Hou oor platforms fit thegither. Ilka concern/ae tool.
RODMENA bigs its products frae smaa hosted services, ilk ane wi ae purpose, and a set o house libraries. Ilk concern belangs tae ae tool, ilk platform has its ain team, and a shared mail bus connects thaim.
products, ane in design
13
hostit platforms
8
libraries, ingines an CLIs
8
shared mail bus
1
Design principles
Ae concern, ae tuil
Authentication is Identity, authorisation is Auth, metering is TokenGate, email is Mail API, approvals are Futex, containers are RunFlow and agentic workflows are Highway. Products never re-implement a concern that a house tool already owns.
Teams coordinate by mail
Ilka platform haes its ain agent, context an repository. Teams coordinate across platforms on the agent-mail bus. Nae team edits anither team’s repository or files tickets in its tracker.
Databases spread owre countries
Ilka service haes its ain database, an the databases sit on different hosts in different countries. Applications can be redeployed an data canna, so the twa are keepit apairt. Ilka database is replicated tae a third region an backed up off-site.
/ Where it runs
Hosts and regions
The managed fleet hauds 22 production databases, ilk ane awned by ae service, on 4 database hosts in 3 kintras, and 4 mair rin on an application host. Nae twa services share a schema, and nae single machine hauds the platform.
production databases, ilk ane awned bi ae service
22
database hosts
4
countries
3
minutes recovery point on the managed fleet, at maist
≤5
UKUnitit Kinrick
Applications and twa database hosts
Hosts the application tier and the databases for the workflow engine, the approvals service, the message bus, email, the ledger and the task platform.
FRFrance
Database host
Hauds the identity and access plane, authorisation, metering and the identity provider, keepit apairt frae the services that depend on it.
DEGermany
Replica set
Haes a continuously updated copy o ivery database, ootside the ither twa regions. It haes nae primary, sae nae traffic depends on it till it is promoted.
Continuous replication
Ilka database streams block-level chynges tae a staundby ootside baith primary regions. Replication is asynchronous, sae a replica canna slow or block the service in front o it.
Off-site backups
Archives gang continuously tae object storage in a sindry facility, encryptit afore they leave the host and recoverable tae ony pynt within retention. Restores are testit end tae end.
Three factors on ilka connection
Nae database takes a network connection on a password alane. Ilka connection needs encryption in transit, a client certificate issued by a private authority and a password. Ilka service is scoped tae its ain database.
Replicas and backups
A mistakken statement reaches ilka replica within moments. Replicas protect against losing hardware, and the archive protects against losing data.
The map haes aicht layers and ae bus, and ilka concern appears ance. Products sit at the tap and the stack at the bottom. Awthing a product needs is ae hop awa.
23 nodes · 27 documentit relations · 1 assumed
Skroll the map sideweys. Ilka node haes a caird ablow it an aw.
Explor
Uisin the map
Pick a node or the bus tae heichlicht its relations and see whit it awns, whit it connects tae and whit it maun never be replaced wi. The cairds ablow cairry the same facts.
documentit relation
assumed: confirm afore lippening on it
the agent-mail bus
a product (gradient border)
No drawn, as they apply awhaur:
Ilka product authenticates wi Identity an authorises wi Auth.
Ilka platform team coordinates ower the agent-mail bus.
Ilka repository is trackit in issuedb-cli, wi EARS specs.
Productin design
RED9
11 ootgang
Agent-workforce platform whaur ilka chat is a durable, autonomous task wi an email address.
Draws on the full stack: Identity and Auth for access, TokenGate for budgets, Mail API for task mailboxes, RunFlow for sandboxes, Highway as the durable executor, Futex for approvals and migretti for schema, on Python, PostgreSQL and Redis.
Double-entry ledger for siller, credits and stock. Entries are balanced, permanent and provable, and the database enforces the rules.
Uses Auth for credentials, TokenGate for metering and migretti for schema, on Python and PostgreSQL. It was audited throu fower internal gates and adversarial re-audits, and the findings are published.
Never replaced wi: A secret that can mint a credential it would accept, or an edit or delete path on the journal.
No for: Quotas or metering (uise TokenGate), non-conserved metrics or workflow state.
Coonin, caps an rate leemits per uiser, organisation or tenant: token budgets, uisage ledgers, plan tiers, reserve/commit flows, an threshal an owerage alerts.
Hoose rule: ilka cap is testit in baith directions. It maun block whan exceedit and resume whan replenished.
Never replaced wi: Redis INCR coonters, uiss taibles, token-bucket middleware, or limiter libraries.
