AP Agency — Project Evidence Report

STEVE-1 Console

A multi-tenant FastAPI + React operations platform that tracks every empire project through its full lifecycle: planning → build → QA → delivery → intelligence. Defect tracking, regression suites, AI fix & verify agents, skills registry, RAG memory, sitemap crawler, credentials vault, operator fleet, and executive-brief generation — in four calendar weeks, solo.

Traditional cost: $1.1M – $2.5M

Engineering effort: 13.3 person-years

Built in: 4 weeks

Speed: 19× faster

The Defensible Quartet

Traditional build cost

$1.1M–$2.5M

What a normal software shop would charge to design, build, and QA this platform

Engineering effort (mid)

13.3 person-years

Two independent models — productivity benchmark and COCOMO II post-architecture

Team this replaces

10 people × 15 months

Estimated headcount and schedule under a traditional engineering org

Build speed

19× faster

Shipped in 4 weeks vs the 15-month normal schedule

The Hard Evidence

No estimates below — every count is pulled directly from git history and the live codebase.

What's Actually In It

Enumerated by reading the 18 backend routers and 25 frontend components. Every item below points to verifiable code.

Signal	Count
Source lines of code (LOC) Python 26,536 · TypeScript 23,930 · JSON/config 6,985 · Docs 4,002 · HTML 2,631	51,329
Files	164
Git commits	169
Distinct calendar days with commits	16
Lines inserted	69,089
Lines deleted	3,687
Contributors	1
First commit	2026-06-02
Last commit	2026-06-27
Calendar span	4 weeks
Defects tracked in console DB	22
Regression tests registered	4
Automated test runs logged	129

Auth & Multi-User Access

JWT bearer-token auth — login, logout, set-password, /me endpoints; token stored in SQLite, checked on every request
Multi-user admin panel — create, update, delete users; role-based access (admin vs viewer)
Per-user project scoping — each user sees only the projects they are granted access to
Owner-only route class — /api/session*, /api/search, memory, and prompt-mining are gated to the instance owner; all other users see only operational data

Project & Environment Management

Project CRUD — create, read, update, delete projects; status lifecycle tracked
Multi-environment management — dev / staging / prod environments per project with independent spec records
Rollout rules & gate — per-project rollout-rule definitions; GET /rollout-gate enforces them before a build proceeds
Pipeline configuration — structured pipeline steps stored per project; AI-teachable via POST /pipeline/teach
Signoffs workflow — stage signoffs with approve/reject before shipping; approval tracked per signoff record
Plan-first new-project wizard — War Table UI enforces AI-generated plan approval before project moves to "building"

Defect Tracker

Full defect CRUD — create / list / update / delete; filterable by severity, category, and status; custom fix-order priority
AI auto-categorization — one-click LLM inference of severity and category from defect description
Agent assignment — assign one or more autonomous agents to a defect; POST /defects/assign-agents
Comments & work-log — per-defect discussion thread; work-log captures time spent per attempt
Proof collection — structured proof records (screenshots, log excerpts) per fix attempt, attached to defect
Verification requirements — project-level and defect-level verification checklists
Autonomous AI fix agent — POST /defects/{id}/fix spawns an LLM agent that reads the defect, edits code, and reports; SSE streaming logs in real time
Autonomous AI verify agent — POST /defects/{id}/verify runs a separate verifier agent; streaming logs + proof written on success
Batch fix-all / verify-all — trigger all open defects or all fixed-but-unverified in a single call; results aggregated
Per-defect activity timeline — chronological event log of every state change, comment, and agent action

Regression Testing

Test CRUD — create / read / update / delete regression test definitions per project
Single-test & run-all execution — async job-tracked runs with status polling at /run-all + /status/{job_id}
Run history — persistent history log; 129 real runs recorded in the live DB
Local validation — POST /tests/{id}/validate-local — verify test script locally before registering

Skills Registry

Skill CRUD with categories — create, read, update, delete skills; grouped by category (deploy / infra / bkfk / general / …)
Usage tracking — POST /skills/{id}/mark-used — records last-used timestamp to surface frequently-needed skills
Edge-case accumulation — POST /skills/{id}/add-edge-case — appends new gotchas discovered at runtime, compounding institutional knowledge

RAG Memory System

Memory file browser — reads Claude's long-term memory files directly from disk; lists available files by type
Type-tagged files — feedback / project / user / reference / synthesis — each rendered with its own color in the UI
Privacy segregation — always-private file set (credentials, identity, health) is blocked for non-owner accounts; team accounts see only feedback/project/synthesis types

AI Intelligence Reports

On-demand executive brief generation — POST /intelligence/generate calls claude-opus-4-8; produces a 7-section narrative report per project
Report sections — Incidents & Anomalies · Product & Performance · Scale Readiness · Cost vs Traditional Team · Competitor/Market Note · Recommendations · 30-Day Forecast
Report history — GET /intelligence returns all stored reports for a project with timestamps

AI Codebase Analysis

Per-project AI analysis — POST /analysis/trigger kicks off an LLM-backed codebase scan; results stored with full streaming log
SSE streaming output — GET /analysis/{id}/stream — real-time event stream of analysis progress to the frontend
Smart actor & login detection — heuristics to distinguish login pages from password-reset/setup pages before analysis begins
Analysis history — list, view, and delete prior analysis runs per project

Sitemap Crawler

Actor discovery — GET /sitemap lists discovered URL actors per project; POST /sitemap/actors adds actors manually
Actor confirmation & deletion — confirm or remove discovered actors individually
Forms catalog — GET /sitemap/forms returns all forms discovered on the project's public pages
Rediscover workflow — POST /sitemap/rediscover triggers a fresh crawl; streaming log endpoint to watch progress

