How we build
Decisions with a reason attached, including the ones that cost us something. Most software companies publish the outcome; this is the argument.
· 4 min read
What a second round of production testing found, and what changed in the apps because of it
On 11 October two testers used the live apps as staff and customers do. They found two blockers and over a dozen serious faults, from a till that misread refunds to a cash-on-delivery order shown as paid. Nearly all were fixed and released on 13 October.
· 3 min read
Forty-six apps from one image: how a release went from 38 minutes of builds to under 12
Every Rutba suite app used to be built and shipped as an image of its own: 46 builds, 38 minutes and 4.1 GB of nearly identical copies. Since 13 October they compile into one image in under twelve minutes and run in 14 containers instead of 46.
· 4 min read
What the evidence behind an e-signature should contain
When a signed agreement is disputed, nobody argues about the picture of the signature. They argue about who signed, what they saw, when, and whether the document has changed since. Here is what a good evidence record holds, and what to ask any provider.
· 6 min read
Every app in the suite now opens at rutba.io
Since 6 October all 46 apps in the Rutba suite run in production, each at its own address under rutba.io, such as pos.rutba.io or books.rutba.io. Your sign-in says whose data you see, so no business needs addresses of its own.
· 6 min read
Which apps your organisation can install, and how the launcher finds out
From the next release, Rutba tells each organisation’s instance which apps it may install. The launcher in every app follows that list, and the console’s Modules page says, app by app, whether it is installed and who decided.
· 7 min read
A reset belongs where the sign-in is, even for somebody Rutba has never met
From 26 September, staff reset their password at Rutba’s sign-in and a shop’s customers reset at the shop, never across. Somebody only their company’s workspace knows can now reset at Rutba too, and every address still gets the same answer.
· 5 min read
We read every product page back against the code. It was wrong in both directions
On 26 September we checked the catalogue, the comparison pages and the blog against what the apps actually do. Some pages called built apps unbuilt; others sold features that do not exist. Both kinds are corrected, and dated.
· 5 min read
One sign-in for the whole suite, and an organisation that stays chosen
Since 24 September, Rutba’s workspaces no longer ask for a password of their own. You sign in once, the organisation you chose stays chosen until you switch, nothing about it travels in a link, and signing out anywhere signs you out everywhere.
· 3 min read
A suffix is not an allow-list: the frames behind one sign-in
One sign-in works by small hidden pages that tell an app who is signed in. The first version trusted any address ending in our domains, which included shops running their merchants’ own code. Review caught it before it reached production.
· 3 min read
The sign-in service no longer has a database of its own
Rutba’s sign-in kept its own database: sessions, keys, second-factor challenges, an audit trail, and a second copy of everybody. Since 21 September it keeps nothing. Every record it needs lives in the one backend that already held people.
· 6 min read
Rutba Office after its first thirty-one releases: what closed, what is open, and who should wait
Thirty-one releases between 8 and 21 September closed most of the list we wrote on day two. Here is that list read back: what is in an installer, what is only in the source, what is still open, and who should not switch yet.
· 3 min read
The lookup before your password, and why it cannot recognise you
Sign in at Rutba and the first thing that happens is a lookup on your address, not a password box. It reads only the domain, so it answers the same for an address that does not exist. And it was quietly doing nothing for weeks before we noticed.
· 4 min read
One place for your second factor, and a code you can scan
Turning on two-factor used to mean typing a thirty-two character secret by hand. It is a code you scan now, or a button on a phone, and the factor itself lives in one store rather than two, which is the part that keeps a settings page honest.
· 3 min read
The password was right. The browser refused the last hop
A sign-in that looked like a wrong password was a security header doing its job too well: it allowed the form but not the page the form lands on. The fix was to build that rule from the list of places a sign-in is already allowed to end.
· 3 min read
Where a sign-in should leave you: the app you hold, not a lobby
Signing in used to send everybody to the customer console, including people who hold no customer account. It now sends you to the one app you can actually open, and when you hold several, a page lays them out by organisation, with a link on every one.
· 4 min read
Measuring is not enforcing: a licence check that never stops your work
Every Rutba deployment now tells us what it is running, and gets back what it is licensed to run. Nothing is refused by that answer: drift is recorded, said out loud and billed if somebody chooses, never turned into an outage you did not plan.
