01Product shell
§15Topbar, sidebar, inspector, mobile nav — once.
Every Ottili product gets the same frame: a 56px topbar, a 248px sidebar that collapses to 72px, a 360px inspector and a real mobile navigation. Products fill the content area; they never rebuild the chrome.
- Company switcher, product switcher, account switcher
- Breadcrumbs, favorites, recents, quick create
- Collapsible sidebar with per-company customization
- Inspector panel contract shared across products
Implemented in
@ottili/foundation-shell@ottili/foundation-navigation
02Design system
§14, §47Primitive → semantic → component tokens. No raw hex in product code.
A three-layer token system with light, dark and high-contrast themes, three densities and a clamped UI scale. Product code consumes semantic tokens only, which is exactly what makes deep white label possible without a fork.
- Light / dark / system themes plus a high-contrast mode
- Comfortable, compact and spacious density
- Per-product accent with automatic text-contrast resolution
- Reduced motion honoured globally, not per component
Implemented in
@ottili/foundation-ui
03Auth & company context
§11, §12Company scope comes from the verified token. Never from the URL.
SSO against auth.ottili.one with PKCE, a session state machine, silent refresh, a session-expired view, multi-tab coordination and account switching. Company-scoped URLs are validated server-side — the path is a hint, not an authority.
- PKCE redirect + callback, refresh and expiry handling
- Company-scoped routes under /c/{companySlug}/…
- Context revision invalidates caches on switch
- Cross-tab session and company coordination
Implemented in
@ottili/foundation-auth@ottili/foundation-context
04Search, palette & Workbench
§20, §21, §45Cmd+K to find. Cmd+` to act.
A global search with pluggable providers, a command palette, and the Ottili Workbench — a Stripe-style command surface for real, authorized customer actions with dry-run, preflight, step-up and approval before anything executes.
- Typed command contract with risk level and approval policy
- parse → resolve → validate → permission → preflight → dry run → execute → audit
- Panels for API Explorer, Events, Logs, Runs, Approvals, Jobs
- Never raw SQL, never a hidden superadmin shell
Implemented in
@ottili/foundation-command
05Shared capabilities
§25AI, Files, Flows, Approvals, Activity and Jobs are platform surfaces.
Products do not each build their own chat, file browser or workflow canvas. They configure the shared surface with profiles, roots, node packs and renderers, and inherit streaming, approvals, versioning and audit for free.
- Ottili AI: streaming, tool-call UI, citations, editable proposed actions
- Ottili Files: browser, versions, sharing, pickers, entity links
- Ottili Flows: canvas, node palette, dry run, run history
- Approvals, Activity/Audit and a background Task Center
Implemented in
@ottili/foundation-capabilities
06Deep white label
§18, §48Draft, preview, publish, roll back — versioned server-side.
Customization is an inheritance chain with a draft lifecycle, not a CSS override file. Every published version is stored, diffable and revertible, and validation runs identically in the browser and in the Unified API.
- Inherited platform → product → company layers
- Draft / preview / publish / rollback / history
- Export and import a customization set
- Mirrored validation so client and server never disagree
Implemented in
@ottili/foundation-customization
07Dashboards & widgets
§22A grid engine plus a widget runtime, per company.
A responsive dashboard grid with a widget runtime, saved views and an importer for legacy dashboard layouts, so the migration from the old dashboard does not throw away customer configuration.
- Company-scoped dashboard persistence
- Widget contribution from products and extensions
- Saved views and page layout customization
- Legacy layout importer
Implemented in
@ottili/foundation-dashboard
08Extension host
§27, §34HQ Apps, product add-ons and integrations — one runtime.
A signed, versioned manifest declares routes, navigation, widgets, commands, AI tools, flow nodes and settings. Third-party UI runs in a sandboxed iframe behind a scoped RPC bridge; third-party backend code never runs in the Unified API process.
- Manifest validation, compatibility ranges and lifecycle
- Sandboxed host, versioned bridge, CSP, origin allowlist
- Console-driven installation, company-scoped activation
- Stable @ottili/extension-sdk — no private internals exposed
Implemented in
@ottili/foundation-extensions@ottili/extension-sdk
09Web, PWA, Tauri, Electron
§29One adapter contract, four distribution targets.
Storage, secure storage, notifications, deep links, clipboard, filesystem, updater, windows, background tasks, auth transport and telemetry sit behind a single adapter interface, so a product becomes a desktop app without a second codebase.
- Web is the full baseline — no native filesystem assumptions
- PWA installability, safe offline cache, update prompt
- Tauri is the preferred native wrapper
- Electron supported through the same contract
Implemented in
@ottili/foundation-platform