Everything on this page runs in production for a $60M freight brokerage on a Salesforce-native TMS, Sage Intacct, and TriumphPay: the live mirror, the accounting bridges, the commission engine that penny-matches payroll, the carrier watch, the customer portals, and the watchdogs over all of it.
If your brokerage runs on Revenova or another Salesforce-based TMS, most of this drops in.
FastAPI and server-rendered HTMX on Railway, Postgres on Supabase, Resend for mail, React islands only where a diagram needs to move. Every design choice below exists because something once went wrong without it.
A persistent async loop with incremental watermarks, exponential backoff, a cross-worker file lock so only one container syncs, and materialized-view refresh at the end of every cycle.
Nightly and hourly work claimed by conditional UPDATE with a per-attempt nonce, so a multi-worker deploy never runs the same payroll job twice.
Rep, customer, key-account, lane, daily, and CSR views behind allowlisted security-definer refresh RPCs, unique-indexed for concurrent refresh — plus a validator that diffs each view against raw data and self-heals on drift.
Brokerage, carrier, and customer contexts each resolve the tenant from a verified JWT — never a request parameter. Customer reads go only through views that exclude margin, cost, and commission by construction; Postgres RLS backs it up.
In-app watchdogs for credentials, heartbeat, staleness, budget, job failures, and error rates — and an independent cloud-side advisor fed by success-only heartbeats, so an app death still pages.
A nightly job catalogs every table, view, function, scheduled process, and API surface with a freshness verdict, diffs it against a committed manifest, and emails on drift. Zombies don't hide.
Deployment topology: internal dashboard on Railway with two workers; the customer portal on its own service and auth boundary; static prospect portals on a third service with a path per customer; a React front end targeting Vercel for the invoice-audit product; every secret in organization-scoped vault storage. Nothing in code, commits, or logs.
A Salesforce-native TMS is a fantastic system of record and a terrible reporting tool. We mirror it, learn it, and write back only where the business signed off.
Loads, accounts, stops, invoices, and accessorial lines mirrored continuously into an analytics warehouse with a five-minute freshness target.
A Flow HTTP callout upserts a single load instantly, bypassing batch latency — with constant-time secret comparison on the receiving end.
Nightly jobs use a server-to-server token path so they never contend with the always-on loop's refresh token — which eliminated a recurring class of 400-level failures.
Full metadata enumeration — objects, fields, relationships, history tracking — to specify an owned replacement while paid access lasts. Found the vendor's own plan-margin field under-netting multi-leg carrier settlements.
Daily append-only capture of who changed pay-relevant account fields, schema-validated each run so a renamed field degrades gracefully instead of failing silently.
Exactly two sanctioned TMS writers — a qualified-customer flag and a payment writer — each set-only, each mirrored to an audit table. Nothing else in the platform can write to the TMS.
Rep attribution stamped at ingest, so a retroactive CRM formula recalculation can never silently repay history — a drift class that left six figures of overstamping in the source system.
Append-only diff of rep-on-account changes, because the source mirror is overwritten nightly. Designed so the first run emits zero false "changed" alerts.
Intacct speaks two dialects. We speak both, batch aggressively, and treat every write as something that will be audited — because it will.
One client for REST (OAuth2) and XML Web Services with automatic fallback for XML-only functions like AR aging. Replaced an abandoned integration burning 215K calls a month with a batched design at a few hundred a day.
AR invoices, AP bills, and aging buckets pulled into a queryable cache with point-in-time snapshots, across entities.
Nightly full-replace pull of income-statement lines with correct debit/credit normalization — P&L, trailing-12 margin, expense breakdown, per-entity comparison. Full replace because the GL is retroactively editable.
Budget line items per fiscal-year header bucketed against actuals by account prefix — after discovering the filter and field names the docs don't mention.
Clusters live AR and AP on normalized document keys, flags any set with an already-paid member as double-payment risk, emails CSV evidence, and never re-alerts on a reviewed set.
Finance staff without dashboard logins resolve a duplicate from the email itself via expiring signed tokens. GET renders, POST mutates — immune to mail-scanner link prefetch.
Behavioral mirroring of an outsourced TMS-to-ERP bridge with no source access, then an owned replacement with fail-closed dedup, pre-flight validation, verify-after-write readback, single-runner interlock, and an append-only run journal. The incumbent's silent-skip failure mode reproduced 24 of 24 times; ~$18K a year in avoidable API tier alone.
