zsty.us

Before / After · Case Study

Porto Verde — a parked web address turned into a manufacturing site brands can actually hire

  • Hemp / CBD

A licensed Long Beach cannabis lab that extracts and packages for other people's brands had a real floor, real machines — and nothing online but a parked web address. Now every service is on display, brands can attach up to 100 MB of print-ready artwork with a quote, and every inquiry lands straight in the lab's own inbox.

“You own the brand. We run the line. — a co-packer's site that says exactly what it is, and marks everything it can't yet prove.”
Live → portoverdelab.com↗Repo → og-gitclaw/portoverde↗
🔒portoverdelab.com
jackiej.events — modern site

At a glance

What this rebuild covers.

  • Design

    Built from a blank slate as a serious manufacturing site — one confident hero of the real Long Beach floor and nine dedicated service pages, each tied to photos shot on-site, not stock.

  • Theme & color

    Deep green, brass gold, and near-black with clean technical type — the feel of a pharmaceutical manufacturer crossed with craft cannabis, deliberately nothing like dispensary kitsch.

  • Security

    A 21+ age check gates the site, quote submissions quietly screen out bots, and every artwork link expires on a timer so print-ready brand files are never left publicly reachable.

  • Agents

    Adversarial checker agents reviewed every factual claim before launch — one caught and removed an invented equipment feature — and anything the lab hasn't confirmed ships with a visible 'to be confirmed' mark instead of a made-up number.

  • Email

    Quote inquiries are emailed into the lab's own inbox on a mail server the owner runs himself, with the inquiring brand set as the reply-to — no outside email vendor ever touches a lead.

  • Search visibility

    Every shared link shows a branded card, and search engines get a full page listing plus machine-readable business details — so the lab reads as a real, findable business from day one.

Receipts — measured

Numbers that moved.

0
Routes shipped (from an empty repo)
was 0
0
In-house service detail pages
was 0
0 MB
Max artwork upload, browser → bucket
was 0 MB
1
Third-party email / data vendors in the lead path
was 1
0
Co-pack & extraction formats offered
was 0
0
Max files per artwork submission
was 0
0
Live systems migrated to the correct domain (zero downtime)
was 0
0
Domain-aligned mailboxes provisioned (Stalwart + SES)
was 0
  • 0 pages → 21 pages in one build
  • 100 MB artwork uploads with every quote
  • Inquiries land in the lab's own inbox
  • Misspelled web address fixed, zero downtime

The pixel diff

Overview, then the walkthrough.

Left: everything the legacy site shipped — frozen in place. Right: an auto-scrolling tour of the rebuild, from hero to booking. No slider to fight with.

Before — the overview
🔒portaverdelab.com · parked
Before — the overview

This is everything the legacy site had to offer above the fold. No pricing, no calendar, no booking — the funnel ended at a mailto.

After — scroll through what shipped
🔒portoverdelab.com
After — scroll through what shipped

Auto-scrolls through the modern site so you can see the booking surface, the package grid, the pricing table, and the calendar inline — without leaving this page.

Tap a pin. The story is in the pixels.

Before — what was broken
🔒portaverdelab.com · parked
Before
After — what shipped
🔒portoverdelab.com
After

The four beats

Problem · Insight · Build · Outcome.

Scroll past the legacy frame. The four beats land in order. At the end, the modern site fades into the same window.

🔒portaverdelab.com · parked
Legacy
01 · Problem

A licensed lab with a real floor — and no way for a brand to find it.

Porto Verde extracts distillate, live resin, and diamonds and co-packs pre-rolls, gummies, and carts for other people's brands. It had the equipment, the license, and a registered domain — and zero web presence. In a saturated 2026 California market, a co-packer that can't be found, can't show its capabilities, and can't take a brand's artwork is invisible to exactly the buyers it needs.

02 · Insight

A B2B manufacturer needs a procurement surface, not a dispensary microsite.

Brand owners and their ops teams want to see the services, the equipment, the compliance posture, and how to hand over artwork — fast. The build is organized around that: nine service pages, an equipment page grounded in the real machines on the floor, a compliance page, and a quote flow that takes 100 MB of print-ready files. The voice is industrial-premium and exact: "you own the brand, we run the line" — a processor that never competes with the brands it serves.

