WhenanEngineeringTeamStoppedDebatingWhetherAICouldWriteCode,andStartedDecidingWhatKind
A 200-person engineering org wanted to use AI coding assistants but had one hard constraint: proprietary code could never leave their infrastructure. We built a context-aware, on-premises copilot that actually understood their 2-million-line codebase. Sprint velocity jumped 32%, and onboarding time was cut in half.
Business Context & Telemetry
Our client was the engineering division of a late-stage fintech company. Their 200 engineers managed a complex, 2-million-line monorepo across 14 services. The leadership wasn't skeptical of AI—many engineers used GitHub Copilot on personal projects and loved it. The blocker was a hard compliance constraint: code could not be sent to external model providers like OpenAI. Standard SaaS coding assistants were categorically off the table. They needed the productivity of GenAI without letting a single line of code leave their building.
Late-stage Series C fintech company
200 engineers across 18 squads (mobile, backend, infra, data, security)
India-headquartered with a highly distributed remote workforce
VS Code Extension, JetBrains Plugin, Neovim Plugin, Internal Developer Portal, CI/CD Integration
2016
“Our senior engineers spend 40% of their time on things a machine could do — writing boilerplate, hunting down context, generating happy-path tests. The blocker has always been security. We can't send our code to OpenAI. We've been waiting for someone to solve this the right way.”
VP of Engineering
A highly capable team spending nearly half their time on work that didn't require their expertise.
A time-motion study revealed a staggering statistic: 42% of engineering hours were spent recovering context, writing repetitive boilerplate, and drafting mechanical test cases. The work was necessary, but it didn't require the senior expertise the company was paying for.
Hours lost to 'context recovery'
Touching an unfamiliar service in a 7-year-old, 2-million-line monorepo required hours of digging. An experienced engineer could easily spend 2 hours reading old PRs and Slack threads just to write a 45-minute code change.
Writing boilerplate at senior salaries
The codebase had established patterns for API handlers, repositories, and schemas. Every new instance required manually typing the same structural code. Delegating it to juniors introduced heavy review overhead, so seniors begrudgingly typed it out themselves.
Lazy happy-path testing
Engineers rigorously tested complex edge cases, but wrote standard 'happy path' tests lazily as a compliance exercise. Analysis showed 60% of production incidents could have been caught by more thorough functional testing.
Security issues caught days late
Internal security guidelines were enforced during PR reviews or CI/CD linting—often days after the code was written. This forced painful context-switching for the author and occasionally allowed subtle vulnerabilities to slip through under deadline pressure.
Onboarding paralyzed by interruptions
It took new hires 4 weeks to become productive. The bottleneck wasn't technical skill; it was learning the company's specific codebase quirks. Doing so required constantly interrupting senior engineers to ask questions.
They had spent heavily on updating Confluence documentation, which quickly drifted out of date. They also ran a tightly controlled GitHub Copilot trial, restricting it from reading surrounding codebase context to meet security rules. Stripped of context, the tool proved useless for anything beyond basic language syntax and was abandoned.
"The VP of Engineering had a deep fear of 'AI spaghetti'—code that is syntactically correct but subtly ignores the company’s established architectural patterns, compounding into an unmaintainable mess over time. He explicitly stated: the tool had to make the codebase *better*, not just larger."
We started with 70 engineers and a stopwatch.
Before discussing architectures, we shadowed 70 engineers for two weeks. Tracking exactly where their time was going completely reframed both the problem and the solution.
Discovery & Methods
We mapped 6 months of PR data against task timing, interviewed developers about their biggest blockers, and audited 12 months of security review flags. The synthesis was precise: the bottleneck wasn't AI model intelligence. It was context. The AI needed to understand the company's specific, messy, internal reality.
The bottleneck wasn't AI quality. It was AI context.
A generic model knows how to write Python. It doesn't know that *this specific team* uses a custom wrapper for payment APIs and handles errors in a highly particular way. Our job wasn't to build a better language model. It was to ingest their proprietary codebase and feed it to the model at the exact moment of generation.
