CyberReadyAI

A cyber-insurance readiness platform for small businesses: a guided snapshot, an AI interview across 56 baseline security safeguards, an evidence vault with AI review, and exportable reports — backed by a 206-row matrix of what nine carriers actually require. 747 commits to a launch-ready state with a formal go decision, then paused with intent.

This is where the agent harness matured: enforced rules instead of advisory ones, parallel worktrees with an isolation protocol, an end-to-end test suite, and a 52-session analysis that converted recurring friction into a permanent solution library.

Key modules

Key features

• A hard rule enforced in code, not prose: never generate documentation implying a control exists when it doesn't — unconfirmed uploads are rejected and unconfirmed policies earn no maturity score.
• A post-hoc audit of 16 agent guardrails found one provably effective (the hard block), three brittle, and roughly nine warning-only theater — the rubric now: block, red-team it day one, or don't ship it.
• Referral fees are fixed-amount only — the safe harbor that avoids insurance-producer licensing — with regulatory counsel budgeted as a gate before the next pricing tier.
• The row-level security policies were implemented incorrectly for Clerk-issued tokens; production paths re-enforced ownership in code as a working layer, and the fix — keying policies on the JWT subject claim — was applied properly in the successor product. No real users or data were on the site at the time.

• Codebase-first pentest scoping caught eight attack-surface gaps that memory-based scoping missed.
• The agent-settings file was the highest-churn file in the repo — 30 commits, ~17 fixes — and every major guard was added after its motivating incident.
• The post-mortem inventoried 42 portable modules with a ~78-hour extraction estimate, and asks the honest question: does extraction beat rebuilding?
• The last production commit fixed dashboard 500s caused by select(*) dragging oversized JSON payloads into list views — explicit column selects only.

• Build discipline outran demand validation: a launch-ready product and a deep feature set against roughly six paid subscribers — the bottleneck was upstream of every feature.
• Of 16 agent guardrails built, one provably worked. The audit's rubric — block don't warn, red-team it on day one, no false-positive patches — was worth more than the guardrails.
• The planned pivot died on one wrong technical assumption, found by investigation after the strategy was written but before any code: most carrier applications are flat, unfillable PDFs.
• Knowledge compounds, workarounds don't: the same six problems had been re-solved more than twenty times across sessions before they were captured permanently.

The guardrail rubric, the solution library, and the worktree protocol — and the successor product wrote its launch gates in advance precisely because this one validated late.