Three Systems That Disagreed, One Portal The Team Reads
Confidentiality Note: Client anonymized. Systems are described by role rather than by vendor, and figures that would identify the company or its costs are left out. This work was done in an operating role inside the client's group of companies rather than under a separate vendor agreement.
The Full Story
Month end started with an export. Someone in supply chain logged into the packing facility's warehouse system and pulled on hand quantities. Then the marketplace fulfilment account. Then the online store. The three got lined up in a spreadsheet by hand, and where they disagreed, which was most months, the spreadsheet won, because it was the only place anyone had ever reconciled them. Cost came out of a second workbook that nobody had read into anything. Margin questions got answered by screenshotting a cell range into chat.
That spreadsheet was doing a system's job and everyone knew it. The founder could even describe the shape he wanted, because a sister company already ran something like it: one area per sales channel, with the real numbers underneath. What he did not have was a way to get from the description to the thing. So we built a base version and connected the marketplace to it live, on a call, while he watched. He spent the rest of the call sizing the real one.
What we built has two halves and one seam. On one side a Go service owns every vendor call and every write to the database: reconciling scan loops against the store's admin API, the marketplace selling API, the subscription platform, and the warehouse system on a read-only role, plus import commands for the exports that still arrive as files. On the other side a dashboard that only reads. It calls a published API and it cannot write to anything, so a display bug can never become a data bug.
The seam between them is the part worth copying. It is a machine readable contract that pins the wire shape, the environment variable names and the values of the write kill switch, and there is a test in each language that asserts against it. We wrote it because the two halves had already drifted apart twice, and both times the symptom looked exactly like the intended no data yet state.
That is also why a tile whose data source has failed now shows a blank marker rather than a zero, checked in a real browser on every pull request: every tile has to contain the marker and no digit. A page reading zero revenue is not a page anyone files a bug about. It just quietly says the business did nothing.
It runs in their accounts. Their code repository, their hosting, their managed database, their identity provider. The shared password is gone; sign in is the company directory with a named allowlist and a role table. It went from an empty repository to a live read spine in a week, and it reads 9,243 orders back to late 2023 and 4,614 stock positions from the warehouse.
What is different now is smaller than a number and more useful than one. Nobody exports three systems by hand to answer a stock question. When a source breaks, the page says so instead of saying zero.
The Challenge
Stock truth lived in three systems that did not agree: the online store, the marketplace fulfilment account, and a third party warehouse system at the packing facility. The real master was a spreadsheet one person in supply chain kept by hand. Month end meant exporting on hand quantities from each system, lining them up by hand, and multiplying by cost. Margin questions were answered by screenshotting a spreadsheet into chat. The interim dashboard everyone used was gated by one shared password.
Our Solution
A Go service that owns every vendor call and every database write, running reconciling scan loops against the store admin API, the marketplace selling API, the subscription platform and the warehouse database on a read-only role. A separate dashboard reads a published API and never writes. Between the two halves sits a machine readable contract pinning the wire shape, the environment variable names and the write kill switch, asserted by a test in each language. Sign in moved to the company identity provider with a named user allowlist.
The Result
One Read API Over Three Systems