Toronto · Founder-operator
I built the business, then I wrote the software it runs on.
I own and operate Quaza Inc., a Toronto export commerce company, profitable in its first half. I wrote the iOS app it sells through and the Cloudflare backend that both the app and the website read from. Before that I rebuilt ATR Sports' online store and grew it more than six times over in a year, as the only person on it.
I learned Swift by shipping that app. Ten days from the first commit to the App Store. That is how I work: I pick a thing up by building something real with it, and I am at production speed in days. Everything below is something I shipped.
First half of 2026 unless stated, reconciled against live platform analytics, the raw bank ledger, marketplace exports, purchase invoices and the filed tax returns. These are rates and counts rather than revenue, which is a choice: a rate is the part that is mine, and it is the part that transfers.
A status console, a commerce storefront, a native app, a warm community site and an editorial studio page are five different design problems, not one look shown five times. Three of these are open in a browser right now.
A full-screen operations display for the business: live commerce figures, machine load, market instruments and a voice input, running continuously on a wall-mounted screen.
It is built to a written performance budget and holds it. Idle cost is measured rather than assumed, and the reduced-motion path drops it by an order of magnitude.
My own export commerce storefront. I customised the theme across 48 JSON templates, 68 sections and 18 theme blocks, and the price surfaces are authored as sections rather than installed as an app, so they are mine to change.
218 commits on the deploy branch. Pushing the branch is the deploy, and a change goes through an adversarial review before it gets there.
A native app, written alone: 98 Swift files and roughly 12,400 lines of SwiftUI and Swift Concurrency, with hand-written GraphQL over URLSession and no vendor SDKs.
Four releases in 24 days. It reads the same backend the website reads, so the two surfaces can never quote different prices, which was a deliberate constraint.
A site for a church I attend. Warm where the rest of this page is cool, because the audience is a congregation rather than a hiring manager, and the design brief follows the reader.
The part that matters is not the generosity. It is that the same person can hold two design languages and not let either one leak into the other.
The site for my services practice. A single long page with a hand-written shader for the globe, not a charting library, and a sustained metaphor carried through the copy.
3,091 lines of TypeScript across 22 files, and no component library. Every element on the page was drawn rather than installed.
Three interfaces I built, running on this page. Scrub the chart. Watch the console move. Run the publishing pipeline.
A market-data client inside a shopping app: price history with touch scrubbing, a watchlist, 7-day movers, separate Sealed and Singles markets, and 46 indexes. It reads a Cloudflare Worker over D1 that I also wrote, so the app and the website can never quote different prices. Hand-written GraphQL over URLSession, no vendor SDKs.
Illustrative data, not live.
The figures are illustrative. Every series here is a seeded random walk computed in this component, not live market data.
The app is native iOS: SwiftUI with the Observation framework and Swift Concurrency, hand-written GraphQL over URLSession, no vendor SDKs. The Prices tab reads a Cloudflare Worker in front of a D1 database. This is a recreation of that tab in one React island, with the chart drawn as SVG rather than pulled from a chart library.
A wall-mounted display showing the state of the business and the machine running it: load, scheduled jobs, agent activity and market instruments. It runs continuously to a written performance budget, and it stops painting the moment nobody is looking at it.
A news blog produced by a pipeline, not typed into an admin. A per-post build renders each article from a shared component library, a verification pass and a regression guard check the output, and publishing goes through the Shopify Admin GraphQL API: images to the CDN first, then the article, always as a draft. The left frame is the article template it renders. The right column is the pipeline, and you can run it.
Quaza News
Sealed held, singles drifted, and the reprint question stayed open.
Sealed boxes of Example Set ended the month close to where they began. Singles from the set drifted a few points lower, led by the alternate arts.
None of this is real. The set, the cards and the figures are invented for this page.
The chase card of the set gained on thin volume, which is the kind of move that fades. Mid-tier holos sat flat, and listed supply held steady all month.
A reprint would reset most of the numbers above, and rumours of one arrive on schedule. Until an announcement lands, every figure here stays what it is: an illustration.
Illustrative article, not a real post.
6 stages, run in order. Nothing here talks to Shopify: the run is a recreation.