Design Philosophy
Three non-negotiable rules: 1) Zero code leaves the infrastructure. 2) Contextual correctness beats generic speed—a suggestion that ignores internal patterns is worse than no suggestion. 3) Earn the seniors' trust first. If senior engineers thought the AI was generating garbage, they would block adoption company-wide.
Constraints Respected
- 100% On-Premises: Inference, indexing, and telemetry had to run entirely within the client's private cloud.
- Latency under 250ms: Slower suggestions break a developer's 'flow state' and kill adoption rates.
- Multi-IDE Support: Native integration for VS Code, JetBrains, and Neovim to respect developer preferences.
- Real-Time Indexing: The AI's context index had to update continuously as hundreds of daily commits were merged.
A copilot that knows the codebase intimately—and never lets that knowledge leave the building.
We built a secure, on-premises AI stack that indexed the entire monorepo, detecting security flaws in real-time and generating code that mirrored the company's exact architectural patterns.
Secure Codebase Context Engine
Continuously indexes the full 2M-line monorepo (code, PRs, docs) into a local vector store. When a developer asks for a completion, it instantly retrieves the internal patterns, interface contracts, and team conventions most relevant to their cursor position.
This makes completions feel like they came from a veteran colleague, not a generic robot. It guarantees that generated code matches the specific architectural style of the surrounding service.
Self-hosted Qdrant vector database. Embeddings generated locally via multilingual-e5. Index updates incrementally via CI/CD hooks within 5 minutes of any merged PR.Fine-tuned on the client's codebase for ultra-low latency (180ms) local inline completions
Zero-retention endpoint for complex test generation and semantic security analysis
100% local vector store and embedding generation for the codebase context engine
Language-agnostic AST parsing for real-time security pattern detection
Routing API handling context assembly, caching, and model handoffs
Native integrations for VS Code, JetBrains, and Neovim
AI suggestions use visual opacity, not just color shifts.
“Senior engineers needed to instantly distinguish AI code from their own. Using a lower opacity made suggestions visually obvious without being jarring, allowing seniors to carefully review the code before hitting 'Tab'.”
Security alerts provide the solution, not just the problem.
“An alert telling a dev what *not* to do is annoying. An alert saying 'This violates our payment API policy; here is the correct pattern authored by the payments team' is a superpower. It turned security enforcement into active mentorship.”
Eighteen weeks to launch. And an 'adversarial' pilot that saved the project.
If senior engineers don't trust an AI tool, it becomes a junior-level toy and a senior-level maintenance nightmare. We structured the rollout to make the most skeptical senior engineers our primary evaluators.
Delivery Timeline
Operational Log
Discovery & Security Clearance
Weeks 1–3Time-motion study, architecture review, and on-premise infrastructure planning. Security boundary designs were heavily scrutinized and signed off by the CISO before provisioning began.
Indexing & Fine-Tuning
Weeks 4–7Deployed Qdrant and successfully indexed the 2M-line monorepo. Executed 3 fine-tuning runs of DeepSeek Coder on the client's codebase to ensure high pattern consistency.
IDE Extensions & Core Build
Weeks 8–12Built native plugins for VS Code, JetBrains, and Neovim. Security rules were configured in tandem with the internal InfoSec team, mapping AST patterns against historical vulnerabilities.
Adversarial Senior Pilot
Weeks 13–16Rolled out exclusively to 15 Staff and Senior engineers. We explicitly asked them to try and break the tool. Their harsh feedback over 4 weeks drove critical adjustments to false-positive rates and context retrieval weighting.
Company-Wide Rollout
Weeks 17–18Phased deployment to all 200 engineers. Because the senior engineers had already vetted and shaped the tool, they acted as organic advocates, driving immediate, frictionless adoption among mid-level and junior devs.
Team Topology
Deployed Roster
Collaboration
Working Rhythm
The internal Security team co-designed the real-time detection layer. They didn't just review our work; they wrote the rule taxonomy, explanatory text, and approved codebase snippets. Because they built it with us, they trusted it enough to officially replace a massive portion of their manual PR review workload.
