Me and My Coding Partner, Agent Claude: Our Journey to Building a Classifieds Web App

At the end of October I gave my new partner the entire brief in one sentence:

create a simple classifieds application, using python and django. The features of classifieds application is that the user should be able to post an ad, view ads, categories and subcategories, geolocation, tags, create user account, delete user account, delete ad.

No Figma. No Jira epic. No 40-slide kickoff deck. 📋❌

Agent Claude receiving my one-sentence spec, probably.

Two weeks later, we had a real, tested, secure-by-default classifieds site: 24 commits, about 5,400 lines of Django, templates, CSS and JavaScript (plus about 400 lines of docs), and 115 automated tests ✅. It's all public at github.com/smakwana2/classifieds.

This isn't a "🪄 the AI built my app while I ate snacks" story. It's a story about a partnership: who did what, the bugs we chased together, and the calls that only the human in the room could make.

👥 Meet the team

That last row turned out to matter a lot. Keep reading. 👀

🛒 What we built

Think "Craigslist, but it went to design school." 🎓

• 📝 Ads with up to 3 photos, a photo grid and a full-screen viewer
• 🗂️ Categories, subcategories and tags (For Sale › Electronics, Housing › Apartments for Rent…)
• 📍 Search by any place and radius: type "Oakland, CA" or "94110", choose miles, and the nearest ads come first
• 🗺️ Maps on every ad (Leaflet and OpenStreetMap), with a pin you can drop when posting
• 💬 Messaging between buyers and sellers, with an inbox, unread badges and read receipts
• 🌗 Light and dark themes, with a switch in the header that remembers your choice
• 🔐 Accounts with sign up, log in and "delete my account" (which really deletes everything)
• ⚖️ A Privacy Policy and Terms of Use written to match what the site actually does
• 🌉 Demo Bay Area ads with real, credited photos, created with one command

The stack is gloriously boring: Django 5.2, SQLite, Pillow, plain templates and no frontend build step. No node_modules folder the size of a small moon. 🌑

🧭 How we work together

My prompts are short and describe the outcome, not the code (you'll see plenty of them in Chapter 1). The partnership runs on a few simple rules:

1. 🧱 One feature at a time, then commit. Each feature gets its own branch and only goes into main after I've tried it myself. "yes, commit and push" is my sign-off.
2. 🧪 Tests come with every feature. No test, no merge. The suite grew from a handful of tests to 115.
3. 🧠 Shared memory in CLAUDE.md. Agent Claude reads this file at the start of every session. It holds the architecture and our house rules: distances in miles, photos must be real and licensed, keep the dark-theme colours in sync. Every session starts already briefed, like a new teammate who actually read the onboarding doc. 📚
4. 🖱️ I'm the one with the real browser. Agent Claude can run tests and even drive a headless browser, but it can't see my Chrome. More on that in a second.
5. 🕵️ Bring in a second opinion. Partners should check each other's work, so we hired some reviewers. (Chapter 3.)

🌱 Chapter 1: Day one, from one sentence to a working site

Our whole first build happened on a single evening in late October. Here's how day one went, prompt by prompt.

🔌 Plugging in

My very first prompt wasn't about classifieds at all:

connect to github account

Agent Claude checked the machine, found nothing set up, and walked me through installing the GitHub CLI and logging in. Then:

create a new empty git repo, called claude-code-test1

Yes, the project started life as a test. It got promoted to the name classifieds about ten days later, once it had earned it:

rename github repository from claude-code-test1 to classifieds

🏗️ The first build

Next came the one-sentence spec from the top of this post. Agent Claude got straight to work… and hit a wall within seconds. The machine couldn't create a Python virtual environment, and fixing that needed my admin password. So it asked me to run one command myself:

sudo apt install -y python3.13-venv

Teamwork moment #1: Agent Claude can't type my password. I can. 🔑

A few minutes later, about six minutes after my spec, the first version was committed:

• 🧱 a Django 5.2 project with two apps, ads and accounts
• 🗂️ 6 starter categories with 23 subcategories
• 🏷️ tags, each with its own page
• 🗺️ maps and a "📍 Near me" search
• 👤 sign up, log in, delete your account, delete your ads
• ✅ 16 passing tests, from the very first build

What impressed me most wasn't the speed. It was the honesty. The summary ended with:

I haven't tried it in a browser, so the maps and the "use my location" buttons are untested.

