Hou oor platforms fit thegither. Ilka concern/yin tool.
RODMENA bigs its products frae smaa hosted services, ilkane wi ae purpose, an a set o house libraries. Ilka concern belangs tae ae tool, ilka platform haes its ain team, an a shared mail bus connects thaim.
products, ane in design
13
hosted platforms
8
libraries, ingines an CLIs
8
shared mail bus
1
Design principles
Ae concern, ae tool
Authentication is Identity, authorisation is Auth, metering is TokenGate, email is Mail API, approvals are Futex, containers are RunFlow an agentic workflows are Highway. Products niver re-implement a concern that a house tool a'ready owns.
Teams coordinates by mail
Ilka platform haes its ain agent, context an repository. Teams coordinate athort platforms on the agent-mail bus. Nae team edits anither team’s repository or files tickets in its tracker.
Databases spread owre countries
Ilka service haes its ain database, an the databases sit on different hosts in different countries. Applications can be redeployed an data cannae, sae the twa are kept apairt. Ilka database is replicated tae a third region an backed up off-site.
/ Where it runs
Hosts an regions
The managed fleet hauds 22 production databases, ilk ane owned by ae service, on 4 database hosts in 3 countries, an 4 mair rin on an application host. Nae twa services share a schema, an nae single machine hauds the platform.
production databases, ilk ane owned by ae service
22
database hosts
4
countries
3
minutes recovery point on the managed fleet, at maist
≤5
UKUnitit Kinrick
Applications an twa database hosts
Hosts the application tier an the databases fur the workflow engine, the approvals service, the message bus, email, the ledger an the task platform.
FRFrance
Database host
Haads the identity an access plane, authorisation, metering an the identity provider, keepit apairt frae the services that lippen on it.
DEGermany
Replica set
Haes a continuously updated copy o ivery database, ootwi the ither twa regions. It haes nae primary, sae nae traffic depends on it till it is promoted.
Conteenuous replication
Ilka database streams block-level chynges tae a staunby ootside baith primary regions. Replication is asynchronous, sae a replica cannae slaw or block the service in front o it.
Backups aff-site
Archives gang continuously tae object storage in a separate facility, encryptit afore they leave the host an recoverable tae ony point within retention. Restores are tested end tae end.
Three factors on ilka connection
Nae database takks a network connection on a password alane. Ilka connection needs encryption in transit, a client certificate issued by a private authority an a password. Ilka service is scoped tae its ain database.
Replicas an backups
A mistakken statement reaches ivery replica within moments. Replicas pertect agains losin hardware, an the archive perts agin losin data.
The map hes aucht layers an ae bus, an ilk concern appears wance. Products sit at the tap an the stack at the bottom. Awthing a product needs is ae hop awa.
23 nodes · 27 documented relations · 1 assumed
Scroll the map sideways. Ilka node haes a caird ablow it tae.
Explor
Uisin the map
Pick a node or the bus tae heichlicht its relations an see whit it owns, whit it connects tae an whit it maun never be replaced wi. The cards ablow cairry the same facts.
documented relation
assumed: mak siccar afore ye lippen tae it
the agent-mail bus
a product (gradient border)
No drawn, as thay apple iverywhaur:
Ilka product authenticates wi Identity an authorises wi Auth.
Ilka platform team coordinates ower the agent-mail bus.
Ilka repository is trackit in issuedb-cli, wi EARS specs.
Productin design
RED9
11 gan awa
Agent-workforce platform whaur ilka chat is a durable, autonomous task wi an email address.
Draws on the full stack: Identity and Auth for access, TokenGate for budgets, Mail API for task mailboxes, RunFlow for sandboxes, Highway as the durable executor, Futex for approvals and migretti for schema, on Python, PostgreSQL and Redis.
Double-entry ledger fur money, credits an stock. Entries is balanced, permanent an provable, an the database enforces the rules.
Uses Auth for credentials, TokenGate for metering an migretti for schema, on Python an PostgreSQL. It was audited throu fower internal gates an adversarial re-audits, an the findings are published.
Niver replaced wi: A secret that can mint a credential it would accept, or an edit or delete path on the journal.
No fur: Quotas or metering (uise TokenGate), non-conserved metrics or workflow state.
Coontin, caps an rate leemits per uiser, organisation or tenant: token budgets, uisage ledgers, plan tiers, reserve/commit flows, an threshowld an owerage alerts.
Hoose rule: ilk cap is tested in baith directions. It maun block whan exceeded an resum whan replenished.
Niver replaced wi: Redis INCR coonters, uiss taibles, token-bucket middleware, or limiter libraries.