03 · Build

Empty repo to live in production — design system, 21 routes, real intake, in one build.

From-scratch design system → home + nine service detail pages + equipment / packaging / compliance / facility / brands / about → a 100 MB browser-direct artwork-intake pipeline (presigned PUT to a Railway bucket, leads to Postgres) → lead email wired to the owner's self-hosted Stalwart server with MX/SPF/DMARC provisioned in Cloudflare → full SEO + OG + JSON-LD + 21+ gate + Prop 65. Real facility photography was processed and placed; an unusable low-res walkthrough clip was flagged for a reshoot rather than shipped pixelated.

04 · Honest engine

Ship loud — and mark everything you can't prove.

The whole build runs on an honest-engine rule: never invent a number or a credential. Adversarial verifier agents stripped a fabricated equipment feature before launch. Throughput, MOQ, and fill-tolerance specs render with a visible TBC chip. The DCC license number stays a placeholder — licensing is verified during the build, and the licensing entity is surfaced to the owner to confirm, never guessed.

05 · Pending

What's honestly still open — surfaced, not hidden.

The DCC license number ships as a visible "TBC — pending partner confirmation" until the owner confirms the licensing entity; throughput, MOQ, and fill-tolerance specs carry the same TBC chip. The /about page exists but isn't yet wired into the nav or sitemap, and the facility walkthrough clip was left out rather than shipped at an unusable low resolution. Every gap is on the page as a marker — the honest engine applies to the roadmap too.

06 · Outcome

Live on portoverdelab.com — and brand inquiries land in the owner's own inbox.

The site is in production on its own domain. A brand can read the capabilities, walk the (photographed) floor, and submit a quote with 100 MB of artwork; the lead is stored in Postgres and emailed into the owner's self-hosted portoverdelab.com inbox, reply-to set to the brand — no Resend, no third-party email or data vendor anywhere in the path.

07 · Postscript

Bought the correctly-spelled domain after launch — migrated everything, lost nothing.

The site shipped on the misspelled portAverdelab.com before anyone clocked it. When the owner bought the correct portOverdelab.com, the full stack moved over in one session — code, DNS, Vercel, self-hosted Stalwart email + four mailboxes, AWS SES + DKIM, every env var — verified live with zero downtime, the old domain wiped from the mail server and re-pointed as a path-preserving 308 redirect. The kind of cleanup that usually means a weekend of broken links and bounced mail; here it was a single afternoon, end to end.

🔒portoverdelab.com
Modern
For the technically curiousHow it was done
  1. 01

    Where it started

    Porto Verde is a licensed cannabis and hemp micro-processor — extraction, co-pack, and compliant labeling for other people's brands, never its own flower. It had the equipment, the license, and a registered domain sitting parked at the registrar with no website behind it. Inquiries happened over text and DM. In a saturated 2026 California market, a co-packer that can't be found or vetted is invisible to exactly the buyers it needs.

  2. 02

    What a co-packer actually needs

    Brand owners and their ops teams want a procurement surface, not a dispensary microsite: the services, the equipment on the floor, the compliance posture, and a way to hand over artwork. The build is organized around that — nine in-house service pages (distillate, live resin, THCA diamonds, plus pre-roll, gummy, and vape co-pack lines), an equipment page grounded in the real machines, a compliance page, and a facility gallery that rebuilds itself when a new floor photo is dropped in a folder. The positioning is exact throughout: you own the brand, we run the line.

  3. 03

    The build — 21 routes and a 100 MB intake

    From an empty repository to production in one build: a full industrial-premium design system, 21 routes, and an artwork-intake pipeline sized for print files. Serverless functions cap request bodies far below 100 MB, so the browser requests a short-lived signed upload link and puts each file straight into object storage — only the file references pass through the API, which writes the lead to a managed database and emails the lab download links that expire after seven days. No artwork file ever passes through a server function.

