Muqira — The Bible 🚀
Your single source of truth: build, security, no-bug discipline, growth from 1 week to 5 years, marketing and business. One platform — Core, AI, Workflow Engine, Integrations, Analytics — many workflow modules built on top.
🧭 How to use this tracker
This file is self-contained — no login, no cloud dependency. Everything lives in your browser, with backup/restore to keep it safe across devices.
1
Navigate with the sidebar — grouped by layer: Core, AI, Workflow Engine, Integrations, Analytics, then Workflow Modules, Security/QA, Growth Timeline, and Marketing/Business.
2
Click any task to mark it done (turns green ✓). Click again to unmark.
3
Growth Timeline has horizon tabs — 1 Week, 1 Month, 3/6/12 Months, 2–5 Years — each with its own focus and checklist.
4
Press "💾 Save Progress" (or Ctrl+S) — saves to browser localStorage. Progress persists between sessions.
5
Use "⬇ Backup / Restore" to download a .json file regularly. Re-import on any device to sync progress — treat this like a save file.
Tasks Done
0
of 0 total tracked tasks
Overall Progress
0%
Across every layer
Current Phase
Phase 0
Repo & Environment Setup
Products & Modules
6 live + 6 planned
AI Studio · Flow · Social · SEOventra · AlShorty · Documateo + more
Loading…0%
🎯 Today's Mission
Loading…
💸 AI Spend (month)$0
❤️ Platform Health—
🚦 Release Ready0 / 4
🔐 Critical Security Closed0 / 0
🕓 Recent Activity
- No activity yet — tick a task to get started.
🔥 Phase 0 — Repo & Environment Setup ✓ Done
Monorepo structure confirmed — apps/api + apps/web on muqira-web / muqira-live
CI/CD pipeline — lint, test, build, deploy on every merge to main
Staging + production Cloudflare environments separated
Secrets management baseline — Wrangler secrets, never committed
Resolve production Worker naming conflict (if still open)
Exit criteria: blank "hello world" Worker deploys automatically on merge to main
📐 The Core Question
Before building any feature: Can another workflow module use this in the next 12 months? YES → build in Core/Layer. NO → build in the module folder. This single test keeps "build once, reuse forever" real.
Muqira
│
├── Core Layer (identity, orgs, projects, billing, storage, settings — DONE)
├── AI Layer (Muqira AI — router, 27-model registry, prompts, cost engine — DONE)
├── Workflow Engine Layer (trigger → step → step → validation → output — DONE, 9 step types)
├── Muqira Connect (25 live connectors, one registry, one SDK — DONE)
├── Analytics Layer (events, performance, engagement — NOT STARTED)
├── Admin Console (12 pages, platform operator control plane — DONE)
├── Marketing Site (blog, docs, changelog, status, tools, labs — DONE)
│
└── Products (the things users actually buy)
├── AI Studio ← Purpose-First v2, live
├── Muqira Flow ← workflow automation, live
├── Social Media Automation ← Workflow #1, in progress
├── SEOventra ← live sub-product
├── AlShorty ← live sub-product
├── Documateo ← live sub-product
├── SEO Automation (planned)
├── Content Marketing Automation (planned)
├── Research Automation (planned)
├── Product Launch Automation (planned)
└── Directory Submission Automation (planned)
North Star & Strategy
The strategic frame every other decision in this tracker hangs off of.
🧭 The Strategic Shift
The unit of value is a Workflow Module running inside Muqira — not a separately branded app.
Social Media Automation ships first, then SEO, Content, Research, Product Launch, and Directory Submission. SEOventra, AlShorty, and Documateo continue as real products consuming the same Core, AI, Workflow Engine, Integration, and Analytics layers — the platform-layer work already done isn't thrown away, it gets a sharper first customer-facing target.
⚠️ One Open Question — Confirm Before Phase 4 Locks In
This blueprint assumes Workflow Modules ship as features inside Muqira rather than as separately branded standalone products. If the separately-branded product line (SEOventra, AlShorty, Documateo) is meant to run in parallel rather than be superseded by this structure, it's worth confirming how the two fit together — easy to adjust now, expensive to unwind after customers are already using named products.
