Hou oor platforms fit thegither. Ilka concern/ae tool.
RODMENA biggs its products frae a set o hoose libraries an frae wee hosted services wi the ane purpose apiece, an gies a concern tae the ane tool alane. The platforms hae their ain teams an crack ower a shared mail bus.
products
13
hostit platforms
8
libraries, ingines an CLIs
8
shared mail bus
1
Design principles
Ae concern, ae tuil
Authentication is Identity, authorisation is Auth, metering is TokenGate, email is Mail API, approvals are Futex, containers are RunFlow and agentic workflows are Highway. Products never re-implement a concern that a house tool already owns.
Teams coordinate by mail
Ilka platform haes its ain agent, context an repository. Teams coordinate across platforms on the agent-mail bus. Nae team edits anither team’s repository or files tickets in its tracker.
Databases spread owre countries
Services hae their ain databases, on different hosts in different kintras. An application can be redeployed bit its data canna, an we keep the twa apairt. Aw databases are replicated tae a third region an backed up off-site.
/ Where it runs
Hosts and regions
The managed fleet hauds 22 production databases, ilk ane awned bi ane service, on 4 database hosts in 3 countries, an 4 mair rin on an application host. Nae twa services share a schema, an the platform disnae lippen on onie single machine.
production databases, ilk ane awned bi ae service
22
database hosts
4
countries
3
minutes recovery point on the managed fleet, at maist
≤5
UKUnitit Kinrick
Applications and twa database hosts
Hosts the application tier and the databases for the workflow engine, the approvals service, the message bus, email, the ledger and the task platform.
FRFrance
Database host
Hauds the identity and access plane, authorisation, metering and the identity provider, keepit apairt frae the services that depend on it.
DEGermany
Replica set
Haes a continuously updated copy o ivery database, ootside the ither twa regions. It haes nae primary, sae nae traffic depends on it till it is promoted.
Continuous replication
Aw databases stream block-level chynges tae a standby ootwi the twa primary regions. Acause replication is asynchronous, a replica cannae slaw doun or block the service in front o it.
Off-site backups
Archives gang continuously tae object storage in a sindry facility, encryptit afore they leave the host and recoverable tae ony pynt within retention. Restores are testit end tae end.
Three factors on ilka connection
Nae database accepts a network connection on a password alane. A connection needs encryption in transit, a client certificate issued bi a private authority an a password, an services are scoped tae their ain databases.
Replicas and backups
A wrang statement reaches aw the replicas within moments. Replicas protect agin tyning hardware, an the archive protects agin tyning data.
On the cairt's aicht layers and ane bus, a concern appears anerly the aince. Products sit at the tap, the stack sits at the boddom, and onythin a product needs is ane hop awey.
23 nodes · 27 documentit relations · 1 assumed
Skroll the map sideweys. Ilka node haes a caird ablow it an aw.
Explor
Uisin the map
Wale a node or the bus tae heighlicht its relations an see whit it awns, whit it connects tae an whit it maun niver be replaced wi. The cairds abaw leet thae facts an aw.
documentit relation
assumed: confirm afore lippening on it
the agent-mail bus
a product (gradient border)
No drawn, as they apply awhaur:
Ilka product authenticates wi Identity an authorises wi Auth.
Ilka platform team coordinates ower the agent-mail bus.
Ilka repository is trackit in issuedb-cli, wi EARS specs.
Producton request
RED9
11 ootgang
Agent-workforce platform whaur ilka chat is a durable, autonomous task wi an email address.
Draws on the full stack. Identity and Auth provide access, TokenGate budgets, Mail API task mailboxes and RunFlow sandboxes. Highway is the durable executor, Futex handles approvals and migretti the schema, on Python, PostgreSQL and Redis.
Double-entry ledger for siller, credits and stock. Its entries are balanced, permanent and pruevable unner rules the database enforces.
Biggit on Python and PostgreSQL, uisin Auth for credentials, TokenGate for metering and migretti for schema. It gaed throu fower internal audit gates and adversarial re-audits, whas findins are furthset.
