source-backed business administration
Prototype
Business administration, put in order.
Rândui turns a Romanian administrative procedure into a versioned service on one runtime: forms, rules, documents, official sources, human approvals, messages, and payments, none of them hardcoded into a wizard. Company formation is the first service; a registered-office change is the second. The name is the Romanian verb for setting things in a useful, tracked order. It replaced the working name Temei, which still names the repository and the package scope, and it is approved as a product direction, not yet cleared as a trademark. The platform is built to its whole specification and runs locally; the public launch waits on trademark, legal, and live-provider gates.
I designed the platform and its boundaries: the Service Pack model, the Company Passport and its source rules, the connector ports, the security posture, and the identity, and I led the build to a full-product bar rather than an MVP.
Project images
What we are building
Versioned Service Packs
A service is a manifest: eligibility, data and UI schemas, required documents, deterministic rules, workflow, templates, messages, pricing, source references, and tests, with a release hash. The compiler refuses a required field without a reason and source, a blocking rule without a test, and a template variable without a mapping. Two packs sit in the catalogue today.
Company Passport, implemented
Each company fact carries its source, retrieval and effective dates, confidence, and confirmation state. Confirmation is server-owned from a durable source observation with a versioned hash. Official, client-claimed, and case-accepted values stay separate, and a fact cannot become verified while its source is stale, partial, or in conflict.
Connectors behind ports
Service Packs ask for a capability, never a vendor. Four packages exist: ANAF public registers, BNR exchange rates, EU VIES, and a mock. Fixtures are the deterministic baseline; the live ANAF and BNR adapters exist but have no authorised real-endpoint evidence yet, so they are not active. A connector is not active because a URL exists.
Two surfaces, one case
A client web app in Romanian and English and an invite-only operator workbench work the same case: intake, documents, a fail-closed rules DSL, operator review, audit, and a jobs plane with an outbox. Telegram is bound as the first external channel. The AI gateway explains fields and drafts summaries; it does not choose a fiscal regime, approve a beneficial owner, or file anything.
How it works
A locked stack, and what actually runs on it
Node 24, pnpm, Turborepo, NestJS on Fastify, PostgreSQL with Drizzle, Temporal, BullMQ, Better Auth and Next.js. A modular monolith of 30 workspace packages and six apps: client web, API, operator admin, marketing, design sandbox, and docs viewer. The Temporal host runs; product-level multi-step workflows are not started, so the case lifecycle is a PostgreSQL state machine for now. 277 unit test files and 10 Playwright specs sit behind a local verify gate.
Tenancy and evidence in the database
38 migrations. The first row-level-security tranche protects company and company_fact with indexed policies, a non-owner migrator role, and audited, expiring break-glass access; the other tenant tables are still application-enforced until later tranches. Operators use MFA, there is no public operator sign-up, and the audit trail carries no personal payloads.
Automation stays accountable
A critical rule cannot go active without an accepted source and a human approval; source changes become candidate requirements, never auto-published rules. The AI gateway has offline evals and a kill switch, and live model keys, live connector evidence, payment keys, and the legal packs are separate human gates. The platform does not file on official portals by scraping, and it does not claim to be an authority.