Catch the design that has already been approved

The problem

The client asked directly whether recolouring a façade would defeat detection, and was told matching runs on structure, not colour. The first engine did not actually honour that: recolouring a render moved the similarity score.

What we did

We rebuilt the engine colour-blind. Images are reduced to luma before the vision model ever sees them, so colour cannot contribute to the visual score at all. Colour did not disappear from the product: it survives as a separate RAL colour-code layer resolved in a fixed precedence order, manual override, then the PDF's text layer, then OCR of the façade images, so a reviewer still sees colour agreement without colour inflating the match. The preprocessing is pinned corpus-wide, because changing it invalidates every stored embedding.

The outcome

A promise made to the client in writing became a property of the code rather than a hope, and the product still answers whether two designs use the same palette as a separate question.

The problem

A submitted permit PDF is not a stack of façades. It carries floor plans, colour swatch sheets and the design office's own logo, and those pages sit inside the same size envelope as the façades, so no dimensional rule separates them.

What we did

We trained a small classifier that runs on the same colour-blind embedding the matcher uses, across five classes, with feature standardisation folded into the weights so the raw embedding is fed straight in. A page enters retrieval only if the probability it is a façade clears a high threshold. Two cheaper exclusions run before it: an exact-bytes hash that drops repeated boilerplate frames, and an edge-density floor that drops near-black rasters. Inference is a matrix multiply and a softmax, so no new runtime dependency.

The outcome

Only genuine façade pages reach the comparison, and the gate's own documentation is careful not to overclaim: its accuracy figure is recorded explicitly as a measurement on our data, not a forecast on theirs.

The problem

The engine's native output is a cosine distance between two vectors. Showing that to a permit reviewer as a percentage would be dishonest, because the numbers are not linear and 0.87 does not mean 87 percent confident.

What we did

We fitted a calibration curve so the number on screen is a same-design confidence rather than a bare distance, and set the classification tiers on that calibrated probability. Identical deliberately stays on the raw distance, because identical means the pixels match, not that the design is probably the same. On top of that sits a client-confirmed rule: a duplicate needs the confidence floor and matching colour codes, and matching codes never promote a pair that failed the floor.

The outcome

The percentage a reviewer reads means something specific and defensible, and the rule that turns it into a verdict was agreed with the client rather than assumed.

The problem

The client asked for near-misses to surface for review, not only near-identical files. Lowering a similarity floor is trivial; lowering it without burying a reviewer under look-alikes is not.

What we did

We sized the new floor from a census of the real library rather than by taste. At one threshold a query produced a median of one and a ninetieth-percentile of six extra cards, while a looser one flooded at a median of twelve. The tighter figure shipped as the default. Everything above the original surface floor keeps the untouched fitted curve, so no previously validated number moved, and the new band's percentages are documented as a position within the band rather than dressed up as calibrated confidences. The environment override is clamped as a fat-finger guard.

The outcome

Sensitivity became a tuned, evidenced setting with a documented cost, not a constant someone lowered until the demo looked good.

The problem

The unit asked to restrict editing to whoever uploaded a file. Applied literally to a library that already existed, that rule would have frozen most of the catalogue overnight, because the unit files by person and several of those people had no account.

What we did

The rule is enforced server-side on all four mutating routes, with a pure decision helper that is unit-testable away from request handling. A configurable cutoff timestamp grandfathers everything uploaded before a chosen instant, so an existing archive stays workable while every new upload is owner-or-admin from day one. The end-to-end test seeds two non-admin accounts on purpose, because every other test signs in as the admin, who is both an administrator and the uploader of everything, so a backwards gate would have passed silently.

The outcome

A security rule that shipped without a migration and without a day where the client could not edit their own library.