This copy opens at: money moving through a product
This copy opens at: AI doing real work
This copy opens at: a technical lead you can trust
This copy opens at: investing in or buying a product
This copy opens at: a team learning AI agents
A short book for founders, teams and investors: products that move money or put AI to work, and the technical lead, the due diligence or the training that goes with them.
by John Wainaina Karanja · building software since 2007 · UTC+3
@qwainaina reads “cue Wainaina”: my middle name, written as music.
The questions, the sample and the offer follow your choice. You can change it here at any time.
I'm John Wainaina Karanja, a product and systems lead. I work remotely, in UTC+3. I design the systems a business runs on, and I lead the build.
John Wainaina Karanja · UTC+3
Reviews are a new offer. The sample in chapter two shows exactly what you get.
It takes a minute. Answer as things are today; "not sure" is an honest answer.
Nothing is stored or sent. Your answers stay on this page unless you choose to send them.
Answer the five questions first; your reading appears here.
This is a self-check, not a finding. A review checks each answer against evidence.
Every review starts with a map of the system as it is today. Numbered pins show where the risks are. The next page explains each pin and what to do.
A real review runs to several pages. The full sample is linked on the next page, to read or download.
Evidence: the sender retries after a timeout, and nothing records that the request was already sent.
Change: write each request down before sending. A retry checks that record first. Rule 04: Make actions safe to repeat
Evidence: timeouts are logged, with no state a person can review.
Change: mark it "uncertain" and check the chain before any retry. Rule 10: Expect other services to fail
Evidence: the score service and the payout table each keep a total. Unknown: how often they have differed.
Change: choose one record that counts, and work the other out from it. Rule 01: Keep each fact in one place
Evidence: invoices from any sender are read and drafted, including first-time senders.
Change: act only on approved suppliers, and match every invoice to a purchase order. Rule 13: Keep AI on a budget and on the facts
Evidence: there is no set of past invoices with known correct drafts.
Change: keep 30 past invoices as a test set and run it before each change. Rule 14: Let tests decide when work is done
Evidence: the approver sees the amount, not the source invoice or what the agent changed. Unknown: how many drafts were approved unread.
Change: show the source document and the agent's reasoning beside every approval. Rule 09: Several simple guards beat one clever wall
Evidence: production access, deploy rights and the domain account sit with one developer.
Change: a list of who has access to what, a second owner on every account, and automatic releases. Rule 07: Give each part only the power it needs
Evidence: changes are copied to the server by hand; there is no previous version to return to.
Change: automatic releases that can go back to the last version in one step. Rule 15: Ship only what was checked, and watch it run
Evidence: nightly backups exist. Unknown: whether one has ever been restored, and how long it takes.
Change: a timed restore test, repeated monthly. Rule 14: Let tests decide when work is done
Evidence: the repository and the cloud account are registered to a former contractor.
Change: make the transfer of both a condition of signing. Rule 07: Give each part only the power it needs
Evidence: the sync job runs once a day; the deck says real-time.
Change: correct the assumption in the valuation, or require the fix before closing. Rule 14: Let tests decide when work is done
Evidence: backups run nightly. Unknown: whether a restore works, and how long it takes.
Change: a witnessed restore test before signing. Rule 15: Ship only what was checked, and watch it run
What: written together during the day, for your own repository.
You leave with: what agents may change, what they must ask about, and what they must never touch. Rule 13: Keep AI on a budget and on the facts
What: built end to end by the team on a real task.
You leave with: a pattern the team can copy for the next task. Rule 14: Let tests decide when work is done
What: agent-written changes pass the same checks as human ones. Unknown: which checks your pipeline already runs.
You leave with: a pull-request checklist for agent work. Rule 15: Ship only what was checked, and watch it run
Findings keep what the evidence shows apart from what is still unknown. The plan is written so your own team, or any other, can act on it.
Read the full sample report · PDF
Read the full sample report · PDF
Read the full sample report · PDF
These are the rules I build by. In a review, every finding names the rule it breaks. Choose a cell to read one.
Decide where each important fact lives, and let everything else read it from there.
Without it: A customer's balance shows one figure in the app and another in the payout table. Support cannot answer, and the books cannot be trusted.
Ask your team
Treat anything from outside as possibly wrong, and check it the moment it arrives.
Without it: A payout address with one wrong character sends money to the wrong place, and there is no way to get it back.
Ask your team
When part of a system fails, choose whether it stops or carries on, by asking what a wrong answer would cost.
Without it: A payment check times out and is treated as "paid", so someone gets access they never paid for.
Ask your team
Connections drop and people press twice. An action that runs twice should have the same effect as running once.