That one sentence set the tone for the whole partnership: Agent Claude tells me what it hasn't checked, and I go check it. 🤝

(Even the first commit had a hiccup: git didn't know my email address yet. Agent Claude set it for the project, pushed, and moved on.)

Then I typed the prompt that turned me from manager into tester:

run the server so I can try it

📸 Builds two, three and four

Over the next hour, each idea became a prompt, and each prompt became a feature with tests:

update my application to add the following features: edit an ad, add upto 3 images per add

Editing, up to 3 photos per ad, and files cleaned up when an ad is deleted. 25 tests.

have a photo grid on the home page, and also on the view page.

A photo grid on every listing, and a full-size photo viewer with arrow keys. 27 tests.

Somewhere in between, my photos refused to show up at all. That mystery deserves its own story, so it's coming in Chapter 2. 🕵️

I also got curious about the meter running:

how many tokens have you used so far?

Agent Claude can't see its own token count, so it pointed me to Claude Code's built-in commands that show it. Even partners have blind spots. 😄

🎨 "Make it beautiful"

Up to then, the site worked but looked like a homework assignment. So I sent possibly the vaguest design brief in history, eight words:

make the website beautiful, with a pretty design

Where "make it beautiful" eventually led.

Agent Claude came back with a complete redesign: a warm cream background, a deep green brand colour, an elegant serif for headings (Fraunces) and a clean sans-serif for text (Inter), a header that stays put as you scroll, and dark mode that switched on automatically with your computer's setting (much later, that became the light/dark switch from Chapter 5). 28 tests, and every page checked as both a visitor and a logged-in user.

Not exactly award-winning prompt writing on my part. ✍️ But that's the point: I described the feeling I wanted, and my partner filled in the craft.

🧠 Giving the team a memory

About a week later, I asked for one more file:

generate claude.md file

CLAUDE.md is the project's shared memory: the architecture, the commands and the house rules, read by Agent Claude at the start of every session. It started as a summary and grew into the most important file in the repo. Every lesson in the chapters below ended up written there.

By the end of day one we had a working, tested, good-looking classifieds site, built in about an hour and a quarter. Then I started actually using it, and the real adventure began. 🎢

🐛 Chapter 2: The early bugs

None of these were "the AI wrote bad code." They were the real web being far messier than any tutorial admits, and each one took both of us to solve.

🖼️ The case of the invisible photos

Remember the photos from Chapter 1 that wouldn't show up? I reported this calmly. Twice.

photos are still not displayed,both on the home page and on the detail page view.

Me, staring at a page full of empty photo boxes.

Agent Claude didn't guess. It checked the server log and found something spooky 🕵️: my browser never even asked for the images. The photos lived under /media/ads/…, and ad blockers hide images whose web address contains /ads/.

Read that again. We built an ads website, and my ad blocker was doing its job perfectly. 🙃

The fix: store photos under /media/listings/ instead. There's now a test that fails if any photo address ever contains /ads/ again. 🙅

🗺️ OpenStreetMap said "403, who are you?"

Next, the maps broke.

OpenStreeMap access is blocked and is giving 403 error.

Our project at roughly this point in the evening.

OpenStreetMap's volunteer-run map servers want to know which website is asking for map tiles. Django's privacy-friendly default stops the browser from telling other sites anything, so every request showed up anonymous, wearing sunglasses and a fake moustache 🥸, and got turned away. The fix was to share just the site's address with the map server and nothing more.

👻 "It still shows two rows for me"

I asked for the search bar to fit on one row. Agent Claude changed the layout and checked it in its own headless browser. ✅ I opened Chrome. Two rows. ❌ So I sent a screenshot.