📊 Wrong Metric vs Correct Metric
Track outcomes, not activity. A completed workflow is the actual unit of value delivered — not a prompt sent or a message generated.
| Instead of tracking | Track this | Why it matters |
|---|---|---|
| Prompts sent | Workflows completed | A completed workflow is the actual unit of value delivered |
| Messages generated | Campaigns published | Output that reaches the real world, not just generated text |
| — | Products launched | Direct measure of the Product Launch workflow's success |
| — | Content generated AND published | Generation alone isn't the goal — publication is |
| — | Rankings improved | The SEO workflow's actual promise to the customer |
| — | Traffic / leads generated | The downstream business outcome every workflow ultimately serves |
| — | Time-to-completion per run, falling over time | Proves the engine is actually getting better, not just busier |
🏷️ Revenue Model
Gate by workflow runs/month and AI tier, not by feature lockout within a workflow — keeps the product feeling complete at every tier, which matters more for trust than upsell pressure does.
| Tier | Workflow Access | AI Tier | Limits |
|---|---|---|---|
| Free | 1 workflow module, limited runs/month | Free-tier models (Groq/OpenRouter free) | Capped runs, single project, no scheduling |
| Starter | All shipped workflow modules | Paid tier (GPT/Claude/Gemini Pro) | Higher run cap, scheduling enabled, single project |
| Professional | All workflow modules | Premium tier available | Multiple projects, full analytics, priority support |
| Agency | All workflow modules | Premium tier | Teams/orgs, unlimited projects, white-label option, seat-based pricing |
Guiding Principles
Every architectural decision must comply. Re-read before any sprint that touches more than one module.
Standing rule for every decision: if a feature could be reused by more than one Workflow Module, it belongs in a Layer (Core/AI/Workflow Engine/Integration/Analytics). If it's specific to one workflow's logic, it belongs in that module. This is the single test that keeps the platform from turning into disconnected products.
1
Build once, reuse forever
Auth, billing, AI routing, storage, notifications — built once in a Layer, consumed by every Workflow Module. If you're writing similar code in two places, stop and extract it.
2
No workflow module ever calls an AI provider directly
Every AI call passes through Muqira.AI.generate() — the single front door. Zero exceptions, even for "just a quick test."
3
AI providers are replaceable implementation details
7 providers behind one interface. A new model becomes a config-registry change, not a code change in any workflow.
4
Every Core table is scoped by org_id, with zero exceptions
A single missing filter is a cross-customer data leak. This is the #1 item on the risk register — treat it that way.
5
Keep Core generic — no module-specific tables
No social_posts or seo_audits table in Core. Workflow-specific data lives in workflow_runs.state_json / workflows.definition_json, or in a module-owned table outside Core if genuinely needed.
6
Workflow definitions are data, not code
JSON-schema validated, no proprietary DSL. The execution engine has zero workflow-module-specific logic inside it.
7
Adding a connector should never touch the workflow engine
The Connector contract in registry.ts is the only interface. If adding WordPress or Ghost had required engine changes, the SDK abstraction would be leaking — proven correct by shipping 25 connectors without touching the engine.
8
Cost visibility before scale, not after the surprising bill
The Cost Engine must exist before Workflow #1 has real paying users. Budget-aware model selection is not optional.
9
Track completed workflows, not generated text
A completed, published, real-world outcome is the unit of value — not a prompt sent or a message drafted.
10
If a module needs a feature that doesn't fit an existing Layer, redesign the module
Don't bolt on a one-off. Scope creep across workflow modules is named explicitly as a top platform risk.
All Platform Modules
Every sub-module across Core, AI, Workflow Engine, Integration, and Analytics layers. Status, maturity, and dependencies — auto-tracked from your checklists, the rest editable inline.
Identity, Organizations & Core
2.1.1–2.1.4 & 2.1.6–2.1.7 — one login system, multi-tenancy, projects, permissions, storage, settings. Build Phase 1.
Exposes:
getCurrentUser(), requireAuth(), getCurrentOrg(), requireOrgMember(), requireRole(role), getProject(), can(user, action, resource), uploadAsset(), getSetting(scope, key) — middleware and helpers every other layer depends on.🔐 Identity & Authentication
Email OTP (Resend), Google OAuth, GitHub OAuth, JWT sessions all working locally
RBAC middleware confirmed on every mutating route
Production Cloudflare deployment of auth confirmed end-to-end
🏢 Organizations & Teams
Create/rename/delete org, personal org auto-created on signup
Invite by email, accept/decline, remove member, org switcher UI
Admin-driven org suspension with a reason shown to the org, enforced at the auth middleware
📁 Projects & 🛡️ Permissions
Project CRUD, settings_json, brand voice / tone / audience context
Four fixed roles (Owner/Admin/Member/Viewer) — no custom permission engine yet
🗄️ Asset Storage & ⚙️ Settings
R2 direct upload, signed URLs, per-org storage quota
Settings UI shared across all workflow modules
Sane defaults so nothing requires configuration before first use
D1 schema (23 migrations applied) confirmed matches Drizzle definitions in production
Billing & Subscriptions
2.1.5 — razorpay integration, plan enforcement, usage metering, credit system, GST-aware discounts. The thing that turns workflows into revenue. Build Phase 1.
