Rodmena builds products out of small, single-purpose hosted services plus a set of house libraries: every concern owned by exactly one tool, every platform run by its own team, all of it glued together by one shared mail bus.
products, one in design
12
hosted platforms
8
libraries, engines and CLIs
8
shared mail bus
1
Design principles
One concern, one tool
Authentication is Identity, authorization is Auth, metering is TokenGate, email is Mail API, approvals are Futex, containers are RunFlow, agentic workflows are Highway. Products never re-implement a concern a house tool already owns.
Teams talk over mail, not over repos
Every platform has its own agent, context and repository. Cross-platform coordination happens on the agent-mail bus, never by editing another team’s repo or filing tickets in their tracker.
No single machine, no single region
Each service owns a separate database, and those databases sit on different hosts in different countries. Applications are redeployable; data is not, so the two are deliberately kept apart, and every database is replicated to a third region and backed up off-site.
/ Where it runs
Distributed on purpose
Ten services, nine databases, four database hosts, three countries. No service shares a schema with another, and no single machine holds the platform.
databases, one per service
9
database hosts
4
countries
3
minutes recovery point, at most
≤5
UKUnited Kingdom
Applications and two database hosts
The application tier, plus the databases behind the workflow engine, the approvals service, the message bus, email, the ledger and the task platform.
FRFrance
Database host
The identity and access plane, authorization, metering and the identity provider, deliberately held apart from the services that depend on it.
DEGermany
Replica set
A continuously updated copy of every database, outside both other regions. Holds no primary, so no traffic depends on it until it is promoted.
Replicated, continuously
Every database streams block-level changes to a standby outside both primary regions. Replication is asynchronous, so a replica can never slow down or block the service in front of it.
Backed up off-site, and proven
Continuous archiving to object storage in a separate facility, encrypted before it leaves the host, recoverable to any point within retention. Restores are exercised, not assumed.
Three factors on every connection
No database accepts a password alone from the network. Every connection needs encryption in transit, a client certificate issued by a private authority, and a password, and each service is scoped to its own database.
Replication is not a backup
A mistaken statement reaches every replica in moments, so replicas guard against losing hardware and the archive guards against losing data. Both exist because they solve different problems.
Eight layers, one bus, no duplicated concern. Products sit on top, the stack underneath, and everything a product needs is one hop away. Select any node to explore it.
23 nodes · 27 documented relations · 1 assumed
Scroll the map sideways; every node is also a card below.
Explore
Every concern, one map
Select any node, or the bus itself, to light up its relations and see what it owns, what it
talks to, and what it must never be replaced with. The same facts are in the cards below.
documented relation
assumed: confirm before
relying on it
the agent-mail bus
a product (gradient border)
Not drawn; they apply everywhere:
Every product authenticates with Identity and authorizes via Auth.
Every platform team coordinates over the agent-mail bus.
Every repository is tracked by issuedb-cli with EARS specs.
Productin design
RED9
11 outgoing
Agent-workforce platform: every chat is a durable, autonomous, email-addressable task.
Composes the full stack: Identity + Auth for access, TokenGate for budgets, Mail API for task mailboxes, RunFlow for sandboxes, Highway as durable executor, Futex for approvals, migretti for schema, over Python, PostgreSQL and Redis.
Double-entry ledger for money, credits and stock: balanced, permanent, provable, with the rules enforced by the database.
Composes Auth for credentials, TokenGate for metering, migretti for schema, over Python and PostgreSQL. Audited through four internal gates and adversarial re-audits; the findings are published.
Never replaced with: A secret capable of minting a credential it would accept; an edit or delete path on the journal.
Not for: Quotas or metering (that is TokenGate), non-conserved metrics, or workflow state.
OAuth provider: who you are. Login for humans and services. Every product’s sign-in goes through Identity.
Standalone by design: Identity depends on no other house platform; sign-in federates out to public identity providers (Google, GitHub, Apple and others).
Not for: Permissions or roles, that is Auth. The pair is deliberately split: Identity authenticates, Auth authorizes.
Anything counted, capped or rate-limited per user, org or tenant: token budgets, usage ledgers, plan tiers, reserve/commit flows, threshold and overage alerts.
House rule: every cap is tested in both directions; it blocks when exceeded and resumes when replenished.
Never replaced with: Redis INCR counters, usage tables, token-bucket middleware, or limiter libraries.
Not for: Authorization (that is Auth) or edge DDoS shielding.