Course Corrections
Diagnostic Log
Latency spikes. Querying the 2M-line vector store added 40–70ms to the pipeline, pushing inline completions over the critical 250ms threshold during peak hours.
We implemented a two-tier cache (Redis) for frequent cross-file contexts, and built a pre-fetch mechanism that queried the database the moment a file was opened, rather than waiting for a keystroke. Context retrieval latency dropped to 8–15ms, bringing the total pipeline comfortably under 200ms.
Security alerts had an 18% false-positive rate in week one. Seniors found it irritating and started blindly dismissing the warnings.
We sat down with the security team and realized three rules were too broad, and the AST parser was failing to recognize a custom internal API wrapper. We tightened the rules, added a one-tap 'Flag as False Positive' button to the IDE, and dropped the error rate to 4%.
One highly respected Staff Engineer spent two weeks aggressively trying to break the model, proving it would occasionally suggest deprecated legacy patterns.
We treated his adversarial testing as a gift. We used his 11 edge cases to update our fine-tuning negative examples, added recency-weighting to the vector search, and asked him to maintain our QA validation suite. He went from our biggest skeptic to our loudest internal champion.
Four months later, the AI wasn't just making the team faster—it was making the codebase better.
Velocity and quality metrics surged immediately. But the true success was cultural: the context-aware AI was nudging developers toward established patterns, generating long-ignored tests, and catching security flaws before they compounded into architectural debt.
32%
Faster sprint velocity
increase in story points completed per sprint post-deployment
21%
reduction in post-release defects vs. same period prior year
4→2 wks
time to first independent PR halved across all new onboarded engineers
Qualitative Objectives Reached
- The security team reduced their manual PR review workload by 40%. With routine vulnerabilities caught instantly in the IDE, they redirected their time to high-value threat modeling and architectural reviews.
- The skeptical Staff Engineer who tried to break the system ended up presenting the project's success at the quarterly all-hands, describing it as 'the first time I've been excited to talk about a vendor tool in my career.'
- A new engineering manager joined 3 months post-launch and assumed the tool was a legacy foundational system. The copilot had so seamlessly embedded itself into the team's workflows that it felt like an established baseline, not a shiny new intervention.
"I've spent my career fixing the mess AI generates when it doesn't understand the proprietary codebase it's writing for. That was my fear going in. What I found was the exact opposite. The suggestions were contextually perfect because they were drawing from our own architecture. I'm actually reviewing the AI's code to learn new things, which is not a sentence I ever expected to say."
Staff Engineer, 9 years at company
Fintech Engineering Client
Insights Gained
Valuable lessons and strategic insights uncovered through this project that inform our future work and architectural decisions.
Context quality matters infinitely more than model size.
Our local, quantized 7B parameter model produced drastically better code for this client than GPT-4 ever could, simply because it had RAG access to their specific repository. The ceiling for AI coding tools isn't set by the foundation model; it's set by the relevance of the context you feed it.
Senior engineer trust must be earned through adversarial testing.
Skeptical senior engineers aren't a roadblock; they are your best QA team. Letting them aggressively stress-test the system, and immediately fixing the edge cases they find, transforms them from loud detractors into your most credible advocates.
Improving codebase quality > Making developers faster.
Speed improvements scale linearly. Quality improvements compound. An AI that enforces security rules, drafts thorough tests, and strictly adheres to internal architectural patterns reduces technical debt forever. Speed is a byproduct of quality.
Capabilities & Archive
Running an engineering team where your best people are wasting time on repetitive boilerplate, but strict security policies have kept AI tools off the table? That combination is more solvable than most leaders think.
Services Leveraged
Your engineers are wasting time on work an AI could do. Your security policies are non-negotiable. We solve for both.
We build on-premises AI coding infrastructure for engineering orgs where code confidentiality is absolute. The fully local path is more accessible than you expect, and the quality—when the AI actually understands your codebase—is transformative. Tell us about your stack, and we'll give you an honest view of what's possible.
"No generic AI productivity pitches. A real conversation about your codebase and constraints."