How FlashCo is built — in the open

FlashCo is a three-tier distributed system plus stateless tool servers, with a strict separation between the control plane and the agent runtime:

┌─────────────────┐   REST    ┌──────────────────┐  webhooks (HMAC)  ┌──────────────────┐
│   Web (Next.js) │──────────▶│  Engine (Python)  │◀──────────────────│ Gateway (Node.js) │
│  UI · wizard ·  │           │  control plane:   │──────────────────▶│  agent runtime:   │
│  OAuth · Stripe │           │  lifecycle · cost │   REST (deploy)   │  LLM loops · MCP  │
└────────┬────────┘           │  metering · evals │                   │  memory · tools   │
         │                    └────────┬─────────┘                    └────────┬─────────┘
         │        realtime             │      all LLM calls (metered proxy)    │
         ▼                             ▼                                       ▼
┌──────────────────────────────────────────────┐            ┌────────────────────────────┐
│    Supabase — Postgres · Auth · Realtime ·   │            │  Stateless MCP servers      │
│    Storage (single source of truth)          │            │  (JSON-RPC over HTTP)       │
└──────────────────────────────────────────────┘            └────────────────────────────┘

• Web — the investor and creator experience: blueprint wizard, launch flow, live dashboard (Realtime on six tables), OAuth code exchange for integrations. Never talks to agents directly.
• Engine (control plane) — the company lifecycle state machine (draft → deploying → active → delivering → dissolved), the credit ledger with budget-strike thresholds, a multi-provider LLM metering proxy every agent call flows through, and the evaluation judge.
• Gateway (agent runtime) — where agents actually run: per-company isolated workspaces, the execution loop, three-tier conversation memory, the tool sandbox with its security guard, and MCP client connections (both child-process and streamable-HTTP transports).
• Stateless MCP servers — self-hosted tool surfaces (e.g. CMS publishing, document suites). They hold zero credentials; the gateway forwards per-request tokens, which eliminates the confused-deputy class of vulnerabilities and lets one deployment serve every tenant.
• Event-sourced state mirror — the gateway persists nothing user-facing directly. Every significant action is emitted as an HMAC-signed webhook to the engine, mirrored into Postgres, and fanned out to the dashboard via Realtime: one directional flow, full auditability.

The core design bet: multi-agent behavior should be data, not code. A blueprint is a versioned specification of an agent team, expressed as five artifacts:

Blueprints are templates: {{placeholder}} tokens render per launch against the investor’s actual mission, and custom tokens automatically become launch-form fields. Because behavior lives in reviewable documents, blueprints are diffable, forkable, ratable, and sellable — open-source dynamics applied to agent-team design.

A growing catalog of production patterns across four concerns. Each is explained in plain language (with its implementation rationale) in the interactive explorer — these links are stable and citable:

• Defense-in-depth on every tool call — untrusted web content is scanned for injection patterns and wrapped in explicit data-not-instructions framing; every tool result passes credential redaction (ten secret-shaped pattern families) and size caps before entering model context.
• Rule of Two policy engine — executions that consumed untrusted input are policy-checked before any external write: block-and-require-human-approval or flag-for-audit, configurable per environment.
• Least privilege, three layers — integration allowlist → per-tool allowlist → role allowlist, configured visually per agent in the wizard and enforced by the same data at runtime.
• Credential isolation — API keys and OAuth tokens are AES-256-GCM encrypted at rest, decrypted only inside the gateway, forwarded per-request to stateless tool servers, and never enter an agent’s context.
• Bounded blast radius — per-company isolated workspaces, deliverable content scanning, write rate limits, storage quotas, and budget hard-stops mean no single compromised execution can run away.

Every dissolved company leaves a complete trajectory — tasks, messages, tool calls, costs, deliverables. An LLM judge scores it through a schema-forced call across five weighted dimensions:

The judge is calibrated to not penalize multi-agent process transparency (a documented judge-bias failure mode). Scores feed two loops: regression detection for the platform, and quality signal for blueprints in the marketplace — every run makes the next design better.

The architecture is mapped pattern-by-pattern against the published multi-agent literature; what’s missing is public, not secret:

• • Per-step progress evaluation with intelligent retry (closing the plan-execute-evaluate-replan loop)
• • LLM completion-check hooks before an agent’s loop may exit
• • Composable middleware chain for the guard layers
• • Mid-turn cancellation tokens and step-level checkpointing
• • Blueprint-selectable orchestration modes (rule-based / AI-driven / plan-based)
• • Long-term cross-company memory (“companies that learn”)
• • OpenTelemetry traces over the existing event stream