· 3 min read
Every page links the family the first time it says the name
Nobody hand-links a marketing site consistently, and a site with no internal links makes readers use a search engine to find its own pages. So the prose is structured content now, and the first mention of a product in any sentence becomes a link.
· 3 min read
One price list, and no page carries a price
One product was advertised at three different prices depending on which Rutba site you opened, and nothing could tell. Every figure now comes from one record as the page renders, and a test fails the build if anybody types a price into the site.
· 3 min read
A common word with a year on the end is still a common password
Our sign-up refused a short list of common passwords, exactly as written. Nobody types them exactly: they add a year, a row of digits or a symbol. The check now finds the word underneath, and leaves passphrases alone.
· 6 min read
Rutba Assistant has no account of its own, and that is the design
Rutba Assistant answers questions about your business from inside whichever app you are in. It signs in as nobody: every call it makes carries your sign-in and meets the checks the screen would, so it never sees or does more than you.
· 4 min read
Every answer lists the calls it made, taken from what ran
An answer with a source can be checked; an answer without one can only be trusted. Under every Rutba Assistant answer are the API calls it made, assembled from what actually ran, never from what the model says it did.
· 4 min read
No model typed the numbers in this report
Press Report instead of Ask and Rutba Assistant writes a spreadsheet into your own Drive, with a native chart and a Sources sheet. The model chooses the layout; every figure is carried across from the recorded responses.
· 4 min read
Three different noes, and who each one sends you to
“Your organization is not licensed for Payroll” is a question for whoever buys. “You do not have access” is one for an administrator. A route that is not there is a bug for us. Rutba Assistant keeps those apart.
· 5 min read
Work that outlasts a reply runs as a plan a person approved
The panel only reads. When you want Rutba Assistant to do something, it becomes a plan: every step written out with the exact request it will send, approved by a person, run by a worker, and stopped the moment a step fails.
· 3 min read
Bring your own assistant, through the same door as everyone else
If your team already works with an AI assistant, it can work with Rutba through the Model Context Protocol, on your organization’s own key. It gets six tools, meets the same three checks, and can propose a change but never make one.
· 4 min read
A launch morning waits ten minutes. A looping script is paused
Rutba Relay now counts the deliveries each organization started in the last hour. Just over its ceiling, a publish is told to wait ten minutes. Four times over is not a person, and that organization’s publishing is paused until somebody looks.
· 3 min read
A page of zeroes is a worse claim than nothing at all
The promoter’s page on the storefront is deliberately thin: it says where you stand, and nothing else. A dashboard of zero earnings would tell an approved promoter they have earned nothing, a different and much worse statement than "this does not exist yet".
· 3 min read
A page for every Rutba app, drawn from the app itself
A product page named its apps in a sentence each, which cannot tell you whether a till handles returns. Forty apps now have a page of their own, listing every screen in them (read from each app’s own menu) with screenshots of it running.
· 3 min read
A receipt in your hand before anybody else has signed
In an agreement with five parties, the first to sign may wait weeks for the last. Until now they held nothing for it. Each party now leaves with proof of their own act, countersigned by Rutba the moment they acted.
· 3 min read
We test against files Microsoft Office actually wrote
A document engine tested against files its own authors made is tested against their understanding of the format. So our fixtures are written by Excel, Word and PowerPoint themselves, and the first run found four things we had wrong.
· 3 min read
A kill switch with a name on it
When a social network changes something overnight, a publishing service can fire thousands of failing requests at it and collect strikes against your accounts. The Relay’s switches stop that, and every one records who threw it and when it clears.
· 3 min read
The documents we refuse to draft, and why that is the product
A flatshare agreement that is not a tenancy, a letter of authority that is not a power of attorney, and wills last of all and on paper. Where a document generator draws its lines says more about it than what it generates.
· 3 min read
An email address and a password is enough
Adding a mail account used to mean an IMAP host, an SMTP host, two ports and two encryption settings: a form most people cannot fill in about their own mailbox. All of it is knowable, so Rutba Office works it out.
· 3 min read
Why our partner application comes in two parts
The first part is eight fields and two minutes. The second asks for turnover, headcount and a year-one commitment, and nobody should have to hand those to a vendor they have not yet decided about.
· 3 min read
Every Rutba page can tell you which page it is
"The login page is broken" describes several pages on several deployments. So every page now ends with a short reference (which deployment, which page, which build and which visit) that a screenshot is enough to trace, and that never carries your data.