The article is illustrative: the set, the cards and the figures are invented for this page. The run animates the real pipeline's order without talking to Shopify.
Quaza News is a TCG news blog on the Quaza Collect storefront, produced by a pipeline rather than typed into an admin: 18,246 lines of Python, a shared component library, and 73,195 words of prose across 30 built articles, tracked as 15,362 lines of article HTML. Publishing goes through the Shopify Admin GraphQL API, images first, article second, always as a Draft.
Running live on this page. Move them.
The database behind my store and my app stops dead at 5 million row reads a day. I measured the hot endpoint at 35,000 rows a call, then precomputed it to one. Drag the traffic.
Before: 105% of the daily ceiling. The tier has stopped serving, so every query fails for every consumer at once.
I gave an agent a shell on this machine, then made it read-only. This is the real policy, running here, with 61 tests behind it. Pick a call and watch it decide.
{ "tool": "Read", "input": {"file_path":"/etc/hostname"} }
ALLOWED
The guard returns no reason when it allows.
Rule: No rule fired
The call cleared every gate in order, so the guard permits it.
The guard is public at github.com/shraygh/readonly-agent. It carries 61 tests that run with no API key.
This table is not typed out. It reads this page's own stylesheet and computes every ratio in your browser, right now.
Contrast audit, measured in this browser
| Ink | Token | Used for | Measured on | Ratio | WCAG AA |
|---|---|---|---|---|---|
| Not measured yet. Every value in this table is read out of this page in the browser, so there is nothing to print before it loads. | |||||
The audit runs in the browser, because it reads the computed value of every token out of this page for itself.
I saw where this was going and built for it early. I do not use AI as autocomplete. I run a machine with rules, gates and orchestration, and every figure below is measured on hardware in my room.
Independent agents attack a change on separate dimensions, a second set attacks their findings, and the run returns a typed verdict rather than a paragraph. Six words put 56 agents on my live storefront, unattended, for 63 minutes.
15 of the 16 orchestration scripts declare a verdict schema, so an agent cannot return prose where a score and a severity are required.
I direct agents against written rules, not ad hoc prompts: 7 instruction files at 802 lines and 71 memory files, 14 of which name the specific incident that produced them.
The same rules govern two different vendors' tools, so the behaviour is a property of the system rather than of whichever model is answering.
I gave an agent a shell, then made it read-only with a deny-by-default pre-tool hook. It runs in the hook rather than through a declarative allowlist, because a declarative match auto-approves and short-circuits the callback that would otherwise be consulted.
93 logged sessions, no write tool in any of them. The policy is public, has 61 tests, and you can run them yourself with no API key.
12 scheduled jobs fire logged out, with catch-up on boot. Across 9 days the estate recorded 325 agent transcripts and 10,887 tool calls, and the daily unattended agent costs about five cents a run.
It runs whether I am at the keyboard or asleep, and it has been running for months.
1,548 lines of orchestration across 16 scripts. A run decomposes a task, sends it wide, then sends every finding to a skeptic whose instruction is to refute it.
The pattern is the point: one pass produces confident output, and a second pass aimed at that output is what makes it worth reading.
Everything above is something I made. This is the part that is not making: getting a decision made by somebody whose money it was.
I recommended that ATR Sports move its store onto a much more expensive platform. The resistance was not technical. It was cost, and underneath the cost it was timing. The owner did not disagree that the platform was better, they did not know when it would be worth paying for.
Above a certain volume the transaction-fee saving offsets the subscription. That turns the question from whether to upgrade into which month the crossover falls in, and I could show where we sat against that line. The second half mattered as much: the platform would make the work easier for the staff who use it every day, not only for me.
It took about a month. What made that possible was not the argument. I had rebuilt their website from scratch earlier that year, and I was the only person running the online side. The recommendation arrived from someone who had already done the work.
They went live the following month. The new website had already started the breakout, and the year closed with online sales up 515% and company sales up 82%. Those figures come from the store's own dashboards and I have the captures.
The form travels with you. It names where you are, its bezel fills as you move, and it moves through eight shapes I actually spend time on. Point at one.