Exposes:
checkUsageLimit(org, metric), getPlan(org), getCreditBalance(org), applyDiscount(org, code), webhook handler for razorpay events.razorpay Checkout + Billing Portal + Webhooks integrated
Plan limits enforced at the API layer (runs/month, AI usage/month, seats) — not just UI-hidden
Usage dashboard, failed-payment handling, proration on upgrade
Credit-based usage system live across all four plans (Free/Starter/Professional/Agency)
GST-aware discount system — USD-priced, INR-converted at checkout, discounts apply correctly either way
Critical Build Order
The spine of the platform. Build top to bottom — each layer unlocks the next. Support modules run in parallel alongside it.
🪜 The Spine
🔧 Support Modules (parallel, non-blocking)
Impact & Priority
Score every module on Business Value, Engineering Effort, Reuse, Risk, and Strategic Fit. Click a star to re-rate — it's saved instantly.
Muqira AI — Router, Tiering & Fallback
2.2.1–2.2.4 & 2.2.6 — single front door for every AI call. No workflow module is ever allowed to call a provider directly. Build Phase 2.
Exposes:
Muqira.AI.generate({ prompt, context, tier }) — the only function any workflow step is allowed to call. Also: selectModel(tier, taskType), renderPrompt(templateKey, variables), buildContext(projectId).⚡ AI Router v2 — 7 Providers
7 providers (Groq, OpenAI, Anthropic, Gemini, Mistral, DeepSeek, OpenRouter) behind one OpenAI-compatible caller
BYOK org-level encrypted provider keys, mk_live_ external API token generation
🎚️ Model Routing & Tiering
27-model registry, Free/Starter/Professional/Agency tier mapping, pricing_tier + constraints field on every model
requireApiKeyOrAuth middleware confirmed on external API routes
Model registry audit system — weekly cron, snapshot diffing, live provider checks, admin email alerts via Resend
Manual audit trigger endpoint exposed in Admin Console — Model Registry page
📝 Prompt Template Engine & 🧩 Project Context
DB-backed, versioned prompt templates with category field
POST /api/ai/render-template endpoint live, sessionStorage handoff confirmed
Brand voice / audience / prior-output context auto-injected into every prompt
🔁 Model Switching & Fallback
KV-backed circuit breaker per provider (3 failures/5min opens, 2-min cooldown), configurable fallback chain
Fallback tested with a simulated provider outage — not just configured
Silent model substitution bug fixed — GenerateResult carries a substitution field, orange warning banner shown in the UI whenever it fires
Root cause fixed at source — resolveKey() no longer silently returns null and falls through to Groq
AI Usage Tracking & Cost Engine (Build)
2.2.5 — know exactly what every AI call costs, per org, per workflow, per model, before it becomes a budget surprise. This is the Golden Rule enforcement point. Build Phase 2.
Per-request cost ceilings by plan tier, org-level override
Heuristic complexity estimation, budget-aware model selection inside generate()
Applies automatically to Console, workflows, and external API callers — verified, not assumed
Key learning: per-request ceilings beat period pools for budget control — more predictable, easier to reason about per-call cost exposure. Money safety must be enforced at multiple independent layers — never rely on a single gate. The Agency plan previously had no real monthly dollar cap, only a credit-count proxy; this has since been fixed.
AI Studio v2 — Purpose-First
Consumer-facing AI writing/generation surface — the product a customer actually opens, built on top of the AI Router, Tiering, Prompt Engine, and Cost Engine.
Replaces a blank-prompt-box flow with a guided three-step experience: pick a Purpose → get model/feature recommendations → generate. Files:
purpose-registry.ts, PurposeSelector.tsx, classifyPrompt().Uses These Platform Modules
🎯 Purpose-First Flow
Purpose Registry — 11 intents mapped to model/feature recommendations
Three-step PurposeSelector.tsx UI — pick purpose, see recommendation, generate
Smart Prompt Analysis — classifyPrompt() auto-detects intent from free-text input
Multi-lens model recommendation engine wired to the Purpose Registry
Model substitution made visible to the user — orange warning banner when a selected model is silently swapped
🧰 Supporting Surfaces
Scripting tools + library — reusable prompt/script assets
History, stats, and templates views inside AI Studio
Settings — BYOK keys, defaults, feedback + attachment support
Streaming responses (SSE) — Anthropic live, extend to remaining 6 providers
Mobile layout verified — three-step flow usable one-handed, no horizontal scroll
Key learning: silent failures are the most dangerous bug class here — silent model substitution was found and fixed by making it loud (visible banner) rather than by trying to eliminate every future edge case that could cause it.
Workflow Engine Layer
2.3.1–2.3.7 — Trigger → Step → Step → Validation → Output. The reusable framework every workflow module is expressed in as data, not code. Build Phase 3 — done.
