Tend — Modules Strategy

InternalCanon as of 2026-08-12 · Directive 2026-08-11 · Repo mapping: MODULE-MAP.md vs origin/main @ 38c13a8c

The strategy

Verdict on the current app: overbuilt and under-perfected. The move: a fresh side app, strangler pattern, one module at a time, cannibalizing the current codebase. Perfect each module before the next. Team workspace only after solo is nailed.

Why it matters commercially (canon §9): Module-1 product and the consulting offer are the same object — chat + data layer + connectors is what the embedded team installs in month one. Now: internal delivery kit. Later: the retainer's client-facing surface. Eventually: self-serve below the retainer line.

Two rules that keep this from becoming two companies:

Every client install runs on the modules. No bespoke stacks — otherwise consulting and product decouple.
Client deadlines never pull product engineers. Ever. The single discipline separating "product company with funded R&D" from "agency with a side project."

Timeline: 3–5 months to public modules while serving clients — aggressive but survivable; breaks only if rule 1 is violated. Raise-story: the end-of-year raise works only as "modules with in-market proof, consulting as distribution" — keep product and services legible as two P&Ls early.

The module map

Module 1 · Solo · chat + data layer · ~80% substrate exists

Chat + Data Layer (+ Connectors)

Chat that beats ChatGPT/Claude as daily driver — super agent: browsing, research, skills, connector reach, visibility. Bar: "doesn't make sense to use ChatGPT or Claude compared to this."
Chat→data-layer loop — agent proposes docs from conversation, inline edit, approve → auto-filed
Data layer front-and-center — attention queue on top (contradictions / quick approve / multiple choice), browsable file tree beneath, click → well-rendered
Connectors in/near the data layer — "super important, super easy and smooth"
Data Librarian removed — chat manages the layer; background grunt agents reconcile/dedupe/clean

Module 2 · Artifacts

Artifacts

Render, build+host web pages, mini-app coding, library.

Module 3 · Automations

Automations

Cron jobs with polished list / preview / run-history / edit UX.

Parked

Team workspace

Only after solo is nailed. The entire Team Hub shell is frozen, not deleted.

What the repo audit found

Module 1's substrate is ~80% present at production quality — and better-built than our own ground-truth doc claimed. The cannibalization is less "steal code" and more "fork the shell, keep the spine." The real new-build: super-agent accessibility APIs (sandboxed exec + browser automation), latency to the daily-driver bar, and two write paths.

Three corrections vs GROUND-TRUTH — all "more built than claimed"

The chat→data proposal loop is substantially shipped. Inline approve/dismiss proposal cards from main chat already exist (InlinePlaybookProposalCard) with a generalized proposal-card spine. Missing is only the proactive "here's a draft for your data layer" trigger + inline-edit-in-card — a small extension, not a rebuild.
The unified attention feed landed. GET /v1/attention is live — ranked, tiered, dismissable. Fragmentation is presentational, not architectural. Only the contradiction→confirm write primitive is deferred, and the feed already reserves its slot.
David landed everything. All of #2421–#2424 merged, plus the entire launch-week run through #2569. ~17 stale rook/w38-* branches are prunable.

Repo shape (origin/main)

7-app monorepo: apps/web (Next.js, 693 files) · apps/application (CF Workers/Hono edge API, 712) · apps/agent (per-tenant Node agent on Fly, 256) · control-plane / admin / mobile / virus-scanner. ~90 DB tables, RLS-enforced, 920 test files.

