Nova Suite

Enterprise Intelligence Platform

Transform your agency into a continuously learning intelligence system—capturing every signal, insight, decision, and outcome to drive smarter strategy and faster execution over time.

6
Styx Workflows
5
AI Agent Types
3
Domain LLMs
Compounding Value

The Strategic Shift: From Projects to Intelligence

Enterprise AI transforms agencies from execution partners to intelligence partners

Traditional Agency

Projects that end

Insight in people's heads

Reactive execution

Headcount scaling

Nova Suite

Intelligence that compounds

Insight in the system

Predictive action

Knowledge scaling

Nova Suite Enterprise AI Styx Workflows Poetry Platform

Industry Vision: The Future of Enterprise AI

Leading analysts define the convergence of AI, orchestration, and automation

Gartner BOAT

Business Orchestration & Automation Technologies

  • "The 'O' is critical" — Orchestration is key
  • Convergence of BPM, iPaaS, RPA, GenAI, Low-Code
  • AI Agents becoming core capability
  • Unified platform replacing fragmented tools

Forrester APO

Adaptive Process Orchestration

  • "The next wave in enterprise automation"
  • AI agents with nondeterministic control flows
  • Evolution from DPA to adaptive orchestration
  • Balance of AI innovation with reliability

Nova Suite: Where BOAT Meets APO

We're implementing what leading analysts envision for enterprise automation

Styx Workflow Suite

Six branded workflows that operationalize strategy into governed execution

SM

Social Media Management

Brief → Strategy → Content → Calendar

Implemented
PM

Paid Media (Poetry)

Planning → Optimization → Reporting

Implemented
SP

Spectre/Crisis

Detection → Assessment → Response

In Progress
KE

KEO/Reporting

Ingestion → Analysis → Visualization

Implemented
CC

Content Creation

Voice → Planning → Creation → Approval

Planned
CS

Review & Customer Service

Intake → Response → Resolution

Planned
🧠
Content AI WRX
Strategy + Learning Agents
👁️
Spectre LLM
Listening + Analysis Agents

Paid Media Workflow Original Requirements

The 8 core functions defined in the Paid Optimization Workflow Outline

PLANNING FLOW
1

Media Mix Allocation

Budget distribution across channels

Implemented
2

Media Forecasting

Performance prediction using benchmarks

Implemented
3

Audience Identification

Unified targeting recommendations

Implemented
4

Campaign Naming

Standardized naming conventions

Implemented
5

Campaign Flighting

Detailed flighting calendar

Implemented
MONITORING FLOW
6

Daily Pacing

Real-time spend & KPI monitoring

Implemented
7

Weekly Reallocation

Budget rebalancing based on performance

Implemented
8

Weekly Snapshot

WoW analysis & strategic insights

Implemented
PLATFORM DIFFERENTIATORS
INT

Multi-Channel Integrations

Google, Meta, LinkedIn, TikTok, GA4, CRM

BPM

BPMN-Driven Workflows

Camunda v7 OSS engine with AI generation

AI

AI Agent Functions

MMM Allocator, Predictive Engine

PRT

Client Portal

Persona-based dashboards & DoA

21 Rival Functions

CortexOne AI agents invoked via API • All published at cortexone.rival.io

Core Marketing AI Functions (21 Total Published ✓)

📊

Predictive Engine

ML forecasting

💰

MMM Allocator

Bayesian optimization

⚙️

Autonomous Executor

Auto-execution

🔒

Privacy Measurement

CAPI validation

📈

Incrementality

Lift measurement

📡

Ad Platform Reader

Unified read API

📧

Email Service

Resend integration

📱

SMS Service

Twilio integration

🧠

Content Extractor

Embedded LLM analysis

🎯

Brand Voice Scorer

Content compliance

📄

Document Chunker

RAG preprocessing

🧬

Embedding Service

Vector generation

BPMN Workflow Steps (8 Camunda Workers)

Media Mix
Forecasting
Audience
Framework
Creative Brief
Daily Optimization
Weekly Reallocation
Weekly Snapshot

Compliance Workers (10 Camunda External Tasks)