Exposes:
WorkflowDefinition schema, executeWorkflow(workflowId, triggerPayload), getRunStatus(runId), scheduleWorkflow(), triggerWebhook(workflowId, payload), validateStepOutput(step, output), cloneTemplate(templateId, projectId), dispatchWorkflowRun().📐 Definition Schema & ⚙️ Execution Engine
JSON-schema validated workflow definitions — no proprietary DSL
workflow-engine.ts, routes/workflows.ts, routes/workflow-runs.ts mounted in index.ts
Trivial test workflow ("generate → validate → output") runs end-to-end
⏱️ Trigger System & 🧩 Step Type Library
Manual / webhook-per-workflow triggers working
Recurring Cron trigger — workflow-scheduler.ts, next_run_at, runs pass through the same quota gate as manual runs
9 live step types: ai_task, validation, transform, delay, integration_action, branching, human_approval, browser_automation, local_file_access, image_generation
✅ Validation Layer & 📬 Queue Processing
JSON schema validation (exists/min_length/max_length/contains) + transform step (trim/case/parse_json)
dispatchWorkflowRun() — queue_attempts tracking with backoff between retries
Dead-letter flag once MAX_QUEUE_ATTEMPTS is exceeded — run stops retrying forever
Dead-letter runs surfaced in Admin Console (Workflows page)
📋 Workflow Templates Phase 7
Template gallery UI
One-click clone into a project (copy-on-create)
Templates owned by a system org, is_template flag on workflows
Template versioning independent of user customizations
Open gap: dead-letter workflow runs are visible in Admin but there's no email/Slack push alert. A stuck cron workflow could sit dead-lettered for days before anyone looks.
Muqira Connect — 25 Live Connectors
2.4.1–2.4.6 — one abstract contract every third-party integration implements. Done ahead of schedule (originally Phase 4–6), now spans 6 categories on a single registry.
Exposes:
getConnector(id), listConnectors(), runConnectorAction(orgId, connectorId, action, params) — the entire SDK contract. Adding a new connector is one file implementing the contract + one line in registry.ts. Zero engine changes required.🔌 Connector SDK & 🔑 Credential Management
Single Connector contract — authenticate, list actions, execute, handle webhook
Encrypted credential storage, decrypted per-call only, revoke-on-disconnect
Per-(org, provider) rate limiting — 20 actions/min, protects the org's standing with the third-party platform
💬 Communication ✓ Live
Webhook — generic inbound/outbound actions
Slack — post message, channel actions
Discord — post message, channel actions
Telegram — send message via bot API
Email — transactional send via Resend
WhatsApp — send message via Business API
📱 Social ✓ Live — Phase 4 dependency
X/Twitter — post, thread, engagement pull
Meta — Facebook Pages + Instagram via Graph API
LinkedIn — post, company page, engagement pull
YouTube — upload, metadata, channel actions
Reddit, Threads remain future candidates — Phase 7+.
📰 Publishing & Commerce ✓ Live
WordPress — posts, categories/tags, featured images
Ghost — posts, tags, publishing
Shopify — products, orders, storefront actions
🗂️ Productivity & Data ✓ Live
Notion — page/database read-write
Airtable — record read-write
Trello — card/board actions
Google Sheets — read-write rows
Google Docs — create/update documents
🧰 Marketing & Dev-Tools ✓ Live
Mailchimp — audience + campaign actions
Brevo — email/SMS campaign actions
GitHub — issues, PRs, repo actions
Jira — issue create/update
Asana — task create/update
📊 Analytics & SEO ✓ Live — was Phase 6
Google Search Console — search performance data
Google Analytics (GA4) — traffic/conversion data
GA4 data wired into a dedicated Analytics dashboard
Search Console data wired into a dedicated Analytics dashboard
🛰️ Future Connector Candidates
Build opportunistically, none required for current products: Gmail, Google Calendar, Reddit, Threads, Web Search/browser automation, Semrush, Ahrefs, Zapier-style generic HTTP action builder.
Analytics Layer
2.5.1–2.5.3 — one place every workflow module's activity gets logged. Build Phase 6 — not started. Note: the GA4 and Search Console connectors themselves already exist in Muqira Connect (Phase 4.5) — this phase is the event pipeline and dashboard on top of them.
Exposes:
track(eventType, payload) — callable from anywhere in the stack.Typed event schema, org/project scoping on every event
Write to Cloudflare Queue first, batch-insert into Postgres — avoid write amplification
Content Performance Tracking — per-post dashboard, trend-over-time, best-performing surfacing
Join published content to engagement metrics pulled via Analytics Connectors
Click & Engagement Tracking — link shortening/tracking on outbound URLs
Engagement event capture wired to Event Pipeline
📣 Social Media Automation Workflow #1 — In Progress
3.1 — take a topic and turn it into published, scheduled social content with zero manual drafting. Build Phase 4.
Trigger: Manual ("create a post about X") or scheduled (e.g. "3 posts/week"). Steps: Topic Research → Content Generation → Image Generation → Validation → Scheduling → Publishing. Success metric: posts published per org/month, scheduled-vs-published ratio, engagement lift vs. manual posting baseline.
