Boring, portable parts, chosen so a stranger can run it.
The record is the product. Everything around it is bought, not built, wherever a well-run open-source project already does the job. What we build ourselves is the broker, the gates, the audit, the records engine and the agent layer. That's the whole make-versus-buy ledger.
Eight parts, and what each one is for.
- 01
Next.js · React · TypeScript
The application
the rebuildThe production Hub is a Vite + React 18 single-page app written in JavaScript, with hash routing and no server of its own. The public rebuild moves it to the Next.js App Router in TypeScript, one section at a time, behind the same design system. The store seam (one shared browser store holding registered tables as maps) is the first thing to redraw, because config-driven panels collide with it.
- 02
Supabase · Postgres
The record
in useOne project: Postgres with row-level security as the whole authorisation story, realtime for the browser, storage for files, edge functions for the narrow doors. Migrations are append-only and applied only with a person present. The store can change; the seam is thin on purpose.
- 03
Nango
Connection lifecycle
ruled, being adoptedOAuth and API-key connections for every platform Hub reads from or drafts into. Nango minds the tokens; the broker makes the calls. Chosen over a per-call integration switchboard because the architecture needs a keymaster, not a router: at thousands of agent calls, per-call pricing is the wrong shape. Open source, self-hostable free to 1,000 connections.
- 04
Airbyte
Extraction
in useEvery new supported source enters through self-hosted Airbyte on a schedule, into raw schemas that are fenced from the public API. Hand-built extraction workers are a superseded class: keep the fixes, stop growing the class.
- 05
n8n
The proven automations
in useThe task-creation and journey automations that pre-date the run platform. They write the corrected task model and stay until the run platform carries the same work.
- 06
The ops machine
Workers and the broker
in useAn always-on box that runs the worker fleet, the dispatcher, the executor and the credential broker, and a local model for triage. For a self-hosted Hub this is any small Linux host. For a hosted tenant it's ours.
- 07
Vercel
Hosting and previews
in useThe app deploys from the default branch. Preview deployments are the review link a visual change must carry before it can reach the desk.
- 08
A warehouse
Ruled out for now
ruled outNo second database until volume earns one. One shared clean layer per source inside the existing database. A recorded decision, reopenable, not scheduled.
What the model layer costs to run.
Running economics only. A unit of work is one bounded job: read context, take a few steps, produce one staged artefact. No skill is welded to one model; the cheapest one that passes its tests keeps the job.
| Model tier | Rate (in / out) | Cost per job | Used for |
|---|---|---|---|
| Local model | On your own hardware | ~$0 | Triage, first drafts, high-volume simple work |
| Small frontier | $1 / $5 per million tokens | ~$0.08 to 0.30 | High-volume simple tasks |
| Mid frontier | $2 / $10 | ~$0.15 to 0.60 | The workhorse. Most work runs here |
| Large frontier | $5 / $25 | ~$0.30 to 1.50 | Reserved for genuinely hard reasoning |
| How much you run it | Roughly | Monthly, tokens only |
|---|---|---|
| Light | Occasional runs, a few checks a day | ~$20 to 40 a month |
| Moderate | Regular daily automation across the week | ~$60 to 120 |
| Heavy | High volume, many workflows running | ~$150 to 350 |
API tokens only, in US dollars, at published list rates. Prompt caching removes a further 40 to 60% of input cost on repeated-context runs once switched on.
Where the rebuild is going.
An agent runtime a business runs
Hub stops being an agency tool and becomes an agent platform any organisation can run: governed credentials, approval gates, auditable runs, config-driven surfaces. The marketing-agency shape becomes the first preset.
Tenancy
The biggest rock in the plan. Today there is one workspace with client-row scoping and proven portal isolation. True tenancy touches hundreds of append-only migrations and every policy, so it's a separate, budgeted programme, not a weekend.
A records engine
Generic record types on one shared table with typed, reportable columns, loaded per record type on open, never boot-loaded into the store. Primitives only. Presets stay opinionated.
One repo, a licensed boundary
One repository with a core and an extensions directory, an import-lint rule at the boundary, contract tests, one exported public surface. A true two-repo split only if independent external consumers ever exist.
More docs
Architecture
The topology: four zones wired around one record, where agents run, and the four ways a worker is started.
Security
Row-level security as the whole authorisation story, the credential broker, the ten-check gate chain, and what has actually been made to fire.
The stack
Next.js, TypeScript, Supabase, Nango, Airbyte, n8n and Vercel: what each does, what's being rebuilt, and what a stranger needs to run it.
Data plane
How client data reaches Hub: Airbyte into a fenced landing zone, thin transforms, a freshness stamp on every number.
Automations & skills
The split: one repo per organisation, a birth certificate for every automation, skills whose home is git.
Status
The capability matrix, five labels, no hedging. What you could use this afternoon versus what needs a switch or a sitting.
Self-hosting
The clone manifest and the transfer sequence: what you stand up, what moves, what never leaves our custody.