One machine.
Every concern/one tool.

Agent-workforce platform — every chat is a durable, autonomous, email-addressable task.

Composes the full stack: Identity + Auth for access, TokenGate for budgets, Mail API for task mailboxes, RunFlow for sandboxes, Highway as durable executor, Futex for approvals, migretti for schema — over Python, PostgreSQL and Redis.

authenticates with Identity · authorizes via Auth · meters budgets via TokenGate · task mailboxes via Rodmena Mail API · sandboxed execution on RunFlow · delegates workflows to Highway · human approvals via Futex · migrates schema with migretti · built on PostgreSQL · built on Redis · default models via Ollama Cloud

Free, open-source unified ingress platform — expose local servers behind NATs and firewalls to the public internet over secure tunnels.

Standalone by design: MIT-licensed Python client and CLI with a self-hostable server — it depends on no other house platform.

OAuth provider — who you are. Login for humans and services. Every product’s sign-in goes through Identity.

Standalone by design: Identity depends on no other house platform — sign-in federates out to public identity providers (Google, GitHub, Apple, …).

Not for: Permissions or roles — that is Auth. The pair is deliberately split: Identity authenticates, Auth authorizes.

federates sign-in to External IdPs

The public identity providers Identity federates sign-in to — Google, GitHub, Apple and friends. The only upstream Identity has.

Hosted RBAC — roles, permissions, memberships, “can user X do Y” checks. Products define their roles here, not in their own tables.

Ships as the PyPI package “auth”.

Never replaced with: Hand-rolled users/roles/permissions tables, Casbin, OPA, or an RBAC library.

Not for: Login, sessions, passwords, JWT issuance — authentication belongs to Identity.

Anything counted, capped or rate-limited per user, org or tenant: token budgets, usage ledgers, plan tiers, reserve/commit flows, threshold and overage alerts.

House rule: every cap is tested in both directions — it blocks when exceeded and resumes when replenished.

Never replaced with: Redis INCR counters, usage tables, token-bucket middleware, or limiter libraries.

Not for: Authorization (that is Auth) or edge DDoS shielding.

authorizes via Auth

Durable, policy-driven human approvals — request a decision, route it by policy, escalate or delegate, collect the verdict via webhook.

Used for deployments, payments, access grants, destructive operations and budget-overrun continuations.

Never replaced with: Slack “please approve” messages, blocking input() prompts, or bespoke approval tables.

executes on RunFlow · meters usage via TokenGate · sends mail via Rodmena Mail API

Distributed, durable agentic workflow engine — agents, goals, sessions, schedules, triggers, activity and normal workers, run forking, traces.

House rule: products keep a single deliberation loop of their own and use Highway as a durable executor reporting back via webhooks — not as a second place where an LLM “thinks”.

Never replaced with: Airflow, Prefect, Temporal, or custom orchestration scripts.

authorizes via Auth · complements RunFlow

Hardened container sandbox plus API-driven DAG workflows — the place to run untrusted or agent-generated code, with pause/resume, live logs, retries and human-approval nodes.

Never replaced with: Local docker run, self-hosted runners, or generic CI.

authorizes via Auth · meters usage via TokenGate · approval nodes via Futex (assumed — confirm)

Code-defined deterministic workflow engine; the lighter-weight house alternative to RunFlow DAGs when no hosted containers are needed.

Scope and API surface to be confirmed with the owning team before this page states specifics.

alternative to RunFlow

Transactional and campaign email — send, templates, delivery tracking, event webhooks, suppression lists, quotas, scheduled sends. Also provisions the mailboxes products build on.

Addresses live on mail.rodmena.co.uk; the API is served at mailserver.rodmena.co.uk.

Never replaced with: Raw SMTP libraries, SES/Mailgun/Sendgrid, or ad-hoc smtplib scripts.

authorizes via Auth · executes on RunFlow · meters quotas via TokenGate

Iceberg-like dataset and blob storage on disk or S3 — append-only records, snapshots, time travel, Parquet.

Never replaced with: Raw pickle/CSV/JSON dumps, hand-managed Parquet folders, or standing up a database just to hold blobs.

SQL-first PostgreSQL migration CLI — create, apply, roll back, squash, seed. The only sanctioned PostgreSQL migration tool.

Never replaced with: alembic, flyway, yoyo, or ORM auto-migrations. An absolute house rule for every PostgreSQL schema.

targets PostgreSQL

Zero-dependency async process supervisor — N workers, daemons, queue consumers, health checks, groups, restart-on-crash.

Plain systemd or k8s remain acceptable when they genuinely fit better.

Bulkheads and concurrency isolation — bounds the blast radius of a failing dependency.

House rule: circuit_breaker_enabled=False, always — bulkman isolates, it never breaks. Breaking belongs to resilient-circuit.

complements resilient-circuit

Circuit breaking, retries with backoff, failsafe/fallback around flaky calls. Paired with bulkman: isolation there, failure behaviour here.

Never replaced with: tenacity, pybreaker, or hand-rolled retry loops.

TaskJuggler-compatible resource-planning and scheduling engine (.tjp) — people and machines over time, dependencies, calendars, Gantt output.

Never replaced with: Spreadsheets or ad-hoc date math.

Per-repo ticket tracker with EARS specs, durable memory and lessons — the mandatory open → in-progress → closed lifecycle for every engineering request.

Every request becomes an EARS spec in a ticket plus a copy in the repo’s SPECS/ directory.

Never replaced with: Untracked TODOs.