Skip to main content
​

​
📋 Management Summary

Riktra’s MVP is feature-complete. The product now does what it set out to do: a company records what it is trying to achieve, what it has decided and who owns what, and any AI assistant an employee already uses picks that up automatically — including when the direction changes. A person opening Riktra sees a short, scannable brief of what needs them today rather than a dashboard.The central promise is verified by an automated test that runs on every change: an administrator changes the company’s direction, a colleague opens a completely new AI conversation, and that conversation reasons from the new direction without anyone re-explaining it. Two things a colleague should never see — another person’s private notes, and anything an AI decided on its own — are enforced by the database rather than by convention, and are covered by tests that would fail if that ever slipped.Two short configuration steps remain before a real AI client can connect for the first live demo. Both are settings changes, not development work.

​
🛠 Technical Summary

Next.js 16 (App Router) on Vercel, Supabase Postgres with row-level security as the tenancy mechanism on both the web and MCP paths, and a hosted Remote MCP server built on the MCP TypeScript SDK v2 with mcp-handler, serving both the current specification and the 2025-era protocol that Claude clients still speak.Thirteen phases across 24 pull requests. 234 tests — 179 integration tests running against a real Postgres as genuine signed-in users (not a privileged client), plus 55 unit tests. Twelve architecture decisions recorded as ADRs, three of them corrections to the original plan after verifying time-sensitive assumptions against current documentation.Security posture is asserted rather than documented: security_lint() checks RLS coverage, role-scoped policies, search_path pinning on definer functions and PUBLIC grants on internal functions, and is asserted empty in CI. That check found two live gaps during hardening.

​
📂 Detailed Changes

​
✨ New Features

  • Company context: goals, ranked priorities with atomic reordering, decisions with supersession chains, open questions, responsibilities, working principles, context notes, system ownership.
  • Today and Me: a scannable daily brief, deterministic attention detection with resolve/dismiss, and private focus and context.
  • Governance: a generic proposal pipeline with review inbox, batch actions and near-duplicate detection.
  • Meeting ingestion: paste or upload a transcript, get reviewable candidates, with a sensitivity pass that withholds personal material entirely.
  • Remote MCP server with twelve tools (seven read, five write) and per-user OAuth.
  • Skills: organization-wide AI behaviour, versioned and rollback-able, delivered through four adapters.
  • Getting Started, ⌘K Quick Capture with in-product guidance, Morning Focus, full-text search, Debug Context and Debug Skills.

​
🏗 Architecture

  • Tenancy and privacy enforced by row-level security; the Context Router does no permission filtering by design, so a bug there returns too little context rather than someone else’s.
  • Shared-truth versioning and revision counters enforced by database triggers, so no write path can forget them.
  • Private records versioned separately from shared truth, because the shared trail is organization-readable.

​
🔗 Integrations

  • Supabase OAuth 2.1 Server as the MCP authorization server; tokens are Supabase JWTs, so RLS applies to MCP calls automatically.
  • Vercel AI SDK for meeting extraction, behind a provider-agnostic interface.

​
📚 Decisions

  • ADR-005 Skills use transport adapters, native extension flag-gated — no client consumes Skills-over-MCP live.
  • ADR-006 MCP serves both wire protocols.
  • ADR-007 Supabase OAuth 2.1 Server, with the audience claim deliberately not validated against the MCP URL.
  • ADR-011 Versioning by trigger, private tables excluded.
  • ADR-012 Protected-resource metadata served path-qualified — the documented example advertises the origin alone and fails invisibly.

​
🐞 Bug Fixes

  • Three instances of Swedish inflection defeating word-boundary patterns; in the sensitivity pass this would have published pay discussion into company context.
  • Two live security gaps: a Postgres PUBLIC grant left the rate limiter callable, and Supabase default privileges exposed a table intended to be internal.
  • Priority reordering violated a check constraint; version snapshots could not be restored once generated columns existed; skills recorded no initial version.

​
⚠️ Outstanding

  • Supabase OAuth 2.1 Server is disabled — no AI client can connect until it is enabled with dynamic client registration.
  • app.riktra.com needs an A record pointing at Vercel, DNS-only.