Hou oor platforms fit thegither. Ilka concern/yin tool.
RODMENA biggs its products frae a set o hoose libraries an frae wee hosted services wi the yin purpose the piece, an gies a concern tae the yin tool alane. The platforms hae their ain teams an tauk ower a shared mail bus.
products
13
hosted platforms
8
libraries, ingines an CLIs
8
shared mail bus
1
Design principles
Ae concern, ae tool
Authentication is Identity, authorisation is Auth, metering is TokenGate, email is Mail API, approvals are Futex, containers are RunFlow an agentic workflows are Highway. Products niver re-implement a concern that a house tool a'ready owns.
Teams coordinates by mail
Ilka platform haes its ain agent, context an repository. Teams coordinate athort platforms on the agent-mail bus. Nae team edits anither team’s repository or files tickets in its tracker.
Databases spread owre countries
Services hae their ain databases, on different hosts in different kintras. An application can be redeployed but its data cannae, an we keep the twa apairt. A' databases are replicated tae a thrid region an backed up aff-site.
/ Where it runs
Hosts an regions
The managed fleet hauds 22 production databases, each owned by yin service, on 4 database hosts in 3 countries, an 4 mair run on an application host. Nae twa services share a schema, an the platform disnae depend on onie single machine.
production databases, ilk ane owned by ae service
22
database hosts
4
countries
3
minutes recovery point on the managed fleet, at maist
≤5
UKUnitit Kinrick
Applications an twa database hosts
Hosts the application tier an the databases fur the workflow engine, the approvals service, the message bus, email, the ledger an the task platform.
FRFrance
Database host
Haads the identity an access plane, authorisation, metering an the identity provider, keepit apairt frae the services that lippen on it.
DEGermany
Replica set
Haes a continuously updated copy o ivery database, ootwi the ither twa regions. It haes nae primary, sae nae traffic depends on it till it is promoted.
Conteenuous replication
Aal databases stream block-level chynges tae a standby ootside baith primary regions. Cause replication is asynchronous, a replica cannae slow or block the service in front o it.
Backups aff-site
Archives gang continuously tae object storage in a separate facility, encryptit afore they leave the host an recoverable tae ony point within retention. Restores are tested end tae end.
Three factors on ilka connection
Nae database accepts a network connection on a password alane. A connection needs encryption in transit, a client certificate issued by a private authority an a password, an services are scoped tae their ain databases.
Replicas an backups
A wrang statement raiches aal the replicas within moments. Replicas protect agin tynin hardware, an the archive protects agin tynin data.
On the map’s eicht layers an yin bus, a concern appears bit the yince. Products sit at the tap, the stack sits at the boddom, an oniehing a product needs is yin hop awa.
23 nodes · 27 documented relations · 1 assumed
Scroll the map sideways. Ilka node haes a caird ablow it tae.
Explor
Uisin the map
Wale a node or the bus tae heighlicht its relations an see whit it awns, whit it connects tae an whit it maun niver be replaced wi. The cards ablow leet thae facts forbye.
documented relation
assumed: mak siccar afore ye lippen tae it
the agent-mail bus
a product (gradient border)
No drawn, as thay apple iverywhaur:
Ilka product authenticates wi Identity an authorises wi Auth.
Ilka platform team coordinates ower the agent-mail bus.
Ilka repository is trackit in issuedb-cli, wi EARS specs.
Producton request
RED9
11 gan awa
Agent-workforce platform whaur ilka chat is a durable, autonomous task wi an email address.
Draws on the full stack. Identity an Auth provide access, TokenGate budgets, Mail API task mailboxes an RunFlow sandboxes. Highway is the durable executor, Futex handles approvals an migretti the schema, on Python, PostgreSQL an Redis.
Double-entry ledger fer siller, credits an stock. Its entries are balanced, permanent an provable unner rules the database enforces.
Built on Python an PostgreSQL, usin Auth fer credentials, TokenGate fer metering an migretti fer schema. It gaed through fower internal audit gates an adversarial re-audits, whas findins are published.
