WorkSelected engagements

Some of the work we cannot name. Here is what we can describe.

Most of our engagements run under terms that prohibit publication. What follows is a small set of anonymized case studies, written in the same restrained register as a redacted forensics declaration — sector, region, methodology, and outcome, with every identifying detail withheld by agreement. Below the cases, the private working portal that runs every active engagement, shown as an artifact.

Begin a conversation How the work happens

Case studies

The work, redacted to the bone.

Each case below is anonymized by sector and region only — no name, no jurisdiction tighter than region, no detail that could identify a client by elimination. Methodology is described in engineering language; outcomes are written as numbers. The redaction discipline is the credibility signal.

Blockchain forensics2025

A private family office, North America

$2.3M traced through a mixer-bridge cluster, evidence packet delivered in eleven days.

Traced and attributed: $2.3M
Brief to evidence packet: 11 days
Preservation target identified: 1 exchange

A long-time client lost the better part of an OTC settlement to a phishing-grade signature on a stale wallet. By the time the engagement opened, the funds had moved through a privacy mixer, a cross-chain bridge, and a deposit address at a major centralized exchange. The brief was simple and unforgiving: where are the funds now, who controls them, and what do we hand the client's counsel to act on it.

Methodology

01
Cluster the source
Reconstructed the spending pattern of the originating wallet; isolated the exfil transaction within sixteen minutes of the signed approval.
02
Trace through the mixer
Used timing-amount-fingerprint analysis on the mixer's deposit/withdrawal pool to recover candidate withdrawal sets within a tight confidence band.
03
Bridge attribution
Followed the candidate withdrawals across a cross-chain bridge; intersected the destination-side flow with our own bridge-event index to lock the path.
04
Deposit-address resolution
Resolved the terminal address to a deposit at a major US-domiciled exchange; documented the path so the client's counsel could prepare the preservation request.
05
Evidence packet
Delivered a written report, reproducible methodology, annotated on-chain graphs, and a block-height-keyed audit trail. The packet went directly to the client's counsel; courtroom presentation was not part of our scope.

We do not promise recovery. We delivered the evidence the client's counsel needed to ask for it.

Source notes redacted · Client identification withheld by agreement

Software development2025

A private clinic, western US

Patient-portal rebuild and managed care for a single-physician practice with HIPAA-grade constraints.

Twelve months post-launch: 0 outages
Reduction in support tickets: 62%
Average response on managed care: 1 hour

The clinic's vendor-supplied portal had been down twice in a quarter, each outage costing reschedule revenue and trust. The brief was a custom rebuild on infrastructure the practice could understand, with managed hosting after launch. We replaced the vendor stack with a tighter custom build, kept every clinical workflow intact, and put the clinic on our managed-care retainer so the next outage is ours to wear, not theirs.

Methodology

01
Discovery + audit
Inventoried existing clinical workflows; documented HIPAA-touching surfaces; identified the three workflows that justified replacement and the four that did not.
02
Replacement build
Custom Next.js + Supabase build with role-segmented access, end-to-end encrypted uploads, and an audit log keyed to PHI-touching reads.
03
Migration without downtime
Cut over patient records during a planned weekend window; reconciliation script ran every 30 seconds against the legacy database during the cutover.
04
Managed handoff
Practice now sits on the monthly managed-care retainer: patches inside the SLA window, on-call engineer for clinical-day incidents, quarterly security review.

The practice writes us; the portal keeps up.

Source notes redacted · Client identification withheld by agreement

AI agents2026

A professional-services firm, US Mountain West

An always-on intake agent that triages new inquiries to a specific operator, with hard-coded refusal lanes.

Median time-to-triage (was 2 days): 11 minutes
Refusal-lane compliance, audited weekly: 100%
Replaced two FTE-equivalents of intake: 1 partner

The firm was losing two business days on the average inbound — every new inquiry waited until a partner had time to read, classify, and route. The brief was an autonomous intake agent with the discretion of a senior associate and the conservatism of a compliance officer. The result is a quiet operator that reads, asks one or two clarifying questions, and threads the inquiry to the right partner with a written brief — never auto-replying on matters the firm refuses to handle.

