Phixi株式会社

AI in Practice

We treat AI not as a tool we occasionally use, but as the infrastructure that runs our organisation. Development, operations, security, and market intelligence are all AI-driven — which means we have direct, operational experience with the same challenges our clients face.

Apps in production
15
In the pipeline
113
Architecture decisions
526
GitHub organisations
25

How Phixi works end-to-end

From research to production and back — the entire loop runs automatically. The factory produces apps, media, and OSS continuously. The gate layer enforces rules and requires human sign-off before anything ships.

  1. ResearchContinuous market and trend collection
  2. BrainEvaluate, score, decide
  3. FactoryApps, media, and OSS built automatically
  4. GateSecurity, rules, and human approval
  5. ProductionDeploy, operate, monitor
  6. MeasureFeed results back to Brain
Measurements feed back into Brain to close the loop

Governing AI through separation of powers

The more you delegate to AI, the more important it is to have rules it must follow — and a mechanism that checks whether it does. We took inspiration from constitutional separation of powers: three branches, each with a distinct role, and a human approval gate at the top.

Make the rules

Rules for AI development and operations are recorded. Changes are proposed, never applied directly.

Judge

Proposals are checked mechanically for consistency with the rule format.

Audit

Every environment is audited regularly against the rules, and violations are reported.

No rule change takes effect without human approval

Each branch runs on separate credentials and never audits itself

25 organisations, one system

Phixi operates 25 GitHub organisations, each with a distinct scope and permission boundary. AI agents never accumulate authority across org lines — the same separation-of-powers principle that governs our rule system also governs our org design.

Core

4 orgs

Management, strategy, governance

App factory

7 orgs

B2B / B2C / internal / native / games

Content

3 orgs

Books, music, video

Infrastructure

4 orgs

Data, assets, packages

Ventures

4 orgs

E-commerce, investment, patents, security

Research & OSS

3 orgs

Research, open source, contract dev

Autonomous development and operations

AI agents handle most of the development cycle

Code review, testing, deployment, monitoring, and documentation updates are handled largely by AI agents running autonomously. Our team focuses on design decisions and final approval. This lets a small team maintain and improve multiple products in parallel without sacrificing quality.

  • Automated code review and quality checks
  • Test generation, execution, and reporting
  • Autonomous deployment pipeline management
  • Automated anomaly detection and first-response

AI governance — separation of powers

Rule-making, auditing, and judgment are kept separate

Any organisation that delegates decisions to AI needs a structure that prevents AI from making unchecked mistakes. We separate three functions: making the rules, auditing compliance, and rendering judgment. No single function accumulates all authority.

  • Explicit rule sets that define AI behaviour
  • Independent auditing of AI actions by a separate mechanism
  • Human approval required for significant changes
  • Automatic detection and logging of rule violations

AI-driven security testing (Purple Team)

An adversarial AI continuously tests our own services

To catch vulnerabilities before they are exploited, an AI with an attacker mindset runs continuous tests against our services. Running both a defensive and an offensive AI in-house lets us maintain a consistent security baseline before and after each release.

  • Continuous testing of authentication and authorisation flows
  • Injection-attack resistance checks
  • Validation of external manipulation patterns
  • Automatic logging and prioritisation of findings

Continuous trend and market intelligence

AI collects and structures global signals for decision-making

AI continuously collects technology trends, market movements, and competitive signals, then structures them for use in product strategy. The output feeds our idea evaluation, technology selection, and proposals to clients.

  • Regular collection of technology trends
  • Competitor and market monitoring
  • Automatic summarisation and classification of industry news
  • Intelligence fed directly into idea scoring

The app factory pipeline

Seven stages from idea scoring to retirement — all automated. Failures are written back into the pipeline as data for the next decision cycle. Spec approval and retirement decisions require human sign-off.

  1. ScoreAutomated 20-dimension scoring
  2. SpecAI generates design specHuman approval
  3. GenerateScaffold built automatically
  4. ImplementFeatures coded and tested
  5. ShipCI/CD deploys to production
  6. GrowMetrics-driven improvement loop
  7. RetireAuto-KILL below thresholdHuman approval
Failures and retirements feed back as learning data

The security loop

Attack and defence in a single continuous loop

A Red AI finds vulnerabilities; a Blue AI implements fixes. Once a defence is confirmed, it is pushed to all apps automatically — then the attack cycle begins again. This is not a one-off audit; it is a loop that never stops.

  1. Step 1Red AI attacksTests auth, injection, and manipulation patterns
  2. Step 2Findings loggedIssues recorded with automatic prioritisation
  3. Step 3Blue AI fixesDefence code generated, tested, deployed
  4. Step 4Shipped to all appsOne fix pushed to 15+ production apps

Technology stack

The shared baseline across all apps — standardised via templates and maintained automatically by AI.

LayerTechnology
FrontendReact 19 / Next.js 15 / Tailwind CSS v4 / shadcn/ui / TanStack Query / Zustand
BackendRuby on Rails / Node.js / Hono / tRPC
DataPostgreSQL / Neon / Redis / BigQuery / pgvector
CloudAWS / GCP / Cloudflare / Vercel / Terraform
AIClaude Code / Anthropic API / MCP / Prompt Caching
DXGitHub Actions / Vitest / Playwright / Sentry

Our commitments

How we hold ourselves to account as we expand AI use

No unsupported claims

We do not use phrases like world-first without evidence. The effects of AI adoption are communicated only within the bounds of what we can verify.

Humans stay in the loop

As we expand what AI handles autonomously, we maintain a design where significant decisions remain with people. We avoid over-dependence on AI judgment.

Governance through structure, not attention

We do not rely on human vigilance to keep AI behaviour in check. Rules and auditing mechanisms automatically detect problems.

What this means for your organisation

The knowledge we have built running AI in production transfers directly to client engagements. Whether you are asking where to start with AI, or why an existing initiative is not delivering results, we can speak from operational experience — not from a slide deck.

See how we help clients

Talk to us about AI adoption

Questions about where to start, governance concerns, or why a current initiative is stalling — we are happy to talk it through.

Get in touch