Uses These Platform Modules
Build Checklist
Topic Research step — pulls context, optionally calls Research Automation sub-step
Content Generation step — AI Generation node via prompt templates
Image Generation step
Validation step before anything publishes
Scheduling step — Delay/Schedule node, calendar-aware
Publishing step — Integration Action node to LinkedIn/Facebook/Instagram
Calendar view + post preview + approval queue UI
Exit criteria: a real post goes live with zero manual editing required
🔀 Muqira Flow
The Workflow Engine, branded and packaged as a customer-facing automation product — not just internal plumbing.
Uses These Platform Modules
Build Checklist
Branded as the workflow-automation product surface, not just an internal engine
Workflow list + detail/run views polished for a real customer-facing product
Workflow templates browsable and cloneable from the Flow UI
Run history, dead-letter, and retry visibility in the Flow UI
Cron/scheduled trigger configuration exposed in the Flow UI
Flow pricing/positioning finalized as a named plan feature, not implicit
🔍 SEOventra
Real, live sub-product consuming Muqira Core. Keyword research, SERP analysis, site audit.
Uses These Platform Modules
Build Checklist
Keyword research tool — calls AI Router internally, domain logic only
SERP analysis
Site audit — Browser Automation node, crawl + checks
Search Console connector wired
Rank tracking over time
GA4 connector wired for traffic correlation
Production deployment confirmed on Cloudflare Pages
MuqiraBar footer (theme-aware) confirmed live
🔗 AlShorty
Real, live sub-product. Link shortening — also doubles as the platform-wide Click & Engagement Tracking layer (2.5.3).
Uses These Platform Modules
Build Checklist
Link creation — custom slug, expiry, max-clicks (Pro)
Redirect engine — KV lookup, sub-10ms response
Click analytics — track clicks, countries, devices, referrers
Bio pages — link-in-bio with multiple links
QR code generation — per-link QR codes
📄 Documateo
Real, live sub-product. PDF toolkit consuming AI Router + Asset Storage.
Uses These Platform Modules
Build Checklist
PDF merge/split/rotate core operations
jsPDF text-primitive export confirmed — no html2canvas, no 16,384px failure mode
AI-assisted PDF summarization / Q&A via AI Router
R2-backed storage for uploaded/generated PDFs, signed URLs
Production deployment confirmed
🛠️ Admin Console
Platform operator control plane. Lives at /dashboard/admin, hidden except for is_platform_admin = true accounts, with a secondary ADMIN_SECRET unlock prompt.
Admin account:
chatmatterji@gmail.com. Two independent gates protect this surface — a compromised session alone is not enough to reach org-suspension, payment, or model-registry controls.🛠️ 12 Admin Pages
Sub-nav sidebar — all admin pages reachable, none orphaned
Organizations — view/search/suspend any org with reason shown to the org
Users — view/search users across orgs
Subscriptions — view/manage plan assignments
Payments — razorpay transaction visibility
AI Requests — inspect logged AI calls, cost, model used
Model Registry — live model list, pricing tiers, constraints, manual audit trigger
Usage — cross-org usage dashboard
Discounts — GST-aware discount management
Integrations — connector health/status overview
Workflows — cross-org workflow run visibility, dead-letter surfacing
Assets — R2 storage overview
Key learning: nine admin pages sat unreachable until a proper sub-nav sidebar was built — dead code and drift accumulate silently; regular navigation audits catch what a feature list alone won't.
🌐 Marketing Site
Public-facing pages beyond the app shell — where SEO, trust, and top-of-funnel discovery actually happen.
🌐 Public Pages
Blog — list + dynamic post pages, SEO-structured
Changelog — public-facing shipped-features log
Docs — guide index + dynamic guide pages
Tools — free top-of-funnel tools directory page
Labs — experimental/early-access features page
Status page — public service status + incident history/timeline
About, Careers, Press, Contact — company/trust pages
Legal — Terms, Privacy, and related policy pages
Products — marketing pages per sub-product (SEOventra, AlShorty, Documateo, AI Studio)
llms.txt served for AI-crawler discoverability
SEO note: Status, Changelog, and Docs are underused SEO surfaces most SaaS competitors skip — each incident write-up, changelog entry, and doc page is a long-tail indexable page that also builds trust. Keep publishing to these even when there's no "content marketing" campaign running.
Future Workflow Modules
3.2–3.6 — none of these get built until the platform layer underneath is solid. That's the whole point of building the platform first. Build Phase 7+.
📋 Phase 7 Build Checklist
Workflow Templates system — gallery, one-click clone into project
SEO Automation workflow module (Analyze → Issues → Recommend → Tasks)
Content Marketing Automation workflow module
Research Automation workflow module (shared sub-step for others)
Product Launch Automation workflow module
Directory Submission Automation workflow module
🎀 MuqiraBar — Cross-App Shared UI
MuqiraBar universal footer — theme-aware via useTheme(), hardcoded prop removed
SiteFooter.tsx — conditional full Footer vs MuqiraBar by route
Propagated to all sub-product repos with their own ThemeProvider
Repos without their own ThemeProvider — prop pinned or ThemeProvider.tsx copied
🔐 Security Checklist
Categorized, severity-tagged. Close every CRITICAL item before any production launch with real customer data. This is the section that makes the tracker dummy-proof on security.