Detects invoices the incumbent marked paid without creating the payment records the TMS roll-ups depend on, and creates them idempotently. A 1,052-invoice outage window backfilled with zero failures.
Credential-health probes, heartbeat liveness with alerts on unexpected service-account activity, stale-cache auto-refresh, and a daily activity digest that costs zero extra API calls.
Async client pulling carrier invoices, settlements, and billing-activity batches — the auth flow and correct gateway host determined by reverse engineering.
Timestamp correlation across TMS, GL, and payment rail proving the real money path: a fan-out writer, same-day approval-to-GL, and "paid" flips landing ahead of settlement.
Broker-initiated prepay at booking plus AR pay links for open invoices, with TMS and GL write-back and a per-transaction authorization trail. Phase one designed to replace a manual card workflow only two people could run. Stripe page →
Empirically derived the TMS credit-gate formula from live data to learn which lever actually controls a credit hold — and ruled out two proposed mechanisms with zero-case evidence.
Zero hardcoded people. Zero hardcoded accounts. Integer cents everywhere. Every exception is a date-effective row in a table, not a line in the code.
Eligibility → rep identification → exception → base rate → calculate → manager override → incentive → audit. Reconciled to the penny against the controller's manual workbook before it paid anyone.
A separate engine for a partner channel paid on collections, computing GP from components on every row. Found a stale-cache defect in the manual workbook — 226 rows caching zero — that had shorted reps.
Distinguishes true cash closure from bad-debt write-offs and credit closures that look identical on the invoice, so write-offs pay nothing and show up labeled.
Committed payroll months reproduce from a snapshot, never the live mirror, so a later data correction can't move a paid month. Prior-period movement is a blocking check.
Admin workbook with per-load, per-channel detail; per-rep PDF statements; one-click emailed statements. Month-scoped by design.
New-customer qualification windows and elevated-rate programs implemented entirely as generated override rows — no per-load engine code changes, ever.
Deterministic detectors, an anomaly ledger, account-change history, and a decision packet whose answers become standing rulings the engine applies next month.
The source system's own stamping audited against a correct engine: an unapplied dual-role rule across 1,232 loads, duplicate multi-leg stamping, a per-leg double-counted quarterly bonus, a UTC-vs-local month boundary. All corrected or immune by construction now.
Structured intake for every rate, split, plan, or one-off change with platform-aware validation — the form only offers bases the engine can compute — and executive sign-off before implementation. In design.
Scheduled safety-data refresh across the entire carrier book, writing carrier records and alerts.
Authority-age banding, double-broker detection via dual authority and equipment/volume mismatch, cargo-theft and identity flags, pre-assignment alerting. Alerts live; composite score specified.
Lanes derived from stop geography rather than whatever got typed in the load, feeding lane and facility analytics.
Carrier login with its own JWT context — documents, invoices, and profile. Built, awaiting rollout.
Microsoft Graph ingest of a weekly partner billing export, de-duplicated by message ID rather than read flags — which closed a seven-week silent outage caused by someone else opening the mail.
Parses successive generations of a partner's export — the legacy ERP format and its replacement — so a renamed column never silently drops data.
Partner invoices matched to GL on normalized BOL/PRO keys with digits-only and leading-zero variants — replacing a key that had matched nothing across ~39.7K rows of nightly runs.
Full partner history reconciled line by line against the mirror; 604 orphaned paid invoices repaired add-only with nothing overwritten.
Read-only measurement of everything a vendor's integration does inside your TMS org, per object, with a drift flag when activity lands outside its baseline lanes — and the permission-set finding that explained an org-wide CRUD exposure.
Shared cloud-folder ingest through the identical parser path, and Swagger-level scoping of a direct partner API with a field-level data contract to retire the file feed.
Built to displace an incumbent audit service billing about $2,400 a month — and to prove it with a side-by-side ledger before anyone had to take our word for it.
Unread mail with attachments fetched via Graph, OCR'd with Document AI, load reference extracted, invoice vs POD/BOL vs junk classified, documents paired, queued. One bad PDF never blocks the batch.
Exact load number, then carrier-plus-amount fuzzy match, then a human. Normalized keys handle prefix and leading-zero variants.
Approve at OCR amount, reject with reason, reassign load, send to CSR, or flag not-an-invoice — with PDF split view and load autocomplete.
Our verdict recorded beside the incumbent auditor's and the payment rail's, producing agreement and discrepancy outcomes as leadership evidence. Idempotent, one row per invoice.
