Platform · 17 Integrated Capabilities
Apps, data, and AI on one fabric.
Every primitive required to build, deploy, operate, and continuously improve software — scheduled by a single control plane on European bare metal and declared in one stack.json.
Four layers, one project graph
Traditional cloud platforms expose hundreds of disconnected primitives that force small product teams to become system integrators. As part of the Software Lifecycle Cloud, KERNSTACK unifies Infrastructure (compute, data, search, AI, workflows, analytics), Code (stack.json, hosted git, SDKs), Intelligence (isolated agent sandboxes and model catalog), and Collaboration (project conversations and boards) into one coherent system.
Explore each capability below to inspect its stack.json declaration, SDK packages across Go, Node.js, Python, and PHP, credit metering model, and reference architectures.
intelligence · Agents Agent sandboxes Isolated sandboxes for coding agents infrastructure · Insight Analytics Product analytics on the same fabric infrastructure · Data Buckets Object storage with presigned upload infrastructure · Edge CDN Cached delivery for apps and assets collaboration · People Collaboration Boards and conversations on the project infrastructure · Compute Functions Go WebAssembly HTTP handlers infrastructure · Edge Gateway HTTP, WebSocket, and prefix routes code · Source Hosted Git Repository hosting inside the project intelligence · Models Inference Catalog and custom model calls infrastructure · Data Search Full-text search over project records code · Config Secrets Project secrets without a vault product code · Manifest stack.json One manifest for the whole project infrastructure · Data Tables Serverless key-value and document tables intelligence · Models Training Training jobs beside the data intelligence · Retrieval Vector search Vector and hybrid retrieval infrastructure · Compute Workers Container workers for long jobs infrastructure · Orchestration Workflows Durable workflows with human pauses
Architectures that use these services
Use case · Product Experiment assignment Assignment is a pure function of the subject key and the experiment’s salt — stable across requests, no coordination needed. The function records the assignment row once and serves the variant; outcome handlers were already writing events, which now simply carry the experiment id the assignment returned. Analysis reads assignments and outcomes from neighbouring tables with the same keys. Use case · Agencies Agency client delivery The studio’s delivery shape is a template stack.json: gateway, functions or workers in the client’s stack languages, tables, buckets, and apps under one target per client, on European infrastructure the studio can name in the pitch. Previews run the same declaration; the client’s approval happens in the bound conversation with a live link. Every client’s meter is separate by construction — the studio sees delivery cost per client without allocation spreadsheets. Use case · Agents Agent operations console The raw material already exists in the project: hosted git lists branches including agent/<id>, each agent branch maps to its environment, and every deploy begins as a plan a person approved. The console view arranges that material — branch, environment URL, plan summary, approval state — into the board engineering managers actually ask for, with conversations and board topics carrying the discussion around each run. Use case · Agents AI agent backend Hosted git carries the repository; agent branches namespace the experiments. The agent edits code and stack.json together, runs kernstack plan --json to verify its own change set, and a reviewer checks the same plan. Environments multiply cheaply because a project is declared, not hand-assembled: the agent-<id> environment runs the branch’s stack for click-through review. Use case · Operations Approval workflow The workflow declares the path: extraction or computation steps first, then the human step, then whatever the approval unlocks — payment release, publication, shipment. Approvers see a queue of titled tasks with the underlying record one click deep; their decision resumes the run with the outcome as data the next steps can branch on. Timeouts and reminders are part of the declaration, so a three-day-old approval nags its owner automatically. Use case · Compliance Audit log platform The audit table is keyed by the audited record’s id with time as the sort key, so a record’s whole history is one ordered read. Write paths either emit entries explicitly — best for business meaning (“discount approved by”) — or lean on a table change stream that invokes a function with batched item changes. Retention windows and legal holds are fields the archiving worker respects. Use case · Product B2B SaaS backend One project holds the product: a tenants table keyed by tenant id, accounts under it, gateway routes marked private with API keys, and Go functions for the API. Longer work — imports, report generation, webhook delivery — becomes nodejs or python workers when the founding code is not Go. Frontend apps live under apps/ and deploy into the same project, so staging and production differ by target, not by assembly. Use case · Finance Billing meter Metering is a write pattern, not a platform: every billable action puts a small row — customer, kind, quantity, timestamp — into the events table, keyed for per-customer reads. The monthly worker folds events into balances with the pricing rules as project code, and invoice drafts appear as records finance can inspect line by line. Analytics over the same events shows usage beside revenue, because it is the same table. Use case · Commerce Catalog search The products table is the only catalogue; the text index is declared over its searchable fields and rebuilds from it. The search function combines index hits with