Pre-release 0.x — working end to end on two adapters

The hard parts, hosted.

AI made building vertical B2B software fast — except multi-tenancy, identity, permissions, audit, and GDPR. Substrat owns those parts and enforces them at runtime, so small teams can build production-grade SaaS on top without the speed being fatal.

Get started Why runtime enforcementpnpm create substrat

The idea in three layers

We build the substrate. You build the verticals.

Kernel--layer-kernel

Everything true of every B2B SaaS, nothing true of any particular one: identity, nested tenancy, permissions, events & audit, GDPR machinery. Owns no domain entities.

Engines--layer-engine

Shared domain machinery — work orders, invoicing, protocols — that owns invariants: state machines can’t skip states, exported invoices are immutable, every mutation emits an event.

Verticals--layer-vertical

The actual products — your code. Vocabulary, workflows, screens, pricing. The layer where AI tools do their best work, because mistakes there are cosmetic.

Enforced at runtime

Code built on Substrat cannot:

None of this depends on the discipline of the code above it — which is the point, because increasingly that code is written by an agent.

Reach another tenant’s data

Data access only exists as capability-scoped operations minted for one (tenant, scope) pair — a mismatch fails closed.

Skip the audit log

Events are stamped with tenant, scope, actor, and timestamp below the API surface. Calling code cannot forge or suppress them.

Emit unclassified PII

Every event carries a mandatory piiClass; a PII-classed event without a data-subject key fails validation, so GDPR erasure is always possible.

Bypass the permission model

Operations run inside the scope’s execution domain; every allow carries the proof path that granted it. The secure default is deny everything.

Reference verticals

The same kernel, three businesses.

RallyPointPadel club

Court booking as allocation over an interval rather than a state machine — the lost race rejected with no locking code anywhere, multi-venue tenancy, and a player who holds no role at all reaching their own booking through an entity-narrowed grant.

MeridianHR

The shape-breaker: no engine exists for its core domain, so leave, time and expenses are vertical code on the kernel alone. Multi-country scopes diverging from one codebase, and one role-adaptive app serving employee and manager in the same surface.

CalloutField service

The canonical composition — a Swedish service & installation firm where two engines cooperate through events with zero imports between them. Runs on SQLite locally and deployed on Cloudflare from one codebase.

Current status

What exists today

@substrat-run/contractsZod contract schemas — the source of truthworking

@substrat-run/kernelScope-host contract + tuple permission checkerworking

@substrat-run/adapter-sqlitePure-SQLite scope host — local dev, CI, self-hostworking

@substrat-run/adapter-cloudflareDurable-Object scope host — productionworking

@substrat-run/contract-testsThe conformance suite both adapters pass unchangedworking

@substrat-run/engine-workorderWork orders, time & materialseed

@substrat-run/engine-invoicingInvoice basis, immutable exportsseed

@substrat-run/engine-protocolChecklists & protocolsseed

Build the vertical.
The substrate holds.

Get started View on GitHub