Never replaced wi: A secret that can mint a credential it would accept, or an edit or delete path on the journal.
No for: Quotas or metering (uise TokenGate), non-conserved metrics or workflow state.
Coontin, caps an rate limits per uiser, organisation or tenant. It covers token budgets, uisage ledgers, plan tiers, reserve/commit flows, an threshold an overage alerts.
Bi hoose rule, caps are testit in baith airts. A cap maun block whan exceedit an stairt up again whan replenisht.
Never replaced wi: Redis INCR coonters, uiss taibles, token-bucket middleware, or limiter libraries.
No for: Authorisation (uise Auth) or DDoS shieldin at the edge.
Distributed, durable engine for agentic workflows. It provides agents, ettles, sessions, schedules, triggers, activity an normal workers, run forking an traces.
Bi hoose rule, a product keeps ane deliberation loop o its ain. It uises Highway as a durable executor that reports back bi webhook an keeps aw LLM raisonin inside the product.
Never replaced wi: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hardened container sandbox and API-driven DAG workflows for runnin untrusted or agent-generated code. Runs can be paused and resumed, and hae live logs, retries and human-approval nodes.
Never replaced wi: Local docker run, self-hostit runners, or generic CI.
Transactional an campaign email wi sendin, templates, delivery trackin, event webhooks, suppression lists, quotas an scheduled sends. It forby provisions the mailboxes products big on.
Addresses are on mail.rodmena.co.uk and the API is served at mailserver.rodmena.co.uk.
Never replaced wi: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad hoc smtplib scripts.
A coding agent gets an inbox, an address an a phonebook entry, an exchynges messages wi ither agents an ony mailbox ower staundart SMTP. The message types are report, ack, question, fix-notice, verify-result an close.
Takes the place o the retired agentmail CLI. Regaird a message frae anither agent as a claim an rin the check yersel. Chynge anerly yer ain repository, an re-rin yer reproduction afore greein that onything is fixed.
Never replaced wi: Eeditin anither platform's repository, openin tickets in its tracker, or askin a body tae relay.
Zero-dependency async process supervisor for wirkers, daemons an queue consumers. It rins health checks, manages groups an restarts a process whan it crashes.
Plain systemd or Kubernetes are acceptable whaur they fit better.
Python
Python librar
bulkman
1 ootgang
Bulkheids an concurrency isolation that leemits the blast radius o a failin dependency.
The hoose rule is tae aye set circuit_breaker_enabled=False. bulkman handles isolation, an circuit breaking belangs tae resilient-circuit.
TaskJuggler-compatible (.tjp) ingine for resource plannin and schedulin. It handles fowk and machines ower time, dependencies and calendars, and produces Gantt output.
Never replaced wi: Spreadsheets or ad hoc date coontin.
Per-repository ticket tracker wi EARS specs, durable memory an lessons. Aw engineering requests folla the mandatory open → in-progress → closed lifecycle.
Engineering requests aw acome an EARS spec in a ticket an in a copy unner the repository’s SPECS/ directory.
OpenAI- and Anthropic-compatible LLM gateway that can pit several vendors ahint ae one model name. Oor deployment routes tae a single upstream provider wi nae failover, and is the house LLM provider for model caws in tools.
Whit ilka tuil awns, whan tae uise it, an whit it maun nivver be replaced wi.
01/ Products
RED9
Producton request
Agent-workforce platform whaur ilka chat is a durable, autonomous task wi an email address.
Draws on the full stack. Identity and Auth provide access, TokenGate budgets, Mail API task mailboxes and RunFlow sandboxes. Highway is the durable executor, Futex handles approvals and migretti the schema, on Python, PostgreSQL and Redis.
proves wha it is wi Identity · authorises throu Auth · meters budgets via TokenGate · task mailboxes via RODMENA Mail API · sandboxed execution on RunFlow · delegates workflows tae Highway · human approvals via Futex · migrates schema wi migretti · built on PostgreSQL · built on Redis · default models via Prism
reTunnel
Product
Free, open-soorce unified ingress platform that exposes local servers ahint NATs an firewaas tae the public internet ower siccar tunnels.
