SEC.00 — CAPABILITIES
What we do
Eight capabilities covering a product from the first argument about scope to the third year of operating it. Each one lists what it includes, what you end up holding, and when it is the right thing to ask for.
CAP.01
Product strategy & discovery
Deciding what to build, and what not to build, before the first line of application code.
What it includes
- Problem framing and user research with the people who will actually use the system
- Requirement specifications written to IEEE-830 and ISO/IEC/IEEE 29148 structure
- Scope shaping into a sequence that ships something usable early
- Risk register covering technical, compliance and delivery risk
You receive
- Requirement specification
- Prioritised scope with sequencing
- Risk register
When it applies You have a problem and a budget, but the shape of the solution is still an argument.
CAP.02
Architecture & platform engineering
Choosing a structure the system can still live inside after three years of change.
What it includes
- Domain and data modelling, with constraints expressed in the database rather than only in application code
- Service and module boundaries, and the reasoning for each one
- Architecture decision records, written down so they can be argued with later
- Migration strategy for schemas that will need to change under load
You receive
- Architecture decision records
- Schema with documented constraints
- Migration and rollback plan
When it applies The system has to hold more than one team, one tenant, or one country’s rules.
CAP.03
Application development
Web and mobile applications, typed end to end.
What it includes
- Web applications in TypeScript, React and Next.js
- Mobile applications where a native or cross-platform client is genuinely warranted
- Design systems built from tokens rather than one-off components
- Accessibility and performance treated as build criteria, not a later pass
You receive
- Running application
- Component library and tokens
- Build and release pipeline
When it applies You need the product itself built, not just advised on.
CAP.04
Data & backend systems
The part that has to stay correct when everything else changes.
What it includes
- Relational schema design with real constraints: check constraints, partial indexes, exclusion constraints
- API design with explicit contracts and versioning
- Background processing, scheduling and idempotent job design
- Reporting and analytical read paths kept separate from transactional writes
You receive
- Documented schema and API contracts
- Data integrity test suite
- Operational runbook
When it applies Correctness matters more than convenience — money, compliance, or records people rely on.
CAP.05
AI integration
Applied where it measurably helps, and deliberately not applied where it does not.
What it includes
- Retrieval and summarisation over a system’s own documents and data
- Assistive features inside products, with a deterministic fallback path
- AI in the delivery pipeline: test generation, migration drafting, code review support
- An explicit statement of where AI output is checked by a person before it reaches a user
You receive
- Integration design with evaluation criteria
- Prompt and model configuration under version control
- A written boundary for what stays deterministic
When it applies There is a real task with fuzzy inputs. Not because a roadmap needs an AI line item.
CAP.06
Cloud & DevOps
Infrastructure that a small team can operate without a dedicated ops hire.
What it includes
- Environment topology and infrastructure as code
- CI pipelines that run typecheck, lint and tests before anything ships
- Observability: structured logs, error tracking, uptime and performance budgets
- Cost modelling before committing to a provider, not after the first invoice
You receive
- Provisioned environments
- CI/CD pipeline
- Monitoring and alerting
When it applies You are going to production and need it to stay there.
CAP.07
Quality engineering
Testing shaped around what would actually hurt if it broke.
What it includes
- Automated tests concentrated on domain logic and data integrity
- End-to-end coverage of the few flows that carry the business
- Accessibility checks against WCAG 2.2 AA as part of the pipeline
- Load testing where a specific volume assumption needs proving
You receive
- Test suites in the repository
- Accessibility audit
- Performance baseline
When it applies The cost of a defect reaching a user is higher than the cost of catching it.
CAP.08
Lifecycle support
Staying with the system after launch, which is when most of its life happens.
What it includes
- Dependency and security update cadence
- Incident response with an agreed severity ladder
- Iterative delivery against a living roadmap
- Documentation kept current as a condition of merging, not as a quarterly cleanup
You receive
- Support agreement with response targets
- Maintained documentation
- Release notes per iteration
When it applies The product is live and needs to keep improving without regressing.
Which of these do you need?
Most engagements start with two or three of them. Tell us the problem and we will say which.