Saturday Open Haus

Problem

Licensed real-estate agents don't respond well to direct recruiting pitches, and a recurring event with any visible brokerage tie reads as a sales funnel the moment it's recognized as one. The challenge was building a genuinely appealing recurring social event — a curated house-music brunch — that could also identify which attendees were actually engaged and worth a real recruiting conversation, without the public-facing brand carrying any trace of the backing brokerage, recruiting language, or downline structure that would break the format the instant a guest noticed it. The positioning had to read as "Soho House meets real estate" — curated and relationship-first, explicitly not a chamber mixer, brokerage event, or vendor lunch — with copy that could never slip into pitch language ("no speakers, no games, no listing pitches"), since even one sales-page sentence on the public surface would collapse the premise for anyone who noticed it.

What was built

A full event-operations platform: a public landing page with RSVP intake, a Turnstile-gated admin approval workflow (approve/waitlist/decline/no-show), a QR-code check-in flow for the door, and a members-only hub at /hub with magic-link login giving approved guests an agent directory, an event "set" page (playlist/gallery), a member feed, next-event RSVP, and referral links. Behind the public event, the admin surface computes a per-guest "warmth" score from check-in history and hub engagement to flag which agents are actively engaging and worth a follow-up conversation — a signal that is never shown to guests and never persisted, only computed on demand when the admin dashboard loads. The public landing page went through a full visual reskin mid-build (from an ivory "Field Studies Flora" look to an immersive golden-hour house-party aesthetic with a video hero, audio-reactive equalizer, and parallax scroll rooms) after the original design was judged too boring. A companion Cloudflare Worker handles scheduled reminder emails since Cloudflare Pages itself has no cron.

Technical approach

The system of record is Cloudflare D1 with a frozen core schema (events/guests/sponsors) — all subsequent features were added as additive migrations rather than schema changes, keeping the original data contract stable across six migration waves. Admin and check-in routes sit behind Cloudflare Access (team-gated, allowlisted email, one-time PIN); the member hub uses a separate stateless auth scheme (HMAC-signed magic-link cookies, no session table) rather than reusing the Access layer, since hub members aren't the same trust tier as admins. The most distinctive engineering decision is an automated "cover-integrity" test (tests/cover.test.ts) that fails the build if any brokerage, recruiting, or downline-related term reaches the public-facing source or built assets — turning a brand-safety rule that would normally rely on manual review into a CI gate, extended to cover client-side scripts as well as markup. A companion voice guard bans em/en dashes and emoji on the public surface, including catching a Unicode play-icon glyph (▶, U+25B6) that technically counts as an emoji character under Unicode's Extended_Pictographic property — replaced with a CSS-drawn triangle instead. Several real infra constraints surfaced and were solved rather than avoided: Cloudflare Pages has no native cron, so a separate companion Worker runs the daily reminder job and calls back using GET instead of POST because Pages blocks cross-site POST as CSRF protection, with a shared secret verifying both sides; AI-generated hero stills from one model silently added people/faces into frames unless the prompt explicitly excluded them, requiring a regeneration pass; and local Playwright screenshot capture of the animated landing page hung the MCP tooling, worked around by driving a cached Chromium instance directly with reducedMotion: 'reduce'. Every UTM parameter on an inbound RSVP link is captured and stored raw on submit rather than parsed-and-discarded, so channel attribution can be recomputed later even if the parsing logic changes.

Creative approach

Craft

The golden-hour redesign replaced an ivory pastoral aesthetic with a moody espresso-and-warm-gold palette built around a full-bleed video hero (turntable, espresso) driving an audio-reactive gold equalizer, alternating dark/light scroll "rooms" with parallax image bands, and a continuous gold waveline motif tying sections together — a direct response to specific creative feedback that the original look read as flat rather than as an event worth attending. The palette is a five-tone system (espresso, oat milk, charcoal, soft white, warm gold) paired with a serif/mono type stack — Libre Caslon Display for headings and large numbers, Libre Caslon Text for body copy, IBM Plex Mono for labels and buttons — that email templates approximate with web-safe fallbacks since custom fonts don't render in most inboxes. Event-format language carries the same craft discipline as the visuals: the five activity zones are named "connection pockets" (Coffee Haus, Collab Nook, Reel Booth, Partner Haus, QR Exchange Bar) rather than "vendor zones" or "stations," and the dress code is framed as "all house — come camera-ready" rather than a generic dress-code line, so the copy voice stays as considered as the palette down to the smallest label.

Reframe

The structural insight is separating the disguise from the mechanism: the entire attraction-intelligence layer (warmth scoring, guest-type flags, admin notes) lives exclusively on the admin side and is computed, never stored as a labeled signal a guest could stumble on — meaning the public event doesn't need to pretend not to be a funnel, because the parts that would give it away architecturally never touch the public surface at all. Making cover-integrity an automated build gate rather than a style guideline converts a judgment call ("does this copy sound too corporate?") into a deterministic pass/fail the same way a type error would be, which matters because a single leaked term on a public page would collapse the entire premise of the event.

Process and what failed

Several planned features were explicitly cut once real requirements clarified: a CRM sync (Follow Up Boss) was ruled out of scope since D1 is the system of record and no downstream sync was needed; Twilio SMS and Apple Wallet pass support were both built toward and then dropped as unnecessary channels once email proved sufficient. The "play the set" audio feature shipped visual-only at launch — the equalizer animates on an idle loop by default, with the actual audio player wired but hidden behind a build-time environment flag, because no licensed house-music loop was available yet and the two audio-generation tools on hand (one lacking a dedicated tool, the other TTS-only) weren't fit for a music loop. Rather than fake it or delay the whole feature, the code shipped complete and flag-gated, ready to switch on the moment a real audio file exists.

Outcome

Live at saturdayopenhaus.com with the public RSVP-to-D1-to-Resend pipeline verified end-to-end in production, admin approval and door check-in in active use, and the member hub, cron reminder worker, and golden-hour redesign all shipped and verified live on desktop and mobile. The test suite (84 Vitest tests across 16 files, plus the cover-integrity and voice guards) runs as a pre-deploy gate, and the cover-integrity and voice checks specifically block pnpm guard — and therefore block deploy — the moment a brokerage term, dash character, or emoji reaches public-facing source. As of the last recorded handoff, the platform is fully built and technically live; setting the next real event date/venue and supplying real event photography remained the owner's outstanding steps.