Distributed, durable agentic workflow engine: agents, goals, sessions, schedules, triggers, activity and normal workers, run forking, traces.
House rule: products keep a single deliberation loop of their own and use Highway as a durable executor reporting back via webhooks, not as a second place where an LLM “thinks”.
Never replaced with: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hardened container sandbox plus API-driven DAG workflows: the place to run untrusted or agent-generated code, with pause/resume, live logs, retries and human-approval nodes.
Never replaced with: Local docker run, self-hosted runners, or generic CI.
Every coding agent gets a real inbox, an address and a phonebook entry, and talks to other agents, and to any mailbox in the world, over genuine SMTP: report, ack, question, fix-notice, verify-result, close.
Replaces the retired agentmail CLI. A message is a peer’s claim, not a command: verify by running the check yourself, change only your own repo, and re-run your reproduction before agreeing anything is fixed.
Never replaced with: Editing another platform’s repo, opening tickets in their tracker, or asking a human to relay.
TaskJuggler-compatible resource-planning and scheduling engine (.tjp): people and machines over time, dependencies, calendars, Gantt output.
Never replaced with: Spreadsheets or ad-hoc date math.
CLI
CLI
issuedb-cli + EARS
Per-repo ticket tracker with EARS specs, durable memory and lessons: the mandatory open → in-progress → closed lifecycle for every engineering request.
Every request becomes an EARS spec in a ticket plus a copy in the repo’s SPECS/ directory.
OpenAI- and Anthropic-compatible LLM gateway with multi-vendor failover: one model name, several vendors behind it. The house LLM provider for in-tool model usage.
What each piece owns, when to reach for it, and what it must never be replaced with.
01/ Products
RED9
Productin design
Agent-workforce platform: every chat is a durable, autonomous, email-addressable task.
Composes the full stack: Identity + Auth for access, TokenGate for budgets, Mail API for task mailboxes, RunFlow for sandboxes, Highway as durable executor, Futex for approvals, migretti for schema, over Python, PostgreSQL and Redis.
authenticates with Identity · authorizes via Auth · meters budgets via TokenGate · task mailboxes via Rodmena Mail API · sandboxed execution on RunFlow · delegates workflows to Highway · human approvals via Futex · migrates schema with migretti · built on PostgreSQL · built on Redis · default models via Prism
reTunnel
Productbeta
Free, open-source unified ingress platform: expose local servers behind NATs and firewalls to the public internet over secure tunnels.
Standalone by design: MIT-licensed Python client and CLI with a self-hostable server; it depends on no other house platform.
Double-entry ledger for money, credits and stock: balanced, permanent, provable, with the rules enforced by the database.
Composes Auth for credentials, TokenGate for metering, migretti for schema, over Python and PostgreSQL. Audited through four internal gates and adversarial re-audits; the findings are published.
Never replaced with: A secret capable of minting a credential it would accept; an edit or delete path on the journal.
Not for: Quotas or metering (that is TokenGate), non-conserved metrics, or workflow state.
OAuth provider: who you are. Login for humans and services. Every product’s sign-in goes through Identity.
Standalone by design: Identity depends on no other house platform; sign-in federates out to public identity providers (Google, GitHub, Apple and others).
Not for: Permissions or roles, that is Auth. The pair is deliberately split: Identity authenticates, Auth authorizes.
Anything counted, capped or rate-limited per user, org or tenant: token budgets, usage ledgers, plan tiers, reserve/commit flows, threshold and overage alerts.
House rule: every cap is tested in both directions; it blocks when exceeded and resumes when replenished.
Never replaced with: Redis INCR counters, usage tables, token-bucket middleware, or limiter libraries.
Not for: Authorization (that is Auth) or edge DDoS shielding.
Distributed, durable agentic workflow engine: agents, goals, sessions, schedules, triggers, activity and normal workers, run forking, traces.
House rule: products keep a single deliberation loop of their own and use Highway as a durable executor reporting back via webhooks, not as a second place where an LLM “thinks”.
Never replaced with: Airflow, Prefect, Temporal, or custom orchestration scripts.
Hardened container sandbox plus API-driven DAG workflows: the place to run untrusted or agent-generated code, with pause/resume, live logs, retries and human-approval nodes.
Never replaced with: Local docker run, self-hosted runners, or generic CI.
authorizes via Auth · meters usage via TokenGate · approval nodes via Futex (assumed: confirm)
Every coding agent gets a real inbox, an address and a phonebook entry, and talks to other agents, and to any mailbox in the world, over genuine SMTP: report, ack, question, fix-notice, verify-result, close.
