System design

How the architecture holds its boundary

A production system is defined by what it refuses as much as what it accepts. Keep consequential work attributable and exportable instead of scattering the company across disconnected tabs and opaque automations.

Control planes

Company record

Zod-validated Markdown and Git form a portable company record with forward-only migrations.

Reviewable Operator

Workers draft decisions, finance closes, digests, KPIs, and queues; risk-aware review gates consequential effects.

Hosted beta boundary

The hosted beta isolates founder and company workspaces while exposing unfinished services honestly.

Request lifecycle

validated company source and imported records
  → deterministic path resolution
  → draft from a bounded worker
  → risk classification and proposal
  → authorized approve or reject transition
  → atomic file update, Git history, and Run Log

Failure model

Invalid schemas, untrusted imports, unapproved high-risk proposals, broken provenance, and failed writes stop before the company record advances.

Verification checklist

Founder ownership: The founder owns the company repository and source records.
Proposal before effect: High-risk work remains a proposal until an authorized review transition.
Attributable Run Log: Every accepted or rejected proposal leaves an attributable Run Log entry.
Testable handback: Backup, restore, open files, and hosted export make the exit path testable.

← Back to overview