Engineering
How I engineer production software
I design and build production software to one written standard: validate every input on the server, isolate each tenant’s data in the database, keep money exact, ship schema changes as migrations, and test the riskiest logic automatically. Each case study shows its architecture and quality figures, measured from the source repository rather than estimated.
What do the numbers say?
- Products live
- 10
- Automated tests and checks
- 2,740
- Schema migrations
- 1,189
- Commits
- 3,971
Summed from the engineering block of each public case study. Products without a measured figure are left out, not counted as zero.
What standard does every build follow?
-
Validate on the server
Every input is checked again on the server, with zod schemas on the web apps. The interface is never trusted.
-
Isolate every tenant
Each row is scoped to its organisation or household and enforced by row-level security in the database.
-
Nothing hardcoded
Prices, limits, roles and settings live in config or data, so a business change is not a code change.
-
Money is exact
Amounts are stored as integer sen or fixed-point decimals. Never floating point.
-
Schema changes are migrations
Database changes ship as numbered, reviewed migrations that run the same way in every environment.
-
Test what can hurt
Payroll is tested against official tables, ledgers against balance invariants, payments and isolation by suite.
-
Privacy by default
PDPA consent before data is stored, field-level encryption for identity numbers, export and erasure built in.
-
Verify, then trust
Payment webhooks are signature-checked on the raw body; licence keys are signed and verified offline.
Which products show this in practice?
Each row links to the full case study with architecture, data, security and quality detail.
Orbit HR
SMEs run Malaysian statutory payroll that matches the official KWSP, PERKESO and LHDN figures to the sen.
I built it as a local-first Electron app with a sandboxed, context-isolated React renderer, a main process owning all data, and pure calculation engines for payroll, leave, proration and overtime that run without Electron.
- Unit tests
- 191 of 191 pass
- Statutory golden tests
- 34 test cases, table-driven to the sen
- End-to-end smoke harnesses
- 55 harnesses, 2,318 assertion call sites
Orbit Finance
SMEs swap a fragile Excel macro workbook for books that always balance, on Mac, Windows and Android.
I built it as an Electron app with a sandboxed, context-isolated React renderer talking to the main process over about 775 named IPC channels, local SQLite as the source of truth, and a Capacitor build for Android and iOS.
- Schema migrations
- 119
- Automated check scripts
- 90 check scripts, 982 assertion call sites
- CI smoke
- 48 of 48 checks pass
Orbit Suite
Sold direct from day one: an in-house storefront and licence engine selling four live product zones.
I built a suite of local-first Electron and Capacitor apps (POS, project manager, staff phone app) around a Next.js storefront on a multi-zone hub, with a Postgres-backed order and licence service that mints offline-verifiable keys.
- Commits
- 330 across 6 repositories (28 Jun 2026 to 8 Oct 2026)
- Licence and order service tests
- 16 test files, 353 assertion call sites
- Gate scripts
- POS 38, staff app 33
StudyBuddy
A tuition centre moved 1,600+ real accounts off WhatsApp and spreadsheets onto one live platform.
React 19 single-page PWA built with Vite and deployed on Vercel, with Vercel serverless functions for payments, PDFs, e-invoicing, AI and notifications, over Supabase Postgres, Auth and Realtime.
- Billing self-check
- 33 assertions, all passing
- Ledger integrity checks
- 32 named invariants
- Cross-user sync test
- 6 end-to-end flows incl. RLS isolation
UrusPro and HelloStay
UrusPro left a vendor-locked no-code prototype for an owned SaaS that now sells paid plans per listing.
Server-rendered TanStack Start (React) app on Cloudflare Workers, backed by Supabase Postgres plus 28 Deno edge functions, wrapped as iOS and Android apps with Capacitor.
- Automated tests
- 581 passing, 0 failing (2,684 assertions, 49 files)
- Build gates
- ESLint plus 9 custom checks block every build
- Schema migrations
- 339
MITE
An institute's brochure site now takes enrolments for 18 programmes, with CRM and finance on one platform.
Next.js 16 App Router on Vercel (Singapore region) with Supabase Postgres; 36 server-action modules, a signed payment webhook and a secret-guarded daily cron; single-institution app with admin, trainer and candidate portals across 18 programmes.
- Automated test cases
- 223 in 35 test files
- Commits
- 259 (Aug 3 to Oct 8, 2026)
- Schema migrations
- 77
MSDI platform
A training provider went from a demo on mock data to a production platform with real payments and credentials.
Next.js 16 App Router on Vercel (Singapore region) with Supabase Postgres; 50 server-action modules and 14 route handlers; six-role model where employer companies are tenants scoped by membership in Postgres policies.
- Commits
- 289 (Jun 10 to Oct 7, 2026)
- Schema migrations
- 157
- Scripted integration checks
- 84 (44 database test scripts, 40 verify scripts)
UrusFamily
From first commit to App Store and Play submission in 9 days, with 1,182 automated tests passing.
Expo and React Native app for iOS and Android built with EAS, on Supabase Postgres with 4 Deno edge functions, plus a static marketing site on Cloudflare Pages that ships no JavaScript.
- Automated tests
- 1,384 passing, 0 failing
- Database smoke scripts
- 20
- Schema migrations
- 119
Which regulated environments has Pali worked in?
The role is stated plainly: some of this work was design only, some was design and build.
PERKESO
DesignPublic sector, social security
Solo designer of the national Employment Insurance portal
TNB (myTNB)
DesignNational utility, regulated tariff
Solo designer of the RP4 tariff experience, with Accenture
MIDF Invest
DesignSecurities trading
UI/UX design lead on the retail trading platform
Hong Leong Bank
DesignBanking
Founding design team of the HLB Connect app
Roche
DesignPharmaceutical
Senior UI/UX designer, design system for a data product
Orbit HR
Design and buildStatutory payroll
KWSP, PERKESO, EIS and PCB calculations, designed and built
Orbit Finance
Design and buildAccounting and tax
Double-entry books with LHDN MyInvois e-invoicing and SST-02, designed and built
Payung
Design and buildInsurance distribution
Branded comparison apps for licensed agents, designed and built
When is Pali the wrong choice?
I am one senior lead working with an AI agent team, and I review every decision myself. That suits founders, SMEs and product teams who want a product designed, built and shipped in weeks. It does not suit a programme that needs 20 engineers on day one or a dedicated platform team. For that, hire an agency or build an in-house team; I can still lead product and design inside it.
Frequently asked questions
Can Pali handle enterprise-grade engineering?
Yes, for products a single senior lead can own end to end. Every build follows the same written standard: server-side validation, tenant isolation in the database, exact money, migrations and automated tests on the riskiest logic. The figures on each case study are measured from the source code.
How is customer data kept apart in a multi-tenant product?
Each record carries its organisation or household, and the database enforces that scope with row-level security policies: 522 of them on UrusPro, 278 on MSDI. The interface hiding data is never the only guard.
How is quality checked before a release?
Each product has automated tests on its riskiest logic: payroll against official tables, ledgers against balance invariants, payments and data isolation. Several run in CI on every push, and each milestone ends with a smoke test of the real app.
Who owns the code?
You do. The code and the IP are yours once each invoice is paid, and every product is built on standard tools so another team can take it over.
Does Pali build for Malaysian regulations?
Yes. Shipped products implement KWSP, PERKESO, EIS and PCB payroll with tests against the official tables, LHDN MyInvois e-invoice submission, SST-02, HRD Corp claims and PDPA consent, export and erasure.
Want something like this built?
Get a price in two minutes, or talk it through on a free call.