No fur: Authorisation (use Auth) or DDoS shieldin at the edge.
Distributed, durable engine for agentic workflows, wi agents, goals, sessions, schedules, triggers, activity an normal workers, run forking an traces.
House rule: ilk product hauds its ain ae deliberation loop. It uises Highway as a durable executor that reports back by webhook, an hauds aa LLM reasoning inside the product.
Niver replaced wi: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hairdened container sandbox an API-driven DAG warkflows fur rinnin untrusted or agent-generated code, wi pause an resume, live logs, retries an human-approval nodes.
Niver replaced wi: Local docker run, self-hosted runners, or generic CI.
Transactional an campaign email wi sendin, templates, delivery trackin, event webhooks, suppression lists, quotas an scheduled sends. It forby provisions the mailboxes products big on.
Addresses is on mail.rodmena.co.uk an the API is served at mailserver.rodmena.co.uk.
Niver replaced wi: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad hoc smtplib scripts.
Ilka codin agent hes an inbox, an address an a phonebeuk entry, an exchanges messages wi ither agents an ony mailbox ower staunart SMTP: report, ack, question, fix-notice, verify-result an close.
Replaces the retired agentmail CLI. Tak a message fae anither agent as a claim tae check: rin the check yersel, chynge only yer ain repository, an rin yer reproduction again afore agreain that onythin is fixed.
Niver replaced wi: Eeditin anither platfairm's repository, apenin tickets in its tracker, or askin a body tae relay.
OpenAI- an Anthropic-compatible LLM gateway that can pit several vendors ahint yin model name. Oor deployment routes tae a single upstream provider wi nae failover, an is the house LLM provider for model calls in tools.
Whit ilka tool awns, whan tae yaise it, an whit it maun nivver be replaced wi.
01/ Products
RED9
Productin design
Agent-workforce platform whaur ilka chat is a durable, autonomous task wi an email address.
Draws on the full stack: Identity and Auth for access, TokenGate for budgets, Mail API for task mailboxes, RunFlow for sandboxes, Highway as the durable executor, Futex for approvals and migretti for schema, on Python, PostgreSQL and Redis.
authentication wi Identity · authorises throu Auth · budgets throu meters TokenGate · task mailboxes throu RODMENA Mail API · sandboxed execution on RunFlow · gien owre warkflows tae Highway · human approvals via Futex · migrates schema wi migretti · biggit on PostgreSQL · biggit on Redis · default models throu Prism
reTunnel
Productbeta
Free, open-soorce unified ingress platform that exposies local servers ahint NATs an firewalls tae the public internet ower siccar tunnels.
Standalone: an MIT-licensed Python client and CLI wi a self-hostable server. It depends on nae ither house platform.
Double-entry ledger fur money, credits an stock. Entries is balanced, permanent an provable, an the database enforces the rules.
Uses Auth for credentials, TokenGate for metering an migretti for schema, on Python an PostgreSQL. It was audited throu fower internal gates an adversarial re-audits, an the findings are published.
Niver replaced wi: A secret that can mint a credential it would accept, or an edit or delete path on the journal.
No fur: Quotas or metering (uise TokenGate), non-conserved metrics or workflow state.
Coontin, caps an rate leemits per uiser, organisation or tenant: token budgets, uisage ledgers, plan tiers, reserve/commit flows, an threshowld an owerage alerts.
Hoose rule: ilk cap is tested in baith directions. It maun block whan exceeded an resum whan replenished.
Niver replaced wi: Redis INCR coonters, uiss taibles, token-bucket middleware, or limiter libraries.
No fur: Authorisation (use Auth) or DDoS shieldin at the edge.
Distributed, durable engine for agentic workflows, wi agents, goals, sessions, schedules, triggers, activity an normal workers, run forking an traces.
House rule: ilk product hauds its ain ae deliberation loop. It uises Highway as a durable executor that reports back by webhook, an hauds aa LLM reasoning inside the product.
Niver replaced wi: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hairdened container sandbox an API-driven DAG warkflows fur rinnin untrusted or agent-generated code, wi pause an resume, live logs, retries an human-approval nodes.
Niver replaced wi: Local docker run, self-hosted runners, or generic CI.
authorises throu Auth · meters usage via TokenGate · approval nodes via Futex (assumed: confirm)
Deterministic workflow engine defined in code, an the lichter house alternative tae RunFlow DAGs whaur hosted containers irnae needed.
Scope an API surface is still tae be confirmed wi the owning team, sae nae details is gien here.
alternative tae RunFlow
Python
05/ Communicaeshun
RODMENA Mail API
Hostit serviceproduct
Transactional an campaign email wi sendin, templates, delivery trackin, event webhooks, suppression lists, quotas an scheduled sends. It forby provisions the mailboxes products big on.