🔍 Gap Detection
📊 Score Calc
🚨 Alerts
📈 Dashboard
📝 Audit Log
🔬 Scan
⚖️ Rules
📤 Submit
📋 Status
📦 Collect

Multi-Channel Integrations

Production-ready integrations with error handling, validation, and retry logic

Google Ads

OAuth 2.0 • Campaign CRUD

Meta Ads

OAuth 2.0 • 9 Workers

LinkedIn Ads

OAuth 2.0 • 189 Tests

TikTok Ads

Token Auth • KB Ingester

Google Analytics 4

n8n Signal Ingestion

CRM Integration

Salesforce • HubSpot

Talkwalker

Blue Silk AI • 150M+ Sources

Google Workspace

Domain-Wide Delegation

Integration Core

Base Classes • Retry Logic

  • Unified error handling with automatic retry (exponential backoff)
  • Input validation via Zod schemas for type-safe API calls
  • OAuth 2.0 token management with automatic refresh
  • Rate limiting and quota management per integration

Platform Architecture

Rival Platform Foundation + Poetry Domain Layer

Multi-Tenant Access
Acme CorpBrand XAgency YN tenants...
Poetry: Client Portal & Dashboards
10 Personas | DoA Workflows | Campaign Analytics | Feedback System
Access & Compliance Control
Role-Based Access | Policy Enforcement | Audit Trail
Campaign Automation Engine
Real-time Processing | Media Workflows | Secure Multi-tenant Operations
Agentic Process Orchestration
BPMN Orchestration | Service Tasks | Human Tasks | Timer Events | AI Agents
Poetry Intelligence System
Causal AI (DoWhy/EconML) | Temporal Knowledge Graph | Cross-Client Pattern Learning
21 CortexOne AI Functions (All Published ✓)
Predictive Engine | MMM Allocator | Privacy Measurement | Autonomous Executor | Incrementality | Ad Platform Reader
Email Service | SMS Service | Content Extractor | Brand Voice Scorer | Document Chunker | Embedding Service
Data Foundation
PostgreSQL
+ pgvector
Neo4j
31 Cypher Schemas
GCS
Object Storage
Upstash
Redis Cache
Descope
Auth

50+ SubAgents

Claude-powered automation

59 BPMN Processes

Visual process orchestration

8 Signal Categories

Unified signal taxonomy

5 Ad Platforms

Meta, Google, TikTok, LinkedIn, X

AI-Powered BPMN Generation

Generate complete BPMN processes from natural language using Claude

User Input

"Media planning workflow
with parallel approvals"

Claude Agent SDK

BPMN generation rules
+ validation

Valid BPMN 2.0 XML

Complete process
+ diagram coordinates

  • No API key required - uses Claude Code session auth
  • 13 BPMN patterns enforced via bpmn-validator
  • Auto-deployment to Camunda via CI/CD pipeline
  • Integration with Planning Workers for end-to-end automation

Claude Code CI/CD Pipeline

Automated BPMN deployment integrated with GitHub

1

Design

AI generates BPMN

2

Validate

BPMN validator checks

3

Commit

Git branch + PR

4

Deploy

Auto-deploy to Camunda

BPMN Promotion Workflow

processes/ (experiment) packages/bpmn/ (promote) CI/CD (deploy)

New processes start in processes/ for experimentation. Once validated, they're promoted to the @rival/bpmn package for automated deployment.

GH

GitHub Integration

Auto-commit, branch management, PR creation

VAL

BPMN Validation

13 rules ensure Camunda 7 compatibility

DEP

Auto-Deployment

Seamless deployment to Camunda v7 engine

GKE

GKE Bootstrap

One-command QA environment setup

Agentic SDLC in Action

Real example: RIV-337 completed autonomously in a single Claude Code session

Workflow Steps

1
Create Work Item
RIV-337 via jira-manager agent
2
Create Branch
feature/RIV-337-qa-fixtures
3
Implement Changes
24 files | Workflows UI, Tasks API, DB seeds
4
CI/CD Pipeline
Tests failed → Fixed specs → Passed
5
Merge to Main
PR #251 squash-merged
Claude Code Terminal
# Work item created
> Created: RIV-337
# Branch created
$ git checkout -b feature/RIV-337-...
# Committed
$ git commit -m "feat(RIV-337):..."
[feature/RIV-337...] 24 files, +4272
# CI/CD passed
$ gh pr checks 251 --watch
pr-pipeline pass 1m58s
test pass 1m19s
# Merged
$ gh pr merge 251 --squash
✓ Merged PR #251
24
Files Changed
4,272
Lines Added
3
Commits
1
PR Merged
~15
Minutes

