The operational infrastructure of a company that trades across continents

Nineteen sites, one codebase

Each surface of the business has its own subdomain: the producer portal, the buyer platform and its four programs, the specialist directory, each partner node, the internal consoles. They are not nineteen deployments. They are one Next.js application whose router reads the incoming Host header and serves the matching internal route.

The subdomain map used to live inside the router, until link previews needed the same map backwards, route to subdomain, to sign every shared card with the right absolute origin. Copying it would have created two truths: add a surface, the router serves it, and the link preview keeps pointing at the root domain. So the map moved to one file that both of them import.

Six of the nineteen, below. Different brands, different audiences, different languages. One repository, one deploy, one place to fix a bug. The three internal consoles are behind the staff login, so they are not pictured.

One source of truth per rule, and a script that enforces it

The quality grade of a coffee lot decides its price, its badge on the public catalog, its eligibility for an auction and what the producer gets paid. It is defined in exactly one file: the bands, the rule that the score decides, the rule that a boundary belongs to the grade above, the two-decimal rounding, the seals.

Every consumer reads from there: the producer portal, the buyer catalog and its structured data, the auction engine, the quoting tools, the payment ceiling calculator. Nothing recomputes it, and a verification script fails the build if anything tries.

That pattern repeats for every cross-cutting rule: the network map, the identity matrix, the season calendar, the legal identity, the frozen vocabulary, the SEO gate, the integration spine. Fifty-nine scripts run as guardians. They do not check style, they check contracts.

Identity: one account, many roles, eleven gates

One authentication account serves the whole network. On top of it sits a role matrix: producer and buyer are mutually exclusive, partners are their own role with their own account table and are never administrators, and the internal team lives in a separate table with per-console grants.

Every gate in the application asks the matrix, never its own version of the question. Two more guardians verify that every protected route has one and that account recovery works for each role.

The database pattern of the house

Row-level security is enabled on every table with zero policies by default, which means nothing reads it except the server. Access is then opened deliberately, one narrow policy at a time, and only where a user genuinely has to read their own rows.

Public reads never go through a wide policy. They go through a narrow view that exposes exactly the columns the public is allowed to see. Update paths are restricted by triggers that limit which columns can change and which state transitions are legal, so an API call cannot walk a lot into a state the process does not allow.

AI with a budget, and a ledger

Several parts of the platform use language models: content drafting, a producer advisor, a label scanner, improvement suggestions. Every one of those calls is recorded in a consumption ledger with its surface, its model, its tokens and its frozen cost.

The defaults are deliberate: a small model unless something demands otherwise, expensive steps opt-in with the price on the button, and a hard rule that missing a credential degrades deterministically and says so, rather than throwing an error page at a producer in a rural area.

Integrations that do not reach into other people's machines

The platform emits events named by domain, and an integration spine decides what to do with them. Nothing in a feature calls an automation platform directly, which is why replacing that automation platform is a change in one file rather than a search across the codebase.

The mirror to the company's knowledge base runs in one direction: the platform owns what it manages, the knowledge base reflects it with three properties that identify the record and link back. Only what has a named handler comes back the other way, and reconciliation is proposed by an agent and confirmed by a human.

Shipping, with a gate

The version number bumps in the same commit as the work, with a changelog entry and an entry in the architecture log, and the commit hash gets sealed into that entry on the next commit. Two guardian scripts enforce it.

The version badge is visible on every surface, so anyone can look at a screen and know whether they are seeing the latest deploy. That was the actual request behind the rule, and the rule is what makes it true.

What transfers to other applications

The domain is specific. The patterns are not. These are the pieces I would carry into a different product on the first day.