  4. 04

    The honest engine

    The build ran through multi-agent passes where a verifier adversarially checks every factual claim. It caught and stripped a fabricated equipment capability a drafting agent had invented before it could reach production. Every number the lab hasn't confirmed — throughput, minimum order quantities, fill tolerance — renders with a visible 'TBC' marker, and the state license number stays a placeholder: an authoritative license search returned no record under the name or address, so the licensing entity was flagged to the owner rather than guessed. Certifications the lab is still working toward are framed honestly as 'pursuing'.

  5. 05

    Email with no vendor in the path

    Instead of a third-party email service, the quote form submits over authenticated mail directly to a mail server the owner self-hosts, delivering into the lab's own inbox on its own domain. Four mailboxes were provisioned and the domain's mail records published, with the inquiring brand set as the reply-to — so the lab replies from its own address and no outside service ever holds a lead.

  6. 06

    Postscript — the one-letter typo

    After launch the owner noticed the domain was misspelled — portAverde instead of the brand's portOverde — and bought the correct one. Rather than a risky big-bang cutover, the whole stack moved in one session: site code and canonical links, hosting, DNS, the self-hosted email domain and all four mailboxes, and every mail credential — verified live with zero downtime. The misspelled domain wasn't deleted; it now permanently redirects page-for-page, so an old link or a typo still lands the visitor exactly where they meant to go.

Architecture

Old stack
  • No site
  • Parked domain
  • Text / DM inquiries
  • No services surface
  • No artwork intake
↓
New stack
  • modern web framework
  • design system
  • managed app hosting
  • 100 MB presigned uploads
  • self-hosted mail server
  • edge hosting we operate

What changed, with evidence

Design

Greenfield design system — pharma manufacturer × craft cannabis, not dispensary kitsch

From an empty repo: a dark industrial-premium system (deep-green / brass-gold / near-black, Space Grotesk + IBM Plex Mono), a single confident facility hero, and nine in-house service detail pages — distillate, live resin, THCA diamonds, THCa, plus pre-roll / infused-preroll / snow-cap / gummy / vape co-pack — each tied to a real photo from the Long Beach floor. The positioning is exact: a micro-processor that doesn't cultivate or sell its own flower, framed sitewide as "you own the brand, we run the line."

Before
No brand, no services list, no facility imagery — a licensed lab that was invisible online.
After
21 routes, 9 service pages, real floor photography, and a procurement-grade capabilities surface.
Agent backbone

100 MB artwork intake — browser → object storage, around Vercel's body cap

Brands upload print-ready artwork (PDF / AI / PSD / EPS up to 100 MB) with their quote. A Vercel function can't accept a 100 MB body (4.5 MB cap), so the browser requests a presigned PUT and uploads straight to a Railway S3-compatible bucket; only the object keys come back through the API, which writes the lead to Postgres and emails download links. No file ever passes through the serverless function.

  • POST /api/uploads/presign → per-file presigned PUT (10-min TTL, type + size validated)
  • Browser PUTs directly to the bucket with XHR progress bars
  • POST /api/contact persists the lead to Railway Postgres + emails 7-day presigned download links
Real-time push

Lead email on the owner's own mail server — zero third-party vendor

Instead of Resend or SendGrid, the contact form submits over SMTP to our self-hosted mail server on an authenticated submission port, authenticating as a real portoverdelab.com mailbox and delivering locally into the lab's own portoverdelab.com inbox. Four mailboxes (info / accounts / sales / no-reply) were provisioned on the mail server with MX + SPF + DMARC in Cloudflare, so brand inquiries land in the owner's own inbox with no SaaS in the path.

  • nodemailer SMTP submission (implicit TLS on an authenticated submission port) → local delivery
  • Reply-To set to the submitting brand so replies go straight back to them
  • MX → our self-hosted mail server + SPF (v=spf1 mx include:amazonses.com) published in Cloudflare
Retention

Honest engine — built by adversarial agents that strip invented facts

The build ran through multi-agent passes where a verifier adversarially checks every factual claim. It caught and removed a fabricated equipment capability a drafting agent had invented (a non-existent CTM "scan-and-eject" feature) before it reached production. Every number the lab hasn't confirmed — throughput, MOQ, fill tolerance — renders with a visible "TBC" marker, and the DCC license stays a placeholder: licensing is verified with the owner during the build, and the license entity is flagged for confirmation, never invented.

