Evidence you can reproduce
One private engagement with a small independent British supplement business, inspected in 2026. Six findings were reported privately, each reproduced before it was reported; three are published here. The business is not named and never will be: a client’s private weakness is not my marketing asset.
Every tool can say “working” while the workflow is broken. The failure lives in the join nobody owns. Five of the six findings sat between two systems, in a join nobody owned: storefront to email platform, sender to DNS, page to visitor, form to server, staging to live.
Three findings · confidence: confirmed · each reproduced before it was reported
Finding 1 · Compliance
Severity: high
A product named after a mineral carried a claim for that mineral at 13% of the Nutrient Reference Value. The GB register permits a claim only at 15% or above. The product named after the ingredient could not lawfully claim it.
Finding 2 · Data
Severity: high
A single account-wide suppression event in April 2025 was mistaken for individual opt-outs. The storefront’s marketing flag said 5,490 people could be mailed; the email platform could reach about 150. Neither system flagged the gap, because each is accountable only for its own half. Restoring a profile inside the platform is not the same as having a lawful basis to email it, and no campaign has been sent to any of these records.
Finding 3 · Email
Severity: high
SPF, DKIM and DMARC were misconfigured: the sending platform was authenticating against the registrar while the DNS actually lived at Cloudflare. Every marketing email was signed as the platform, not the brand.
None of these needed AI to exist. All of them needed someone to look, check what “working” means and write down how to reproduce what they found. The findings were found by hand; what I build from them is where the agent teams work. Every finding I report comes with its reproduction path and a plain statement of what I could not check.