A curator spent up to an hour on each chemical.
A regulator's deadline was coming for the rest.

The tempting move was to migrate everything to containers at once. Instead we ran an eight-week containerization proof of concept to test an alternative to individually managed virtual machines, using real workloads:

• We ran the application workloads on Amazon EKS and used that run to set the container-based deployment pattern the team reuses when it onboards each new customer.
• We evaluated Amazon Aurora MySQL because its automated backup, scaling and failover mean engineers don't have to manage the database by hand themselves.
• We adapted the infrastructure-as-code pipelines for Kubernetes operations, so the team has a version-controlled record it can use to reproduce environments.
• A one-off build for each customer costs more to support over time. The team defined the scale profile instead, so every new customer lands on the same pattern.

The proof of concept validated the target architecture before the production migration began. Proving the pattern once, on a single customer, was far cheaper than finding problems after it had rolled out to every customer.

Letting a model write the chemical profiles outright would have been simpler to build, but a safety product cannot work that way. The model was scoped to read and extract; the curator's judgment stayed in the review step. The three-to-four-week AI assessment followed the real profile workflow: source document, extracted safety information, profile fields, curator review.

• Workshops established the users, required response times and success criteria for the tool.
• The data-readiness work looked at Safety Data Sheet formats, storage schemas, accessibility and ingestion rates, so the team knows which inputs are ready for the pipeline and which need work first.
• We evaluated foundation models for Safety Data Sheet processing and external research, feeding task benchmarks and cost estimates into the implementation plan.
• The design uses Amazon Bedrock as the model layer, Amazon S3 for source documents and integration with the existing profile application, with encryption, IAM access and audit requirements set during the assessment.
• The workflow we designed extracts GHS codes, regulatory information and fire classifications for a curator to review, which cuts out the retyping but keeps the final call with the expert.

The assessment delivered a model evaluation, an architecture, a quantified business case and a scoped implementation plan. The next step is building chemical-profile generation on Bedrock.

A production feature was generating recurring Jira bugs and Zendesk tickets, but long-term fixes don't help the customer raising a ticket today. We ran a two-week feature audit that pulled the bugs and reports into one triaged backlog and connected them to logs, telemetry and user workflows. A bug report only describes a symptom, so we read the error traces, the SLO and SLI signals and the user journeys to build a time-windowed example of every recurring failure, which gave engineering the exact conditions it needed to reproduce each one. The audit also reviewed test coverage and release gates.

The team delivered quick-win mitigations within hours or days, such as configuration changes, guardrails, feature-flag rollbacks and throttles, while the longer fixes were scoped. Each remediation item carried an owner, an effort estimate, its place in the sequence and rollback criteria.

Patching one page at a time would have fixed the symptom 27 times. We put three full-time full-stack engineers and a part-time QA engineer inside the customer's sprint process, with one shared defect backlog across both codebases. Full-stack engineers who can work in Drupal, PHP and Vue.js meant both products could reach compliance on the same schedule, with no handoffs between specialist teams.

The remediation fixes tab order, focus behavior, ARIA attributes and screen-reader announcements in shared components, so one fix covers every page that uses the component. The work runs in four tranches, ordered by severity:

1. Critical navigation and sidebar fixes, in weeks one to three.
2. High-priority tables, accordions and modals, over the next two weeks.
3. Medium and low-priority forms and headers, in one to two weeks.
4. The PDF and SCORM training modules, in a week.

Because the deadline was fixed, the team closed the highest-risk defects first, so the worst exposure was gone whatever else happened.

The audit evidence comes from the customer's own tools, so that's where each fix has to prove itself. Legacy Drupal and PHP changes get manual validation, and Vue.js changes can also run through automated test validation. Each ticket closes only after a rescan with the customer's own accessibility tools confirms the fix, and that rescan is also the evidence for the remediation.

The pod reports weekly, reviews each milestone and keeps a risk register reviewed every week, because deadline work fails when surprises arrive late. Deployment stays with the customer, on its own release cadence, so the pod's hours go on fixes.