The OS of pharma manufacturing. Six years, 51 customers, 370 plants.

In the first version, a checklist wasa job. Within four months every customer plant had local SOP variants — Cipla Indore's tablet-coating cleaning was a different checklist from Cipla Goa's, even though the master procedure was identical. QA reviewers were drowning: the same SOP existed as 40 forks across 12 sites. The product was getting harder to use the more it was used.

The fix was to separate master (the template) from instance(the executed job). I rebuilt the data model and the UI in the same month. I didn't know it then, but ISA-88 had codified this exact separation in 1995.

DWI → ePBR → eBMR → MES → LeucineOS. Every step extended the platform without replacing it. The same task object, signature object, and audit trail that ran a cleaning checklist in 2020 today runs a 14-stage tablet-manufacturing batch at Cipla. Compounding, not rebuilding.

The product got harder to use the more it was used. That meant the abstraction was wrong — not the screens.

The intuitive 2020 fix would have been a surface fix: the checklists are multiplying and getting messy, so add search, add folders, add filtering. That treats the symptom. The real gap was structural — a checklist was modelled as a job, so every execution forked a new template, and 40 versions of one identical SOP piled up across 12 sites. No amount of UI polish fixes a model where using the product creates the mess.

Separating the template from the executed instance is the one decision the entire six-year platform compounded on. It's also the transferable diagnostic I still lead with: if a system feels harder to use the more it's used, the abstraction is wrong, not the surface. Every later step — procedure hierarchies, batch records, the execution layer — was the same primitive extended, not a rebuild, because the model was right the second time.

Not the only ten — the ten the system bent around. Each started as a customer escalation, an audit finding, or a flat refusal from a plant manager, and each became a primitive every later module reused.

The shopfloor visit that reset four years.

In February 2022 at Cipla Indore, an operator told me they still wrote everything on paper — because if the tablet crashed mid-batch the digital record was gone, and at audit time it's only the paper a regulator accepts as proof. That one sentence reset every assumption from week one. The next four years were spent making the digital record more trustworthy than paper, not just compliant: crash recovery, dual persistence, supervisor exception flow, signature attestation, structured deviation logging.

The killed feature. I pitched a full prototype review flow with branching approval and inline annotation; the founder cut it at deal-close to compress scope. The stripped-down 3-pane builder shipped instead — drag a primitive, configure, save — and it closed Zydus plus three more in Year 1. The full review flow shipped in Year 3, when the platform could carry the weight. The cut was right; the argument made the design defensible. Scope discipline at deal-close beats feature richness at demo.

How the team scaled. Two years solo (2020–2022) was a deliberate cadence — the architecture needed time to harden before more designers could safely extend it; hiring earlier would have duplicated the master/instance debt across more pairs of hands. By 2023 the system was legible enough that a five-person team could take modules end-to-end. In June 2025 the role bifurcated: the team owns the screens; I own the world model the agents reason against and the surface where humans approve their work.

The AI inflection — and whose bet it was.

The ontology-first platform direction was the CPO's strategic call, made in 2022 to stop modules duplicating their own data models. My job was to design its interface layer — how every module references shared universal entities (Equipment, Material, Procedure, Batch, Personnel, Site) instead of forking per module, and the screens humans move through. When Cortex's agents later needed a structured world to reason against, that same ontology — and the legible surfaces I designed on top of it — was exactly what they could operate on. The lesson isn't that I predicted AI; it's that designing cleanly against a sound architecture meant the design held when the inflection arrived. Cortex itself was built by a separate engineering team; what I designed is the human-facing surface where operators and QA approve what the agents propose.

The platform runs across 51 pharma enterprises and 370+ GMP sites — Cipla, Dr. Reddy's, Amneal, Biocon, Valent BioSciences, Revlon, Viatris, Zydus, Lupin (representative, not exhaustive).

Commercial frame.Most pharma MES rollouts take 18–36 months and 30–60% fail to reach planned scope — Körber PAS-X, Rockwell PharmaSuite, SAP ME/MII all carry heavy ISA-88-modelling and PLC-integration debt. Leucine landed on the operator surface first, then extended down to the substrate, with a 2–6 month implementation. A Plant Manager at a Valent BioSciences cleanroom in Iowa noted their operators actually want the digital tablet at their station now — which wasn't true with the last system.

The receipt: a Huvepharma audit collapsed 15 manually-transcribed paper fields into 1 controlled subtotal — a 92% reduction in uncontrolled data entry, 100% global harmonization across plants.

Scope boundary — stated plainly.What I designed is the interface and interaction layer across the platform: how the product reasons visually, the master/instance and stage primitives, the operator and QA surfaces, the builders, dashboards, and interlocks. I did not set the ontology-first platform strategy — that was the CPO's call — and I did not build Cortex, which a separate engineering team built. What I own on the AI side is the world model the agents reason against and the surface where humans approve their work. The regulatory frameworks (FDA, EMA, ICH, WHO) belong to the regulators. Being precise about what I designed is what makes the rest credible.

Three lessons I'd apply on day one of the next regulated-domain platform: read the standards earlier (ISA-88, ISA-95, GAMP 5, ALCOA+ — I rebuilt half of them by accident); visit the shopfloor in week two, not month eighteen (the Cipla Indore visit reset four years); and treat a sound data model as architecture to design against, not a refactor to retrofit — when the strategy is right, the leverage is in designing cleanly on top of it from the start.