· 3 min read
One sign-in for every Rutba site, and why it asks for your address first
Six Rutba sites used to disagree about whether you were signed in, and two of them collected passwords of their own. Now there is one front door, and since 24 September it is the one sign-in for the whole suite, the workspaces included.
· 6 min read
Why nobody sells an office suite any more
Every office suite you can name is free, subsidised, or the doorway to something else. So we did not try to sell ours. We sell the engine underneath it, and the speed to close a gap you still have.
· 4 min read
An agreement does not end when it is signed
Signature software treats the signature as the finish line. For the business that sent it, that is the moment an agreement starts costing attention: renewals, notices, formalities, and proof somebody asks for years later.
· 4 min read
Ask for your money back, any time, and we will not ask why
If you have paid for time you are not using, there is a button that gives it back. No window, no reason, no email to support. Here is exactly how the number is worked out, and where we round.
· 4 min read
We wrote an office suite and gave it away
Nine desktop applications, our own document engine, and the Outlook archive formats almost nothing else opens. Free under the AGPL, no account, no telemetry. And a commercial reason it is not charity.
· 3 min read
Every rounding goes to the customer
Software is full of places where the arithmetic is not exact. Each one is a decision about who absorbs the fraction, and we made that decision once, in advance, for all of them.
· 3 min read
One unit, one rater: the rule that stops us billing you twice
When two systems can both price the same thing, eventually both of them do. Here is the single rule we hold to instead, and the one line of SQL that enforces it.
· 4 min read
The CRM is not the pipeline. It is the record everything else hangs off
Pipeline stages are the easy half of a CRM and every product has them. The half that decides whether anyone can answer the phone is whether the call, the mail, the ticket and the order hang off the same customer.
· 2 min read
Stock is the number a business argues about most
The argument always starts the same way: two systems each keeping their own copy. The fix is not better syncing. It is deciding, once, which one is allowed to hold the number.
· 4 min read
Anyone can put a picture of a signature on a page
What decides a dispute two years later is whether you can still show what happened: who opened it, from where, what they accepted, in what order, and that not one byte has moved since. That record is the product.
· 3 min read
Every signature API returns an audit report the vendor vouches for
Which is worth exactly as much as your relationship with that vendor. Ours returns a record anyone can check independently: from a public endpoint, with no key, that does not reach your systems at all.
· 3 min read
The plan, the stockroom and the floor should not be three systems
Most production planning goes wrong in the gap between them. An MRP run that reads today’s stock, plans against a pinned bill version, and hands the dispatch list to the bench closes that gap, and works offline when the bench has no signal.
· 2 min read
Nobody notices email deliverability until sales drop
Bounces, complaints and the slow drift into spam folders are a reputation problem, and reputation is a property of your domain rather than of any one product. So transactional mail and campaigns go out through the same relay.
· 3 min read
Most companies have three asset registers and none of them agree
The HR list of issued kit, the fixed-asset register in accounting, and whatever the plant keeps for machines. They describe the same laptops and the same machines, and the auditor asks all three.
· 3 min read
We built the whole meeting and you still cannot buy it
Rooms, lobby, breakouts, polls, whiteboard, attendance reports: built and tested. The media server all of it talks to is not deployed, so the product is listed as coming soon. Also: why we refuse end-to-end encryption.
· 2 min read
Phone calls are where the business happens and the least gets recorded
So we built the record-keeping half first and the telephony second. That is backwards from how phone systems are usually built, and it means you cannot buy this yet, but the half that exists is the half that was missing.
· 2 min read
Rutba Drive is running. There is just nowhere to visit it
Folders, versions, sharing, quotas and a published SDK all work today, as the layer underneath Rutba Docs. The standalone interface is not built, so the product is marked coming soon rather than early access.
· 2 min read
Exclusivity is genuinely available, because nobody holds it yet
Most partner programmes offer a territory that three other partners are already working. Ours has eleven regions and none of them is spoken for, which is a statement about how early we are, not how generous.
· 3 min read
A fleet manager’s questions are compliance and cost, not today’s parcels
What is due, what is off the road, what did fuel cost per kilometre. Those are asset questions, so the vehicle goes on the asset register rather than in a fleet system’s own copy of it. We published the design first; the app has since been built.