The screenshot showed the new page wearing the old CSS. 🧥 My Chrome had cached the old stylesheet and wasn't letting go, and Agent Claude's fresh browser had no cache to get stuck on. This is the "it can't see my browser" weakness from the team table, in action.

The stale CSS, once we'd spotted it.

The fix was a tiny template tag that gives the stylesheet a new address every time it changes. Twenty lines, and that whole genre of "works on my machine" bug is gone. 🎉

Honourable mentions 🏅: the geocoder decided the ZIP code 94301 (Palo Alto) was in Mexico 🇲🇽, and "Mission District, San Francisco" matched a business named after the neighbourhood. Both fixed, both with tests.

🕵️ Chapter 3: Calling in the reviewers

Once the site worked, I wanted fresh eyes. So I asked Agent Claude to hire some help:

spin up a coding agent and let it review the whole project without providing access to previous context or conversations.

spin up another agent, whole only role is review as a cybersecurity specialist and flag any risks or concerns.

The key detail: no previous context. The reviewers didn't know our history, our excuses or our "we'll fix that later"s. They just read the code. 🔍

The security reviewer's verdict was blunt: the code handled the classic attacks well (no cross-site scripting, no SQL injection, no way to edit someone else's ad), but it was not safe to put on the public internet as it was. Some of what the two reviewers found:

• 📍 Photos leaked GPS data. A phone photo of a couch could reveal the seller's home address. Now every photo is re-saved without its hidden data, and map pins are rounded to about 100 meters.
• 🔓 Unsafe defaults. If someone forgot a setting when deploying, the site would show debug pages to the world and sign cookies with a key that's public on GitHub. Now it refuses to start instead.
• 🐌 The location search could be abused to slow the site down for everyone. Now there are limits per visitor.
• 🏷️ Tags "c#" and "c++" merged into one, because both become "c" in a web address. Now they don't.

We fixed the serious findings in six focused commits, then cleaned up the smaller ones in a follow-up round, all with tests. The test count went from 44 to 91. A few items are still on the to-do list (like a CAPTCHA at signup), and they're written down rather than forgotten. Lesson: your partner is great, but a reviewer with no history catches what you've both stopped seeing. 👓

🧪 Chapter 4: Three users walk into a classifieds site…

Unit tests are great, but I wanted to see real people use the site. So:

can you run end-to-end workflow for 3 simaltenous users, signing up and posting ad?

Agent Claude created three Bay Area neighbours and gave each their own browser, all starting at the exact same moment:

• 🚴 Maya in the Mission, selling a carbon road bike
• 🪑 Omar in Rockridge, selling an antique French armchair
• 🛶 Sofia in Almaden Valley, selling a fishing kayak

Maya's ad posted. Omar's and Sofia's crashed with "database is locked". 💥

Every single test had passed, because tests run one at a time. Real people don't. Saving an ad held the database while the photos were being processed, and SQLite only lets one writer in at a time, so the other two were turned away instead of waiting their turn. The fix: process photos before touching the database, and tell SQLite to queue writers politely. On the rerun, all three ads posted within a tenth of a second of each other. ✅

Then I asked for one more scene: Omar messaging Maya and Sofia. Messages worked, but Omar's inbox listed his older conversation first. It turns out Django quietly ignores a model's default sort order on queries that count things, and the inbox counts unread messages. One line to fix, one test to keep it fixed. 🔧

Omar asking Maya about her bike. "Seen" means she's opened it. 👀

Two real bugs, found only because we simulated real people doing real things at the same time.

⚖️ Chapter 5: The grown-up stuff

A public website needs more than features:

create a privacy policy and page for that. also check that the website meets all the California and USA regulations and website is compliance with all the applicable laws.