Replaces the retired agentmail CLI. A message is a peer’s claim, not a command: verify by running the check yourself, change only your own repo, and re-run your reproduction before agreeing anything is fixed.
Never replaced with: Editing another platform’s repo, opening tickets in their tracker, or asking a human to relay.
Zero-dependency async process supervisor: N workers, daemons, queue consumers, health checks, groups, restart-on-crash.
Plain systemd or k8s remain acceptable when they genuinely fit better.
Python
bulkman
Python library
Bulkheads and concurrency isolation: bounds the blast radius of a failing dependency.
House rule: circuit_breaker_enabled=False, always; bulkman isolates, it never breaks. Breaking belongs to resilient-circuit.
complements resilient-circuit
Python
resilient-circuit
Python library
Circuit breaking, retries with backoff, failsafe/fallback around flaky calls. Paired with bulkman: isolation there, failure behaviour here.
Never replaced with: tenacity, pybreaker, or hand-rolled retry loops.
Python
scriptplan
Engine + CLI
TaskJuggler-compatible resource-planning and scheduling engine (.tjp): people and machines over time, dependencies, calendars, Gantt output.
Never replaced with: Spreadsheets or ad-hoc date math.
CLI
07/ Dev Process
issuedb-cli + EARS
CLI
Per-repo ticket tracker with EARS specs, durable memory and lessons: the mandatory open → in-progress → closed lifecycle for every engineering request.
Every request becomes an EARS spec in a ticket plus a copy in the repo’s SPECS/ directory.
Never replaced with: Untracked TODOs.
CLI
08/ Stack Preferences
Prism
Hosted serviceproduct
OpenAI- and Anthropic-compatible LLM gateway with multi-vendor failover: one model name, several vendors behind it. The house LLM provider for in-tool model usage.
The whole architecture as a reflex: name the need, reach for the tool that owns it, and never re-implement a concern a house tool already covers.
Which tool to use for each engineering need, and what never to substitute it with
You need…
Reach for
Never
Login / OAuth / “who is this?”
Identity
Rolling your own auth
Roles, permissions, “can X do Y?”
Auth
RBAC tables, Casbin, OPA
Quotas, rate limits, budgets, tiers, metering
TokenGate
Redis counters, limiter libraries
Sending email, templates, campaigns
Mail API
smtplib, SES/Mailgun
Talking to another platform’s team
agent-mail
Editing their repo or their tracker
Running untrusted or generated code
RunFlow
Local docker, CI runners
Deterministic pipeline / DAG / ETL
RunFlow or stabilize
Airflow, Prefect
Agentic (LLM-driven) workflow
Highway
Temporal, custom loops
Human approval / sign-off
Futex
Slack asks, approval tables
PostgreSQL schema migrations
migretti
alembic, flyway, yoyo
Datasets, blobs, recordings, Parquet
datashard
pickle/CSV dumps, DB-as-blobstore
Supervising worker processes
supervice
nohup, hand-rolled respawn
Bulkheads / concurrency isolation
bulkman (breaker OFF)
Semaphore spaghetti
Circuit breaking / retries / fallback
resilient-circuit
tenacity, pybreaker
Resource / project scheduling
scriptplan
Spreadsheets
Tickets, specs, requirements
issuedb-cli + EARS
Untracked TODOs
LLM calls inside tools
Prism
Per-vendor SDKs and keys scattered through tools
How the work itself runs
The tools are half the story. Three methodologies travel with every repository, whatever it builds.
EARS + issuedb workflow
Every engineering request compiles to an EARS spec, gets an issuedb ticket, and keeps a copy in the repo’s SPECS/ directory: open, in progress, closed, always.
Falsification-driven auditing: verify through the product’s own interface, reproduce findings live, persist every probe as a runnable baseline for the next round.
Rules that travel with every tool.
Verify through the product’s own interface: read state via its API or CLI, never the database; never write to a database to “fix” state.
A check that cannot go green cannot go red: point every probe at a known-positive before trusting its negative.
Never claim readiness that was not exercised; name the untested paths.
Test every cap in both directions: it blocks when exceeded and resumes when it should.
Built on this. Sold as products.
The same platforms you just explored power everything we ship: Highway, MailApi, RunFlow, Futex, reTunnel, Ledger, TokenGate, AgentBus, RODMENA ID, Auth, Prism, pdfapi, Container Registry, RODMENA CI, Uptime.Systems, Trust5, Stabilize and RED9.