The platform's #1 named risk: multi-tenant data isolation. Every Core table must be scoped by org_id with zero exceptions — a single missing filter is a cross-customer data leak.
✅ No-Bug / QA Policy
The discipline that keeps production clean. Adopt these as standing practice, not a one-time checklist.
The bar: a feature is not "done" until it works in production, not just locally. Every fixed critical/high bug gets a regression test so it can't silently come back.
⏳ Growth Timeline — 1 Week → 5 Years
Every horizon has its own focus and checklist. Switch tabs to zoom in or out on the plan.
Phase Roadmap (0–7)
From the blueprint, section 6. Check each phase's steps off as you ship. Click a phase to expand its deliverables and exit criteria.
Phase 0 — Repo & Environment Setup ✓ Done
1
Monorepo structure
apps/api (Hono/Workers/D1), apps/web (Next.js 15/Pages) — muqira-web / muqira-live, GitHub ataurCODEX/muqira-web
2
CI/CD pipeline
Lint, test, build, deploy on every merge to main
3
Staging + production environments
Separate Cloudflare environments, separate secrets
4
Secrets management baseline
Wrangler secrets, .dev.vars locally, never committed
Exit criteria: a blank "hello world" Worker deploys automatically on merge to main.
Phase 1 — Muqira Core ✓ Done
1
Identity & Authentication
Email OTP (Resend), Google OAuth, GitHub OAuth, JWT sessions, RBAC middleware
2
Organizations & Teams
Create/invite/remove members, org switcher, personal org auto-created on signup, admin-driven suspension with customer-visible reason
3
Projects
CRUD + project-level settings_json + brand context
4
Permissions (RBAC)
Owner/Admin/Member/Viewer — four fixed roles
5
Billing Foundation
razorpay Checkout + webhooks, plan limits enforced at the API layer, credit system, GST-aware discounts
6
Asset Storage
R2 direct upload, signed URLs, per-org quota
7
Settings
jsonb columns on organizations/projects — no new infra
Exit criteria: auth + org + billing all work end-to-end with zero workflow logic yet built.
Phase 2 — Muqira AI ✓ Done
1
AI Router v2
7 providers (Groq, OpenAI, Anthropic, Gemini, Mistral, DeepSeek, OpenRouter), single OpenAI-compatible caller, shared generate-pipeline module
2
Model Registry & Tiering
27-model registry, audited weekly with snapshot diffing + live provider checks, BYOK org-level encrypted keys, mk_live_ external API tokens
3
Prompt Template Engine
DB-backed, versioned prompt templates with category field, POST /api/ai/render-template
4
Project Context Management
Brand voice / audience / prior-output injection into every prompt
5
AI Usage Tracking & Cost Engine
Per-request cost ceilings by plan tier, heuristic complexity estimation, budget-aware model selection — the Golden Rule enforcement layer
6
Model Fallback (hardened)
KV-backed circuit breaker per provider (3 failures/5min opens, 2-min cooldown), configurable fallback chain
7
AI Studio v2 — Purpose-First
Purpose Registry (11 intents), three-step PurposeSelector UI, Smart Prompt Analysis, multi-lens recommendation engine, visible model-substitution warning banner
Exit criteria: a test call through the Router correctly routes a free-tier user to a free-tier model and a premium-tier user to the best available model, with cost logged.
Phase 3 — Workflow Engine ✓ Done
1
Workflow Definition Schema
JSON-schema validated definitions, no proprietary DSL
2
Workflow Execution Engine
workflow-engine.ts, routes/workflows.ts, routes/workflow-runs.ts — sequencing, state, retry
3
Trigger System
Manual / recurring Cron (workflow-scheduler.ts, quota-gated like manual runs) / webhook-per-workflow
4
Step Type Library
9 live step types: ai_task, validation, transform, delay (pause/resume via scheduled_jobs), integration_action, branching, human_approval, browser_automation, local_file_access, image_generation
5
Validation Layer
JSON schema (exists/min_length/max_length/contains) + transform (trim/case/parse_json)
6
Task/Queue Processing
dispatchWorkflowRun() — retry with backoff + dead-letter after MAX_QUEUE_ATTEMPTS, surfaced to Admin instead of retrying forever
Exit criteria: a trivial test workflow ("generate text → validate → output") runs end-to-end through Trigger → Step → Validation → Output with zero workflow-module-specific code in the engine.
