An engineering and AI governance review. What we run on, what the review found, and what we changed.

By Kelechi Orji (Kelly Hansome), Founder, CelebIsland

I am going to start publishing our engineering review.

Not a press release. The actual readout: what each workstream looked at, what it found, what did not go well, and what changed because of it. Nigerian technology companies do not usually publish this. That is precisely why we are going to.

Some months it will be a good look. This month it is not, and that is why it goes first.

What we are actually built on

Before the findings, the stack, because people cannot judge a claim about governance without knowing what is being governed.

CelebIsland runs as a PHP and MySQL application on a dedicated VPS, with our own theme layer on top of a social networking core. Media does not sit on the application server: images, audio and video are held in object storage and served through a CDN, which is what keeps a page load in Enugu from depending on a single disk in a single rack.

The database runs a three-byte UTF-8 character set. That is not trivia. It means a four-byte character, most emoji included, will break an insert rather than store quietly. It is a real constraint that shapes what we can accept from members, and it is the kind of thing you only find out by reading your own schema.

Content creation is gated. Article submission passes through a CAPTCHA challenge and then a human approval queue before anything becomes publicly readable. Media uploads are handled by a separate request pipeline that returns a storage URL rather than writing into the web root.

Around that sit the surfaces members actually touch: live radio, reels, the marketplace, creator payouts, premium content, campus, and the ads manager.

Method: how the review was run

One instruction: stop building, and read what our own website tells the outside world about itself. Not what we think it says. What it says when fetched cold, with no session attached, exactly as a stranger or a crawler receives it.

That distinction did all the work this month. Almost every finding below was invisible from an administrator's screen and obvious from an anonymous one.

Three rules governed the review, and they are now permanent:

Fetch anonymously or it does not count. An admin session shows you a different site than the public gets. We had been reviewing the wrong site.

Every fix ships with an acceptance test somebody else runs. A command, an expected result, and the actual output pasted back. Not a report saying it is done.

Check the output, never the input. More on why below, because that one cost us a week.

How we work

Since people ask, and since the answer explains why the findings below were found at all.

We run in weekly cycles. Each cycle opens with one question rather than a list of tasks, because a list gets worked through and a question gets answered. This cycle's question was whether our own site says what we think it says.

Work leaves a cycle as a numbered brief, not a conversation. Each brief states what was found, with the evidence attached, then a paste-ready instruction, then a table of acceptance tests. Nothing is marked done on somebody's word. It is marked done when the test is run and the output is pasted back.

Three briefs came out of this cycle. One on spam control and the sitemap. One on article tags and structured data. One on the homepage and server backups. They are numbered, they are dated, and they carry twelve, eleven and ten acceptance tests respectively.

The backlog is ordered by ratio, not by noise: what does this cost to fix against what does it change. That is why a one-line canonical tag outranked a feature this cycle. It cost ten minutes and it was suppressing our entire front door.

Definition of done, written out, because ours used to be implicit and that is how the tag failure happened: a change is done when an anonymous request confirms it, when somebody other than the author has run the test, and when the result is written down where it can be read later.

And every cycle ends here, in public. Publishing the review is not marketing. It is the forcing function. It is much harder to leave a finding unfixed when you have already told people it exists.

Finding one: our sitemap pointed at a laptop

sitemap.xml is the file that tells search engines which pages exist. Ours held 188 entries.

Every one of them pointed at http://localhost/wowonder/.

localhost means "this machine". It is the address of whatever computer generated the file during installation, before anything was live. That file has been sitting on our domain telling every search engine on earth to go and look at a machine that is not on the internet.

Which means that for the entire life of this platform, not one real CelebIsland URL has ever been submitted to a search engine. Not a profile, not an article, not the marketplace.

I have spent months asking why our work was not surfacing. The answer was in a file nobody had opened since setup.

Finding two: the homepage was suppressing itself

The same review, once it knew to distrust the defaults, found three more in the page head.

The title element was a single lowercase word. The strongest on-page ranking signal there is, and it said nothing about what we are or where we are.

There was no H1 heading on the page at all.

And the canonical link pointed at /welcome. A canonical tag tells a search engine which URL is the authoritative version of a page. Ours was telling them our homepage is a duplicate and to index something else instead. We were suppressing our own front door.

The meta keywords were still the demonstration values that shipped with the software.

Finding three: the queue nobody was reading

The content review counted the article table. 1,318 articles: 45 approved, 1,273 pending. Essentially all of the pending were commercial spam from throwaway accounts, arriving at roughly six a day, in several languages.

Credit where it is due, and this is the one control that performed. The approval gate held. The review verified it properly, requesting those URLs with no session attached, and every one redirects a stranger away. None of that content was ever publicly readable. Members never saw it.

But nothing was preventing the arrival, and nobody was reading the queue. A control that works with nobody watching its output is how organisations get surprised.

AI governance: the part I care most about

Here is the section I would rather write than any other, because it is where most platforms in this market are quietly doing nothing.

What AI already touches on this platform

We do not use the word AI as decoration, so let me be precise about where it actually runs.

