Build almost any business app.
Field service, HR, a bike workshop, a CMS, a coffee shop, a support desk — eight demo verticals on one kernel, and four of them run their core domain on the kernel alone. Tenancy, identity, permissions, audit and GDPR come with the foundation instead of with your discipline.
npm create substrat my-appEight demos. Eight businesses. One foundation.
Chosen, not accumulated — each one proves a different way of using the platform. The foundation is identical in all eight; the vocabulary, the screens and the shape are not.
None of this is a feature you build.
Every one of these exists the moment your project does — on the laptop and in production, the same code either way. Nothing here is a checkbox on a pricing page or a module you install.
The list is the argument. Any one of these is a sprint; the identity and audit ones are a quarter and a consultant. They are here because the layer under your app is the same in every business — which is exactly why nobody should be rebuilding it per product.
One operation, whole.
This is the entire handler. Everything in the right-hand column happened anyway — not because the code asked for it, but because it could not avoid it.
// The vertical's own operation, composing the work-order engine.
const createWorkOrderOp = async (ctx, input) => {
assertAllowed(await ctx.check(WO.create));
const facility = ctx.sql.query(
'SELECT * FROM callout_facilities WHERE id = ?',
[input.facilityId],
)[0];
if (!facility) throw new Error(`facility not found`);
return createWorkOrder(ctx, { // the engine's in-scope
facility: ref('facility', facility.id), // function, inside
customer: ref('customer', facility.customer_id),
kind: input.kind, // YOUR transaction
title: input.title,
});
};- 01No tenant filterThere is no WHERE tenant_id to forget. ctx.sql reaches this scope’s own database and cannot address another.
- 02No audit callThe engine emitted a work-order event stamped with tenant, scope, actor and time — below this code, which cannot forge or suppress it.
- 03No transaction managementThe operation is the transaction. The throw rolls back the rows, the events, and any platform intent it had enqueued.
- 04No lock, no retry loopOne operation runs in this scope at a time, to completion. Read-modify-write needs no ceremony.
- 05No fork of the enginecreateWorkOrder is a plain export called inside the vertical’s own handler — extension by composition, so upgrading the engine stays an upgrade.
We build the substrate. You build the verticals.
The engines in the middle are optional — compose them where your domain matches one, and skip them where it doesn’t.
Seven engines you don’t have to write.
They own the invariants that are the same in every business: a state machine that can’t skip, an invoice immutable once exported, a booking that can’t double-allocate. Four of the eight demos above need none for their core domain, and three compose none at all — engines are there when your domain matches one, not a tax when it doesn’t. And no engine talks to a sibling: with N engines talking to the kernel there are N contracts to keep compatible; between each other there are N².
Code built on Substrat cannot:
None of this depends on the discipline of the code above it — which is the point, because increasingly that code is written by an agent.
Get the book: Substrat, end to end.
The docs answer a question and let you go. The book is the other thing: thirteen chapters, read front to back, on how the pieces actually join. It assumes nothing except that you have written server software before.
- →The path of one request from hostname to SQL and back, with every hop named
- →The life of one event from ctx.emit to a consumer, and which failures retry
- →What a push does to your data across a version change
- →What breaks in production where you look, and what the lifecycle states mean
EPUB for Apple Books, Kobo and any e-reader · also as one printable page or plain text
Open, a few teams at a time.
The hosted platform — pushes, domains, per-scope databases, the dashboard, the deploy previews — is invite-only while it is onboarded by hand, so that the people running on it are people we can answer. There is no queue number and no launch date attached to this: tell us what you would build and we will tell you honestly whether Substrat is ready for it yet.
The code is not gated.npm create substrat my-app works right now, against SQLite on your laptop, with the same kernel and the same engines the hosted platform runs. An invite is what moves that from your machine to ours.
The substrate holds.