A standalone Python client and CLI, MIT-licensed, that comes wi a self-hostable server and depends on nae ither hoose platform.
Double-entry ledger for siller, credits and stock. Its entries are balanced, permanent and pruevable unner rules the database enforces.
Biggit on Python and PostgreSQL, uisin Auth for credentials, TokenGate for metering and migretti for schema. It gaed throu fower internal audit gates and adversarial re-audits, whas findins are furthset.
Never replaced wi: A secret that can mint a credential it would accept, or an edit or delete path on the journal.
No for: Quotas or metering (uise TokenGate), non-conserved metrics or workflow state.
Coontin, caps an rate limits per uiser, organisation or tenant. It covers token budgets, uisage ledgers, plan tiers, reserve/commit flows, an threshold an overage alerts.
Bi hoose rule, caps are testit in baith airts. A cap maun block whan exceedit an stairt up again whan replenisht.
Never replaced wi: Redis INCR coonters, uiss taibles, token-bucket middleware, or limiter libraries.
No for: Authorisation (uise Auth) or DDoS shieldin at the edge.
Distributed, durable engine for agentic workflows. It provides agents, ettles, sessions, schedules, triggers, activity an normal workers, run forking an traces.
Bi hoose rule, a product keeps ane deliberation loop o its ain. It uises Highway as a durable executor that reports back bi webhook an keeps aw LLM raisonin inside the product.
Never replaced wi: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hardened container sandbox and API-driven DAG workflows for runnin untrusted or agent-generated code. Runs can be paused and resumed, and hae live logs, retries and human-approval nodes.
Never replaced wi: Local docker run, self-hostit runners, or generic CI.
authorises throu Auth · meters usage via TokenGate · approval nodes via Futex (assumed: confirm)
Deterministic workflow ingine defined in code. It is the lichter hoose alternative tae RunFlow DAGs whan hosted containers are no needed.
We gie nae details here acause scope and API surface are still tae be confirmed wi the awnin team.
alternative tae RunFlow
Python
05/ Communication
RODMENA Mail API
Hostit serviceproduct
Transactional an campaign email wi sendin, templates, delivery trackin, event webhooks, suppression lists, quotas an scheduled sends. It forby provisions the mailboxes products big on.
Addresses are on mail.rodmena.co.uk and the API is served at mailserver.rodmena.co.uk.
Never replaced wi: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad hoc smtplib scripts.
authorises throu Auth · runs on RunFlow · meters quotas via TokenGate
A coding agent gets an inbox, an address an a phonebook entry, an exchynges messages wi ither agents an ony mailbox ower staundart SMTP. The message types are report, ack, question, fix-notice, verify-result an close.
Takes the place o the retired agentmail CLI. Regaird a message frae anither agent as a claim an rin the check yersel. Chynge anerly yer ain repository, an re-rin yer reproduction afore greein that onything is fixed.
Never replaced wi: Eeditin anither platform's repository, openin tickets in its tracker, or askin a body tae relay.
Zero-dependency async process supervisor for wirkers, daemons an queue consumers. It rins health checks, manages groups an restarts a process whan it crashes.
Plain systemd or Kubernetes are acceptable whaur they fit better.
Python
bulkman
Python librar
Bulkheids an concurrency isolation that leemits the blast radius o a failin dependency.
The hoose rule is tae aye set circuit_breaker_enabled=False. bulkman handles isolation, an circuit breaking belangs tae resilient-circuit.
complements resilient-circuit
Python
resilient-circuit
Python librar
Circuit breaking, retries wi backoff, and failsafe or fallback handlin roond unreliable calls. Pair it wi bulkman for isolation.
Never replaced wi: tenacity, pybreaker, or hand-rolled retry loops.
