Rathvan · architecture review
Generated from this repository every time the site is built, so every count below
is the current one and not the one that happened to be true when somebody typed it: kernel
1825, builder service 1291,
each read from the known-good file that testCounts ratchets — a task that cannot
report success without running.
The console and CLI are clients; the builder service hosts the kernel; every external system sits behind a port with a stub beside each live adapter.
| Layer | Holds | Retrofit cost |
|---|---|---|
| L0 foundations | identity · tenancy · RLS · audit · money-minor-units · flags | very high — must exist in migration 1 |
| L1 capabilities | auth · profile · notification · storage · ports/registry | high |
| L2 relationship | client/professional · payments seam · email · approvals · integrations | moderate |
| L3 verticals | the actual product (e.g. CRM funnel — PROPOSED until Gate 1) | low — scaffolded per product |
| Invariant | Enforcement |
|---|---|
| RLS enabled and forced on every user-data table | gate test scans every migration for the pair |
| Migrations additive only, contiguously numbered | checksummed; gate test fails on a gap |
| Feature flags default OFF and registered | registry map; unregistered = permanently inert |
| Money is an integer in the smallest unit | DDL + kernel types; no float path exists |
| PII never logged or sent to a model | PiiScan (masked findings, redact()) + FieldCipher (AES-GCM, column-bound) |
| Production branch unreachable by machines | SourceControlPort refuses main at construction |
| AI spend bounded | TokenBudget is a meter decorator — no call site can skip it |
| A test count below known-good fails the build | testCounts; a shrunken suite renders FAILED in evidence reports |
Deliberate seams (port exists, adapter is BYO): search, queue/messaging, payments gateways, observability backend. Deliberately refused: docs rendering, SDK generation, a Backstage-rivaling catalogue, A/B testing.
Recorded from Chrome on 2026-08-14, and showing the intake as it stood that day: one sentence starts it, 23 gated questions, sign-in with a personal revocable credential, and a workflow honest about what was simulated. This is the system above, operating.
Second cut, narrated (2 min), covering the pipeline and this release's capabilities:
Six slides for the review itself — present full-screen; each fills the viewport.