A loop wrote a complete SaaS for $23.85 — then handed over the keys.

October 6, 2026

findefend.com is a subscription-spend defense product: upload a CSV or bank statement and it finds the recurring charges you're still paying — price hikes, upcoming renewals, zombie trials — and recommends what to cancel. It has Stripe billing, email digests, an admin console, a status page, and a login that works. Nobody wrote it. A LiveGraph bootstrap run created the repo, provisioned Railway, Cloudflare, Stripe, and delegated the domain at GoDaddy — and an improvement loop then built the entire product through fourteen queued items, each one a reviewed, CI-gated pull request.

The total model spend for the entire product backlog: $23.85. This is the honest version of that story — including every place it broke, because the breakage is where the product actually lives.

Twenty-five minutes of model work, then a loop

The bootstrap run did the plumbing a founder would otherwise spend a week on: seeded a private repo with a 50-file SvelteKit starter and a 14-item QUEUE.md; armed CI and the required build check; stood up Railway with Postgres and push-to-deploy; created the Cloudflare zone, DNS records and Stripe test products; and delegated findefend.com's nameservers at GoDaddy. Two steps paused for a human: the registrar delegation is a money-risk tool gate (the first API attempt actually 404'd, the Provisioner corrected the call shape and re-gated), and the Deploy Verify gate is the last checkpoint before the run declares anything live.

Its last output was honest rather than triumphant: “the app is pending — DNS propagation in flight.” The domain resolved an hour later.

The queue built the product

A ten-minute tick then worked QUEUE.md top to bottom — one branch per item, every push runs CI, a reviewer reads the real diff, a human gate watches protected paths. Fourteen items, fourteen merges, zero items left needing a human:

Steady-state items run $0.40–$1.20 each on a deliberately cheap fleet — the three outliers each had a mid-flight incident, which is the next section. When the backlog emptied, the loop didn't stop: its Planner node drafted the next milestone itself (manual entry, alert preferences, categories, a price-history chart) as a QUEUE.md diff that waited on a human merge. A person clicked merge; the loop shipped the first item within the hour.

What broke, and what it produced

The product was the demo; the incidents were the roadmap. Each of these is a real production failure from the build — and the fix it shipped or queued:

• A rejected review went invisible. The reviewer flagged q-0008 for revision, but the rejection detector required the verdict at position 0 while the edge router accepts the first standalone verdict line anywhere — the loop read queue_in_flight forever. Fixed by making the detector call the router's own parser; detection can never diverge from routing again. The revision lane then fired, the engineer added the missing page, and the PR merged.
• GitHub ran out of Actions minutes. A CI job queued 15 minutes, never got a runner, and cancelled. Detection existed; recovery didn't. Now a self-hosted runner is provisioned per-app at bootstrap, and a “no runner assigned” delivery flips the repo to it automatically — the loop healed itself on the new runner and its fix round found a real bug.
• The health check read a redirect as downtime. The Provisioner's own apex→www rule 301s the apex, and Deploy Verify read the bare 301 as “still issuing” — reporting APP_PENDING on a healthy app. Queued: verify must follow same-domain redirects.
• Stale IDs baked into instructions. A node's saved instructions carried a Railway project ID from an earlier deployment; the owner handoff looked the project up, found nothing, and stopped — legibly, not silently. Queued: input markers are authoritative, instructions never bake drifting IDs.
• A human edited the spec mid-flight — and wedged the branch. Rewriting an open queue item on main made the in-flight branch's untouched-but-stale copy read as a forbidden reword to the queue-diff verifier — a wedge only a human could clear. The fix is queued: compare against merge-base, not live HEAD. (The rewrite itself was right — the engineer had discovered GoDaddy's OAuth is partner-gated, so the item became PAT Bearer auth.)
• A secrets gate almost auto-approved empty. The gate that collects the owner's credentials would have been released by the generic auto-approve window. Now secrets-declaring gates can never auto-approve — silence must not release a gate that exists to gather input.

The last gate hands over the keys

The build's final step is an Owner Handoff gate. It renders a fillable secrets form — owner email and password — encrypts the values into the credential vault at approve-time, and writes only {{vault:…}} references to Railway. The model saw references, never values; the run ended with “SUCCESS: build complete — log in at findefend.com/login.” The app now belongs to its owner, and the loop that built it is still running — on a $50/day budget, behind the same gates, proposing its own backlog.

The product is real, too

The pitch isn't that a loop can write a CRUD SaaS — it's that the failures were legible. Every incident above surfaced as an observable state — a parked gate, a skip reason, a needs-you row — and most produced a platform fix that makes the next app's run smoother. Pick App Bootstrap in Templates, fill in six fields, and watch a domain become a self-improving product. (Or go find the subscriptions you forgot about — the product works either way.)