Standalone AP-audit and payment-routing UI — queue, detail split view, bulk approval — built as an offering, not a one-off.
Carrier-uploaded documents classified, with rate confirmations withheld from customers and BOLs/PODs always shared — enforced in storage rules, not etiquette.
Dashboard, shipment history with search and export, supplier and lane reporting, rate and accessorial breakdowns, quarterly reports. Every onboarding includes a written reconciliation tying counts and dollars to the TMS before a login is activated.
Tenant resolved only from the verified identity; no parameter can supply or override it; unscoped reads raise instead of returning rows. A 13-test isolation suite plus an admin-gate suite proving non-allowlisted identities see nothing at all.
Internal staff see any customer's portal exactly as that customer does, reading the same margin-free feed, with every cross-tenant view logged.
Self-contained portals used to win accounts: inbound board with per-unit cost allocation, invoices, lane reports, sample BOLs, a multi-mode pickup request form with weight autofill — one built from a prospect's own dispatch sheets and 47 real historical loads.
Carrier status text parsed into pickup, in-transit, approaching, delivered, early, late, exception, and document-available events queued to customers; Project44 tracking client with webhook receipt. Built, arming on request.
A customs broker's historical in-bond register matched to platform loads — 903 pairs across 803 loads, every one with a resolvable TMS record — for portal display and TMS import.
Action queue, confirmed-qualified list, decay watch for key-account slippage and cooling customers, decay heat map, and a trailing-12 new-customer contribution chart — one surface.
The broker's call — confirm, review later, ignore, override — persisted on top of the computed classification and fed to the commission engine.
Daily scan for key-account and incentive status changes emitting append-only events and human-validation emails. Advisory only: never writes the CRM, never changes pay. Sticky-within-year with an annual rollover digest.
Rep conversion metrics, scorecards, customer-source analysis, load-flow freshness and delay detection, and eight fraud patterns for CRM activity — Friday dumps, bulk logging, zero-duration calls, copy-paste notes.
A single write path where first-load dates only move earlier and last-load dates only later — fixing a silent clobber that had drifted 142 customers and made ~42% of "qualified new customer" badges false.
Upstream defects catalogued and quantified — an org-wide scan of 52,328 accounts surfaced lifetime gross profit paying zero commission from configuration gaps — and the platform made immune to each by construction.
Nightly catalog of every scheduled process, table, view, function, and API surface with FRESH / ZOMBIE / UNKNOWN / DORMANT verdicts, diffed against a committed manifest. Surfaced orphaned schedule rows with no code behind them.
Cloud-side monitor independent of the app — heartbeat, freshness, job ledger, site speed, dead-man switch — that diagnoses via the Claude API and emails a drafted fix with exact SQL or runbook steps behind an approval link. Staged; armed on your say-so.
Heartbeat, job-failure, feed-staleness, and upsert-error-rate monitors on the commission feed and partner ingest — pure database reads, verifiable without the running app.
Root-caused chronic "server disconnected" failures to an HTTP/2 client that can't see server-closed sockets; rebuilt on HTTP/1.1 with a keepalive shorter than the platform sweep and a transport that replays only idempotent verbs.
A Claude-powered analyst using pre-approved parameterized read-only tools — no text-to-SQL — with members scoped to their own reps and customers, compensation behind a separate gate, anonymized leaderboards, row caps, and timeouts.
Site-wide MFA middleware with a signed enrollment cookie and downgrade protection; a per-component runbook and an in-app interactive architecture diagram so the next engineer isn't archaeology.
A house rule and shared helper eliminating a silent 999-row API cap, with ordered pagination and expected-max assertions on every table over a thousand rows.
Standardized pass/warn/fail health checks across every source, run after every deploy, sync, and view refresh.
Anonymous and authenticated access revoked from 13 views and 16 materialized views after finding customer rollups readable with a public key. Verified before, 401 after.
Pure, network-free tests for every money-touching rule, each anchored to a real verified production vector. Credentials in organization-scoped vault storage; nothing in code, commits, or logs.
Headline outcomes: four to eight hours of manual multi-report Excel consolidation eliminated per reporting cycle; penny-level reconciliation against the controller's workbook; ~155K historical loads across three-plus years unified; a documented path to displacing an incumbent audit service and an incumbent integration vendor.
We'll connect to your Revenova or Salesforce instance, run a commission audit, and show you what you've been missing — in your first session.