Module 1 — existing code → verdicts

Capability	State	Verdict
Chat core (SSE stream, resume, attachments, typed blocks, projects, stop)	Mature — best-built surface. Latency is the only real debt.	STEAL AS-IS
Research / deep_research	Built, real tool. Open-web browse is not this.	STEAL AS-IS
Skills (9 seeded, tool bindings)	Built, prompt-wired.	STEAL AS-IS
Subagents / delegation	Built, grant-safe.	STEAL AS-IS
Doc / PDF generation	Built (feeds Module 2).	STEAL AS-IS
Connector tool-use (gmail/drive/slack/atlassian/hubspot + memory tools)	Built, grant-gated.	STEAL AS-IS
"Accessibility APIs" — sandboxed exec (#1068), browser automation (#1070)	Deliberately un-built. Largest genuine greenfield.	MISSING
Chat→data proposal loop	Cards + write rail shipped; needs proactive trigger + inline-edit + `data_file` variant.	STEAL + REWORK
Attention queue	`/v1/attention` live; consolidate WaitingOnYou + tray into one queue UI.	STEAL + REWORK
Contradiction → confirm-fact write path	Feed slot reserved; write primitive unbuilt.	REBUILD
File tree + renderer	Built (categories, click→render/edit, provenance). Polish bar unmet (~150 P2s).	STEAL + REWORK
Upload / virus-scan / extraction	Mature pipeline.	STEAL AS-IS
Connectors (16–17 Composio, core-7 at launch bar, OAuth, freshness, write-safety)	Mature-ish. "Join the module map" = placement, not build.	STEAL AS-IS
Background grunt agents (scheduled curation passes → pending edits)	Built under librarian persona — re-own under base agent, keep the jobs.	STEAL + REWORK

Modules 2 & 3 — quick verdicts

Module	Exists & stealable	Missing
2 · Artifacts	Artifact render pane (Surface + typed blocks) · library grid w/ versions & deep-links (strip team-share arm) · publishes ledger	"Build+host web pages / mini-app coding" — new build, gated on sandboxed exec (#1068)
3 · Automations	Automation home w/ conversational creation, template gallery · cron/scheduler engine (silent-outage class killed) · runs ledger (consolidate from /outputs) · agent-drafted suggestion miner (flag-gated)	Mostly consolidation + polish, not build

What NOT to take

Data Librarian persona — remove per directive. Cheap: a thin persona over persona-independent plumbing. Keep the pending-edits ledger, pass-runs, and curation rules; delete the Hero/Chat UI and the persona entry.
Team Hub shell entirely — home/hub/work/rooms/members/shared-data/team-admin + room/workspace/share server code + team tables. Freeze, don't delete.
Solo legacy surfaces — /map (Business Map — impressive, not Module 1), /pipeline, /outputs (fold runs into M3), /workflows (superseded), /dev.
Voice intake (Vapi), billing surfaces — hide; keep code dark.

Gaps ranked (biggest build first)

Sandboxed exec + open-web browser automation (#1068/#1070) — the "super agent accessibility APIs." Real greenfield.
Latency to daily-driver bar — p50 first-token 5.6s vs 2.5s target; prompt-cache flip dark; verify pass holds ~4s.
Proactive chat→data propose trigger + inline-edit-in-card — medium; extends the shipped proposal spine.
Confirm-fact write path (contradiction → proposal) — medium; slots into a reserved seam.
Rendered-file quality to "beats ChatGPT" bar — polish, not build (~150 P2s to sweep).
Attention-queue consolidation — one interaction grammar over the live feed. Small-medium.
Solo first-run intake — current intake is team-first, lives on stale branches. Small-medium.
Production cutover + real push — ops, not product.

Execution model — fork the shell, keep the spine

The side app becomes a second web client of the existing apps/application API — the application layer is already the seam between web and agent, so this is the cleanest strangler cut available.

Share (do not replicate)	Fork fresh
DB + RLS schema · WorkOS auth + agent-JWT · agent runtime + Fly control-plane · connector engine · retrieval stack (vector+graph+hybrid) · Inngest job queue These are the mass and the moat; re-implementing any is weeks-to-months and re-opens solved safety surfaces.	The web shell chrome · the /data + attention-queue surfaces (recut into one polished queue-over-tree) · chat surface chrome Keep SSE / proposal-card contracts identical so the fresh UI drops onto existing routes.

Three cannibalization risks

1 · RLS / multi-tenant coupling. Retrieval + data layer assume Neon RLS roles and tenant-scoped JWTs. A fresh DB silently loses tenant isolation; you can't cleanly amputate "solo" from the schema. Plan: share the DB, don't surface team tables.

2 · Fly control-plane dependency. The agent is a per-tenant VM behind a coordinator, not a library call. Sharing the runtime inherits that fleet's ops; forking a lighter agent re-implements the tool loop + subagents + retrieval — expensive.

3 · Proposal-substrate entanglement. Chat→data loop, attention feed, and approvals share one proposal/audit substrate. Fork it and you rebuild three surfaces. Extend the existing spine instead.