Northstar Atlas / El Sembrador Ecosystem

Make the ecosystem and its trust boundaries inspectable.

A single validated component graph drives 2D and optional spatial views, phase filters, component details and workflow links. The React interface loads operational views on demand.

Every shipped asset is public. Client controls do not authorize API operations. The static architecture remains inspectable without the backend; protected workspaces require a verified API identity.

One canonical model prevents diagrams from drifting apart. Spatial depth explains boundaries rather than measuring network distance.

Coordinate business workflows through a Go HTTP API.

Typed contracts connect the browser to catalog approvals, orders, warehouse, documents and dispatch. Authorization combines token roles with record ownership or current driver assignment.

Signed access tokens bind issuer/subject to allowlisted roles; each operation also enforces record scope. Missing or rejected identity cannot authorize protected operations. Partial OIDC configuration fails startup.

A modular API keeps transactions and permissions close to business rules without creating a service for every domain noun.

Retain business state, revisions, evidence and delivery progress.

PostgreSQL stores approved products, orders, stock, documents, routes and append-only history. Constraints, row locks and transactions preserve related facts together.

Database grants restrict runtime writes; audit/history protections do not constrain database owners. Transactions roll back together; readiness distinguishes a reachable process from unavailable persistence.

One application database simplifies consistent transactions and recovery. Database owners remain outside runtime audit restrictions.

Delegate user authentication to a dedicated identity provider.

An upstream Authentik public client uses authorization code with S256 PKCE. The browser confirms its identity and roles through the API before exposing protected workflows.

Public authorization-code client uses S256 PKCE. The Go API validates signed access tokens, audience and dedicated role scope. Rejected or expired tokens do not create an authorized application session; unconfigured mutations remain disabled.

Delegated identity avoids application password storage; availability and configuration of the identity provider remain operational dependencies.

Publish product changes through independent review.

Proposals retain their base product revision. Approval locks the current product and proposal, checks authorship and version, and commits the product, decision, audit and outbox event atomically.

Creator self-approval is forbidden, including for administrators. API roles and actor identity govern decisions. Stale product versions conflict. Product, decision, audit and outbox changes commit or roll back together.

Explicit conflicts prevent lost updates. Independent review adds a workflow step in exchange for attributable changes.

Keep approved changes and their integration events consistent.

A versioned product-approved event is inserted in the same transaction as the product change. Stable event identities and expiring leases support deferred delivery.

Stable event IDs, lease tokens and canonical payload validation constrain repeated delivery. Expired leases permit recovery; bounded retries and durable receipts preserve a single receiving effect across retries.

At-least-once delivery requires duplicate-safe receiving. It does not promise exactly-once transport.

Process persisted integration work outside request handling.

A separate Go process claims events, validates payloads, commits receiving effects and acknowledges delivery. Bounded timeouts, retry classification and structured logs expose failures.

The worker claims persisted events with expiring fenced leases and validates before receiving. Database timeouts are bounded before lease expiry; lost acknowledgments can be retried against durable receiver receipts.

Polling and database leases fit the bounded deployment; they trade immediate push delivery for a simpler recoverable worker.

Demonstrate integration receiving and durable acknowledgments.

A synthetic catalog subscriber and fictional partner tables apply incoming events in separate receiving transactions, retaining receipts and record references.

Receiver identity and payload/version checks operate inside a local synthetic receiving transaction. Duplicate events return durable receipts; conflicting payloads or versions are rejected rather than silently replaced.

The receiving schema shares application PostgreSQL. It demonstrates transaction semantics, not an independent network failure domain.

Connect orders to stock reservations, pick/pack and shipments.

Orders snapshot approved prices and revisions. Whole-order reservations lock stock consistently, while operation IDs and optimistic versions fence repeated or stale commands.

API roles and issuer/subject ownership govern order and warehouse operations. Stock is locked consistently. Insufficient stock, competing reservations, stale versions and repeated commands have explicit persisted outcomes.