Niver replaced wi: A secret that can mint a credential it would accept, or an edit or delete path on the journal.
No fur: Quotas or metering (uise TokenGate), non-conserved metrics or workflow state.
Coontin, caps an rate limits per user, organisation or tenant. It covers token budgets, usage ledgers, plan tiers, reserve/commit flows, an threshold an overage alerts.
Bi hoose rule, caps are testit in baith airts. A cap maun block whan exceeded an stairt agane whan replenished.
Niver replaced wi: Redis INCR coonters, uiss taibles, token-bucket middleware, or limiter libraries.
No fur: Authorisation (use Auth) or DDoS shieldin at the edge.
Distributed, durable engine fer agentic workflows. It provides agents, goals, sessions, schedules, triggers, activity an normal workers, run forkin an traces.
Bi hoose rule, a product keeps ane deliberation loop o its ain. It uses Highway as a durable executor that reports back bi webhook an keeps aa LLM reasonin inside the product.
Niver replaced wi: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hardened container sandbox an API-driven DAG workflows fer rinnin untrusted or agent-generated code. Runs can be paused an resumed, an hae live logs, retries an human-approval nodes.
Niver replaced wi: Local docker run, self-hosted runners, or generic CI.
Transactional an campaign email wi sendin, templates, delivery trackin, event webhooks, suppression lists, quotas an scheduled sends. It forby provisions the mailboxes products big on.
Addresses is on mail.rodmena.co.uk an the API is served at mailserver.rodmena.co.uk.
Niver replaced wi: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad hoc smtplib scripts.
A coding agent gets an inbox, an address an a phonebook entry, an exchynges messages wi ithir agents an onie mailbox ower standard SMTP. The message types is report, ack, question, fix-notice, verify-result an close.
Taks the place o the retired agentmail CLI. Coont a message frae anither agent as a claim an rin the check yersel. Chynge anerly yer ain repository, an re-rin yer reproduction afore greein that ocht is fixed.
Niver replaced wi: Eeditin anither platfairm's repository, apenin tickets in its tracker, or askin a body tae relay.
Zero-dependency async process supervisor fer workers, daemons an queue consumers. It rins health checks, manages groups an stairts a process agane whan it crashes.
Plain systemd or Kubernetes are acceptable whaur they fit better.
Python
Python leebrar
bulkman
1 gan awa
Bulkheids an concurrency isolation that leemit the blast radius o a failin dependency.
The hoose rule is tae aye set circuit_breaker_enabled=False. bulkman fettles isolation, an circuit breaking belangs tae resilient-circuit.
TaskJuggler-compatible (.tjp) engine fer resource plannin an schedulin. It haundles fowk an machines ower time, dependencies an calendars, an produces Gantt output.
Niver replaced wi: Spreadsheets or ad hoc date maths.
Per-repository ticket tracker wi EARS specs, durable memory an lessons. Aa engineering requests follae the mandatory open → in-progress → closed lifecycle.
Engineering requests aa become an EARS spec in a ticket an in a copy unner the repository’s SPECS/ directory.
OpenAI- an Anthropic-compatible LLM gateway that can pit several vendors ahint yin model name. Oor deployment routes tae a single upstream provider wi nae failover, an is the house LLM provider for model calls in tools.
Whit ilka tool awns, whan tae yaise it, an whit it maun nivver be replaced wi.
01/ Products
RED9
Producton request
Agent-workforce platform whaur ilka chat is a durable, autonomous task wi an email address.
Draws on the full stack. Identity an Auth provide access, TokenGate budgets, Mail API task mailboxes an RunFlow sandboxes. Highway is the durable executor, Futex handles approvals an migretti the schema, on Python, PostgreSQL an Redis.
authentication wi Identity · authorises throu Auth · budgets throu meters TokenGate · task mailboxes throu RODMENA Mail API · sandboxed execution on RunFlow · gien owre warkflows tae Highway · human approvals via Futex · migrates schema wi migretti · biggit on PostgreSQL · biggit on Redis · default models throu Prism
reTunnel
Product
Free, open-soorce unified ingress platform that exposies local servers ahint NATs an firewalls tae the public internet ower siccar tunnels.
