TL;DR. Platform work in the first stretch isn’t a model bake-off. Find the constraint that already picked the architecture. Stand the capability on rails inside the existing cloud account. Leave gates you can enforce: AI drafts; deterministic rules and humans apply. I already wrote the Spanish cost essay. This is the pattern that produced it.
The constraint already picked the architecture
Nobody hands you a blank AWS account and a whiteboard. They hand you an account that already has a billing owner, an identity provider, a VPC, and a product repo. The first month is spent finding the constraint those facts already imposed, then refusing to fight it.
On the last platform job the constraint was boring and decisive. Inference billing and access control had to stay inside the cloud account. No separate AI vendor login. That picks Bedrock. The product app’s translation engine only speaks the Anthropic Messages API with an x-api-key header. Bedrock’s Mantle endpoint speaks the same shape. nginx at container start bridged them. No custom image, no registry, no build step.
The cheapest Claude on that endpoint was Haiku 4.5. It was sufficient for UI strings. The model was not a choice. The constraint chose it, and the measured pilot did not argue.
Find the constraint. Stand the rails. Leave the gates.
That is the whole shape. The rest is tools.
Example: Weblate on those rails
One instance, not the essay. Self-hosted Weblate for the product app, translators in the browser, git as the shipping path. The stack that actually ran:
- ALB, internet-facing, with Cognito email allowlist on every non-API request. The task holds a git write token. That listener action is what made a public URL acceptable.
- ECS Fargate ARM64. 0.5 vCPU / 3 GB OOMed. 1 vCPU / 4 GB held: the Django app, a Valkey sidecar on localhost, an nginx sidecar on
localhost:8443speaking Anthropic-shaped requests at Mantle. - RDS Postgres 16 (
db.t4g.micro) and EFS for git working copies and app keys. - Bedrock Mantle, Claude Haiku 4.5.
- A dedicated translation branch on the app repo. Ordinary pull request to
main.
Steady state about $70/month (about $75 during backfills). A measured pilot: ~2,648 strings, eleven minutes, $1.26 of inference, about $0.0005 per string. Cheap model, UI strings, enough. The bill is FinOps proof. It is not the plot. The plot is that none of this opened a new vendor account.
Sidecars over managed services at this scale. Valkey on localhost instead of ElastiCache. nginx in the task instead of a mesh. Persistent volume on day one, because a translation UI without the git working copies is a demo.
The playbook for the next tool
Weblate was one payload. The reusable move is an agnostic POC deployer you can point at the next self-hosted tool the company already wanted and nobody had stood up.
Defaults that survived contact:
- Serverless containers. Fargate / ARM64 unless something in the constraint forbids it.
- Sidecars over managed at POC scale. Cache and proxy in the task. Buy the managed version when the bill or the failure mode says so, not on day one.
- Auth at the edge. Cognito on the ALB, not a homemade login in the app, especially if the task holds a write credential.
- Persistent volume on day one. EFS (or the account’s equivalent) before you promise anyone a URL.
- Under $100/month is a green light. The Weblate stack cleared that at ~$70. If the estimate does not, the constraint is cost, and you say so before you draw a diagram.
Order of work, same every time:
- Cost estimate from the pricing APIs, not from memory.
- Infra on a branch. No public listener yet.
- Phase 1: private. Prove the task, the volume, the data store.
- Phase 2: ALB plus auth. Then it can face a person.
- Alarms before the demo.
- Measured pilot. One real workload, timed, billed.
- Handover. Docs a teammate can drive.
Adoption is the test. If someone else runs the next batch without asking you, the rails held. That is also when you find out whether your gate was a control or a suggestion.
Infrastructure works when other people start driving it without asking.
A week of AppSec rails
Same 30-day shape, smaller loop. A scanner the org already pays for, a CI check that was advisory, a week of forward-deployed platform work to make the check fail the build and group the noise into stories a developer can close.
The constraint was already there: no enterprise workflow layer, sibling repos that had drifted, a pile of ungrouped alerts nobody would ever triage. The rails were the reusable workflow they already had, made the same everywhere it runs. The gate was the PR check, not a wiki page that says “please look at the dashboard.”
No new vendor. No new dashboard someone has to remember to open. The week is a success when the next person merges through the gate without paging you.
Two gates, one of them fake
The design is short enough to say out loud: the AI drafts, humans gate, git ships.
Gate one lives in the platform. Suggestions only, until someone clicks Accept. On Weblate that was a convention, not a permission. A teammate walked through it with a script. Spot-checks read as native. The language shipped. They did nothing wrong. If a review gate matters, it needs an enforceable control, not a default nobody is obliged to respect. I wrote that into the known-gaps doc instead of claiming a fence I did not have.
Gate two is a pull request. Accepted strings commit to the translation branch. Reaching the product takes the same PR to main as any other change. That one held.
Same shape as the OpenClaw leash: the model is the engine, the constraint around it is the product. Same shape as the Holtwick loop: the gate is what you actually shipped.
Handover
The 30 days are done when a teammate can drive the thing and the gates fail closed. Not when the demo lands. Not when the model looks clever.
I take selected, forward-deployed platform work of this shape. Available Q4 2026. Ottawa, Ontario remote, Canada remote. Propose a time on Hire.