Discovery to production inside a customer's Moodle in under 90 days

Toglo turned first-person job-site video into AI-drafted, human-approved training procedures and delivered them inside the customer's own learning management system. I co-founded it with an ex-Retool product leader. Our first customer was Fuse Service, an HVAC franchise operating across several states. On 21 July 2026, their production Moodle was registered against our tool and the launch handshake was green. The first discovery conversation had been less than 90 days earlier.

This is the forward-deployed story I tell most often, because every part of it was the job: discovery, scoping, architecture, build, security review, and the live cutover.

Discovery

I sat with HVAC operators and technicians before writing anything. The number that shaped the wedge: every failed-technician callback costs the franchise $200 to $500. Training was the lever, and training that lived in a PDF nobody opened was not training. The operators already ran Moodle. So the product had to show up there, not ask them to adopt one more tool.

What I built

Two deployables and a pipeline between them.

The platform. Upload of raw job-site video with multipart S3 ingest. Mux for streaming, which served 118 production video assets by launch. A review console where a domain expert approves what the ML pipeline drafted, with click-to-seek video evidence beside every step and immutable published versions. The procedures were real: one heat-pump install came out at 18 steps and 112 substeps, each with tools, PPE, hazards, and the video span that justified it. Multi-tenant from day one, with org-scoped data access enforced on every query.

The ML boundary. The pipeline was a separate codebase owned by my co-founder. We met at a contract: HMAC-signed, idempotent webhooks with a Zod schema on our side that tolerated both real output shapes we had seen, canonicalized tools against a 35-item controlled vocabulary, and flagged anything unknown into the review queue instead of dropping it.

The LMS integration. A standalone LTI 1.3 Advantage tool provider: OIDC login, Deep Linking so an instructor can place a procedure in a course, Assignment and Grade Services so completion flows back to the gradebook, and Dynamic Registration so a new franchise location can connect without me on a call. Run as its own long-lived service, talked to over an internal secret-guarded API.

Run like an engagement, not a demo

• Production and staging environments. Staging auto-mirrored from main with a fail-closed migration step: if the migration fails, nothing deploys.
• 300+ automated tests, and a separate 19-check live verification harness run against the real environments. It was green at cutover.
• Health endpoint, error boundaries, PII-scrubbed error reporting, and a 30-minute production smoke cron that pages when the live path breaks.
• A staging environment that used a real copy-on-write branch of the production database, so migrations were rehearsed against real shapes.

The decision I would defend

I ran an adversarial security review on my own system before any customer traffic. It found two things that would have shipped otherwise.

The first was a launch-blocking auth misconfiguration. The second was an account-takeover vector: the LMS launch carried an email address, and the platform trusted it to link a learner to an account. An LMS admin, or anyone who could edit a profile field, could have become someone else. The fix was to treat LMS-asserted email as a hint, never as identity, and to bind accounts on the platform-issued identity instead.

Neither finding was subtle after the fact. Both are the kind of thing a founder ships when they are two weeks from go-live and nobody is checking. I decided the review was worth the week.

The honest gaps

• The go-live was the integration handshake and a working learner launch. Volume usage inside Fuse's courses was still ramping when my time at Toglo ended in July 2026.
• The ML pipeline's field names were still stabilizing at contract time. The schema tolerated two shapes because it had to.
• Role enforcement was labels first, enforcement second. Fuse-domain signups were auto-tagged as domain experts; the enforcement PR was deliberately sequenced after.

Why it matters

Selling into an operator means deploying into whatever they already run. The LMS integration was the least glamorous part of the product and the reason there was a customer at all.