  • Verifier removed a fabricated CTM scan-and-eject spec from the title + body
  • Throughput / MOQ / potency render with an inline TBC chip until confirmed
  • DCC license # left as a placeholder pending the real licensing entity
Agent backbone

Full launch surface — SEO, OG, structured data, age gate, Prop 65

Complete Next.js metadata: robots.ts, a sitemap enumerating all routes, a dynamic /opengraph-image (next/og) brand card + generated favicon, LocalBusiness JSON-LD, and a Twitter card. Compliance is built in: a 21+ age gate, Prop 65 warnings by product format, and METRC / C1D1 / COA trust signals — without claiming a certification the lab doesn't hold (GMP/ISO are framed as "pursuing").

  • robots.ts + a sitemap enumerating all 19 public routes
  • Dynamic 1200×630 next/og share card + generated favicon, rendered at the edge
  • LocalBusiness JSON-LD + Twitter summary_large_image card on every page
  • 21+ age gate with 30-day localStorage + cookie persistence
  • Prop 65 warnings by product format; METRC / C1D1 / COA signals with GMP & ISO honestly framed as "pursuing"
Agent backbone

A facility gallery that maintains itself

The facility page reads /public/facility at build time — drop a new floor photo into the folder and it ships in the next build, captioned and ordered by a small metadata map, with the hero poster auto-excluded. No CMS, no code edit. Images render as a responsive CSS-column masonry with a click-to-open lightbox, next to a lazy-loaded Google Map of the Long Beach floor.

  • lib/facility.ts scans /public/facility at build, applies a caption + order map, excludes the hero poster
  • Gallery.tsx: CSS-column masonry (1 / 2 / 3-up) with a click-to-open lightbox + captions
  • Drop a file in the folder → it appears on the next deploy, no code change
Agent backbone

A one-letter domain typo, migrated across 8 live systems with zero downtime

After launch the owner noticed the domain was misspelled — portAverde, not the brand's portOverde — and bought the correct one. Instead of a risky big-bang cutover, the whole stack was migrated in place and verified live the same session: site code + canonical/OG, the Vercel project domain, GoDaddy DNS, the self-hosted email domain + four mailboxes, the AWS SES identity + DKIM, every email environment variable, and this case study itself. The misspelled domain wasn't deleted — it was re-pointed as a 308, path-preserving redirect, so a typo or an old link still lands the visitor on the exact right page.

Before
Whole site + email built on a misspelled domain.
After
Everything on the correct domain; the typo domain 308-redirects to it.
  • Correct domain verified live (HTTP 200, valid SSL) the same session
  • Old domain decommissioned from Vercel + the mail server, then re-added as a redirect
  • portaverdelab.com/equipment → 308 → portoverdelab.com/equipment (path preserved)

While the owner sleeps.

Autonomous surfaces

The agent backbone keeps the brand earning after hours. The owner approves; the system runs.

  • Captures brand inquiries 24/7 into the owner's self-hosted inbox

    on each submission

    Every quote submission — including up to 100 MB of artwork — is persisted to Railway Postgres and emailed into the owner's own Stalwart portoverdelab.com inbox with the brand set as Reply-To. No third-party email provider is in the path; the lab replies straight from its own mail server.

  • Serves a dynamic share card + structured data on every link unfurl

    on every unfurl / crawl

    next/og renders a 1200×630 brand-gradient OG image at the edge and the layout emits LocalBusiness JSON-LD, so every shared link and crawler sees a branded card and machine-readable business data without a static asset to maintain.

  • Screens spam and records lead provenance on every submission

    on each submission

    The quote API drops bot submissions via a hidden honeypot field, then persists each real lead to Postgres with a JSONB artwork manifest and request provenance (IP, referer, user-agent). The leads table migrates its own schema on first write — no manual migration step.

  • Expires artwork links on a fixed lifecycle

    per upload / per email

    Upload URLs are presigned for 10 minutes; the download links emailed to the lab expire after 7 days — so print-ready brand files are never left publicly reachable indefinitely.

← All rebuilds

Porto Verde — a parked web address turned into a manufacturing site brands can actually hire — zsty.us