• 📜 A Privacy Policy that tells the truth. Agent Claude wrote it from what the code actually does: which cookies exist and for how long, what's public, what's private, and that OpenStreetMap is the only outside service. No analytics, no ads, no selling data.
• 📄 Terms of Use covering the age requirement (18+), prohibited items, fair-housing rules for housing ads and equal-employment rules for job ads, and how copyright takedowns work.
• ✅ A consent checkbox at signup, saved with the date and the version of the terms.
• ♿ An accessibility audit with axe-core, the standard automated checker, on every page. It found grey text that was slightly too faint, a red button that was hard to read in dark mode, and photo links a screen reader couldn't name. All fixed: zero violations now.
• 🗂️ A law-by-law checklist of California and US rules, including the steps only a human operator can take, like registering a copyright agent and getting a lawyer to review the pages. An AI partner can do the homework, but it can't sign the paperwork. 🖊️

And because every good site deserves it: a favicon 🏷️ and a light/dark theme switch 🌗 that remembers your choice and loads in the right theme from the very first moment, without a flash of the wrong one.

The same site after one click on the sun/moon switch. 🌙

🧑‍✈️ What only the human could do

This is the section for the hiring managers 👋. Agent Claude is fast, thorough and tireless. But a partnership needs someone to make the calls:

• 🚫🖼️ No fake data. When the first photo service failed, the quick fallback was computer-generated placeholder pictures. I said no: real, freely licensed, credited photos only. That rule now lives in CLAUDE.md, and a test fails if any photo isn't credited.
• 🎯 Quality over quantity. When some downloaded photos didn't match their ads (RIP, dresser and bike ads 🪦), I stopped the downloads and had those ads removed.
• 🔍 Independent review. Asking for reviewers without our shared history was the single best decision of the project.
• 🧪 Real-world testing. "Three users at the same time" was my idea, and it found a bug that 100+ passing tests had missed.
• 🇺🇸 Product calls. Miles, not kilometres. Nearest results first. Messaging between buyers and sellers. A theme switch, not a forced dark mode.
• ⚖️ Knowing the limits. The compliance checklist ends with "have a lawyer review this", because some decisions shouldn't be delegated to any partner, human or AI.

🧰 Our toolbox

• 🛠️ A Makefile: make setup, make run, make test, make seed-demo. Clone and run in a few commands.
• 🌱 A demo data command that builds the Bay Area ads offline from bundled, credited photos.
• 📸 Automatic screenshots for the README, taken by a headless browser.
• 📓 Session journals: every session is exported to readable Markdown when it ends, which is how I could quote my own prompts in this post. 😅 ### 📊 What it took

Every partnership has a budget, so here's ours. These numbers come from the Claude Code session logs and git history, from the first prompt on Oct 28 to Nov 11, 2026. They cover building the site and drafting this post.

Remember from Chapter 1 that Agent Claude can't see its own token count? It still can't. These numbers were tallied afterwards from the logs. 🧾

💡 What I learned about working with an AI partner

1. 🎯 Describe outcomes, then review results. Short prompts work. Skipping the review doesn't.
2. 🌐 You're the one with the real browser. Your Chrome, with its extensions and its stubborn cache, is where the sneakiest bugs live.
3. 📝 Write your rules down. CLAUDE.md turns one-off corrections into permanent team knowledge.
4. 🕵️ Get a second opinion with no history. Fresh reviewers found what we'd both stopped seeing.
5. 👥 Test like real people. Simultaneous users found a bug that 100+ unit tests couldn't.
6. 🧪 Turn every bug into a test. Many of our 115 tests exist only to stop an old bug from coming back.
7. 🙅 Refuse shortcuts out loud. One line, "can you put real photos and not the placeholder images, and remember this choice for future tasks", raised the quality of the whole project.
8. 💾 Small, frequent commits make AI work safe. Every change is easy to inspect and easy to undo.

🚀 Try it

The code is public: github.com/smakwana2/classifieds

git clone https://github.com/smakwana2/classifieds.git
cd classifieds
make setup        # virtualenv, dependencies, database, categories
make seed-demo    # demo Bay Area ads with real photos
make run          # http://127.0.0.1:8000

To my coding partner, Agent Claude. And to you, for reading this far. 🥂

Next up for the team: deploying the site for real, and adding a "Report this ad" button. I'll write about both, bugs included 🐛. If you're working with an AI coding partner too, I'd love to compare notes. Drop a comment or connect with me on LinkedIn. 👋