Intelligent Prompt Enhancement

40-60% Effectiveness Improvement Through AI-Powered Routing

87%
Task Success
12.3h
Saved/Week
0.82
Quality Score
16K
Calls/Week
92%
Fast Model
AI

Intelligent Model Routing

Automatic selection of optimal model based on task complexity

Haiku 67% | ~2s
Sonnet 25% | ~5s
Opus 8% | ~10s
PE

Enhancement Pipeline

5-stage pipeline with feedback loop for continuous improvement

1 CLASSIFY - Analyze task complexity
2 ENHANCE - Apply 12+ patterns
3 ROUTE - Select optimal model
4 EXECUTE - Run with monitoring
5 MEASURE - Quality feedback
UC

Active Use Cases

Production deployments with measured effectiveness

Agentic SDLC
Powers 50+ SubAgents with intelligent routing for code generation, review, and deployment
Poetry Chatbot
Optimizes response quality and latency for marketing intelligence queries
Click for detailed metrics

Technology Stack

22

Node.js 22 LTS

Runtime (LTS until Apr 2027)

T

Turborepo + pnpm

Monorepo with 10+ packages

N

Next.js 14

React web app with App Router

NS

NestJS API

TypeScript backend with DI

C

Camunda v7 OSS

BPMN engine with REST API

A

Authority Management

Enterprise authorization

Z

Zod Validation

Runtime API validation

S

shadcn/ui + Tailwind

Accessible UI components

P

Playwright E2E

End-to-end testing

PG

PostgreSQL 18

Alpine-based database

PR

Prisma ORM

Type-safe database access

RD

Redis

Cache and sessions

FM

Framer Motion

Spring animations

KB

Knowledge Base

Neo4j + pgvector

🐳

Docker

Containerized stack

LK

LiveKit Agents

Real-time voice AI

AI

OpenAI GPT-4o

Conversational LLM

DG

Deepgram

Speech-to-text

BP

Beyond Presence

AI Avatar rendering

SEC

Container Security

Automated vulnerability scanning

Monorepo Structure

rival/
├── apps/
│   └── web              # Next.js dashboard
├── packages/
│   ├── api              # NestJS REST API
│   │   └── test/fixtures/   # BPMN test fixtures (CI/CD)
│   ├── bpmn             # Production BPMN (@rival/bpmn npm package)
│   ├── workers          # Camunda workers (5 planning)
│   ├── authority-management  # Enterprise Authorization
│   └── integrations/
│       ├── core         # Shared utilities
│       ├── google-ads   # Google Ads API
│       ├── meta-ads     # Meta/Facebook API
│       ├── linkedin-ads # LinkedIn Marketing
│       ├── tiktok-ads   # TikTok Ads API
│       ├── ga4          # Google Analytics 4
│       ├── crm          # CRM integration
│       └── google-workspace
├── functions/           # CortexOne AI agents
└── processes/           # BPMN scratch/experimentation (local dev)

BPMN File Organization

processes/
Scratch & experimentation
Local dev only
packages/bpmn/
Production processes
Deployed to Camunda
api/test/fixtures/
Test fixtures
CI/CD validation

GCS Object Storage

Secure, multi-tenant file storage with enterprise compliance controls

🔒
rival-{env}-system
Platform templates
Admin only
📁
rival-{env}-tenants
Tenant data
Path isolation
📤
rival-{env}-exports
Temp exports
7-day TTL
🔍
rival-{env}-quarantine
Upload validation
Staging area
🛡️

Path Validation

  • UUID tenant ID verification
  • Category whitelist enforcement
  • Path traversal attack prevention

Tenant Isolation

  • Every operation verified
  • Cross-tenant access blocked
  • Unauthorized access logged
📋

GDPR Compliance

  • Article 17 erasure support
  • Hard delete from DB + GCS
  • Audit trail preserved
🔐

Workload Identity

No service account keys in Cloud Run. Uses GCP Workload Identity for zero-credential access to GCS buckets.