Addresses is on mail.rodmena.co.uk an the API is served at mailserver.rodmena.co.uk.
Niver replaced wi: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad hoc smtplib scripts.
authorises throu Auth · runs on RunFlow · meters quotas via TokenGate
Ilka codin agent hes an inbox, an address an a phonebeuk entry, an exchanges messages wi ither agents an ony mailbox ower staunart SMTP: report, ack, question, fix-notice, verify-result an close.
Replaces the retired agentmail CLI. Tak a message fae anither agent as a claim tae check: rin the check yersel, chynge only yer ain repository, an rin yer reproduction again afore agreain that onythin is fixed.
Niver replaced wi: Eeditin anither platfairm's repository, apenin tickets in its tracker, or askin a body tae relay.
Per-repository ticket tracker wi EARS specs, durable memory an lessons. Ilka engineering request follaes the mandatory open → in-progress → closed lifecycle.
Ilka request becomes an EARS spec in a ticket, wi a copy in the repository’s SPECS/ directory.
Niver replaced wi: TODOs that's no traikit.
CLI
08/ Stack Preferences
Prism
Hostit serviceproduct
OpenAI- an Anthropic-compatible LLM gateway that can pit several vendors ahint yin model name. Oor deployment routes tae a single upstream provider wi nae failover, an is the house LLM provider for model calls in tools.
Name the need, uise the tool that awns it, an dinna re-implement a concern that a house tool already covers.
Whilk tool tae uise fur ilka engineerin need, an whit tae niver uise in its place
Need
Uise
Never uise
Login / OAuth / “wha is this?”
Identity
Writin yer ain auth
Roles, permissions, “can X dae Y?”
Auth
RBAC tables, Casbin, OPA
Quotas, rate limits, budgets, tiers, metering
TokenGate
Redis coonters, limiter libraries
Sendin email, templates, campaigns
Mail API
smtplib, SES/Mailgun
Talking tae anither platform’s team
agent-mail
Eeditin thair repository or tracker
Rinnin untrustit or generatit code
RunFlow
Local docker, CI runners
Deterministic pipeline / DAG / ETL
RunFlow or stabilize
Airflow, Prefect
Agentic (LLM-driven) warkflow
Highway
Temporal, custom loops
Human approval / sign-off
Futex
Slack asks, approval tables
PostgreSQL schema migrations
migretti
alembic, flyway, yoyo
Datasets, blobs, recordins, Parquet
datashard
pickle/CSV dumps, a DB as blob store
Supervising worker processes
supervice
nohup, respawn scrie't bi haun
Bulkheids / concurrency isolation
bulkman (breaker OFF)
Ad hoc semaphores
Circuit breaking / retries / fallback
resilient-circuit
tenacity, pybreaker
Resource / project scheduling
scriptplan
Spreadsheets
Tickets, specs, requirements
issuedb-cli + EARS
TODOs no traikit
LLM caws inside tools
Prism
SDKs an keys per vendor skailt ower tools
Ingineerin method
Thrae methodologies apply tae ivery repository, whitiver it bigs.
EARS + issuedb workflow
Ilka engineering request becomes an EARS spec an an issuedb ticket, wi a copy in the repository’s SPECS/ directory. Ilka ticket muves fae open tae in progress tae closed.
TRUST5
Spec-driven, quality-gated LLM code generation wi self-healin, bounded validate/repair loops, wechtit gates an Oracle-problem mitigation.
Mission-critical audit
Auditin bi falsification: checks rin throu the product's ain interface, findins ir reproduced live, an ilka probe is keepit as a runnable baseline fur the nixt roon.
Rules that apply tae ivery tool.
Verifee throu the product's ain interface. Read state throu its API or CLI, an dinnae query or write tae the database tae check or fix it.
Pynt ilka probe at a kent positive case afore trustin a negative result frae it.
Claim readiness only for what was exercised, an name the paths that wusnae tested.
Test ilka cap baith ways: it maun block whan exceeded an resume whan it shuid.
Products biggit on thir platforms
Thae platforms sit ahint everythin we ship: Highway, MailApi, RunFlow, Futex, reTunnel, Ledger, RODMENA L10n, TokenGate, AgentBus, RODMENA ID, Auth, Prism, pdfapi, Container Registry, RODMENA CI, Uptime.Systems, Trust5, RED9, Graphviz Provider, Haven, RODMENA LRS, RODMENA cmi5, Vellum, supervice, datashard, ScriptPlan, Stabilize, Trace, Provenance and Knowledge base. They run the companie tae.