Agents write the code. You decide what ships.
Describe the product in a sentence, the way you would to any prompt-to-app tool. What comes back isn't a demo you rebuild before anyone can use it — it's a repository that already went through 13 stages of reuse, design and executable gates, and parked at the 3 points where a person is legally on the hook. Self-hosted. Row-level security enabled and forced from the first commit.
No card. No account for intake. Runs on your machine or ours.
Verified at build time — if a number here is wrong, the build fails
One method, whatever you're starting from
The same 13-stage pipeline carries a blank page and a codebase you've run for a decade to the same place: staged, reviewed, operated.
From a sentence to a reuse map
Stage 1 checks what you're describing against the catalogue before anything is written. The part before that sentence — market research, finding the customer's actual pain point — isn't a Rathvan screen. It's the conversation you have first, in your own head or a doc; the pipeline picks up at the reuse map and carries it from there.
From a repository to a baseline
Point it at a legacy repo instead of a blank page. It reads the tree and the commit history at one resolved commit — no diffs, no old file versions, secrets and PII scrubbed before anything reaches a model — writes a cited baseline document, and proposes a roadmap grounded only in what it actually read.
Both paths rejoin the same run: PRD → design → build → the executable gates → staged → the operational-readiness gate before anything is called live. Modernising what you already run and building what doesn't exist yet are one pipeline, not two products.
Two things a five-minute demo never has to solve
They're also the two questions a finance or security reviewer asks first, and the reason a prototype stays a prototype.
Never a Rathvan ledger
QuickBooks Online, Xero, Zoho Books, or a Tally bridge you run on your own machine — Rathvan reads and posts through your accounting system's own API. There's no platform ledger to reconcile against, because there isn't one: balances, journals and the chart of accounts stay the system your auditor already trusts.
The pipeline doesn't stop at deploy
Stage 10 instruments the deploy boundary, the first error after boot, and the number that actually catches a stuck queue — what's left, not what's processed. Stage 13 is the operational-readiness gate: a runbook, a named owner, a rollback that needs no deploy, and the query that proves it's working, before anything is called live.
What a diff review cannot give you
Four things that have to be decided before the code exists, or not at all.
The key never leaves
Credentials sit encrypted on hardware you control. No key, no storage — plaintext is never a fallback. Nothing is indexed off-box.
Authorisation is one lookup
Four roles and a viewer who reads a design without being able to approve it. Teams address work and grant nothing. The last owner cannot be removed.
STAGED is the last state
No method in the platform expresses the move past it. Production needs a person, and the refusal is structural rather than configured.
Approval binds to a version
Every stamp attaches to the exact artifact under review. Every transition writes an audit event naming its actor — including the refusals.
Rigour by stakes
A workspace belongs to exactly one track. The track decides which stages apply and how many gates block.
| Track | Ships to | Gates | What it forces |
|---|---|---|---|
| Build or edit a web app | production | ◆ ◆ ◆ | All thirteen stages, all three gates, nothing relaxed. Editing an existing codebase is the harder half — bounded ownership, minimal diff, and the reuse map is the entire job. |
| Create prototypes | nowhere | — | Tightens the two stages people skip; relaxes the rest. A prototype must be structurally incapable of shipping — separate namespace, no production credentials, an expiry. Promotion is a restart, not a merge. |
| Convert designs to code | pull request | ◆ | Round-trip fidelity or bounded ownership — a generator that rewrites a component discards every hand-edit since. Tokens are a failing gate, not a review comment. |
| Manage content | production | ◆ | Publishing changes data, never code. If a content change needs a build, an engineer is back in the loop and “without developer dependency” is false. |
| Marketing sites | production | ◆ ◆ | A marketing page fails invisibly. Deep-link objects must exist — a 404 rewritten to 200 renders as a blank page with an empty console. Verify by downloaded size, never status code. |
| E-commerce | production | ◆ ◆ ◆ | Everything tightened, plus the full security pass. The amount is server-priced from the catalogue, always. Not yet in the kernel: catalogue variants, cart, inventory, fulfilment, returns, tax. |
| Personalization | production | ◆ ◆ | Never average across variants — the aggregate hides the losing one. Assignment must be stable and recorded, and the stopping rule is decided before launch. |
A refusal, in full
Proof is a real run that stopped, not a happy path.
rathvan run --workspace courier-ops → 09 gate tests 13 gates · 12 passed · 1 failed ✗ ReuseLint architecture references types that do not exist · DispatchWindow no such type in catalogue or scaffold · Courier.reassign() no such method on Courier ◆ build halted at stage 09 state: STAGED → held nothing written to source control · nothing deployed audit: run.gate.refused actor=system/ReuseLint 2026-09-11T04:18:22Z
You do not have to build it to get it
Four capabilities are decoupled from the catalogue. Take them as a service today, or generate them into your own repository. Same source, same gates.
Editorial & content
Workflow, review, scheduling, publishing and content governance for people who publish for a living.
Feed & community
Feeds, follows, reactions and moderation — multi-tenant from the first migration, not as a paid upgrade.
Courses & certification
Embedded inside your product, not a separate place your users have to log into.
Notification orchestration
Preferences, digests and routing above the transport you already pay for. Billed per workflow run, not per message.
Three ways to run it
The console is a client. It is only ever pointed at a builder somebody runs.
Scaffold and run
No account. Node 20+, JDK 21+, Docker. Prints the plan — every file, every skip, with the reason — and writes nothing until you confirm.
npx rathvan new ./your-product
Self-hosted builder
macOS image with a bundled Java runtime and its own console. Unsigned, not notarised — you build it yourself.
build.rathvan.com
The same builder, run by us in Mumbai. Organisations, SSO, audit streaming, spend caps. Your model keys, your source control.