📝

HMAC-SHA256 Audit Trail

Tamper-proof audit logs with cryptographic signatures. Every upload, download, and delete is immutably recorded.

Web Application Features

Next.js 14 dashboard with enterprise-grade features

A11Y

WCAG 2.1 AA Accessible

Full ARIA support, keyboard navigation

SEC

Security Headers + CSP

Content Security Policy, HSTS

API

Zod API Validation

Runtime validation with type-safe client

PLAN

Planning Studio

Smart forms, KB search, RBAC-protected routes

BPMN

BPMN Viewer

Interactive process diagram viewer

MOCK

Dev/Prod Separation

Mock data layer for development

DASH

Persona-Based Dashboards

7 role-specific views with proactive insights

CHAT

Context-Aware Chat

Cmd+K with page detection + auth guardrails

DoA

Approval Workflows

Enterprise delegation of authority

CortexOne Serverless Functions

AI-Powered Campaign Optimization Agents (GCP Python 3.13 Runtime) - All 6 Published ✓

📊

Predictive Engine

Actions: ROAS forecasting, creative fatigue, audience saturation

✓ Published ($0.01)

🔒

Privacy Measurement

Actions: CAPI signal quality, privacy-compliant validation

✓ Published ($0.01)

⚙️

Autonomous Executor

Actions: Auto-execute with budget guardrails & safety limits

✓ Published ($0.01)

💰

MMM Allocator

Actions: Bayesian budget optimization, Media Mix Modeling

✓ Published ($0.01)

📈

Incrementality Testing

Actions: Geo-holdout, synthetic control, Bayesian lift

✓ Published ($0.01)

📡

Ad Platform Reader

Actions: Unified read API for Google & Meta campaigns

✓ Published ($0.01)

🎉 11 Functions Live on CortexOne Marketplace

11/24 functions published at cortexone.rival.io | 13 in development | API-invokable via BPMN workflows | $0.01/call pricing

Agentic Intelligence Architecture

How CortexOne Functions Think, Reason, and Act Autonomously

🧠

ReAct Loop

THINK - ACT - OBSERVE cycle enables multi-step reasoning with tool use

🛡

HITL Escalation

Risk-based thresholds ($5K budget, 50% change) trigger human approval

Dual-Mode Execution

Fast rule-based (sync) or intelligent multi-step (agentic) modes

📋

CDD Evidence

Complete audit trail with query hashing and trace correlation

Daily Optimization Agent

  • Predictive analytics for ROAS trends
  • Budget allocation recommendations
  • Creative fatigue detection

Compliance Checker Agent

  • Privacy signal validation
  • CAPI compliance verification
  • Policy guardrail enforcement
Deep Dive: Full Architecture Guide →

Rival Modeler & Function Marketplace

Visual BPMN Modeler with CortexOne Marketplace Integration

🔧

Rival BPMN Modeler

bpmn.io + Rival Activity Palette

  • Visual drag-and-drop BPMN 2.0 editor
  • Rival Activity type with function selector
  • Auto-maps to Camunda external tasks
  • CI/CD deployment to process engine
🛒

CortexOne Marketplace

100s of AI Functions Available

  • Dynamic fetch from CortexOne API
  • 8 categories: NLP, Analytics, Marketing...
  • Unit pricing per execution ($0.01+)
  • Search, filter, and browse functions

Tenant Admin Function Curation Workflow

🛒

Browse Marketplace

Select Functions

💰

View Collection Cost

💾

Save Collection

🔧

Use in Modeler

Tenant admins curate which marketplace functions are available to their process modelers

100s
Functions Available
8
Categories
$0.01+
Per Execution
Tenants Supported

Client & Operations Portal

Poetry: World-Class Client Experience

4
Portals
100+
Components
47
Pages
2
AI Assistants

Client Portal

Dashboard, Spend, Campaigns, Reports, Approvals

Operations Portal

ITSM Tickets, Client Health, Feedback, Workflows

Admin Portal

Functions, Infrastructure, Settings

Auditor Portal

Audit Trail, Evidence, Reports

Shared Infrastructure

Descope Auth, AI Chat, Voice Agent, Knowledge Base
  • Descope auth: Social (Google/Microsoft/Apple) → Magic Link → Enterprise SSO
  • AI Cmd+K chat assistant with Neo4j Knowledge Base
  • Poetry Voice Agent with LiveKit + Beyond Presence avatar
  • Enterprise DoA approval workflows with BPMN
  • Role-based access control with OPA policies