Without it: A payout times out, the system tries again, and the customer is paid twice.
Ask your team
A change should happen completely or not at all, never halfway.
Without it: Money leaves one account, the server restarts, and the money never arrives in the other.
Ask your team
Never store money in a way that rounds. Use whole cents, and write down the rule that must always hold.
Without it: Small rounding errors pile up until the totals no longer match the bank, and nobody can say where the difference went.
Ask your team
Keep keys out of the code, and design so that one broken part cannot do much damage.
Without it: A website is hacked. Because the website holds the keys to the wallet, the money goes too.
Ask your team
Every request should prove who sent it, and that it was not changed or sent again.
Without it: Someone copies a valid request and sends it again an hour later, and the system acts on it twice.
Ask your team
No single check is perfect, so stack simple, separate guards. When one misses, the next one catches it.
Without it: One spam filter fails, and fake sign-ups flood the system overnight.
Ask your team
Retry what is safe, pause what keeps failing, keep a second source, and never blindly resend money.
Without it: A payment provider is slow to answer. The system decides the payment failed and sends it again. Both payments go through.
Ask your team
The newest blocks can be replaced. Wait for confirmations, count each transaction once, and refuse old requests.
Without it: A deposit is credited as soon as it appears. Its block is replaced, the deposit disappears, and the customer has already withdrawn the money.
Ask your team
When several copies of a program run at once, decide which jobs may run in one place only.
Without it: Two copies of the payment checker see the same deposit, and both credit it.
Ask your team
Treat AI like any paid service that is sometimes wrong: cap the cost, give it checked facts, check its answers, and keep a person in charge.
Without it: An AI assistant invents a price that is not on your site, and a customer holds you to it.
Ask your team
Agree what "correct" means as tests before you build, and for money, test the rule itself.
Without it: A change passes a quick look, goes live, and quietly breaks the refund flow.
Ask your team
Release exactly what was reviewed, check it after every release, keep a way back, and hear about problems before your users do.
Without it: A fix made directly on the server is overwritten by the next release, and the old bug comes back.
Ask your team
Every system has bad days. What counts is a calm account of what happened, and a rule that stops it happening again.
Without it: A bug is patched in a hurry, nobody asks why it happened, and a cousin of the same bug comes back a month later.
Ask your team
I'm John Wainaina Karanja, a product and systems lead. I design, lead and deliver. If a specialist is needed, we agree that first.
Three products by name. The systems behind my other work, by what they do. The honey is the benefit I aim for, not a promise.
What I don't do: I don't write or audit smart contracts, train AI models from scratch, or give investment advice. I plan around them and work with the specialists who do.
Turns spare electricity into Bitcoin mining: a mining pool, and Melanin Click, an app that mines to your own wallet from a computer, a Raspberry Pi board or a phone.
HoneyPower that would be wasted becomes value, with rewards people can inspect.
A Bitcoin trivia game with scoring, leaderboards and cryptocurrency reward payouts.
HoneyLearning that connects game progress with a traceable reward process.
Verified video tours of Kenyan property before you enquire. An assistant answers only from the site, and passes you to a person when needed.
HoneyBuyers find relevant answers and reach a person when a question needs judgement.
Tracks wallet and token activity on a public blockchain, explains what large holders do, and sends alerts. Paid plans open only after the payment is confirmed on the chain.
HoneyPublic data made readable, with payment treated as its own control.
Scheduled AI agents that do real office work: they read mail and records, draft replies and reports, keep a record of decisions and tasks, and raise only urgent alerts. A person approves anything that leaves.
HoneyRoutine work done every day, with people deciding what matters.
Reads bank and mobile-money statements into the books of several companies, checks they match, links every figure to its source, and tracks filing deadlines.
HoneyBooks you can trace, and deadlines you see coming.
A digital currency anyone can mine on an ordinary computer: its own chain, wallets and mining software, and a reward token other products pay out in.
HoneyAn open way in for people without mining hardware.
Speech practice for an African language, with spaced practice and answers from checked sources. Draft material stays apart from approved lessons.
HoneyPractice material that stays connected to its sources and review status.
Scores new technologies on several measures, records where each fact came from, and compares signs with history before a decision.
HoneyAssumptions and evidence that are easier to inspect.
I only need read-only access. Never send passwords or live keys. I sign your confidentiality agreement, or you can use mine. I delete your materials on a date we agree.
Then the report says so, with the evidence. Proof that a system is sound is useful, to you and to anyone you show it to.
I do the review myself. Nothing is handed to a junior.