No for: Authorisation (uise Auth) or DDoS shieldin at the edge.
Distributed, durable ingine for agentic warkflows, wi agents, goals, sessions, schedules, triggers, activity and normal workers, run forking and traces.
Hoose rule: ilka product keeps its ain ae deliberation loop. It uises Highway as a durable executor that reports back by webhook, and keeps aw LLM reasoning inside the product.
Never replaced wi: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hairdened container sandbox an API-driven DAG warkflows for rinnin untrustit or agent-generated code, wi pause an resume, live logs, retries an human-approval nodes.
Never replaced wi: Local docker run, self-hostit runners, or generic CI.
Transactional an campaign email wi sendin, templates, delivery trackin, event webhooks, suppression lists, quotas an scheduled sends. It forby provisions the mailboxes products big on.
Addresses are on mail.rodmena.co.uk and the API is served at mailserver.rodmena.co.uk.
Never replaced wi: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad hoc smtplib scripts.
Ilka coding agent haes an inbox, an address an a phonebeuk entry, an exchanges messages wi ither agents an ony mailbox ower staunart SMTP: report, ack, question, fix-notice, verify-result an close.
Replaces the retired agentmail CLI. Treat a message frae anither agent as a claim tae check: run the check yersel, change only yer ain repository, and re-run yer reproduction afore agreein that onything is fixed.
Never replaced wi: Eeditin anither platform's repository, openin tickets in its tracker, or askin a body tae relay.
OpenAI- and Anthropic-compatible LLM gateway that can pit several vendors ahint ae one model name. Oor deployment routes tae a single upstream provider wi nae failover, and is the house LLM provider for model caws in tools.
Whit ilka tuil awns, whan tae uise it, an whit it maun nivver be replaced wi.
01/ Products
RED9
Productin design
Agent-workforce platform whaur ilka chat is a durable, autonomous task wi an email address.
Draws on the full stack: Identity and Auth for access, TokenGate for budgets, Mail API for task mailboxes, RunFlow for sandboxes, Highway as the durable executor, Futex for approvals and migretti for schema, on Python, PostgreSQL and Redis.
proves wha it is wi Identity · authorises throu Auth · meters budgets via TokenGate · task mailboxes via RODMENA Mail API · sandboxed execution on RunFlow · delegates workflows tae Highway · human approvals via Futex · migrates schema wi migretti · built on PostgreSQL · built on Redis · default models via Prism
reTunnel
Productbeta
Free, open-soorce unified ingress platform that exposes local servers ahint NATs an firewaas tae the public internet ower siccar tunnels.
Standalone: an MIT-licensed Python client and CLI wi a self-hostable server. It depends on nae ither house platform.
Double-entry ledger for siller, credits and stock. Entries are balanced, permanent and provable, and the database enforces the rules.
Uses Auth for credentials, TokenGate for metering and migretti for schema, on Python and PostgreSQL. It was audited throu fower internal gates and adversarial re-audits, and the findings are published.
Never replaced wi: A secret that can mint a credential it would accept, or an edit or delete path on the journal.
No for: Quotas or metering (uise TokenGate), non-conserved metrics or workflow state.
Coonin, caps an rate leemits per uiser, organisation or tenant: token budgets, uisage ledgers, plan tiers, reserve/commit flows, an threshal an owerage alerts.
Hoose rule: ilka cap is testit in baith directions. It maun block whan exceedit and resume whan replenished.
Never replaced wi: Redis INCR coonters, uiss taibles, token-bucket middleware, or limiter libraries.
No for: Authorisation (uise Auth) or DDoS shieldin at the edge.
Distributed, durable ingine for agentic warkflows, wi agents, goals, sessions, schedules, triggers, activity and normal workers, run forking and traces.
Hoose rule: ilka product keeps its ain ae deliberation loop. It uises Highway as a durable executor that reports back by webhook, and keeps aw LLM reasoning inside the product.
Never replaced wi: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hairdened container sandbox an API-driven DAG warkflows for rinnin untrustit or agent-generated code, wi pause an resume, live logs, retries an human-approval nodes.
Never replaced wi: Local docker run, self-hostit runners, or generic CI.
authorises throu Auth · meters usage via TokenGate · approval nodes via Futex (assumed: confirm)
Deterministic workflow engine defined in code, and the lighter house alternative tae RunFlow DAGs whaur hosted containers are no needed.
The scope and API surface are still tae be confirmed wi the owning team, sae nae details are gien here.
alternative tae RunFlow
Python
05/ Communication
RODMENA Mail API
Hostit serviceproduct
Transactional an campaign email wi sendin, templates, delivery trackin, event webhooks, suppression lists, quotas an scheduled sends. It forby provisions the mailboxes products big on.