Click persona to see task inbox:

📊
Sarah Johnson
CMO
🎯
Mike Chen
Brand Manager
💰
Lisa Rodriguez
Finance
🚀
Alex Thompson
Campaign Mgr
🎧
Jamie Lee
Support
👥
Morgan Kim
Admin

Descope Identity Platform

Poetry Login - Descope Authentication

Social OAuth + Magic Link + Enterprise SSO (7.5K MAU free)

Operations Ticket Management

ITSM-Style Ticket Queue for Support & Operations Teams

5
Statuses
4
Priorities
6
Categories
60+
E2E Tests

📥 Ticket Queue

Filterable list with status badges, priority indicators, and SLA tracking

Open In Progress Resolved

📋 Detail Panel

Full ticket view with description, assignee, timeline, and communication thread

Claim Respond Resolve

📊 Analytics

Metrics cards showing queue health, response times, and resolution rates

Total Open Avg Response

Priority Levels

Critical High Medium Low

Categories

Technical Billing Account Feature Data Other

Available at /operations/tickets • Support Agent persona • RIV-478

Planning Studio Intelligence

AI-Assisted Campaign Creation with Enterprise Controls

📝

Smart Form UX

  • Required field indicators
  • Real-time validation
  • Custom date range picker
  • Error scroll-to-first
🔍

KB-Powered Search

  • Searchable client dropdown
  • Tier + vertical display
  • Industry benchmarks
  • Live KB integration
🔐

RBAC Protection

  • Route-level guards
  • Persona-based access
  • Graceful redirects
  • Loading state UX

⚙️ Admin-Configurable Fields

Campaign objectives, target audiences, industry verticals, platform channels - all editable by admins via /admin/settings

4 Field Types CRUD Admin UI localStorage
Create Plan
Select Client
Configure
Start BPMN

AI-Powered Chat Assistant

Context-Aware Intelligence with Auth Guardrails

⌘K / Ctrl+K

Global shortcut
from any page

Page Context

Route detection
intent classification

Knowledge Base

Persona-filtered
responses

AI Response

Markdown + syntax
highlighting

CTX

Page-Aware Context

Detects landing, login, dashboard, planning routes for tailored suggestions

AUTH

Auth Guardrails

Intent classification blocks auth-required questions from guests

KB

Neo4j Knowledge Graph

720+ nodes, 665+ relationships, TOGAF ontology

PER

Persona-Aware

Role-based knowledge filtering via graph

SUG

Smart Suggestions

Dynamic questions based on page + auth state

FB

Feedback Loop

Thumbs up/down with AI sentiment analysis

Context Examples: Landing page → "What is Poetry?" | Dashboard → "How is my ROAS trending?" | Planning → "What's the recommended budget for retail?"

PoetryBot Voice Assistant

Multi-Modal AI Interaction with Local LLM

Avatar Mode
🎬

Avatar Mode

Beyond Presence AI avatar with real-time lip sync

Voice Mode
🎙️

Voice Mode

Audio-only with real-time bar visualizer

Text Mode
💬

Text Mode

Traditional chat interface with markdown support

AI Stack

LLMOllama (llama3.2) - Local
STTDeepgram
TTSDeepgram (aura-asteria-en)
VADSilero - Local
WebRTCLiveKit Cloud

Key Differentiators

  • No OpenAI dependency for LLM inference
  • Local model = data stays on-premise
  • Tool calling for campaign insights
  • Seamless mode switching during session
  • WCAG 2.1 AA compliant interface

Powered by: LiveKit Cloud + Deepgram + Ollama + Beyond Presence

Enterprise Approval & Feedback Workflows

Delegation of Authority (DoA)

