Cowork.Ctis — agent embedded in Reportia

The problem

Reportia, my own product under CtisEvolution, needed an embedded agentic assistant able to answer by requesting real user data — reading transactions, generating Excel and HTML reports — without that turning into a security or maintenance nightmare. An agent with access to real production data isn't something that can be treated like just another chatbot.

The approach

The first decision, documented in an ADR, was how to embed Cowork inside Reportia. Module Federation was evaluated and dropped in favor of a simple iframe, for style isolation and deployment simplicity — a conscious trade-off, not the trendy option.

The second was handling language models: a fallback and retry system with a mathematically bounded cost budget, at most attempts_per_model × fallback_chain_length calls in the worst case (six calls max with the default configuration), plus an environment-variable kill switch that turns off the fallback instantly, with no need for a redeploy.

Everything was built with strict TDD using Vitest, and CI runs vulnerability scanning with Trivy and secret scanning with Gitleaks on every push.

I built it practically alone — external help was limited to specific pieces, not the design or implementation of the system.

Result

An AI assistant embedded in a real product, with a mathematically bounded cost ceiling and an emergency kill switch that needs no redeploy — the difference between "we tried it" and "we let it run in production".