Two products on one kernel. The router routes model calls by context, meters them and hosts partner models. The harness is the governed assistant built on rooms: people, bots, shared money and a record. The kernel underneath is identity, tenancy, gates, the audit chain, the ledger and lifecycle; the ops plane is the operator console.
- Guides start at
docs/guides/README.md; the integration pieces atdocs/integrations/README.md.
| Product | API modules (apps/api/src/modules/<product>/) |
Web surface (apps/web/src/surfaces/<product>/) |
Deploy profile | Staging hostname |
|---|---|---|---|---|
| MassRelay | relay/ — gateway, router, memory, partners, relay |
relay/ (console), partners/ (partner portal) |
gateway (OpenAI-compatible /v1/* + rankings, apps/relay-gateway); relay (api-relay — kernel + MassRelay, incl. Partners) serves the two surfaces' own /api/* |
relay-stag.example.com, partners-stag.example.com |
| the harness | control/ — agentruntime, agentdefs, rooms, tasks, companion, channels, integrations, pieces, reminders, attachments, team, flows, connectors, toolinstances, llm, mcp, evidence, clearance |
control/ (today's default surface: pages/, control-only components/) |
control (api-control — kernel + the harness) |
control-stag.example.com |
| kernel (shared, no surface of its own) | kernel/ — envelope, gates, audit, auth, membership, payments, platform (tenant/plan/billing — the old modules/control, renamed to avoid colliding with the harness product name), access, scim, seed, settings, notifications, onboarding, scheduler, proposals, consent, legal, lifecycle |
shared components only: apps/web/src/components/{ui,shell,charts} + the explicit cross-surface allowlist in structure-surfaces.test.ts |
— (mounted inside whichever profile calls it) | — |
| ops (operator plane) | ops/ — ops, incidents, health |
apps/ops (separate app, not a surfaces/ entry) |
api-ops |
ops-stag.example.com |
Beside the TypeScript API there is the Rust workspace (crates/, one binary mr-server with the profiles api and
gateway), which takes over route by route; private/blueprint/07-architecture.md lists the crates and says what runs on which
database. packs/ holds policy and product data by owner (relay/, control/, kernel/, ops/).
npm run verify
The whole chain: types, every suite, the Postgres suite, the red-team set, piece certification, import direction, the document
and tracker checks, the web, ops, relay and partners browser suites on isolated ports, and the Rust gates. Narrower commands are
in AGENTS.md §10. Each app's own package.json has its dev script; deployment is deploy/README.md,
deploy/stag/README.md and deploy/prod/README.md.
One host, one command, no clone: deploy/community/README.md is the guide (what it installs, what it does not, sign-up and
ports). Do not pipe the installer into a shell; verify it first:
Verify the installer BEFORE you run anything (the trust anchor is this README, not the release):
TAG=v0.1.0
B=https://github.com/nicholasandreasujitno/massrelay/releases/download/$TAG
curl -fsSLO $B/install.sh -O $B/install.sh.sig -O $B/cosign.pub
sha256sum cosign.pub # must print: 9b7844f5eb57e7518917856a5622389d78fd8ad8d6acf4960254251b513ad185
cosign verify-blob --key cosign.pub --signature install.sh.sig install.sh # must print: Verified OKThe fingerprint above is COSIGN_PUB_SHA256 inside install.sh and is checked against this file by a test
(tools/deploy/compose-community.test.mjs), so the two cannot drift. A release is signed with that one key; whoever can
upload release assets but does not hold it cannot produce an install.sh that passes the second command.