$10K

Manager

$100K

Director

$1M+

CMO

  • Threshold-based approval routing
  • Visual approval chain progress
  • Multi-level escalation with timeouts
  • Full audit trail integration

Closed-Loop Feedback

Collect

👍/👎

Analyze

AI Sentiment

Resolve

Notify User

  • AI sentiment analysis via CortexOne
  • Priority-based BPMN routing
  • Email + in-app notifications
  • Operations dashboard for staff

Intelligence-Enhanced Knowledge Graph

40+ nodes including Signals, Causal AI, Patterns & Anomalies - Click "Data Scientist" to explore

Persona
Platform
Signal
Causal AI
Temporal
Cross-Client
Function
Pattern
Anomaly
Validation
Security
Regulation

Poetry Intelligence System 3D Explorer

Immersive visualization of Signals, Causal AI, Cross-Client Learning & 80+ relationships

🖱️ Drag to rotate 🔍 Scroll to zoom 👆 Click node for details

Content Science: Data-Driven Intelligence

Transform content creation from art to measurable science

Powered by ContentWRX methodology | Partnership with Colleen Jones / Content Science   View Breakout →

6
Dimensions of Effectiveness
0-100
WRX Score
3
Application Modes
6
Entity Types
5
Social Platforms
📥
Ingest
Social APIs
🏷️
Extract
Entities
🧠
Enrich
Semantics
📊
Attribute
Performance
🎯
Predict
& Recommend
ROI

ROI Attribution

Track which themes and archetypes drive business outcomes

🎨

Brand Consistency

Score content against brand pillars for voice compliance

🔍

Gap Analysis

Identify underserved themes, audiences, or formats

🔄

Learning Loop

Self-improving recommendations that compound over time

Content Science Architecture

25,000+ lines of AI-powered content intelligence | 3 Application Modes: Agency, Platform, Competitive

Social Listening Layer

LinkedIn API Twitter/X API Reddit API TikTok API Instagram API
~12,000 lines
OAuth 2.0 + Rate Limiting

Intelligence Layer

Entity Extraction Semantic Enrichment Graph Augmented RAG Hybrid Search Cross-Encoder Reranking
~8,000 lines
Neo4j + pgvector

LLM Abstraction Layer

Content Analyzer Content Embedder Content Classifier Narrative Analyzer
~6,000 lines
OpenAI → Content AI WRX

WRX Scoring Layer

Discovery Accuracy Relevance Usefulness Polish Influence
0-100 Score
ContentWRX (Colleen Jones)

BPMN Workflow Layer

Entity Extractor Worker Semantic Enricher Worker Brand Voice Worker Social Ingestion Workers
Camunda 7
External Task Pattern

Rich Persona & User Personalization

Deep User Modeling for Truly Personalized Experiences

10
Rich Personas
21
Attributes Each
16
Jobs-to-Be-Done
16
Skills
4
User Profiles
JTBD

Jobs-to-be-Done

Primary & secondary jobs, goals, success metrics, pain points for each persona

Optimize Campaigns Debug APIs
USR

User Profiles

Individual users synced from PostgreSQL with expertise tracking and learning history

Expertise Level Certifications
SKL

Skills & Learning

16 skills with prerequisites, learning paths, and certification tracking

Meta Ads GDPR
GAP

Knowledge Gaps

Identify what users should know vs. what they currently know

SHOULD_KNOW Personalized
MR

Multi-Role System

Users can hold multiple roles - unified task inbox across all assigned personas

UserRole Table Aggregated Groups Role Badges
CO

Compliance Officer

New persona for regulatory compliance review and content approval workflows

compliance-reviewers Operations Portal

Context-Aware Queries

"What should I know as a Campaign Manager?" "What skills do I need for Meta API integration?" "What's my learning path to become GDPR expert?"

Individual User Context

"What topics has Sarah recently viewed?" "What's Alex's expertise level in OAuth?" "What knowledge gaps do I have in compliance?"