Methodology

01
Refusal lanes first
Wrote the agent's no-list before its yes-list: prohibited matter classes, jurisdictions outside scope, conflict-of-interest checks against an internal client roster.
02
Inquiry classification
Trained classification on the firm's own twelve-month archive; thresholds set so ambiguous matters route to a human, not the agent's best guess.
03
One-shot clarifying turn
Agent permitted at most one clarifying question per inbound, with the question itself reviewed by a partner during the first month of operation.
04
Operator-in-the-loop
Every matter the agent forwards is shadowed by a written brief; the partner accepts, edits, or declines with one click — the agent learns from edits, not from acceptances.

The agent does not practice. It reads, classifies, and writes the brief that lets the partner decide.

Source notes redacted · Client identification withheld by agreement

The portal, as artifact

Here is what it actually looks like.

Every active engagement runs in a private portal — a single surface for milestones, line-item pricing, files, decisions, and two-way email. What follows is a composed view of that surface, presented the way a print magazine would present an artifact.

Engagement · Deposit + 3 phases$25,000.00

PRIVATE WORKING PORTAL · CLIENT VIEW · 2026.04

How the work happens

Seven surfaces, one source of truth.

Every panel below is rendered exactly as it appears in the portal — minus your project name. The layout, the typography, the cyan accent: what you see here is what you sign into.

Money is legible

Trust Ribbon + Phase Board

A single horizontal bar shows what's been paid, what's outstanding, and what's remaining — at a glance. The Phase Board breaks the engagement into named line items, each with its own status and (when it's billed) a Stripe link to pay or download the receipt.

Paid

$13,750

Outstanding

$5,000

Remaining

$6,250

Trust Ribbon — paid · outstanding · remaining

DepositBooked engagement$2,500Paid
Phase 1Foundation + auth$7,500In progress
Phase 2Portal + admin$7,500Pending
FinalHardening + launch$2,500Pending

Phase Board — every line item, every status

Every change has a reason

Revisions Log

Every adjustment to the headline price — up or down — opens a dialog that requires a written reason of at least twenty characters. The reason is logged immutably, surfaced in the portal alongside the operator's name, and emailed to you with a before/after diff.

Revision · 12 hours agoOperator

$20,000$25,000

Scope expanded to include an admin role and multi-tenant Stripe wiring; we'd rather price the new surface honestly than carry it as a hidden cost.

●Reason · 154 charsImmutable · client-visible

Revisions Log — every change, every reason

Real-time, not weekly

Activity Feed

Pinned at the top of every project: a live timeline of milestones, files, decisions, questions, and replies. When something changes, the row fades in with a one-second cyan pulse and settles. The connection state is shown by the ‘Live’ pip in the header.

Recent activityLive

ReplyNew client reply
Thursday at ten works on my end…
just now
MilestonePhase 1 — Foundation
Marked as in progress
2h
Filedesign-spec-v3.pdf
Uploaded by client · 1.4 MB
yesterday
DecisionHosting region locked to us-east-1
Logged on the project record
yesterday

Activity feed — postgres_changes, not polling

One channel, both ways

Two-way email threading

When we reply from the operator console, the email lands in your inbox like any other. When you hit Reply, your response threads back into the portal automatically — via plus-addressed routing, with an In-Reply-To header fallback for gateways that strip the address.

You2 days ago
Sending a quick check-in — the foundation phase is wrapped. Let me know when you're free for a fifteen-minute walk-through.
Clientclient@…
6 minutes ago
Thursday at ten works on my end. The portal makes it easy to keep up between calls — appreciated.

Two-way email — your reply lands here automatically

Discovery, but you keep the keys

Intake form

Five sections, around seventeen questions. Autosaves on every blur — you can leave the tab and come back without losing a field. When you submit, the form locks read-only. The version is captured so future intake updates don't silently overwrite what you said.

Discovery intakeAutosaved

About the work5/5
Constraints + risk3/3
Stakeholders2/2
Success4/4
Operating preferences3/3

Locks read-only on submit. We'll take it from here.

Intake — five sections, autosave on every blur

You choose how we reach you

Notification preferences

Three toggles: email, web push, and estimate updates specifically. Each one is a sub-gate, not a kill switch — so even when push is off, the in-portal bell still updates.

How we reach you

Email
Web Push
Estimate updates

Preferences — you choose the channels

The discipline

The portal is the receipt. The reason column is the trust. The audit log is the contract. You don’t have to take our word for any of it.

Open the room

Send us the brief. We’ll send back the keys.

Within twenty-four business hours of accepting the engagement, you’ll have a private portal URL, a password, and a discovery intake waiting for you. The first row in your activity feed will be the one that says “kickoff.”

Begin a conversation