live reads — facet counts, stock states, prices — so merchandising rules (boost this season’s line, bury out-of-stock) are code and data in the project, reviewable before the sale starts, not a vendor console’s drag-and-drop. Use case · Trust Chat moderation The websocket route (functions only, by design) receives the message; before fanout, the handler calls the classifier and writes the outcome. Scores below the threshold deliver immediately, scores above it park the message in a quarantine table visible to moderators, and the sender sees a held state rather than a silent disappearance. Released messages fan out from the same handler, so ordering stays sane. Use case · Insurance Claims intake Intake is a state machine the claimant can see. The claim record lists required document types for its category; uploads land in the bucket under the claim’s prefix and flip checklist items as workers verify them. When the file is complete, a workflow step puts the claim in front of a handler with everything attached; requests for missing pieces go out as one precise message generated from the same checklist. Use case · Content Content delivery Content is files with states: draft prefix, published prefix, and archived versions beside them. Publishing promotes a file; the prefix route serves the published tree with a default key, canonical redirects, and hard 404s for what does not exist (fallback_mode: not_found, so analytics stays honest). Apps fetch the same objects at runtime through the routes file the platform writes, instead of baking URLs into builds. Use case · Compliance Compliance export The export is a workflow with a human at each end. A request step records the scope; a worker extracts the rows into per-table files, computes SHA checksums, and writes a manifest describing tables, windows, row counts, and hashes. An approver reviews the scope before the bundle leaves, and the presigned delivery link expires — the export is an event in the project’s history, not a file on a laptop. Use case · Legal Contract review The playbook is data: clause types, acceptable ranges, and fallback language in a table the legal team owns. On upload, a worker splits the contract into clauses, matches them against playbook entries, and classifies each as standard, deviation, or missing. The workflow presents deviations to counsel as individual steps; standard clauses never consume attention. Inference assists the matching, deterministic playbook data decides the verdicts. Use case · Product Customer portal The portal is an app served by a gateway prefix route, reading status rows the operational side writes and listing the client’s bucket prefix for shared files. Access keys are per client; a handler scopes every read to the authenticated client’s slice. Conversation topics belong to the project, shareable with partners, so the “any update?” message becomes a place both sides can read. Use case · Data Data pipeline A workflow on a cron trigger starts the extract worker, which reads sources with credentials held as project secrets, validates each record, and writes good rows to staging tables. A second step promotes validated batches into the published tables and records the run summary. Rejected records land in a failures table with the rule they broke — data quality becomes a queue somebody owns, not a surprise in a chart. Use case · Compliance Data retention The discipline is declared per table at design time: which field identifies the subject, which date ends retention, which flag freezes instead of deletes. The retention workflow walks those declarations on schedule and on demand for a named subject, acting identically in both cases — delete from tables, delete or anonymise bucket objects, and log subject, scope, and timestamp into a proof table that itself contains no personal payload. Use case · Documents Document processing Upload is a presigned URL into a bucket prefix reserved for unprocessed files. A worker claims each new document, extracts text and fields, and writes a record keyed by document id, with per-field confidence. High-confidence records flow onward; low-confidence ones become a human workflow step showing the page beside the extracted values, so confirmation is a glance instead of a retype. Use case · Commerce Ecommerce backend Catalogue rows carry price, stock, and the fields the text index searches; a cart is a session-keyed record the storefront functions read and write. Checkout creates an order row and hands payment to the provider; the provider’s webhooks return as stored raw events that a worker reconciles into order states, so “paid” is a derived, provable state. Fulfilment steps — pick, pack, ship, the occasional human “call the customer” — run as a workflow per order. Use case · Search Embedding backfill A worker does the walking; a table row does the remembering. The cursor records the last processed key, so a stopped job resumes where it left off and a second worker can take a disjoint key range. The new index is declared over the same sources, and queries keep hitting the old index until the backfill verifies — then one stack.json change points traffic at the new embeddings. Use case · Integration Event fanout The write stays a write. The table’s change stream delivers batched changes to a fanout function after the fact, which maps each change to its subscriber set — stored as data, so adding a subscriber is a row, not a release. Internal subscribers run as worker steps; external ones become delivery rows handled by the retry pattern. The handler that served the customer returns when the write lands; consequences proceed on their own clocks. Use case · Product Feature flags A flags table keyed by flag name carries the rule: off, on, or a cohort definition (tenant list, percentage bucket, region). Functions evaluate the rule from the row — cached briefly in-process — and write an exposure event next to the product’s own event tables. Changing a rollout is a row change through your admin surface, recorded with who and when; killing a bad flag is the same operation at higher speed. Use case · Product Form backend The endpoint is deliberately boring: validate, store, acknowledge. Spam discipline is layered — gateway rate behaviour, a honeypot/timing check in the function, and a quarantine state for submissions the classifier distrusts. Attachments never pass through the function; the form gets presigned URLs and the submission row carries the object keys. Routing is a workflow, so “leads over this value also ping the founder” is a declared step. Use case · Product Geo lookup The place dataset — id, names in the languages you serve, aliases and misspellings you have learned, coordinates — loads into a table, and a text index is declared over the name fields for ranked, prefix-friendly matching. The function normalises the query, checks the result cache for hot lookups, and falls back to the index. Cache entries are rows, so a place that gains a new local name teaches the system once, permanently. Use case · Product GraphQL API The worker is the GraphQL server (your framework of choice), deployed beside the data it resolves. Tables are keyed for resolver patterns — by id, by owner, by time — and persisted queries can be stored as rows when clients are first-party apps. Gateway routing keeps the endpoint private or public per environment, and the schema file lives in the repository the worker deploys from, versioned with the resolvers. Use case · Operations Human review queue Any automated step can end at a human step carrying the item’s context: the record, the machine’s scores, the rule that fired. The run waits; the queue shows age and reason across sources, because moderation, extraction exceptions, and approval requests share the step mechanism. Verdicts write back onto the source record, so downstream steps resume with the human’s answer as ordinary data. Use case · Trust Image moderation Uploads are born private: the browser gets a presigned URL into a quarantine prefix of the bucket. A worker scores each new object with a vision model and writes the scorecard to the uploads table. Clear passes publish by moving the object to the public prefix; clear failures reject; the middle band becomes a human step in a workflow, so the reviewer sees image, scores, and policy in one task. Use case · Operations Internal operations tool Start from the spreadsheet’s columns: they become a table keyed by the request’s natural id, with status, owner, and timestamps as fields. A minimal app — your framework under apps/, built and published by deploy — reads and writes through functions; files attach from buckets; and the workflow layer carries approvals as human steps, so the state “waiting on finance” is a place in a flow, not a cell someone coloured yellow. Use case · Finance Invoice extraction Each invoice is a bucket object and a record keyed by invoice id. The worker extracts header fields and line items, validates arithmetic (lines sum to total, tax rate matches the supplier’s country pattern), and parks discrepancies as review steps with the page shown beside the values. Only a human-approved invoice changes state to payable; the paying system reads approved rows, nothing else. Use case · Data Device ingest Ingest is a write pattern: the function checks the device key, stamps arrival time beside the device’s own timestamp, and appends the reading under the device key with the reading time as sort key. Clocks lie and networks retry, so arrival order is never trusted — queries sort by device time, and duplicate device timestamps overwrite idempotently. Aggregations (hourly means, last-state) are worker jobs writing summary tables the product reads. Use case · Support Knowledge base Articles are bucket objects, so publishing is a file operation with versions kept beside the current text. Indexes declared over the bucket make the corpus searchable by readers and retrievable by functions. A small table keyed by article and day collects helpful/not-helpful marks from the help UI, which gives editors a repair queue ranked by evidence. Use case · Media Media processing Upload completes into a quarantine prefix; a table change or workflow step starts the processing worker, which renders derivatives into a renditions prefix and writes the media record: dimensions, durations, rendition keys, moderation scores. Publication is a state on that record — public URLs exist only for cleared renditions — and reprocessing a new size is a worker run over the untouched original, not a negotiation with users to re-upload. Use case · Product Mobile backend The BFF is a set of gateway routes to Go functions (or a nodejs worker for TypeScript teams), each returning exactly the shape one screen needs. Sessions are rows keyed by device with expiry the handler enforces. Media uploads go straight to buckets on presigned URLs, and the resulting keys join the feed items that reference them, so the API never proxies bytes. Use case · Product Multi-tenant SaaS Every tenant-owned table keys on tenant id, with the entity id as sort key. Gateway API keys are issued per route and mapped to tenants in a tenants table; functions resolve the tenant from the key, never from request input. Quotas are counters in the tenant’s own slice, incremented by the same writes they limit, so enforcement and evidence are one record. Use case · Product Notification fanout Producers emit an event — kind, subject, template data — and start the notification workflow. Steps fan out per channel: the email worker renders the project’s template, the conversation step posts to the bound topic (mirrored to Telegram or WhatsApp where bound), and each outcome writes a receipt row. Preferences are recipient rows: channels a