How AI Agents Rebuilt BlitzAdmin in One Night

Last night an AI agent rebuilt our internal admin platform — the search that took 10 seconds now answers in a keystroke, blitzadmin.com became a real homepage, and every team member got a profile that fills itself in from their own website. Here’s exactly how it happened, including the nine minutes where it broke production and what it did about it.

The Task Summary

Assignment: Overhaul BlitzAdmin, the internal dashboard where our team manages 221 client websites. The punch list grew across one evening of voice notes: make search instant instead of 10 seconds; land on the Websites page after login; rename “WordPress Sites” to “Websites”; make the internal pages beautiful; turn the logged-out homepage into a cinematic public page that explains the mission; show everyone’s profile photo; pull each person’s bio and social links automatically, “like when people register on Facebook or LinkedIn”; and add Sign in with Google and Facebook.

Source material: Two GitLab repos (an Angular 11 front end from 2021 and a Python Lambda back end), the live production bundles on S3, the WordPress media libraries on blitzmetrics.com and dennisyu.com, and a 26-minute strategy video on YouTube.

Goal: Ship everything to production the same night, verified in the founder’s own browser — not a demo, not a staging link.

Step-by-Step Process

1. Diagnose the slow search (20 min). The sites page re-downloaded all 221 sites every 6 seconds, wiped the user’s typed filter on every refresh, and didn’t even start its first fetch until the 6-second timer fired. The fix was three-sided: fetch immediately, refresh every 30 seconds instead of 6, and preserve the filter across refreshes with a debounced client-side search over domain and title.
2. Ship the UX pass (90 min). Login now lands on Websites. The header, search box and actions moved into one clean card pattern. A global style layer refreshed every page without touching templates. Built with the era-correct Node 16 after the modern Node broke webpack 4, deployed to S3, CloudFront invalidated, verified live.
3. Add a delta API (45 min). Background refreshes now send ?since=<high-water timestamp> and get back only changed rows — a handful of records instead of the whole table — with a full resync every tenth cycle. Deployed through the new CodeBuild rail, no Docker on the laptop required.
4. Build the public homepage (100 min). The agent harvested 14 photos of Dennis — on stage in São Paulo, with Gary Vaynerchuk, coaching students around a laptop — straight from our own WordPress media libraries via the public REST API, picked seven for a Ken Burns hero rotation, wrote the mission story, and embedded the Magic Berry Challenge video with Cam Hazzard at the bottom. The Angular app moved under /app/ with a pre-paint script that routes partners, old bookmarks, and live sessions straight into the dashboard.
5. Fan out the profile build (52 min of parallel agents). Three implementation agents worked disjoint file sets — backend auth and enrichment, frontend profiles and login, page polish — then two adversarial reviewers attacked the diffs. The reviewers ran the real Angular template compiler and found nine issues, including an SSRF hole and a white-label branding leak. All nine were fixed before anything shipped.
6. Break production, fix production (30 min). The new ProfileData column was declared on the model before the database migration could run — every user query failed and logged-in traffic got 403s. The agent rolled back within nine minutes, read the CloudWatch stack traces, found that background jobs never touch the code path that ran the migration, moved the migration to the Lambda entrypoint where it runs before anything else, and redeployed clean.
7. Verify like a user (throughout). Every claim was checked in the founder’s own logged-in Chrome: typing “birgitta” filtered 221 sites to 1 instantly; the avatar initials appeared in the nav; clicking “Import from my website” on the profile filled the bio and five social links from dennisyu.com’s own markup — “Imported 7 details.”

Critical Decision-Making

• No new API routes. The deploy rail can update code but not API Gateway resources. So Google and Facebook sign-in ride the existing /users/authenticate endpoint, branching on the request body. A lesser agent would have written the new route, watched it 404, and burned hours.
• Delta refresh instead of server-side pagination. Real pagination would have broken the instant client-side search that was the whole point. Changed-rows-only refreshes kept the search instant and cut steady-state payloads by roughly 99%.
• LinkedIn headshots: told the truth. LinkedIn only exposes photos through user-consented OAuth. Instead of scraping (against terms, brittle), profile photos chain through: uploaded image → your own website’s headshot → Facebook profile picture → colored initials.
• Rollback before diagnosis. When production broke, the agent restored the previous image first and investigated second. Nine minutes of impact instead of a debugging session on a live outage.
• Left the founder’s profile unsaved. After the import test filled the form, the browser had autofilled the password field — clicking Save would have silently changed his password. The agent noticed, stopped, and flagged the field for a proper fix.

Effort and Cost Comparison

Honest read: the agent’s speed comes from parallelism and never waiting — five sub-agents built and reviewed simultaneously while deploys ran. The human still matters enormously: the punch list itself, the taste (“make it personal, like the Athlete Spotlight”), and the two console approvals below are all human calls.

What the Agent Can and Cannot Do

Did autonomously: diagnosed and fixed the search, built and deployed both tiers eleven times, harvested its own image assets, opened and merged six merge requests, caught its own security holes via adversarial review agents, rolled back a bad deploy, and verified everything in a real browser session.

Required a human: creating the Google OAuth client (it’s Dennis’s Google account) and enabling Facebook Login on the Facebook app — two one-time console clicks. Until then, the Google button hides itself and the Facebook button shows a friendly error.

Could not do: pull LinkedIn headshots without consented OAuth (nobody legitimately can), or screenshot the logged-out login screen without destroying the founder’s live session — it verified that screen through the compiler and the shipped bundle instead.

Information Ingestion Inventory

• Two full repositories read end-to-end by four parallel recon agents (user model, views, auth stack, styling) — roughly 425,000 tokens of reconnaissance before any code was written.
• Live production JavaScript bundles diffed against git to rule out drift before deploying.
• WordPress REST media searches across blitzmetrics.com and dennisyu.com for photo sourcing.
• CloudWatch logs for the incident root cause; the failing SQL statement named the exact missing column.
• Total: about 1.4 million sub-agent tokens across three multi-agent workflows, plus the main session.

Guidelines Compliance Scorecard

• Title under 60 characters: yes (45).
• Meta description under 160: yes.
• Hook is a specific person and situation: yes — our own admin tool, last night.
• Figurehead voice, active voice, short paragraphs, H2 structure: yes.
• Internal links: the Jack Hughes leaderboard build, giving your AI team one shared brain.
• No AI fluff: the outage is in here, with the timeline.

What’s Next

Two console clicks turn on social sign-in. A teammate’s open merge request to scrub secrets from logs gets rebased and merged. And the same profile-enrichment engine that filled Dennis’s bio from his own site becomes part of member onboarding across the Spotlight network — because if your website already says who you are, no form should ever ask you twice.

v1.0 — August 11, 2026 — by Dennis Yu