Phase 4 — Workflow #1: Social Media Automation In Progress
1
LinkedIn, Meta (Facebook + Instagram), X, YouTube connectors
Auth, post, fetch engagement metrics — all four live in the connector registry
2
Social Media Automation workflow
Topic Research → Content Generation → Image Generation → Validation → Scheduling → Publishing
3
Workflow-specific UI
Calendar view, post preview, approval queue
Exit criteria: a real post, generated end-to-end by the workflow, goes live on a connected LinkedIn/Facebook/Instagram account with no manual editing required.
Phase 4.5 — Muqira Connect: Full Connector Build-Out ✓ Done
1
Communication
Webhook, Slack, Discord, Telegram, Email, WhatsApp
2
Social
X/Twitter, Meta, LinkedIn, YouTube
3
Publishing & Commerce
WordPress, Ghost, Shopify
4
Productivity & Data
Notion, Airtable, Trello, Google Sheets, Google Docs
5
Marketing
Mailchimp, Brevo
6
Dev & Project Management
GitHub, Jira, Asana
7
Analytics & SEO
Google Search Console, Google Analytics (GA4)
8
Per-connector rate limiting
20 actions/min per (org, provider) — protects the org's standing with the third-party platform, separate from the AI burst limiter
Exit criteria: adding a new connector requires only implementing the Connector contract and one registry line — proven by shipping 25 connectors across 6 categories on the same registry.
Phase 4.6 — Admin Console & Marketing Site ✓ Done
1
Admin Console
12 pages behind is_platform_admin + ADMIN_SECRET: Organizations, Users, Subscriptions, Payments, AI Requests, Model Registry, Usage, Discounts, Integrations, Workflows, Assets — reachable via a proper sub-nav sidebar
2
Marketing site
Blog, Changelog, Docs, Tools, Labs, Status (with incident history), About/Careers/Press/Contact, Legal, per-product marketing pages, llms.txt
Exit criteria: a platform operator can see and act on every org, subscription, payment, AI request, and workflow run from one console.
Phase 5 — Publishing Infrastructure Hardening In Progress
1
OAuth/credential hardening at scale
Encryption at rest, strict access scoping, refresh rotation, revoke-on-disconnect verified for every live connector
2
Scheduler + queue hardening
Higher volume, dead-letter alerting (email/Slack) — currently surfaced in Admin only, no push alert yet
Exit criteria: connector build-out already proves the SDK works (Phase 4.5) — this phase hardens what exists under real volume.
Phase 6 — Analytics Layer Not Started
1
Event Pipeline
Cloudflare Queue → batch-insert Postgres, typed event schema
2
GA4 + Search Console connectors
Already live in Muqira Connect (Phase 4.5) — this phase is wiring them into a dedicated Analytics dashboard, not building the connectors themselves
3
Content Performance Tracking
Per-post dashboard, trend-over-time, best-performing surfacing
4
Click & Engagement Tracking
Link shortening/tracking layer — AlShorty doubles here
Exit criteria: a user can see real engagement numbers (not just "published" status) on content the Social Media workflow generated.
Phase 7 — Workflow Marketplace & New Modules Multi-Workflow
1
Workflow Templates system
Gallery, one-click clone, system-org-owned templates
2
SEO Automation
Analyze Website → Find Issues → Recommendations → Tasks
3
Content Marketing Automation
Brief Intake → Research → Draft → Validate/Edit → Publish
4
Research Automation
Define Question → Web Research → Synthesize → Structured Output
5
Product Launch Automation
Analyze Product → Generate Assets → Launch Plan → Publish
6
Directory Submission Automation
Gather Info → Match Directories → Generate Copy → Submit → Track
Exit criteria: a second workflow module ships in materially less time than Workflow #1 did, because the platform layers already exist.
📣 Marketing Channels
How to play reachability — owned content, product-led growth, community, partnerships, and paid (only after PMF).
✅ Marketing Action Checklist
🔍 SEO Playbook
Technical foundation, keyword strategy, link building, and measurement — how Muqira itself plays SEO.
✅ SEO Action Checklist
💼 Business & Revenue
Pricing, unit economics, retention, and capital strategy.
✅ Business Action Checklist
Ownership Matrix
The most important document. Before building any feature — check this first.
The core question: Can another workflow module use this in the next 12 months? YES → Build in a Layer (packages/ or platform API). NO → Build in the workflow module's folder.