A staun-alane Python client an CLI, MIT-licensed, that comes wi a self-hostable server an depends on nae ither hoose platform.
Double-entry ledger fer siller, credits an stock. Its entries are balanced, permanent an provable unner rules the database enforces.
Built on Python an PostgreSQL, usin Auth fer credentials, TokenGate fer metering an migretti fer schema. It gaed through fower internal audit gates an adversarial re-audits, whas findins are published.
Niver replaced wi: A secret that can mint a credential it would accept, or an edit or delete path on the journal.
No fur: Quotas or metering (uise TokenGate), non-conserved metrics or workflow state.
Coontin, caps an rate limits per user, organisation or tenant. It covers token budgets, usage ledgers, plan tiers, reserve/commit flows, an threshold an overage alerts.
Bi hoose rule, caps are testit in baith airts. A cap maun block whan exceeded an stairt agane whan replenished.
Niver replaced wi: Redis INCR coonters, uiss taibles, token-bucket middleware, or limiter libraries.
No fur: Authorisation (use Auth) or DDoS shieldin at the edge.
Distributed, durable engine fer agentic workflows. It provides agents, goals, sessions, schedules, triggers, activity an normal workers, run forkin an traces.
Bi hoose rule, a product keeps ane deliberation loop o its ain. It uses Highway as a durable executor that reports back bi webhook an keeps aa LLM reasonin inside the product.
Niver replaced wi: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hardened container sandbox an API-driven DAG workflows fer rinnin untrusted or agent-generated code. Runs can be paused an resumed, an hae live logs, retries an human-approval nodes.
Niver replaced wi: Local docker run, self-hosted runners, or generic CI.
authorises throu Auth · meters usage via TokenGate · approval nodes via Futex (assumed: confirm)
Deterministic workflow engine defined in code. It is the lichter hoose alternative tae RunFlow DAGs whan hosted containers are nae needed.
We gie nae details heer acause the scope an API surface are still tae be confirmed wi the awnin team.
alternative tae RunFlow
Python
05/ Communicaeshun
RODMENA Mail API
Hostit serviceproduct
Transactional an campaign email wi sendin, templates, delivery trackin, event webhooks, suppression lists, quotas an scheduled sends. It forby provisions the mailboxes products big on.
Addresses is on mail.rodmena.co.uk an the API is served at mailserver.rodmena.co.uk.
Niver replaced wi: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad hoc smtplib scripts.
authorises throu Auth · runs on RunFlow · meters quotas via TokenGate
A coding agent gets an inbox, an address an a phonebook entry, an exchynges messages wi ithir agents an onie mailbox ower standard SMTP. The message types is report, ack, question, fix-notice, verify-result an close.
Taks the place o the retired agentmail CLI. Coont a message frae anither agent as a claim an rin the check yersel. Chynge anerly yer ain repository, an re-rin yer reproduction afore greein that ocht is fixed.
Niver replaced wi: Eeditin anither platfairm's repository, apenin tickets in its tracker, or askin a body tae relay.
Zero-dependency async process supervisor fer workers, daemons an queue consumers. It rins health checks, manages groups an stairts a process agane whan it crashes.
Plain systemd or Kubernetes are acceptable whaur they fit better.
Python
bulkman
Python leebrar
Bulkheids an concurrency isolation that leemit the blast radius o a failin dependency.
The hoose rule is tae aye set circuit_breaker_enabled=False. bulkman fettles isolation, an circuit breaking belangs tae resilient-circuit.
complements resilient-circuit
Python
resilient-circuit
Python liberry
Circuit breaking, retries wi backoff, an failsafe or fallback handlin roon unreliable calls. Pair it wi bulkman fer isolation.
Niver replaced wi: tenacity, pybreaker, or hand-rolled retry loops.
