Online Taxman

Monorepo architected before it existed — The second brand, Global Expat Advisors, is what drove the workspace split, and we planned for it from the beginning rather than refactoring into it later.

• The Online Taxman build was deliberately structured as the "build out the shared framework" phase, so extraction into @repo/shared was step one of building GEA rather than a cleanup pass.
• Strict import-direction rules keep the layering honest: sites may import from @repo/shared and @repo/design-tokens, shared may import tokens, and tokens import nothing — enforced by a style-boundary checker and a custom token-reference script that rejects undefined custom properties.
• Laurel's design system lives inside that structure as a three-layer token contract: neutral tokens in @repo/design-tokens, site-owned --theme-* overrides per brand, and site-private palette constants that shared components are forbidden from touching.

Layered anti-spam defense for a real operational problem — Bots weren't just filling the inbox; they were booking fake consultations and burning real accountant hours.

• Rate limiting backed by Turso, with tunable thresholds, ban history, and manual IP access rules.
• A captcha provider abstraction that supports both Cloudflare Turnstile and reCAPTCHA (a two-pronged v3/v2 flow), with hostname fail-open handling so legitimate users never get stuck.
• Bouncer email validation as a third layer, catching disposable and invalid addresses before a submission ever reaches the CRM.
• The combination has almost entirely solved the problem — spam moderated substantially without adding friction for real prospects.

Complex conditional consultation forms — The multi-step intake flows are the site's revenue path, and they carry a lot of machinery.

• Conditional branching across steps with Zag.js step machines, partial-save so a half-finished form survives a refresh or a return visit, and resubmission guards.
• A Zapier retry/replay system so a failed webhook delivery is recoverable rather than a silently lost lead.
• Attribution tracking and GTM dataLayer events wired through the funnel, plus dynamic confirmation pages and Calendly booking confirmation.
• A dedicated test:consultation command runs as part of the production build, so the highest-risk path is verified on every deploy.

PageData mirroring convention — Each site's src/data/pages directory mirrors src/pages exactly, giving a single source of truth for routing metadata, SEO, schema.org output, sitemap control, and redirects. Page copy and section composition live in data files rather than inline in routes, which keeps routes thin and makes cross-site reuse of section shells practical.

Performance work as a first-class task — Redirect-chain flattening, category-archive build path optimization, build throttle-queue fixes, bundle analysis via a per-site bundle-analyze script, and Partytown offloading for third-party tags.

Documented, enforceable conventions and CI — The repo carries a substantial rules and skills library (.agents/rules, .agents/skills) covering forms, content loaders, PageData, rate limiting, schema.org, and WordPress GraphQL.

• CI detects affected workspaces and runs only the relevant quality gates and test suites, keeping pull request feedback fast in a growing monorepo.
• A separate GitHub Actions workflow runs an OpenAI-backed PR review that loads path-scoped instruction files and a component inventory, then scores changes against a threshold before merge.