Engineering, the service center, finance and the spokesperson's office at an Israeli national public-housing company now work from one Hebrew web app. A daily pipeline turns ERP data into ranked anomalies, AI-written asset reports and review queues, and every human decision is saved safely across replicas behind corporate sign-in.
The company maintains a very large portfolio of apartments and buildings. Maintenance calls, contractor projects, inspector visits, price catalogs, resident service history and utility bills all sit in different ERP tables. Spotting a contractor who is always late, a building with recurring failures, a project whose quantities don't add up or an empty apartment that still uses electricity meant analysts pulling exports and reading them by hand. Each department had its own spreadsheet habits and no shared record of what had already been reviewed.
The diagram is wider than the screen: swipe sideways to see all of it →
The backend is not allowed to import raw-data loaders or read ERP snapshots, and a test enforces this. That keeps every request inside a 2 GiB container and makes response time independent of ERP size. Storage is split by owner: the pipeline owns what it computes, and the app owns what people decide. A pipeline rerun can never erase a review.
All joins, features and scoring run in the nightly job (4 CPU / 28 GiB). The API reads partitioned parquet: 300 hash buckets, a 5-minute cache capped at 32 buckets. Trade-off: data is as fresh as the last run, and the run records a manifest so staleness is visible.
Review state is a small set of JSON documents. Instead of adding a database, every shared write goes through one helper: read with ETag, re-apply the change, write only if nothing changed in between, retry up to 3 times. Trade-off: heavy contention returns a clean 503 instead of queueing.
The app has no login code. Entra ID (Easy Auth) guards the frontend, the browser talks only to a same-origin proxy, and the backend trusts forwarded identity headers only because it has no public ingress. Trade-off: per-user roles live in Entra groups, not in the app.
LLM calls return validated, versioned structured output. Rankings and AI assessments are labelled as review priority, not proof of fault. Responses to media inquiries go through draft → approved roles. Trade-off: slower than auto-publishing, but every outcome has an owner.
Images are tagged with the commit SHA. Prod runs only from master after an approval, and each deploy waits until the new revision reports healthy (up to 40 checks, 15 s apart). Trade-off: a few minutes more per deploy, but one-step rollback.
Toggling one row's status read the use case's review file, changed one key and saved. If that read failed for any reason, the code treated it as “no reviews yet” and saved a nearly empty file over all of them.
Only a true 404 starts empty. Any other read error propagates and nothing is written. The write is conditional on the version that was read, and the UI shows the reviewer the server actually saved.
Prod runs at least 2 backend replicas. Renovation-priority edits, alert subscriptions and price-catalog approvals were read-modify-write with no version check, so two near-simultaneous saves kept only the later one.
One shared helper does ETag-conditional writes and re-applies the change on newer data. A boundary test fails the build if new code writes shared JSON any other way.
The browser called the backend's public URL directly, so a frontend-only sign-in would have left the API open.
API calls now go to a same-origin /backend-api rewrite baked into the build. The backend ingress became internal, and identity headers are trusted only behind that boundary. The header user now comes from the backend, not from a browser call that failed behind the proxy.
The first Azure DevOps builds failed on a wrong Dockerfile path and a floating build agent. A healthy container could also hide a frontend built with the wrong API wiring.
Pinned the agent to Ubuntu 24.04, shared one build-and-deploy script across components, gave each revision a unique suffix, added a wait for health, and added a check that inspects the packaged build's API settings.
Existing environments were managed from a developer machine, with no reviewed plan.
Plan-only runs publish a summary artifact, and the apply needs an environment approval and runs only from master. A Key Vault admin grant was pinned so plans stop showing false drift.
The daily run selects the top 20 assets and 13 buildings for AI reports, at one request a minute to respect quota.
Each report carries a fingerprint of its complete evidence: calls, findings, notes and money. Unchanged evidence reuses the stored report. Large regenerations stop unless someone explicitly approves them, and all workers share the Retry-After cooldowns.
Replica A and replica B both handle a save to the same review file.
Illustration of the write protocol. No client data.
The electricity module ships switched off until its operator worker and production data are in place. Its warm reload measured 41.8 s at a 696 MiB peak inside the 2 GiB backend limit.
Free scoping call · 30 minutes · No commitment
Write a few lines: the process or system, what hurts today (time, errors, cost or an AI pilot that stalled) and who uses it. After a short call you get a written plan and a fixed quote within ≈3 days.
Opens a pre-filled email · reply within one business day
The model reads. The code counts.
All projects