Python
scriptplan
Engine + CLIproduct
TaskJuggler-compatible (.tjp) engine fer resource plannin an schedulin. It haundles fowk an machines ower time, dependencies an calendars, an produces Gantt output.
Niver replaced wi: Spreadsheets or ad hoc date maths.
Per-repository ticket tracker wi EARS specs, durable memory an lessons. Aa engineering requests follae the mandatory open → in-progress → closed lifecycle.
Engineering requests aa become an EARS spec in a ticket an in a copy unner the repository’s SPECS/ directory.
Niver replaced wi: TODOs that's no traikit.
CLI
08/ Stack Preferences
Prism
Hostit serviceproduct
OpenAI- an Anthropic-compatible LLM gateway that can pit several vendors ahint yin model name. Oor deployment routes tae a single upstream provider wi nae failover, an is the house LLM provider for model calls in tools.
Name the need, uise the tool that awns it, an dinna re-implement a concern that a house tool already covers.
Whilk tool tae uise fur ilka engineerin need, an whit tae niver uise in its place
Need
Uise
Never uise
Login / OAuth / “wha is this?”
Identity
Writin yer ain auth
Roles, permissions, “can X dae Y?”
Auth
RBAC tables, Casbin, OPA
Quotas, rate limits, budgets, tiers, metering
TokenGate
Redis coonters, limiter libraries
Sendin email, templates, campaigns
Mail API
smtplib, SES/Mailgun
Talking tae anither platform’s team
agent-mail
Eeditin thair repository or tracker
Rinnin untrustit or generatit code
RunFlow
Local docker, CI runners
Deterministic pipeline / DAG / ETL
RunFlow or stabilize
Airflow, Prefect
Agentic (LLM-driven) warkflow
Highway
Temporal, custom loops
Human approval / sign-off
Futex
Slack asks, approval tables
PostgreSQL schema migrations
migretti
alembic, flyway, yoyo
Datasets, blobs, recordins, Parquet
datashard
pickle/CSV dumps, a DB as blob store
Supervising worker processes
supervice
nohup, respawn scrie't bi haun
Bulkheids / concurrency isolation
bulkman (breaker OFF)
Ad hoc semaphores
Circuit breaking / retries / fallback
resilient-circuit
tenacity, pybreaker
Resource / project scheduling
scriptplan
Spreadsheets
Tickets, specs, requirements
issuedb-cli + EARS
TODOs no traikit
LLM caws inside tools
Prism
SDKs an keys per vendor skailt ower tools
Ingineerin method
Thrae methodologies apply tae ivery repository, whitiver it bigs.
EARS + issuedb workflow
Aal ingineerin requests turn intil an EARS spec an an issuedb ticket, an the spec is copied intil the repository’s SPECS/ directory. Tickets muve frae open tae in progress tae closed.
TRUST5
Spec-driven, quality-gated LLM code generation wi self-healin, bounded validate/repair loops, wechtit gates an Oracle-problem mitigation.
Mission-critical audit
Auditin bi falsification: checks rin throu the product's ain interface, findins ir reproduced live, an ilka probe is keepit as a runnable baseline fur the nixt roon.
Rules that apply tae ivery tool.
Verifee throu the product's ain interface. Read state throu its API or CLI, an dinnae query or write tae the database tae check or fix it.
Pynt ilka probe at a kent positive case afore trustin a negative result frae it.
Claim readiness only for what was exercised, an name the paths that wusnae tested.
Test ilka cap baith ways: it maun block whan exceeded an resume whan it shuid.
Products biggit on thir platforms
Thae platforms sit ahint everythin we ship: Highway, MailApi, RunFlow, Futex, reTunnel, Ledger, RODMENA L10n, TokenGate, AgentBus, RODMENA ID, Auth, Prism, pdfapi, Container Registry, RODMENA CI, Uptime.Systems, Trust5, RED9, Graphviz Provider, Steward, Tollgate, Haven, RODMENA LRS, RODMENA cmi5, Vellum, supervice, datashard, ScriptPlan, Stabilize, Trace, Provenance and Knowledge base. They run the companie tae.