USD 2,450Fixed · 10 hours at USD 245 an hour · ready in about 10 days
Find out where your system is sound, where it is fragile and what to change first. One application, the most important thing your users do in it, and the services it connects to.
Hire me for the follow-on work within 60 days and the full fee counts towards it.
Start smaller A 90-minute working session on one question, USD 300, which counts towards the review.
Go further If you want help building it: the work in reviewable phases, quoted after the review.
USD 2,450Fixed · 10 hours at USD 245 an hour · ready in about 14 days
Find where a payment could be lost, repeated or recorded wrongly. One payment or payout flow and its ledger trail, traced with a sample that has private details removed. No live payments.
Hire me for the follow-on work within 60 days and the full fee counts towards it.
Start smaller A 90-minute working session on one flow, USD 300, which counts towards the check.
Go further Then the fix phase, and monthly reconciliation support if you want it, quoted after the check.
USD 2,450Fixed · 10 hours at USD 245 an hour · ready in about 10 days
Find out if an AI workflow is ready for a small, limited trial, what to prove first, and how people stay in control when it goes wrong.
Hire me for the follow-on work within 60 days and the full fee counts towards it.
Start smaller A fixed setup audit of one workflow you already run, USD 1,000.
Go further Then a trial build, and monthly help from USD 5,000 a month (about ten hours a week) if you want it.
USD 2,450Fixed · 10 hours at USD 245 an hour · ready in about 10 days
Before you hand me, or anyone, the keys: a clear account of how the product is built, who holds what, what breaks first, and a plan for the first 30 days.
Hire me for the follow-on work within 60 days and the full fee counts towards it.
Start smaller A 90-minute working session on the decision in front of you, USD 300, which counts towards the review.
Go further Then a part-time technical lead: from USD 5,000 a month, about ten hours a week.
USD 4,500Fixed · a product with 1 to 2 developers · about 15 days
A clear account of the technical risks, open questions and handover difficulties before you buy, invest in or partner with a product. Larger codebases are quoted separately.
Hire me for the follow-on work within 60 days and the full fee counts towards it.
Start smaller A 90-minute working session on the deal in front of you, USD 300, which counts towards the diligence.
Go further After the deal: a technical plan for the first 90 days, quoted separately.
USD 2,000Fixed · one day, up to 10 people, online or on site
Your team builds one AI-agent workflow end to end on its own codebase, and leaves with rules, a review gate and a plan.
Hire me for the follow-on work within 60 days and the full fee counts towards it.
Start smaller A 90-minute briefing for leaders, USD 300, which counts towards the workshop.
Go further Then 4 to 12 weeks of coaching for the team, quoted per team.
Not included: code changes, deployment, load or penetration testing, security certification.
Checked against rules 01, 03, 05, 07, 15 of the field guide.
Not included: financial audit, tax or accounting opinion, smart-contract audit, handling passwords or keys, moving funds or building the fixes.
Checked against rules 04, 06, 10, 11, 12 of the field guide.
Not included: training AI models, access to live systems, legal advice on data rights, or promises about accuracy or returns.
Checked against rules 13, 03, 09, 14 of the field guide.
Not included: code changes during the review, security certification, hiring or employment terms.
Checked against rules 01, 07, 12, 15, 16 of the field guide.
Not included: valuation, investment advice, legal ownership opinion, financial audit, exhaustive code or security audit.
Checked against rules 07, 01, 14, 15 of the field guide.
Not included: building your product, tool licences, model training or certification.
Checked against rules 13, 14, 15, 16 of the field guide.
Paid by USD invoice before the work starts, or through Upwork, which holds the payment until the work is done. Prices exclude any taxes that apply to you.
Five short answers. I reply within two working days, and nothing starts before we agree the scope in writing.
Please leave out passwords and production credentials. Nothing you type here is sent or stored by this page: it only opens your own email. Privacy
Or write to info@johnkaranja.com
Prefer to talk first? Book a 20-minute call.
Prefer a platform? Discuss your brief on Upwork.
Request a review at johnkaranja.com/book/request/ or write to info@johnkaranja.com.
The end. Or the first page of yours.
An old soul who builds new things. When the wood is quiet, I make music.
Set in Fraunces and Lora, with original bee and honeycomb drawings. Written, designed and built by John, and served from his own server with no third-party trackers. The logo, qwainaina, reads “cue Wainaina”: my middle name written as a musical score, one bar for each letter.
Behind the book, my name runs along a stave of music, and a bee dances across it. Bees dance to show the hive where the honey is. This book does the same for your system.
Read this book as a plain pageAll offers on one pageHow my name became musicThe field guidePrivacy