Palantir-for-procurement.
Open-source. Audit-verifiable. Multi-agent.
One Postgres-backed kernel for procurement: hash-chained audit log, per-tenant ontology, 10-agent swarm with replayable decisions. Every transition cryptographically verifiable cold. Every spend pattern queryable via 170+ documented APIs. Built to survive a SOC-2 audit on day one.
The problem with every procurement stack today
Procurement teams are stuck between two failure modes. The legacy monoliths take 18 months to implement and have no agent layer. The new point tools each cover one slice and shred audit-trail integrity across five vendors. Custom-built always wins for 18 months, then collapses under tech debt.
The wedge — three primitives nobody else ships
- Hash-chained, replayable auditEvery state transition is hash-chained (RFC 6962 Merkle). Every agent decision is replayable. An auditor verifies a single event against a published root with no platform trust required.
- Per-tenant ontology that doesn't forkPer-tenant ObjectTypes / LinkTypes / Actions extend the global ontology. Workspace branches let you experiment safely. Snapshot-versioned for rollback.
- 10-agent swarm with persistent memoryVoyager-style playbook memory (Wang et al. 2023) compounds agent performance over runs. SOC-2 / ESG / OFAC / LkSG / CSRD attestation falls out of the data model.
The architecture
One transaction writes domain + audit + outbox atomically. Postgres is the only source of truth. FalkorDB and webhook fan-out are derived — you can drop them and rebuild from the outbox.
┌──────────────────────────────────────────────────────────────────┐
│ Edge / API │
│ Next.js · /v1/* (170+ routes) │
│ Lucia magic-link + RFC 6238 TOTP · RFC 9457 problem+json │
└────────────────────────┬─────────────────────────────────────────┘
│ tx
▼
┌──────────────────────────────────────────────────────────────────┐
│ SOURCE OF TRUTH │
│ Postgres 17 · 28 migrations · 60+ tables │
│ partitioned audit_events · RFC 6962 Merkle roots │
│ outbox table (transactional) │
└──┬───────────────────────────┬─────────────────────────┬─────────┘
│ outbox │ /v1/audit/verify │ tx
▼ ▼ ▼
┌──────────┐ ┌──────────────────┐ ┌─────────────────┐
│ BullMQ │ │ FalkorDB graph │ │ 10-agent swarm │
│ workers │ │ 10 node labels │ │ Ollama Cloud │
│ outbox │ │ 10 edge types │ │ replayable │
│ webhooks │ │ │ │ tool-call audit │
└──────────┘ └──────────────────┘ └─────────────────┘- Postgres 17ACID source-of-truth. 28 migrations, partitioned audit_events.
- Outbox-driven projectionDomain + audit + outbox in one tx. No eventually-consistent gap.
- FalkorDB graph sidecar10 node labels / 10 edge types. Multi-hop supplier-network risk.
- BullMQ webhooksHMAC-SHA256, staircase backoff, 7 attempts → dead-letter.
- RFC 6962 Merkle auditPer-request linear chain, daily Merkle roots, /v1/audit/verify.
- Lucia + RFC 6238 TOTPMagic-link sign-in, hand-rolled TOTP 2FA, marker-based access.
What's already shipped — live numbers
Counts pulled live from the seeded prod kernel, refreshed every 60 seconds. Numbers anonymized for public display.
SOTA showcase — anonymized live primitives
Each card below is rendered server-side from real database queries, with supplier names hashed into pseudonyms. Click through to the live (auth-gated) version.
Engineering credibility
10 ADRs documenting every load-bearing architectural choice, with arxiv + RFC + ISO citations. Open-source-ready (repo URL pending public release).
We picked Postgres 17 over MongoDB because financial transactions need ACID. We picked FalkorDB sidecar over pgvector because multi-hop supplier-network queries need a real graph engine. We picked Voyager-style playbook memory because Wang et al. 2023 demonstrated compounding agent performance with persistent lessons.
Read the 10 ADRs →