user muted are skipped by the step that would send, with the skip recorded too. Use case · Integration Partner API Gateway routes declare their API keys; each partner’s key maps to a partner row that carries their scopes, limits, and counters. Functions check the partner slice on the way in — key, scope, remaining rate — and increment counters on the way out. The partner-facing usage view reads the same counters, so the invoice, the throttle, and the dashboard never disagree. Use case · Documents PDF archive Ingest writes both sides atomically from the archivist’s point of view: object into the bucket under a stable key, row into the documents table with a SHA hash of the bytes, the signatories, and the retention label computed from document type. A worker extracts text for the search index. Deletion jobs read the same labels, skipping anything under hold, and log what they destroyed. Use case · Engineering Preview environments The stack is a file, so an environment is an instantiation: same stack.json, different target, seeded from seed files that ship with the repository (seed/tables and seed/buckets upload after deploy). Branch previews run the branch’s stack; agent branches deploy to agent-<id> environments automatically in code mode. Expiry is a target you delete, and its tables of rehearsal data go with it — no shared staging state to curate. Use case · Support RAG knowledge assistant Documents land in a bucket; a vector index is declared over that bucket and re-embeds from source when articles change. A Go function behind a gateway route embeds the question, retrieves the closest passages, and calls a catalogue or custom inference endpoint with those passages as context. Query logs go to a table, so unanswered questions become an editorial list. Use case · Product Realtime application Connect, message, and disconnect are function invocations over the socket route. Presence is a table row per connection with a heartbeat timestamp; fanout targets are read from subscription rows rather than held in process memory, so any function instance can serve any socket. Streams of notifications are written as rows first and pushed second — a reconnecting client catches up from the table, which is the difference between live and eventually-informed. Use case · Product Recommendation API Storefront and app functions write events into a behaviour table keyed by user and time; catalogue rows carry the descriptive fields a vector index embeds. The recommendation function reads the user’s recent items, asks the index for neighbours, filters against live catalogue rows — stock, region, permissions — and returns ranked ids with the reason recorded to a results table for later evaluation. Use case · Analytics Scheduled reports The report is code plus a schedule. The worker reads the same tables the product writes — no export step to drift — computes the defined metrics, and stores both the rendered file and the underlying numbers as a run record keyed by period. Delivery steps send the file link to the bound conversation or inbox. Definitions are reviewed code, so a metric’s meaning has a git history instead of a folklore. Use case · Search Semantic search You declare the index over its sources and the platform builds it from them. A function embeds the incoming query, asks the index for nearest neighbours, and merges results with ordinary keyed reads — price, permissions, stock — from the tables themselves. Text and vector indexes can coexist over the same sources when a query needs both exact terms and meaning. Use case · Product Session store Create-session writes a row with a random id, the user key, and an expiry timestamp. Each authenticated request does one keyed read; expiry is checked against the row, sliding if your policy slides. Revocation is a delete, effective everywhere instantly because there is exactly one copy of the truth. Worker and function handlers share the table, so websocket and HTTP faces of the app agree about who is connected. Use case · Logistics Shipment tracking Carrier events enter as webhooks stored raw (the ingestion pattern) or by a polling worker where no webhook exists; a normaliser maps each carrier’s statuses into the project’s canonical states and appends to the shipment’s timeline. Exception rules — no scan for 48 hours, returned to sender, customs hold — are evaluated by the reconciler and written as flagged rows with an owner, converting silent drift into a work queue. Use case · Web Sitemap publisher The generator is a worker on a cron workflow with three inputs, all inside the project: the gateway’s public routes, the published content prefix’s objects with their modification data, and an exclusions table for what must stay unlisted. It writes sitemap.xml (or a sharded index for large sites) into the site bucket and logs the run — URL count, additions, removals — so a sudden drop is a visible event, not a slow mystery. Use case · Support Support deflection The widget or help page calls a gateway route; the function embeds the question, retrieves from the article index, and asks a catalogue model to answer strictly from the passages. A confidence path decides: show the answer with its sources, or create the ticket with the retrieved passages attached so the human agent starts from evidence instead of from zero. Use case · Media Transcription pipeline Each recording is a bucket object and a record carrying its source, participants, and consent state. The transcription worker processes in segments, writing transcript rows keyed by recording and offset, with speaker labels attached per segment. A text index over the transcript table powers search with timestamps, so a result links to the second it was said; summaries and theme tagging can run as later worker steps over the same rows. Use case · Integration Webhook ingestion The receiving function does three