Agents write the code. You decide what ships.
Describe the product in a sentence. Rathvan runs it through 13 stages — reuse, design, scaffold, executable gates — and parks at the 3 points where a person is legally on the hook. Self-hosted. Row-level security enabled and forced from the first commit.
No card. No account for intake. Runs on your machine or ours.
Verified at build time — if a number here is wrong, the build fails
What a diff review cannot give you
Four things that have to be decided before the code exists, or not at all.
The key never leaves
Credentials sit encrypted on hardware you control. No key, no storage — plaintext is never a fallback. Nothing is indexed off-box.
Authorisation is one lookup
Four roles and a viewer who reads a design without being able to approve it. Teams address work and grant nothing. The last owner cannot be removed.
STAGED is the last state
No method in the platform expresses the move past it. Production needs a person, and the refusal is structural rather than configured.
Approval binds to a version
Every stamp attaches to the exact artifact under review. Every transition writes an audit event naming its actor — including the refusals.
Rigour by stakes
A workspace belongs to exactly one track. The track decides which stages apply and how many gates block.
| Track | Ships to | Gates | What it forces |
|---|---|---|---|
| Build or edit a web app | production | ◆ ◆ ◆ | All thirteen stages, all three gates, nothing relaxed. Editing an existing codebase is the harder half — bounded ownership, minimal diff, and the reuse map is the entire job. |
| Create prototypes | nowhere | — | Tightens the two stages people skip; relaxes the rest. A prototype must be structurally incapable of shipping — separate namespace, no production credentials, an expiry. Promotion is a restart, not a merge. |
| Convert designs to code | pull request | ◆ | Round-trip fidelity or bounded ownership — a generator that rewrites a component discards every hand-edit since. Tokens are a failing gate, not a review comment. |
| Manage content | production | ◆ | Publishing changes data, never code. If a content change needs a build, an engineer is back in the loop and “without developer dependency” is false. |
| Marketing sites | production | ◆ ◆ | A marketing page fails invisibly. Deep-link objects must exist — a 404 rewritten to 200 renders as a blank page with an empty console. Verify by downloaded size, never status code. |
| E-commerce | production | ◆ ◆ ◆ | Everything tightened, plus the full security pass. The amount is server-priced from the catalogue, always. Not yet in the kernel: catalogue variants, cart, inventory, fulfilment, returns, tax. |
| Personalization | production | ◆ ◆ | Never average across variants — the aggregate hides the losing one. Assignment must be stable and recorded, and the stopping rule is decided before launch. |
A refusal, in full
Proof is a real run that stopped, not a happy path.
rathvan run --workspace courier-ops → 09 gate tests 13 gates · 12 passed · 1 failed ✗ ReuseLint architecture references types that do not exist · DispatchWindow no such type in catalogue or scaffold · Courier.reassign() no such method on Courier ◆ build halted at stage 09 state: STAGED → held nothing written to source control · nothing deployed audit: run.gate.refused actor=system/ReuseLint 2026-09-11T04:18:22Z
You do not have to build it to get it
Four capabilities are decoupled from the catalogue. Take them as a service today, or generate them into your own repository. Same source, same gates.
Editorial & content
Workflow, review, scheduling, publishing and content governance for people who publish for a living.
Feed & community
Feeds, follows, reactions and moderation — multi-tenant from the first migration, not as a paid upgrade.
Courses & certification
Embedded inside your product, not a separate place your users have to log into.
Notification orchestration
Preferences, digests and routing above the transport you already pay for. Billed per workflow run, not per message.
Three ways to run it
The console is a client. It is only ever pointed at a builder somebody runs.
Scaffold and run
No account. Node 20+, JDK 21+, Docker. Prints the plan — every file, every skip, with the reason — and writes nothing until you confirm.
npx rathvan new ./your-product
Self-hosted builder
macOS image with a bundled Java runtime and its own console. Unsigned, not notarised — you build it yourself.
build.rathvan.com
The same builder, run by us in Mumbai. Organisations, SSO, audit streaming, spend caps. Your model keys, your source control.