You get a whole product, not a starting point.

This page is written to be checked. Where something is designed and not built it carries a badge, where it is a research direction it says so, and every capability sentence on this site has a row in the repository’s claims ledger naming the code, the document or the test that backs it.

Each section below carries one of these blocks. Nothing in them is a summary of the section above — it is the mechanism, in the words the page used to lead with.

The picture is drawn from the repository’s own generated topology rather than from a whiteboard, and a test fails if the two stop agreeing: the same seventeen services serve every tenant that comes out of the factory.

Every one of those seventeen services is routed over TLS at its own subdomain and answers a health check; the operator console probes all seventeen of them on one page.

The system documents itself at docs.alodai.com — routes, API key scopes and the shared contracts, generated from this repository. It is not drawn above because it is not part of anybody’s platform: it describes the machine rather than running on it.

Makers create platforms, choose an experience pack and the modules on top of it, set roles and brand, and publish a site with its pages, theme and custom domain. Every change lands as rows the compiler can read back.

A module is a reusable capability with surfaces of its own. An Experience Pack is a factory preset for a whole vertical: its naming, navigation, modules, seed content and AI behaviour, applied when a platform is created and editable afterwards.

The registry is honest about itself, and that is load-bearing. A module whose implementation is marked as not yet built cannot be enabled for a platform at all — the activation gate refuses it — so what you can switch on is exactly what is built.

A pack configures; it does not own data. That is a deliberate boundary: a vertical cannot quietly grow its own tables, so moving a platform between packs stays a configuration change.

A module is generic and shared between platforms. A project block is the opposite: functionality meaningful in one platform, which consumes the modules rather than reimplementing them. Blocks are disabled by default and enabled per platform.

The catalog itself is framework-agnostic — definitions, configuration schemas and availability rules — and the thing that draws a block lives in the platform app, looked up by key. One boundary is enforced rather than requested: the server half of a block cannot be imported by an app, and a guard fails the build if one tries. The first block has a scored challenge, and a quiz whose answer key ships inside the browser bundle cannot support a ranked result.

The compiler runs staged, resumable passes that can be re-run. The runtime layer sits behind four provider adapters — Anthropic, OpenAI, Google, DeepSeek — selected by one router with a spend guard in front of every call.

Deterministic first, wherever determinism is available. Which modules a pack enables comes from a registry and a manifest, not from a model; the model writes names, labels, copy and onboarding steps. When the model is unreachable, the compiler falls back to the deterministic path and records that it did.

You can bring your own provider key, at organisation or platform level, so both the model choice and the model spend can be yours.

Tenancy is asserted, not assumed. No middleware compares a token’s platform to the platform in a URL. Every tenant-scoped request resolves the platform and the user in the service layer before it touches data, and every change to such a query ships a test that proves the other tenant is refused.

One token table per plane. Crossing from one identity plane into another mints a fresh session through a single-use, short-lived, hash-stored code that lives in its own table. A token issued on one plane cannot be redeemed on another, because there is nowhere to redeem it.

Contracts, not conventions. Request and response shapes are schemas in one shared package that the apps and the services both import. Money is integer cents. Status values are catalog rows, never a database enum, so a new status is data rather than a migration.

Docker Swarm across three tiers: an edge server for ingress and compute, a data server for PostgreSQL, MongoDB and Redis, and a build-and-monitoring server. Traefik terminates TLS, and one Cloudflare wildcard covers every tenant and site subdomain.

Ansible roles and Terraform, with every secret encrypted at rest inside the repository through sops and age. Prometheus, Grafana, Loki and Alertmanager run on their own host, and the backup rules alert on absence as well as failure.