things only: verify the signature, persist the payload under the provider’s event id, respond. Processing workers claim unprocessed rows, do the real work, and mark outcomes — processed, failed with the error, or dead-lettered after the attempt budget. Because the raw body is stored, reprocessing after a bug fix replays the true payload, not a reconstruction. Use case · Integration Webhook retry Emitters write delivery rows instead of calling out directly — same transaction of intent as the domain event itself. The delivery worker claims rows whose next-run time has arrived, posts with a timeout, and writes the outcome back: delivered with the response code, or rescheduled with exponential backoff and the error verbatim. After the attempt budget, the row parks in a failed state that a human step can release after the customer confirms their endpoint lives. EU alternative European alternative to Amazon API Gateway KERNSTACK routes are gateway.routes entries. API Gateway stages, models, and authorizers are not imported into stack.json. EU alternative European alternative to Amazon CloudFront KERNSTACK CDN is a prefix route with cdn_enabled. CloudFront behaviors, origins, and cache policies are not imported. EU alternative European alternative to Amazon DynamoDB KERNSTACK tables declare key_name and key_type. DynamoDB capacity, GSIs, and stream settings are not imported. EU alternative European alternative to Amazon OpenSearch KERNSTACK search is a search_indexes entry over tables or buckets. An OpenSearch domain configuration is not imported. EU alternative European alternative to Amazon S3 KERNSTACK buckets are named under resources.buckets. S3 bucket policies, ACLs, and replication rules are not imported. EU alternative European alternative to Amazon SageMaker Catalog models are called by id from the SDK. SageMaker endpoints, notebooks, and model artifacts are not imported. EU alternative European alternative to AWS Lambda KERNSTACK functions are Go WebAssembly handlers named in resources.functions. Lambda memory, layers, and event sources are not imported. EU alternative European alternative to AWS Step Functions KERNSTACK workflows are resources.workflows with steps you write. A Step Functions state machine is not imported.
FAQ
Frequently asked questions
Every service is declared in a single stack.json file at the root of your repository and scheduled by one control plane. Functions and workers read and write to Tables, Buckets, Search indexes, Inference endpoints, and Workflows using scoped identity injected automatically at runtime.
No. Every service draws from one shared environment credit balance metered across compute, storage, network egress, and catalog model steps. Idle services scale to zero.
KERNSTACK provides official SDKs and runtime support for Go, Node.js, Python, and PHP, plus a browser analytics SDK and static frontend hosting for SvelteKit, React, Vue, Angular, Next.js, and Ionic.
Connected in the Project Graph
Related capabilities, architectures, and comparisons
Use Case · ProductExperiment assignmentAssignment is a pure function of the subject key and the experiment’s salt — stable across requests, no coordination needed. The function records the assignment row once and serves the variant; outcome handlers were already writing events, which now simply carry the experiment id the assignment returned. Analysis reads assignments and outcomes from neighbouring tables with the same keys.Use Case · AgenciesAgency client deliveryThe studio’s delivery shape is a template stack.json: gateway, functions or workers in the client’s stack languages, tables, buckets, and apps under one target per client, on European infrastructure the studio can name in the pitch. Previews run the same declaration; the client’s approval happens in the bound conversation with a live link. Every client’s meter is separate by construction — the studio sees delivery cost per client without allocation spreadsheets.Use Case · AgentsAgent operations consoleThe raw material already exists in the project: hosted git lists branches including agent/<id>, each agent branch maps to its environment, and every deploy begins as a plan a person approved. The console view arranges that material — branch, environment URL, plan summary, approval state — into the board engineering managers actually ask for, with conversations and board topics carrying the discussion around each run.Use Case · AgentsAI agent backendHosted git carries the repository; agent branches namespace the experiments. The agent edits code and stack.json together, runs kernstack plan --json to verify its own change set, and a reviewer checks the same plan. Environments multiply cheaply because a project is declared, not hand-assembled: the agent-<id> environment runs the branch’s stack for click-through review.Use Case · OperationsApproval workflowThe workflow declares the path: extraction or computation steps first, then the human step, then whatever the approval unlocks — payment release, publication, shipment. Approvers see a queue of titled tasks with the underlying record one click deep; their decision resumes the run with the outcome as data the next steps can branch on. Timeouts and reminders are part of the declaration, so a three-day-old approval nags its owner automatically.Use Case · ComplianceAudit log platformThe audit table is keyed by the audited record’s id with time as the sort key, so a record’s whole history is one ordered read. Write paths either emit entries explicitly — best for business meaning (“discount approved by”) — or lean on a table change stream that invokes a function with batched item changes. Retention windows and legal holds are fields the archiving worker respects.
Ship your stack on the Software Lifecycle Cloud.
Closed preview on dedicated European infrastructure. Bring a repository or start from a blueprint.