Feature Ownership
| Feature | Owner | Location | Notes |
|---|---|---|---|
| Authentication | Core Layer | apps/api/auth/ | All workflow modules import this |
| AI Routing | AI Layer | packages/ai/router.ts | Only entry point for AI calls |
| Workflow Execution | Workflow Engine | packages/workflow-engine/ | Every module's steps run through this |
| Cost Tracking | AI Layer | packages/ai/cost-engine.ts | Auto-logged per request |
| Billing / razorpay | Core Layer | apps/api/billing/ | One razorpay account |
| File Storage | Core Layer | apps/api/storage/ | R2 via platform service |
| Connector SDK | Muqira Connect | lib/connectors/registry.ts | Single Connector contract, 25 connectors registered |
| Topic Research / Content Gen | Social Automation | workflow definition | Calls AI Router internally |
| Keyword Research / SERP Analysis | SEOventra | apps/seoventra/ | Domain logic only |
| PDF Processing | Documateo | apps/documateo/ | Storage via platform R2 |
| Link Shortening / Click Tracking | AlShorty | apps/alshorty/ | Also serves as platform click layer |
Cross-Module Matrix
Which workflow modules consume which platform modules — and how built-out each pairing already is.
🚫 Kill List
Do NOT build any of these before product-market fit. Re-read this before every sprint.
If you find yourself about to build one of these: stop, re-read the Guiding Principles, and ask if there's a simpler path. Every item on this list has killed bootstrapped companies.
Kubernetes or container orchestration — Cloudflare Workers scale globally for free.
Microservices split of apps/api — modular monolith on Workers until proven independent scaling needs.
Event mesh / message broker (Kafka, RabbitMQ) — Cloudflare Queues is enough until serious scale.
Multi-region deployment logic — Workers are already globally distributed by default.
Custom AI model training or fine-tuning — route across 7 existing providers instead.
Real-time collaborative editing (Google-Docs style) — massive complexity, uncertain return at this stage.
Enterprise SSO — not before real revenue and an actual enterprise customer asking.
Granular custom-permission engine — Owner/Admin/Member/Viewer is enough for years.
Plugin marketplace — not before 3+ workflow modules are live with real usage.
Native mobile apps — responsive web is sufficient; native adds huge maintenance overhead.
On-premise / self-hosted offering — cloud SaaS only until an enterprise customer pays for it.
Custom analytics infrastructure — lightweight pipeline first, not a Snowflake-style stack.
White-label reseller system — after PMF only.
Affiliate / referral program infrastructure — after PMF only.
Rebuilding billing/auth/storage per sub-product — everything reusable goes in Muqira Core, no exceptions.
Tech Stack
Deliberate, confirmed choices. Boring until scale demands otherwise.
Frontend
Next.js 15ReactTailwindCSSshadcn/uiCloudflare Pages
Backend
Cloudflare WorkersHonoTypeScript
Database
D1 (Cloudflare SQLite)Drizzle ORM23 migrations applied
Queue & Storage
Cloudflare QueuesCloudflare R2Cloudflare KV
Auth
Resend (Email OTP)Google OAuthGitHub OAuthJWT Sessions
AI Providers (7)
GroqOpenAIAnthropicGeminiMistralDeepSeekOpenRouter
Payments
razorpayCheckoutBilling PortalWebhooks
PDF Generation
jsPDF text primitives
Never html2canvas — non-selectable output, 16,384px page-height failure mode.
Monitoring & VCS
SentryPostHog / CF AnalyticsGitHub
⚠️ Risk Register
From the blueprint, section 9. Named risks with their mitigation — revisit quarterly.
| Risk | Mitigation |
|---|---|
| AI Router as a single point of failure | Every workflow module depends on it — build Model Fallback early, not as an afterthought. |
| OAuth token security | A leaked LinkedIn/Facebook token is a real liability — encryption at rest + strict access scoping on the token store from day one. |
| Multi-tenant data isolation | Every Core table scoped by org_id with zero exceptions — one missing filter is a cross-customer data leak. |
| Cost overruns from AI usage | The Cost Engine must exist before Workflow #1 has real paying users, not after the first surprising bill. |
| Scope creep across workflow modules | "Build once, reuse forever" is the safeguard — if a Phase 7 module needs a feature that doesn't fit an existing Layer, redesign the module, don't bolt on a one-off. |
| Connector maintenance burden | Every third-party API changes over time — budget ongoing maintenance capacity per connector, not just initial build time. |
AI Cost Dashboard
Track AI spend across all 7 providers before it surprises you. Plug in real numbers as the AI Router ships and logs usage.
Platform Health
A weighted self-assessment across the dimensions that actually predict production pain. Adjust sliders as things change.
Release Readiness
A workflow module is marked "Ready" only when its overall score is ≥85%, testing ≥70%, and docs ≥50%. No exceptions — that's the bar that prevents shipping broken things.
Technical Debt
The shortcuts you took on purpose. Log them here so they get paid down deliberately instead of forgotten.
Title
Severity
Est. hours
Decisions Log
Lightweight Architecture Decision Records. Capture the why, not just the what — future you will thank present you.
Decision
Reason
Alternatives considered
My Notes
Free-form workspace. What you're building today, blockers, ideas.
Current Focus
Blockers
Next 3 Actions
Decisions Made (free-form)
Open Questions
Abandoned / Deprioritized
Ideas Backlog