There is assisted article generation, which can draft an article body and produce a cover image from a prompt. There is a platform assistant available to members as a chat surface. And there is a flag recorded on every article at creation time indicating whether AI was involved.

That flag is real. It is captured. It is stored.

The finding

It is never shown to the reader.

We fetched published articles anonymously and searched the delivered markup. There is no disclosure of AI involvement anywhere on a published page. The flag goes into the database and stops there.

That is a governance gap, and I would rather name it here than have somebody else name it later. A reader has a legitimate interest in knowing whether what they are reading was drafted by a machine. Storing that fact and not surfacing it is the worst of both positions: we have the evidence and we are not acting on it.

Why this matters more in Nigeria than people realise

Nigeria's Data Protection Act came into force in 2023, and the General Application and Implementation Directive took effect in September 2025. Between them they establish obligations that most operators here have not yet mapped onto their AI features at all.

Two provisions bear directly on any platform running AI.

Transparency. People are entitled to know how their data is processed and by what. An automated system operating invisibly inside a service is exactly what that provision exists to reach.

The right not to be subject to a decision based solely on automated processing where that decision produces legal effects or similarly significant ones. On a platform like ours, that is not abstract. Account suspension is significant. Payout eligibility is significant. Monetisation approval is significant. If a model made any of those calls alone, we would be on the wrong side of the Act.

There is also a filing obligation with a real date on it, the 31 March compliance return, which is not a thing you begin preparing in March.

What we decided this month

Six commitments. Some describe what is already structurally true, some are work now scheduled. I am marking which is which, because a governance claim that blurs the two is worthless.

Already true. Every AI-assisted article passes through the same human approval queue as everything else. Nothing generated publishes without a person releasing it. That was an accident of architecture rather than a decision, but it is the correct architecture and it stays.

Already true. No account action on this platform, no suspension, no payout decision, no monetisation ruling, is taken by an automated system. A person decides, and that is now written down rather than merely habitual.

Scheduled. Surface the AI flag publicly. If an article was AI-assisted, the reader sees so on the page, plainly, not in a footer nobody reads.

Scheduled. An AI use register: every AI surface on the platform, what data it touches, what it produces, who can invoke it, and which human owns it. This is a living document, not a launch artefact, and it is the backbone of the compliance return.

Scheduled. Logging on every AI invocation: who called it, when, on what. Without a log there is no audit, and without an audit a governance policy is a press release.

Standing rule. Member content is not used to train external models, and prompts carry the minimum data required to do the job. Data minimisation is not only a legal principle, it is the cheapest way to reduce what a breach could expose.

How I intend to monitor it

Governance that is not measured is decoration. So the register gets reviewed monthly, in this document, against four numbers: how many AI surfaces exist, how many are disclosed to users, how many carry logging, and how many account decisions were taken without a human. That last number should always be zero, and if it is ever not, it gets published.

Where we got it wrong, including me

Two failures worth writing down.

We diagnosed before we looked. When I reported that our published articles were showing no tags, the answer came back that tags were saving correctly, because somebody checked the form field. True, and not the question. It took three separate raisings before anyone opened the published page as a reader. When they did, the tags were there all along, rendering as small grey text with no label, directly beneath body copy, invisible in practice. The links inside them also carried unencoded spaces and pointed at a route that cannot serve them.

Checking the input is not checking the output. A field that saves correctly and displays invisibly is a broken feature, and only a reader can tell you that.

We assumed the installation was finished. The sitemap, the demo keywords and the canonical were all setup defaults nobody revisited after go-live. Re-reading installation artefacts is now a standing item.

The open door: the Analyst Corps

Three books are finished, written here, against the law that applies here.

Which brings me to the thing I most want out of this entry.

We are opening the Analyst Corps. Security analysts and students from anywhere in Africa spend six weeks inside what we are building, before it opens to paying students. They run the exercises, they break them, they tell us what is wrong. If they work in compliance in Ghana, Kenya or South Africa, they tell us exactly where our Nigerian chapters do not fit their jurisdiction.

In exchange: the full programme free, a credential in their name, a written reference, and their name in the acknowledgements of the book they helped correct.

The terms are fixed and public before anybody applies. Six weeks. Four to six hours a week, stated honestly. Nobody writes our chapters or runs our support desk. And every cohort we publish the count: how many came from outside Nigeria, and from where. If that number is embarrassing, it goes out anyway.

This is not a Nigerian programme with guests. Nigeria is first. Nigeria is not the destination.

What gets measured next month

Search position for our own name. Real URLs submitted and indexed. Spam reaching the queue per day. AI surfaces disclosed, AI surfaces logged, and account decisions taken without a human. Corps applications by country.

I will publish those numbers here, including the ones I do not enjoy.

The lesson of the first entry, if there is one: you do not get to skip the boring layer. You can have the best material on the continent and still be invisible, because a file nobody opened since installation is pointing at a machine that is not even on.

Founder Diary is a monthly engineering and governance review from Kelechi Orji, known as Kelly Hansome, founder of CelebIsland. Comments are open under our community standards: argue with the point, not the person.