The first real commit on this platform isn't a feature. It's a spec and an empty shell. The second, roughly 48 hours later, is a running app with five risk categories, an incidents table, and a dashboard route that rendered nothing but a title. Almost every decision I'm still living with today was made in that window, before I'd written a single thing a risk officer could actually use.
This series started with one complaint: risk teams don't have a data problem, they have a fragmentation problem. The register is in one spreadsheet, controls testing in another, incidents in a third. The first 48 hours are where you quietly decide whether you're fixing that or just building a sixth silo. If every module is going to share one taxonomy, one source of truth, you commit to that before the code exists. Retrofit it later and you become the fragmentation you set out to kill.
So I did something that looks like over-engineering and wasn't: I scaffolded the shape of the whole platform on day one, not a minimal register. Folders and schema for modules I wouldn't touch for months, with one shared taxonomy at the center that incidents, risks, and everything after would point back to.
What I deliberately under-built was everything cosmetic. No real UI, no validation, no polish. The dashboard route existed and showed a heading. A seed script wrote a handful of fake risks so the database wasn't lying about being empty.
The reasoning: structure is cheap to add on day one and brutally expensive to retrofit. A shared taxonomy you bolt on in month four means rewriting every module that already assumed its own. Polish is the opposite. It costs almost nothing to defer, and you redo it anyway once you know what the thing actually is.
The first 48 hours, step by step:
What I got wrong
Scaffolding the whole shape meant I spent day two looking at a dozen folders that felt like progress and were actually just debt with good posture. Empty routes, empty modules, a navigation that promised features that didn't exist. For about a day I mistook structure for a working product, which is its own quiet version of milestone theater, except the only audience was me. The fix was boring and correct: I deleted the fake navigation and let the app be honestly small. One real thing a user can do beats ten routes that only I knew were hollow.
Where the tool stands now
After those 48 hours, a risk officer could log in, see the five categories, and add a risk against the shared taxonomy. That was the whole of it. Nothing to report on, nothing to export. But the spine was real, and every module since has hung off it instead of forking away from it.
Next up: incidents. Specifically, why I made linking an incident to a risk mandatory instead of optional, and why that one rule is the difference between a log and an early-warning system.
If you've ever scaffolded something and mistaken the folder structure for progress, reply and tell me. I collect these.