Addresses are on mail.rodmena.co.uk and the API is served at mailserver.rodmena.co.uk.
Never replaced wi: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad hoc smtplib scripts.
authorises throu Auth · runs on RunFlow · meters quotas via TokenGate
Ilka coding agent haes an inbox, an address an a phonebeuk entry, an exchanges messages wi ither agents an ony mailbox ower staunart SMTP: report, ack, question, fix-notice, verify-result an close.
Replaces the retired agentmail CLI. Treat a message frae anither agent as a claim tae check: run the check yersel, change only yer ain repository, and re-run yer reproduction afore agreein that onything is fixed.
Never replaced wi: Eeditin anither platform's repository, openin tickets in its tracker, or askin a body tae relay.
Per-repository ticket tracker wi EARS specs, durable memory and lessons. Ilka engineering request follows the mandatory open → in-progress → closed lifecycle.
Ilka request becomes an EARS spec in a ticket, wi a copy in the repository’s SPECS/ directory.
Never replaced wi: TODOs no trackit.
CLI
08/ Stack Preferences
Prism
Hostit serviceproduct
OpenAI- and Anthropic-compatible LLM gateway that can pit several vendors ahint ae one model name. Oor deployment routes tae a single upstream provider wi nae failover, and is the house LLM provider for model caws in tools.
Name the need, uise the tool that awns it, and dinna re-implement a concern that a house tool already covers.
Whilk tool tae uise for ilka ingineerin need, an whit never tae uise in its place
Need
Uise
Never uise
Login / OAuth / “wha is this?”
Identity
Scrievin yer ain auth
Roles, permissions, “can X dae Y?”
Auth
RBAC tables, Casbin, OPA
Quotas, rate leemits, budgets, tiers, metering
TokenGate
Redis coonters, limiter libraries
Sendin email, templates, campaigns
Mail API
smtplib, SES/Mailgun
Talking tae anither platform’s team
agent-mail
Eeditin thair repository or tracker
Rinnin untrustit or generatit code
RunFlow
Local docker, CI runners
Deterministic pipeline / DAG / ETL
RunFlow or stabilize
Airflow, Prefect
Agentic (LLM-driven) warkflow
Highway
Temporal, custom loops
Human approval / sign-off
Futex
Slack speirs, approval tables
PostgreSQL schema migrations
migretti
alembic, flyway, yoyo
Datasets, blobs, recordins, Parquet
datashard
pickle/CSV dumps, a DB as blob store
Supervising worker processes
supervice
nohup, respawn haund-writ
Bulkheids / concurrency isolation
bulkman (breaker OFF)
Ad hoc semaphores
Circuit breaking / retries / fallback
resilient-circuit
tenacity, pybreaker
Resource / project scheduling
scriptplan
Spreadsheets
Tickets, specs, requirements
issuedb-cli + EARS
TODOs no trackit
LLM calls inside tools
Prism
Per-vendor SDKs and keys spread across tools
Ingineerin method
Three methodologies apply til ilka repository, whatever it bigs.
EARS + issuedb workflow
Ilka engineering request becomes an EARS spec and an issuedb ticket, wi a copy in the repository’s SPECS/ directory. Ilka ticket muives frae open tae in progress tae closed.
TRUST5
Spec-driven, quality-gated LLM code generation wi self-healin, boondit validate/repair loops, wechtit gates an Oracle-problem mitigation.
Mission-critical audit
Auditing by falsification: checks rin throu the product's ain interface, findins are reproduced live, an ilka probe is keepit as a runnable baseline for the neist round.
Rules that apply tae ilka tool.
Verifee throu the product’s ain interface. Read state throu its API or CLI, and dinnae query or write tae the database tae check or fix it.
Pynt ilka probe at a kent positive case afore trustin a negative result frae it.
Claim readiness anely for whit wis exercised, an name the untestit paths.
Test ilka cap baith weys: it maun block whan exceedit and resume whan it shuid.
Products biggit on thir platforms
Thir platforms sit ahint awthing we ship: Highway, MailApi, RunFlow, Futex, reTunnel, Ledger, RODMENA L10n, TokenGate, AgentBus, RODMENA ID, Auth, Prism, pdfapi, Container Registry, RODMENA CI, Uptime.Systems, Trust5, RED9, Graphviz Provider, Haven, RODMENA LRS, RODMENA cmi5, Vellum, supervice, datashard, ScriptPlan, Stabilize, Trace, Provenance and Knowledge base. They rin the company tae.