Redacted.
← PARAM BAHIA
Redacted.
AI orchestration completely embedded across the operations of a UK food & beverage manufacturer. Built to save millions. Operational software, in daily use.
Redacted.
AI orchestration completely embedded across the operations of a UK food & beverage manufacturer. Built to save millions. Operational software, in daily use.
It started with a sheet — not a spreadsheet somebody kept on a desk, but a refreshable extract of the business’s own planning system. The ask had been earned a week earlier by a demo built on the group’s invoice history: millions of invoices, eight years deep. Then the demand planner sent the workbook and the director forwarded it to me the same afternoon. Four tabs, each one live against the system underneath: sales, with the full order history and every promotion ever run; open purchase orders; product detail; stock. Behind the sales tab sat close to a decade of orders, and with it came the six-step weekly process the planners had been running in their heads, written down for the first time.
The rules arrived in the same drop: the order types to exclude, the product statuses to ignore, the shelf-life rules, the weeks of cover the business wanted to hold between a floor and a ceiling. I ingested it that day. Those rules are still the rules — every exclusion and every band in that message still governs the pipeline. The first load held more than one and a half million order lines. Within weeks the sheet was replaced by a nightly sync against the live order book, and the history has grown to nearly two and a half million lines since, every row carrying the tag of where it came from.
It was meant to be one workflow. It became the planning system. Forecasting, demand classification, replenishment, the governance layer, the bridge between a forecast and a buy — each arrived because someone asked a sharp question and the honest answer was that the system could not yet answer it. The best requirements I have been given came from the client’s own demand planner, who wrote model libraries and scenario lists and expected them read.
The honest turns belong in the file too. Early accuracy figures were better than the data underneath them deserved, and the fix was not a better model — it was a rebuild of data trust, after which the numbers moved because the history finally was what it claimed to be. Accuracy is where the data allows, and the system says so on the screen rather than in a footnote. Twice in one month it broke in production. Both breaks were root-caused inside hours, and both were survived.
One operator. Multiple connected surfaces — supply chain, demand planning, material planning, sales, market intelligence, commodity & FX exposure, financial reporting. Designed end-to-end. Built solo. Over three hundred and fifty specifications defined the system by September, and the numbering now runs past five hundred and eighty. It is operational software, in the final stage before full day-to-day adoption: a working demand planner in it daily, and nine years of order history — millions of order lines — rebuilt with a source tag on every row.
The forecasting runs as a tournament. Every SKU is classified by its demand pattern — smooth, erratic, intermittent, lumpy — and models compete within each class, the champion chosen on measured accuracy. The system watches itself for drift and refits on a schedule, keeping a new model only when it beats the one it replaces. Richer layers — a Prophet tournament, gradient-boosted demand sensing — are built and gated, promoted only when they earn it. After the data-trust rebuild, the median forecast error fell by more than a third.
Trust in the data is treated as architecture, not hygiene. One recompute chain owns every derived number; every table carries a freshness watermark; a nightly coherence check asserts nothing has gone quietly stale. When data is stale, the API says so — an honest error beats a silently old number. On top sits a fleet of twelve detector agents that read everything and act on nothing: stockout risk, seasonal alerts, customer pulse, data-quality warnings, margin leaks — findings filed to one audit trail, decisions left to humans.
An AI copilot of nearly eighty tools handles the operational surface — natural-language queries across any dataset, automated report generation for the C-suite, answers that cite their source and their as-of time, and a design that says “I don’t know” rather than invent. Every tool is governance-aligned: decision gating ensures no AI action executes without appropriate human approval. More than five thousand automated tests hold the whole thing still while it moves. Operations first. Finance is next.
Two months of load. The system grew several times over, and twice in August the system broke in production. The first break wedged the database: a write held the single writer while a request thread waited on it, and every logged-in session hung behind the deadlock. The second filled the disk, and a half-written save truncated the login store to nothing — nobody could sign in. Both were root-caused inside hours and recovered without losing a number.
What came out of them matters more than the outages. Every state file is written atomically now, so a failed write leaves the live file untouched. A free-disk floor refuses the work rather than corrupting it, and the health endpoint reports disk as a first-class signal. The backup set covers the auth store, not only the database, and the restore has been rehearsed rather than assumed. I wrote each fix against the incident that earned it.
The gates hardened alongside. A security gate runs in CI — an abstract-syntax-tree guard that refuses unparameterised SQL, plus offline static analysis on every push. Every milestone now passes an independent review from a different model family before it promotes. The database engine was upgraded so readers run alongside the writer, proven in staging and then promoted to production — the structural answer to the wedge.
