Trust Through Tests: Building a Platform You Can Leave Running

This week I made significant changes to the platform from a laptop nowhere near the server. I shelved a module. I rewrote a signup flow. I pushed code that deployed automatically. And at no point did I open a browser to manually poke the thing and confirm it still worked. The reason is that I no longer have to. The platform checks itself now.

That sentence is easy to write and hard to mean. For most of Devalo’s life, verification looked exactly like what everyone else does — a half-dozen browser tabs, a run through the dashboard, a click through to each module, a quick sanity check that nothing obviously caught fire. It works when you are at your desk. It does not work when you are not. And it definitely does not work when a business is counting on your platform to be up while you are asleep, at a client meeting, or on a flight. The cost of manual verification is not the minutes it takes. It is that it cannot scale across the times you are unavailable.

So the past week has been about replacing manual verification with automated verification. A conftest file that spins up a Postgres test database from nothing. Factories that build realistic organisations and users in one line. A httpx client that hits the real FastAPI routes with real authentication cookies. Integration tests that verify cross-organisation data isolation, auth flow edge cases, webhook idempotency, and twenty previously-fixed bugs that we do not want to regress. A GitHub Actions workflow that runs all of it on every push so that if something breaks in a commit, the red mark appears before the deploy even finishes. It is unglamorous plumbing. It is also the difference between a platform you trust and a platform you hope.

There is an argument that tests are a luxury for small teams. The argument goes like this — when you are one person shipping fast, tests slow you down and catch things you would notice anyway. That argument is wrong in every direction. When you are one person, tests are the only way you can afford to not notice things. They are not a substitute for good engineering. They are how good engineering stays good once you stop looking at it. The Tasks module has twenty bugs documented in an audit from a few months ago. Fifteen of them were fixed since, and I did not write those fixes — some of them got addressed by me in other sessions, some by AI-assisted refactoring I had forgotten about. Without tests, the only way to confirm that the fixes are still in place would be to go through each of the twenty and check the code again. With tests, I can see that number is a green check mark in CI. That is trust. Not faith. Evidence.

The other quiet shift has been how this changes the AI collaboration. When AI writes a fix and I commit it, I used to verify by reading the diff and trusting my reading. That worked, mostly. It also meant that genuinely subtle bugs — a missing ILIKE escape, a role check that forgot to cover the manager case, a webhook handler that was not idempotent across workers — could sneak past me because I was reading for the shape of the change, not the edge cases. Tests make edge cases first-class. When I ask AI to fix a cross-organisation isolation concern, the test for it goes in the same commit. The commit either goes green or it does not. There is no “looks right to me” in between.

None of this matters to a customer directly. A small business that signs up to Devalo is not going to ask whether we have pytest. What they will notice is what tests give them on the other side. Features that keep working after new features get added. Security boundaries that cannot be accidentally breached in a refactor. A billing integration that will not double-charge them even if Stripe retries a webhook. These outcomes feel invisible when they work. The cost of them not working is what every “we accidentally charged all our customers twice” email from a competitor demonstrates.

The shape of this platform is still settling. The modules that make it up are still being hardened. New ones are still being built. But underneath all of that, what changed this week is that Devalo can now be left running. I can close the laptop and go somewhere else, and the platform will tell me if something breaks. Not by silently degrading until a customer complains. By turning a commit red before it deploys.

That is the real quiet superpower of being a solo founder with AI assistance. It is not that you can build faster. It is that you can build a platform that does not need you in the room.