Last week's work went almost entirely below grade — foundations poured, paperwork held deliberately in flight. This week was its mirror image: the paperwork closed, and on the ground it cleared, a new client's site went up — scaffolded, provisioned, built and tested — across a single concentrated week.
The week belonged to the new clinical canine massage practice, which accounted for thirty-seven of the items closed. It began exactly where the last entry ended. The three threads held in flight a week ago — the combined services, processor and Domain Hosting Schedule agreement, the last outstanding [TBC] specification items, and the client's ICO Tier-1 registration — all closed. The agreement was drafted; the brand palette was lifted from the mockup into the specification; the remaining amendments were folded into the master specification as a single versioned revision; and the client was helped through their ICO Tier-1 registration, so the published site can in time carry a real registration number in place of a placeholder. Advice and paperwork before code — and now, code.
With the ground cleared, the build came quickly. The repository was scaffolded: the approved mockup moved into place, a .NET 8 isolated-worker function project stood up beside it, security headers and a content-security policy configured, fonts self-hosted to retire the last unsafe inline exception, and the small civic furniture every site owes its visitors — a licence, a trading-disclosure footer, robots and sitemap, stub privacy, accessibility and terms pages — put in. Then the cloud: a resource group and a Static Web App provisioned in the UK South region, wired to the repository, the deployment pipeline — preview builds on every pull request, production on merge — verified end to end, and a required status check registered so nothing reaches the main branch unbuilt.
On that footing, the heart of the thing went in: the contact pipeline. A request model with server-side validation and input hardening; a bot challenge verified server-side; a message composed and sent through a third-party transactional-email provider; an audit record written for every submission; a health endpoint built to its specified contract; a content-security-policy report collector; and a security-header middleware across the whole API surface — each piece behind a single HTTP-triggered function, then integration-tested together against a local environment and the deployed preview. Built to be tested, and then tested.
— On sequence —Last week the foundations went in below grade. This week the structure rose on top of them — quickly, because the groundwork had been honest.
Testing did what testing is for: it found things. Three defects were caught and closed before any of this meets the public — a contact address that had carried the wrong domain, a placeholder telephone number swapped for the real one, and a dependency-injection oversight that left the contact function returning a server error until its validator was properly registered. Found on the bench rather than in the field, which is the whole purpose of a bench.
The week's last practice thread closed a loop the previous entry had opened. With the domain's pre-change DNS baseline captured a week earlier, the additive email onboarding could be done against a known-good starting point: a transactional-email provider onboarded in-region, four DNS records added at the registrar — additive only, so nothing already serving the live domain was disturbed — the domain verified, and a first message confirmed arriving with SPF, DKIM and DMARC all passing. Careful, reversible, checked against the baseline. A live domain is a thing to touch gently.
Running quietly alongside, the internal quantitative sports-analytics platform — last week's headline — kept a lower tempo and turned toward modelling and connectivity: a Poisson model for match-outcome probabilities, expected-goals (xG) and advanced statistics folded into the feature set, and the daily data refresh from external sources put on automation. Connectivity began too, and deliberately read-only — an account opened with a betting exchange, a delayed application key generated, and a read-only exchange odds-client abstraction written. Reading before writing, observation before action: the same restraint that kept the system in paper-trading a week ago.
On the enterprise side, the e-commerce platform's steady-state support carried on at its now-ordinary cadence — a goods-in regression test run on UAT with the warehouse, the source of some zero-valued stock-log entries traced across both the cloud platform and the procure-to-pay system, and a new regional user group stood up — with one forward thread in flight, scoping a third-party connector into the ERP platform. And the smaller stewardship: for the retained veterinary practice, a round of price updates applied to its website. Low-frequency, hands-on, done and closed.
Looking ahead: the new practice's site now stands built, deployed and tested behind a holding page, and turns next toward content and pre-launch checks before it goes live under its own name; the internal platform carries on from construction into validation; the enterprise support tapers toward steady state; and the company's own website sits in its final pre-cutover end-to-end testing — quietly, where a system in good order should be. Quieter weeks have louder ones inside them.
Forty-seven items to Done across four projects — thirty-seven of them a single new site carried from signed paperwork to a tested build. One research thread still in flight. A loop closed on a live domain, gently. The deliberate, unhurried practice — building, now the ground is ready.