Object Model Discovery

Domain object discovery — POST /object-model/discover runs AI inference on project source to enumerate domain objects and their fields
Mastery score — GET /mastery — computed score of how deeply each object is understood; displayed as a badge per project
Object deepening — POST /object-model/objects/{id}/deepen — focused AI pass on a single object to enrich its understanding
Run history & log viewer — persisted discovery run records with log retrieval

Savings / Evidence Engine

Global & per-project savings dashboard — GET /savings and /projects/{id}/savings — shows cost-replaced, time-replaced, headcount-equivalent vs traditional team
Configurable role roster — per-project savings config overrides default role mix and rate assumptions
On-demand evidence refresh — POST /evidence/refresh re-runs git + LOC analysis to update all metrics
HTML evidence report generation — GET /projects/{id}/evidence/report renders a standalone defensible HTML report (the system that produced this document)

Project Planning

AI plan generation — POST /plan/generate — LLM produces a structured plan with phases, tasks, milestones, dependencies, durations, and owner roles
Natural-language plan editing — POST /plan/edit — edit any field of the plan by describing the change in plain English; LLM applies it
Build gate — plan must reach status=approved before the project may move to "building"; enforced by both API and War Table UI
Per-phase cost comparison — each phase carries AI cost estimate vs traditional-org equivalent, rolling up to project totals

Capacity Estimation

Load-runner capacity estimator — POST /capacity/estimate computes max Virtual Users, RPS ceiling, and throughput from server specs (CPU cores, RAM, NIC)
Environment spec management — PUT /environments/{id}/specs — record and update specs for each environment
Per-project capacity view — GET /projects/{id}/capacity — rolls up capacity across all registered environments

Operator Fleet Management

Operator registration — physical or virtual agents self-register with hostname, OS, CPU, RAM, and browser list; issued a unique API key
Heartbeat tracking — POST /operators/{id}/heartbeat — operators ping every N seconds; status auto-transitions online → offline on missed beats
Task dispatch — POST /operators/{id}/dispatch — queue a task (URL, instructions) to a specific operator
Result collection — POST /operator-tasks/{id}/result — operators POST completed results; stored and surfaced to console UI
Available-operator query — GET /operators/available — returns only online operators ready to receive tasks

Credentials Vault

Encrypted at-rest storage — passwords and API keys encrypted with Fernet (via crypto.py + CONSOLE_SECRET_KEY); legacy plaintext rows read transparently
Service type taxonomy — Facebook/Meta, MySQL, SSH, API key, other; listable by service
Per-project scoping — credentials optionally linked to a project; filtered by project in the UI
Masked display — values shown as •••••••• by default; explicit ?reveal=true required to see plaintext — admin-only

Claude Agent Chat (WebSocket)

Multi-turn agent sessions — each session holds a persistent ClaudeSDKClient; context survives WebSocket reconnects for true multi-turn continuity
Real-time WebSocket streaming — agent events (text blocks, tool calls, results) stream to connected clients via ws://.../ws/{session_id}
Agent state broadcast — TelemetryBus pushes live agent state (idle / running / tool-calling) to all connected UIs simultaneously
Session export — GET /session/{id}/export — download full message history for a session
Owner-only with full briefing — owner sessions load the complete personal briefing (CLAUDE.md + memory) as context; non-owners cannot create sessions
Irreversible-action modal — frontend intercepts agent proposals for destructive actions and gates on explicit user confirmation before executing

War Table Dashboard & Global Search

War Table hub — landing view showing all projects with per-project savings tiles, mastery badges, and quick-links to every module
Global savings hero strip — aggregated total cost-replaced and time-replaced across all projects in one glance
Global search — GET /api/search — cross-entity full-text search over defects, skills, and projects; owner-only
Health endpoint — GET /api/health — machine-readable liveness check; polled by the tray watchdog
Branding API — GET /api/branding — returns per-deployment brand config (name, colors, logo) so the console can be white-labeled
File upload — POST /api/upload — evidence and screenshot ingestion endpoint

How We Costed It

Model. The same model with the same constants is applied to every project in this portfolio — there are no per-project complexity multipliers and no schedule compression applied. The generator is console/backend/tools/evidence_merge.py.

Low bound. Productivity model — 51,329 lines of production code ÷ 25 finished LOC per developer-day ÷ 21.7 work-days per month = 94.6 person-months (7.9 person-years). The 25 LOC/day figure is the conservative industry baseline for finished, tested, reviewed code (McConnell, Code Complete); it excludes generated scaffolding and build artifacts.

High bound. COCOMO II post-architecture — PM = 2.94 × (51.33 KLOC)^1.0997 = 223.5 person-months (18.6 person-years). Applied nominally, with no effort-adjustment multipliers, so the ceiling is not inflated.

Mid (reported). The arithmetic mean of the two models: 159.1 person-months = 13.3 person-years. This is the figure quoted throughout this report.

Rate assumption. $135,000/year fully-loaded blended developer (salary, benefits, overhead) = $11,250 per person-month. Applied uniformly to all three effort bounds: low $1.06M, mid $1.79M, high $2.51M.

Calendar. Git-verified: 2026-06-02 → 2026-07-01 = 0.95 months of real calendar. COCOMO's schedule equation gives the calendar a conventional team would need: TDEV = 3.67 × 159.1^0.28 = 15.2 months at a sustainable 10.5 engineers. Speed advantage = 15.2 ÷ 0.95 = 16.0×.