Governance & Compliance: The Strategic Advantage

AI Under Control + Industry Regulations Built-In

View E2E Compliance Evidence Report
12 Screenshots | 10 Personas | SOC2 + GDPR Mapping

AI GOVERNANCE Autonomous Agents Under Control

18
Controls
100%
Compliant
<4hr
Drift Detection
76%
Cost Savings
Claude Code SDLC
Bias detection, security scanning, audit trails, quarterly reviews
Poetry Chatbot
OTEL tracing, hallucination scoring, PII scrubbing, evidence gen
CortexOne Functions
Cost tracking, usage metrics, audit trails, model routing

INDUSTRY COMPLIANCE Regulated Verticals Built-In

37
DMN Tables
10
BPMN Workflows
30+
Services
8
Verticals
50
States
💊
Pharmaceuticals
FDA OPDP • Fair Balance
Off-label Prohibition
Click for GTM →
🏦
Financial Services
SEC • FINRA • CFPB
APR Disclosures
Click for GTM →
🏥
Healthcare
CMS • HHS
Medicare Ad Approval
Click for GTM →
🎰
Gaming & Betting
State Gaming Commissions
Responsible Gaming
Click for GTM →
🍺
Alcohol & Cannabis
TTB • State Authorities
Age-Gating Required
Click for GTM →
🛡️
Defense & Aerospace
DoD • ITAR/EAR
Export Controls
Click for GTM →
🎓
Education
Dept of Education
Outcome Claims
Click for GTM →
📈
+ More Daily
AI targeting = new risk
Pattern expanding
Click for GTM →
Ad Spend Is
Auditable Evidence
Marketing Is
Regulated Workflow
Placement Is
Legally Significant
AI Targeting Creates
New Compliance Risk

Poetry builds compliance into the platform from day one—
a strategic advantage for us and a competitive edge for our clients.

AI Governance Framework

18 Controls Across 5 Categories - Complete Autonomous Agent Oversight

18
Controls
5
Categories
100%
Automated
13mo
Retention
~$55-75
/month
🔍 TRANSPARENCY
  • Intelligent model routing (H/S/O)
  • 87% success, 12h/wk saved
  • Click for metrics →
3 Controls
📜 ACCOUNTABILITY
  • Decision audit trail
  • Data minimization
  • Human oversight gates
3 Controls
🔒 SECURITY
  • Risk register updated
  • Security review integration
  • PII detection & masking
  • Incident response ready
4 Controls
📈 OBSERVABILITY
  • Metrics collected
  • Drift detection alerts
  • SLA compliance ≥99%
  • Continuous improvement
4 Controls
QUALITY
  • Bias detection metrics
  • Fairness validation
  • LLM-as-Judge evaluation
  • Quarterly reviews
4 Controls
Prometheus Metrics + Alerts
Phoenix LLM Tracing
Grafana Dashboards
OTEL Collection

Complete Framework: Every AI decision is logged, every model call is traced, every output is evaluated— automated governance that scales with your agents

Compliance Evidence Architecture

BPMN-Driven Automated Evidence Collection & Gap Detection

10
Workers
8
Evidence Types
11
API Endpoints
2
Portals
📥 EVIDENCE SOURCES
  • • Access Logs
  • • Backup Verification
  • • Security Scans
  • • Policy Documents
  • • Attestations
⚙️ BPMN WORKFLOW
  • • compliance-monitoring.bpmn
  • • Gap Detection Loop
  • • Score Calculation
  • • Alert Triggers
  • • Dashboard Updates
🔌 EVIDENCE SERVICE
  • • CRUD Operations
  • • File Upload (S3/GCS)
  • • Validation Rules
  • • Audit Trail
  • • API + GraphQL
📊 OUTPUTS
  • • Compliance Scores
  • • Gap Reports
  • • Email/Slack Alerts
  • • Real-time Dashboard
  • • Audit Reports
ATTESTATION AUDIT_LOG SCREENSHOT POLICY_DOC CONFIG_FILE API_RESPONSE TEST_RESULT CERTIFICATION

Automated Compliance: BPMN-orchestrated evidence collection with real-time gap detection— compliance becomes a continuous process, not an annual scramble

Multi-Persona Compliance Portals

Role-Based Views for Clients and Auditors

👤

Client Dashboard

/compliance/evidence
5
Pages
28
Unit Tests
  • ✓ Evidence Submission UI
  • ✓ Compliance Score Display
  • ✓ Gap Remediation Actions
  • ✓ Framework Progress Tracking
  • ✓ Control Status Overview
🔍

