Solstice

Solstice (this repo's working name is still "Nah") is a credit-only, white-label document signing platform — a web portal, a super-admin, and a public marketing site, all in one monorepo. $0.50 flat per document, no per-seat fees, no surprise overages. The platform owner keeps the brand; the user keeps the workflow; the upstream signing provider keeps the cryptographic side.

Why credit-only?

Per-seat e-signature pricing punishes intermittent users — every paralegal who signs three documents a quarter pays the same $40/mo as the partner who signs 200. Credit-only flips that: load credits when you need them, pay flat per document, no recurring bill, no contract review. The pricing model is the point of the platform.

The monorepo, in five drawers

• backend/ — Go API, single static binary on CGO-free SQLite. The only process that will ever talk to upstream signing, billing, or AI providers; the only thing that holds privileged keys.
• web/ — SvelteKit bundle shared by the customer /portal, the super /admin, and the desktop shell.
• desktop/ — Solstice for Windows: a hardened Electron window (fuses verified at build) that loads the production app, so it is always the same product as the browser. Native save-as and open for PDFs, an offline page that retries on its own, and an update check that shows a download button and never installs anything itself.
• marketing/ — public site, static HTML, deployed independently of the app surface.
• ops/ + tests/e2e/ — server-side deploy/rollback/migrate scripts, Apache vhost, Playwright end-to-end suite.

The hard rules

• No destructive git, no destructive SQL, no secrets in repo.
• Server is pull-mode after initial setup. Deploys are atomic symlink swaps, never edits in place.
• Frontend never holds privileged keys — backend is the only thing that talks to upstream services.
• Files ≤150 lines, functions ≤30 lines, by policy — and a 2026 cleanup pass brought every file back under budget rather than letting the rule rot.

What ships today

The portal and super-admin run on the production hostname. Onboarding is invitation-only: the public endpoint writes a request-access row and nothing else, and a platform admin either approves it — which creates the org and invites its first admin — or onboards a customer directly. Self-serve signup was deleted rather than left behind a feature flag. Seats inside an approved org stay self-service: email-verified teammate invites and org switching. On top of that sit a per-tenant credits ledger, document audit, white-label configuration, and per-tenant branding. Behind /admin sits an encrypted secrets vault with role-based access, key-rotation tooling, and a written recovery runbook.

The Firma signing integration is live, not just wired for later: each org gets its own signing workspace provisioned on demand, and a signed webhook receiver verifies, spools, and dispatches events with replay protection, secret rotation, and an admin re-dispatch console. The whole send path is walkable — upload a document into the template studio, place roles and fields in the embedded editor, then a send screen that prices the send against the org's balance and confirms against the backend's facts rather than the form's. Every signed copy is stored locally, re-hashed on read, and shown on a document page with its audit trail, per-signer status, resend and cancel. Prepaid credit packs through Stripe are built — checkout, webhook and success-page fulfilment, credited exactly once under three independent guards — and wait on the Stripe account being connected in production; until then credits are admin-granted. A public /stack page publishes the deployed commit and build time straight from the server, so "is prod current with the repo?" is a URL, not a question.

The roadmap items have since landed. The Windows desktop shell ships as an installer with a download page (version, size, SHA-256) mirrored from the release, and a /whats-new page renders the changelog in both the browser and the app. Passkeys sign a user in with a fingerprint, face or security key and re-confirm before sensitive changes. Org-wide skins carry two accents, an appearance and a logo to every member, behind a readability guard that keeps every control at 4.5:1. And the assistant is in the app as a docked panel, bring-your-own-key by design: it answers only from the help pages and the changelog, sees a member's own documents and the org's balance and nothing else, stores no question or answer, and sits behind daily allowances, a passkey check, a classifier and an independent misuse watch — every org off until an admin switches it on.