What it is, and why it is that way
Every subsystem in the kit gets a page: what it does today, the invariant it protects, and the reasoning that produced it. Read them in order for the tour, or jump to the one you are about to change. The full reference lives in docs/CONCEPTS.md in the repo.
Foundation
The shape of the code — how it is organised, validated, shipped and kept honest.
Agent-first by design
Built to be worked on by a coding agent: the rules, the per-directory guides and the test gate are the interface it reads and the check it cannot skip.
The API shell
One Worker runs one Hono app with one validated config, and every middleware sits where it does for a stated reason.
Database
Postgres through one driver and one client per request, with row-level security already wired and waiting to be switched on.
The UI shell
A React shell with design tokens instead of colours, one guard for pages and navigation alike, and a data layer that never shadows the server.
Deployment
Staging and production as two wrangler files a test keeps identical, and a release you ship by pushing a tag.
Shared contracts
One zod package the API validates with and the UI and CLI parse with — no build step, so the three can never drift.
Plugins
A capability is a git repository copied into your app, not an npm package — it lands as ordinary source, reaches the app through five lines, and deleting the folder uninstalls it.
Platform
What every organisation gets — sign-in, members, background work, mail, files and a command line.
Tenancy and access
Every row belongs to an organisation, and one schema serves a single tenant or a thousand — changing modes needs no migration.
Authentication
Sign in with nothing configured: magic links, Google or Microsoft, your own OIDC identity provider, and API keys, all over sessions stored as database rows.
Background work and realtime
Long work never runs inside a request — it goes to a queue or a durable workflow, and the WebSocket only tells the browser to look again.
Email and file storage
Mail that logs instead of failing when no provider is set, and file storage on R2 behind a small interface with a table in front of it.
The CLI
A browser sign-in that ends with a tenant API key on your machine, and commands that parse the server’s own schemas.
Feature flags
Ship a surface to production dark, then turn it on for one customer at a time — a percentage or an override, with no redeploy.
Product
What you build the product on — the AI layer, analytics, and connections to the tools your customers already use.
Analytics and dashboards
Dashboards over a semantic layer that scopes every query to the tenant, fact tables rebuilt hourly, templates kept as code — shipped as a plugin, installed by default.
The AI layer
Chat, agents and search behind one resolver that picks the model, traced and evaluated — and it works on a fresh clone with no key at all.
Connectors
An organisation’s admin connects its Microsoft 365 once, and its directory and calendars sync in on a schedule — a connection for the organisation, not a login for one person.