Architecture at a glance

The shape

Veristep is a Next.js 16 application (App Router, server components, server actions) deployed on Vercel, in front of a single PostgreSQL database on Supabase with its storage and authentication. There is no separate API tier and no message bus: a request runs as the signed-in person, every read and write goes through PostgREST or a direct server-side connection, and Postgres decides what that person may do.

That last sentence is the design. Authorization, evidence rules, freezes and audit are triggers, policies and security-definer functions in the database. The application gives friendly refusals; it is never the only thing standing between a person and a row.

Application

Next.js on Vercel. Server components read as the user; server actions write as the user; a handful of route handlers stream exports and serve crons.

Database

PostgreSQL on Supabase, AWS us-east-2. Row-level security on every table. 79 idempotent, checksummed migrations.

Files

Supabase Storage, private bucket, signed URLs of one hour, visibility derived from the records that reference the path (lt_evidence_ref).

Auth

Supabase Auth: email and password, optional TOTP second factor (AAL2 step-up). Passwords never touch application code.

AI

Ten agents run on a model provider behind one interface (Gemini today; Anthropic and OpenAI-compatible endpoints supported) and act only through a permission-checked tool registry.

Modules are sidecars

The codebase is divided into named modules in a manifest (modules.json): every source file and every migration belongs to exactly one, a module may import only from those it declares, the graph is acyclic, and a module marked non-core is never depended on by a core one. An automated test enforces all of that, so the AI workforce, billing, drawings, RFID and the rest can be removed without the quality platform noticing.