Let’s talk

Consultancy OS

The internal operating system for a two-person AI consultancy, built as one HTML file and a dependency-free PHP API in seven days.

Category
Internal tool, Rayden AI
Status
Internal
Period
Apr 2026
Role
Design, build, operate
Stack
HTMLVanilla JavaScriptChart.jsPHP 8JSON file storageMicrosoft GraphGoogle Places APIVapiTypeformCompanies House API
Pipeline board with six metric tiles and four columns of fictional deals from prospect to closed, each card showing sector, value and probability.

Context

Rayden AI was running on a spreadsheet and a group chat. We needed a pipeline, lead tracking, proposals, revenue, meetings and client workspaces, and I wanted to find out how far a single file could get a two-person firm before it needed a framework.

What I built

A 4,837-line index.html with thirteen tabs, sitting on 774 lines of PHP with no dependencies at all. State is a JSON file written under an exclusive lock with five rolling backups. Fifteen API actions, three inbound webhook receivers and five outside integrations: Microsoft Graph for tracked email and SharePoint client spaces with delta sync, Google Places for lead discovery, Vapi for outbound AI calls, Typeform, and a self-hosted nine-question audit that scores itself and creates a lead. The front end pulls exactly two things from a CDN.

Consultancy OS architectureA public survey and three verified webhooks from Typeform, Vapi and Microsoft Graph feed a single PHP API with fifteen actions. The vanilla JavaScript front end authenticates with bcrypt and lockout. Data lives in a locked JSON file with rolling backups. The API calls Microsoft Graph, Google Places and Vapi, and a mock mode replaces the Graph path so the whole email pipeline runs offline.default onPublic audit survey9 questions, self-scoringTypeform webhookHMAC verifiedVapi call webhooksecret headerGraph change webhookvalidation handshakeapi.php15 actions · 0 dependenciesdata.jsonexclusive lock · 5 rolling backupsindex.html4,837 lines · 13 tabs · vanilla JSAuthbcrypt cost 12 · lockoutMicrosoft Graphmail, SharePoint spaces, delta syncGoogle Placeslead finderVapioutbound AI callsMock modewhole Graph path offline
Every credential is configuration; there are no secrets in source.
  • Data store
  • Check or gate
  • External service

The Graph service had a mock mode from day one, which meant I could develop and demonstrate the whole email pipeline without an Azure tenant. That one decision saved more time than anything else. Passwords are bcrypt at cost 12, failed logins lock the address out, and the web server denies every JSON file.

Outcome

Built in seven days in April 2026 and used internally. Three days into the build I started porting the back end to Next.js and Turso, keeping the same front end, and found Prisma costing thirty-six round trips a page where one batched libSQL call would do. That port later grew ReviewFlow on the same rails. The original still runs with a one-line PHP server.

What I’d do differently

A JSON file is not a database, and I knew it before I finished. It works at six leads and would not at six hundred. Sessions inside the same file meant every login rewrote the whole dataset. And the single-file constraint outlived its usefulness: at 88 functions in one script block I was scrolling to find things, which is why the port kept the file rather than fixing it.

Screens