The surface grew too. New products get a forecast by analogue matching — the system finds the closest things it already knows, weighs the resemblance, and shows its working; it is built and running dark behind a flag until the planner rules on it. Material planning arrived in slices: gross requirements explode from the demand plan through the recipes, then net against stock and open orders to answer the only question a buyer asks — buy what, by when. Where a feed is missing the screen says so instead of inventing a number.
Operations first. Finance next. Unchanged.
Four weeks on from the demo. More than two thousand commits since it was frozen, and a hundred and fifty specifications. The promotion engine landed: every promotion ever run is measured for the uplift it actually produced, the lift is governed for elasticity and fatigue, and the results are precomputed overnight so the morning reads them, not waits for them. The demand plan became the demand of record — amendments, consensus and approval folded into one final number that the rest of the system reads from.
Margin runs through it now, order by order and as delivered, on products, on customers and on the buy. The same sign-in opens a different product depending on the role — the demo further down shows the pattern; the live system runs it. A Trust page keeps a ledger of every recommendation the system has made and what happened next, under a dual accuracy gate and a thirteen-week window, so the forecast is judged on the horizon the business actually buys against. Every model call is logged. Every change ships with a plain-words note.
The surface it reports to grew: a weekly one-page executive brief, written by the system and read against the week before; week-by-week reports of record; the agents reporting by area, so what needs a look is one list. Five short films explain the system from the inside. The host was hardened in October — key-only access, bans on repeated failure, HTTPS only, rate limits at the edge.
The demo below is still the system as it stood on 18 September. Refreshing it is a project of its own, because every new line of code has to pass the same anonymisation gate the first version did.
The screens further down are the demo, captured as it runs. It is a complete clone of the system, anonymised end to end, frozen in place, and open to anyone with the link. Role-based access is the first thing you meet: the same sign-in opens a different application depending on who you are. Behind it sit the planning console, the forecasts and the demand plan, stock and replenishment, the governance desk with its rulings, the agents and their findings, and a demo copilot that answers a fixed set of questions from cached answers — no live model, no key on the server.
Each link signs you straight in and drops you on that role’s own front door: the executive gets the money view, the planner the desk that does the work, operations the buy list, sales the customer book. A bar at the bottom of every page switches you to another role without signing out. Five accounts also share one password, , if you would rather sign in yourself. The role gate reads clearest when one visit shows you two different products.
It is deliberately not live, not updating, not connected, and not real. Every name, SKU, site, supplier and figure is generated. The numbers agree with each other because the application’s own pipeline recomputed them, not because they came from anywhere. The data is frozen at the date it was taken: nothing recomputes, and every figure carries the as-of date it was frozen on. No job runs, nothing you do is saved, and the site asks search engines not to index it.
How it was built, in order. An inventory of every place an identity could leak — brand strings, logos, accounts, the customer master, product descriptions, supplier and site names, prompts, documents, error strings, and the commit history itself. Then a seeded anonymiser that regenerates every entity from a key, so the shape survives and the identity does not. Then the derived tables rebuilt by the pipeline rather than edited, because a hand-edited total is a lie that compounds. Then a behaviour freeze: scheduler off, notifications off, no outbound key. Then a gate that had to return zero hits three ways — over the repository, over the rendered pages under every account, and over every text column of the database — and a cross-model review over the whole of it before it went up. The demo repository carries no history from the source.
What follows is the demo itself: eight frames across the five roles. Nothing in it is blacked out, because nothing in it is real. The last frame is the client system on its own data, with the brand, the customer and the product names covered under NDA — kept so the two can be read against each other.
01 / 20 · Redacted — From a sheet to the planning system
It started as a refreshable extract of the business’s own planning system, and the rules that came with it still govern the pipeline.
Within weeks the sheet gave way to a nightly sync against the live order book, every row tagged with where it came from.
One recompute chain owns every derived number, every table carries a freshness watermark, and a nightly check refuses anything quietly stale.
Every SKU is classed by its demand pattern and models compete inside the class; the richer layers stay gated until they earn promotion.
Amendments, consensus and approval fold into one final number, and everything downstream reads from it.
Material planning explodes the demand plan through the recipes and nets it against stock and open orders.
Every metric is written out with its formula, source and exclusions, and no AI action executes without a person’s approval.
It answers across every dataset, cites its source and its as-of time, and says it does not know rather than invent a number.
A fleet of agents reads every layer and acts on nothing; findings go to one audit trail and the decisions stay with people.
A weekly one-page brief for the executives, reports of record, and a trust ledger that checks every recommendation against what happened next.
