One login for a solar business, in place of a patchwork of tools

Partial data is always saved; gaps gate the stage. Dragging a deal forward asks the API whether the deal and its sites hold what that stage needs, and a refusal says exactly what is missing: an MPAN, bills, a signed-off survey, half-hourly data, a quote. The rule is cumulative, so a deal dragged straight from discovery to won must satisfy everything in between; moving backwards, closing as lost and imported historic stages are never gated. An override exists, needs its own permission and records a reason, because a rule nobody can get past is a rule people learn to route around.

The original quote tool had the same arithmetic written out six times, and the copies had drifted: a payback figure that differed between the tab and the saved record, a twenty-five-year total that disagreed with the table beneath it. They were reconciled into one module of pure functions with tests. The customer reads their quote at an unguessable no-login link, and the cost build is stripped on the server before anything leaves it.

Each person has a spend policy, and the three-step order wizard shows a live verdict on whether this order will auto-approve before it is submitted. Over-limit orders route to finance, a director or operations. Goods are received against order lines with partial deliveries tracked, invoices are matched in one click against what was ordered and delivered, and the order number series continues the legacy one rather than starting again.

Projects have a Gantt with multiple predecessors per task, per-link lag, true float and critical path, ring detection over the whole graph and a what-if sandbox that changes nothing until it is saved. Baselines are stored on the server, and a daily job tells the project manager which tasks have slipped against the plan.

Meeting transcripts are matched to a CRM record by attendee, written up against a template for the type of call, and a model extracts who said they would do what by when. Nothing becomes real until a person confirms it. Confirmed actions then escalate (a notification, a nudge near the due date, repeated nudges once overdue, an email to the owner if still undone six days on) and every step is stamped so a re-run never chases twice.

The in-app copilot runs a tool-use loop over the live CRM, but its writes call the same business logic as the REST API, so gates, permissions and the audit log all still apply, and writes sit behind a flag. The same tool registry is exposed as an MCP server with an OAuth layer, so Claude itself can connect as a custom connector. The public website chatbot gets exactly one tool (capture a lead) and none of the read tools.

Moving data from the old tools was the riskiest part, so imports are resumable cursor jobs that work in slices of about twenty-two seconds to stay inside the host's function time limit, save their position and are drained by a scheduled task. They dry-run first and cannot be applied until the dry-run has been viewed, remember a mapping against a fingerprint of the sheet's headers, park files they do not recognise rather than guess, and treat a blank cell as nobody having answered, never as an instruction to erase.

Every screen carries a feedback control that captures the route, severity and a screenshot or screen recording. A ticket cannot be closed without a written resolution, the person who raised it is emailed the outcome, and a sweep every fifteen minutes catches any close where the email failed. The system's latest change is a direct product of one of those tickets.