Python
scriptplan
Ingine + CLIproduct
TaskJuggler-compatible (.tjp) ingine for resource plannin and schedulin. It handles fowk and machines ower time, dependencies and calendars, and produces Gantt output.
Never replaced wi: Spreadsheets or ad hoc date coontin.
Per-repository ticket tracker wi EARS specs, durable memory an lessons. Aw engineering requests folla the mandatory open → in-progress → closed lifecycle.
Engineering requests aw acome an EARS spec in a ticket an in a copy unner the repository’s SPECS/ directory.
Never replaced wi: TODOs no trackit.
CLI
08/ Stack Preferences
Prism
Hostit serviceproduct
OpenAI- and Anthropic-compatible LLM gateway that can pit several vendors ahint ae one model name. Oor deployment routes tae a single upstream provider wi nae failover, and is the house LLM provider for model caws in tools.
Name the need, uise the tool that awns it, and dinna re-implement a concern that a house tool already covers.
Whilk tool tae uise for ilka ingineerin need, an whit never tae uise in its place
Need
Uise
Never uise
Login / OAuth / “wha is this?”
Identity
Scrievin yer ain auth
Roles, permissions, “can X dae Y?”
Auth
RBAC tables, Casbin, OPA
Quotas, rate leemits, budgets, tiers, metering
TokenGate
Redis coonters, limiter libraries
Sendin email, templates, campaigns
Mail API
smtplib, SES/Mailgun
Talking tae anither platform’s team
agent-mail
Eeditin thair repository or tracker
Rinnin untrustit or generatit code
RunFlow
Local docker, CI runners
Deterministic pipeline / DAG / ETL
RunFlow or stabilize
Airflow, Prefect
Agentic (LLM-driven) warkflow
Highway
Temporal, custom loops
Human approval / sign-off
Futex
Slack speirs, approval tables
PostgreSQL schema migrations
migretti
alembic, flyway, yoyo
Datasets, blobs, recordins, Parquet
datashard
pickle/CSV dumps, a DB as blob store
Supervising worker processes
supervice
nohup, respawn haund-writ
Bulkheids / concurrency isolation
bulkman (breaker OFF)
Ad hoc semaphores
Circuit breaking / retries / fallback
resilient-circuit
tenacity, pybreaker
Resource / project scheduling
scriptplan
Spreadsheets
Tickets, specs, requirements
issuedb-cli + EARS
TODOs no trackit
LLM calls inside tools
Prism
Per-vendor SDKs and keys spread across tools
Ingineerin method
Three methodologies apply til ilka repository, whatever it bigs.
EARS + issuedb workflow
Aw ingineerin requests become an EARS spec an an issuedb ticket, an the spec is copied intae the repository’s SPECS/ directory. Tickets muive frae open tae in progress tae closed.
TRUST5
Spec-driven, quality-gated LLM code generation wi self-healin, boondit validate/repair loops, wechtit gates an Oracle-problem mitigation.
Mission-critical audit
Auditing by falsification: checks rin throu the product's ain interface, findins are reproduced live, an ilka probe is keepit as a runnable baseline for the neist round.
Rules that apply tae ilka tool.
Verifee throu the product’s ain interface. Read state throu its API or CLI, and dinnae query or write tae the database tae check or fix it.
Pynt ilka probe at a kent positive case afore trustin a negative result frae it.
Claim readiness anely for whit wis exercised, an name the untestit paths.
Test ilka cap baith weys: it maun block whan exceedit and resume whan it shuid.
Products biggit on thir platforms
Thir platforms sit ahint awthing we ship: Highway, MailApi, RunFlow, Futex, reTunnel, Ledger, RODMENA L10n, TokenGate, AgentBus, RODMENA ID, Auth, Prism, pdfapi, Container Registry, RODMENA CI, Uptime.Systems, Trust5, RED9, Graphviz Provider, Steward, Tollgate, Haven, RODMENA LRS, RODMENA cmi5, Vellum, supervice, datashard, ScriptPlan, Stabilize, Trace, Provenance and Knowledge base. They rin the company tae.