Integer cents and indivisible units make arithmetic explicit. Partial picking, split shipments, returns and backorders remain outside this version.

Turn persisted business records into revisioned documents.

Drafts autosave against a revision number. Issued invoices and manifests retain source records, totals, hashes and their generated PDF bytes.

Ownership independently protects editing, issuing and downloading documents. Issued snapshots preserve source references. Revision conflicts retain the losing local text. Issued PDF bytes and business snapshots remain tied to their source revision.

Compare-and-swap conflicts preserve edits without pretending to provide conflict-free simultaneous collaboration.

Review supply requests with clear ownership and authority.

Requests capture product/vendor snapshots and quantities. A separate supervisor approves or rejects a versioned request with attributable history.

Requester and independent supervisor have separate responsibilities; self-approval is forbidden. Stale or duplicate decisions are checked. An approved request records intent and does not itself change stock.

Approval records intent; stock receipt and external purchasing remain separate operations.

Connect fictional partner messages to real persisted workflows.

Versioned JSON envelopes map incoming requests to orders and queue outgoing catalog, shipment and issued-invoice snapshots. UUIDs, payload hashes and receipts protect retries.

Exact synthetic JSON v1 envelopes, stable UUIDs and canonical payload hashes validate exchange messages. Fenced claims, bounded retry, durable receipts and rejected-message retention make failures inspectable.

The custom protocol is intentionally bounded and uses a same-database simulator; it is not an EDI compliance claim.

Keep operational conversations connected to business context.

Membership-scoped threads reference authorized records. Messages and deduplicated local MIME previews commit together while preserving source language.

Thread membership limits visibility even for administrators; linked records undergo separate current-role checks. Polling handles the bounded workflow. Protected identifiers are redacted when current record access is absent.

Polling is sufficient for the bounded demonstration. The local message sink does not send external email.

Connect employee identity, time records and reviewed corrections.

Raw punches remain intact while supervisor decisions update effective time. Staff views combine weekly hours, private captures, leave and clearly labeled gross-pay estimates.

Verified employee scope, private image permissions and independent supervisor review govern staff records. Corrections use versions and overlap checks while retaining raw punches; estimates expose missing or open time entries.

Stored UTC instants retain IANA display zones. Synthetic captures and location signals do not prove physical presence or biometric identity.

Turn persisted shipments into executable delivery plans.

Dijkstra computes paths through a versioned graph; a deadline-first insertion heuristic schedules stops, service time and return windows. Dispatch atomically links shipments to registered drivers.

Dispatcher permissions and registered driver assignments guard persisted route creation and dispatch. Unreachable paths and time-window failures are explicit. A heuristic failure does not establish global infeasibility.

A bounded heuristic is explainable and deterministic, but does not guarantee a globally optimal route.

Record ordered delivery progress under current assignment.

Route versions serialize driver updates. Delivery status and shipment state commit together, while normalized image evidence retains hashes and append-only associations.

Current driver role and issuer/subject assignment authorize mutations and photo reads. Ordered progress uses route versions; delivery and shipment state commit together. Repeated evidence associations remain attributable.

The demonstration establishes software behavior using synthetic evidence; it does not establish physical delivery.

Translate fresh route observations into actionable exceptions.

A controlled clock and increasing observations define off-route episodes. One persisted alert per episode separates acknowledgment from actual resolution.

Current roles and assignments scope operational alerts and manager actions. Only fresh increasing observations extend an episode; persisted alert identity prevents duplicate alerts after retry or restart.

The planned-path corridor is an explicit approximation; the demonstration does not imply a connected GPS fleet.

Explain operations through traceable, consistent measures.

Read-only reporting uses one repeatable-read snapshot, explicit UTC cohorts and stated denominators. Decimal-string totals retain monetary precision and link back to source records.

Administrator-only reporting reads persisted records under a repeatable-read, read-only database transaction. Unavailable data stays unavailable; zero denominators show no sample rather than fabricated metrics.

Current inventory snapshots are not historical balances. Order totals are not recognized revenue or evidence of production scale.