Auditor Portal

/auditor/*
5
Pages
80
Unit Tests
  • ✓ Evidence Review & Verification
  • ✓ Complete Audit Trail
  • ✓ Report Generation (PDF)
  • ✓ Framework-Specific Views
  • ✓ Compliance Dashboard
Dashboard Metrics Overview
Evidence Review & Verify
Reports Generate & Export
Audit Trail Complete History

Dual Persona Design: Clients manage their compliance posture while auditors verify evidence— 108 unit tests ensure reliability across both portals

Continuous Monitoring Infrastructure

10 Camunda External Task Workers for Real-Time Compliance

🔍 GAP DETECTION
detectEvidenceGaps

Missing & stale evidence

📊 SCORE CALC
calculateComplianceScore

Framework & overall

🚨 ALERTS
sendComplianceAlerts

Email & Slack

📈 DASHBOARD
updateDashboard

Real-time metrics

📝 AUDIT LOG
audit-log

Complete trail

🔬 SCAN
compliance-scan

Content scanning

⚖️ RULES
rule-evaluation

Policy checks

📤 SUBMIT
third-party-submit

External services

📋 STATUS
third-party-status

Service checks

📦 COLLECT
evidence-collection

Automated gathering

Monitoring Loop (compliance-monitoring-process.bpmn)
Timer Start Detect Gaps Calculate Score Send Alerts Update Dashboard End

Always-On Compliance: Timer-triggered BPMN workflows continuously detect gaps, calculate scores, and alert— compliance issues found in hours, not audit cycles

GRC Framework Foundation

SOC 2 Type 2 + Rival AI Governance - 120-150 Controls Target

120-150
Target Controls
5
TSC Categories
10
AI Domains
10
PoC Controls

🛡️ SOC 2 Trust Service Criteria

CC - Security
~50-60 controls
A - Availability
~10-15 controls
PI - Processing
~8-10 controls
C - Confidentiality
~8-10 controls
P - Privacy (+ GDPR)
~8-10 controls

🤖 Rival AI Governance (30-40 Controls)

Model Governance (MG)5
Prompt Security (PS)4
Agent Oversight (AO)5
Cost Management (CM-AI)3
Output Quality (OQ)4
Data Governance (DG)5
Observability (OB)5
Incident Response (IR)4
Vendor Management (VM)3
Ethics & Fairness (EF)4
PoC Controls: MG-1 MG-2 PS-1 AO-1 OB-1 AC-1 AU-1 CM-1 IA-1 IR-1
Neo4j Control Graph Schema
7-Section Template Standardized Docs
60 Artifacts Evidence Library

Right-Sized Framework: 120-150 controls targeting SOC 2 Type 2 certification— inspired by RI AI CoE 214-control framework, adapted for commercial SaaS

Security Posture: Comprehensive Protection

7-Layer Zero-Trust Defense + 5-Gate CI/CD Pipeline | SOC 2 CC Aligned

7
Defense Layers
5
CI/CD Gates
5
NetworkPolicies
10
Service Accounts
38+
Protected APIs
10
Scanning Tools

🛡️ 7-Layer Zero-Trust Defense

1. Edge (Cloudflare)
WAF, DDoS, Zero Trust Access
2. Network (Kubernetes)
Default-deny NetworkPolicies
3. Transport (TLS 1.3)
HSTS, mTLS, Cert Pinning
4. Identity (Descope/RBAC)
Server-Side Token Refresh, JWT Auth
5. Application (Next/Nest)
CSP, Input Validation, 38+ Guards
6. Authorization (OPA WASM)
ABAC, Tenant Isolation, Audit Logs
7. Data (PostgreSQL)
RLS, Encryption at Rest

🔍 CI/CD Security Pipeline

Gate 1: SAST
ESLint Security + Semgrep (15 rules)
Gate 2: SCA
npm audit + Socket.dev (supply chain)
Gate 3: Secrets
Trivy FS + Gitleaks pre-commit
Gate 4: Config/IaC
Trivy config + Hadolint
Gate 5: Container
Trivy + Grype + SBOM

🔒 Zero-Trust Infrastructure

NetworkPolicies (5)
Default-deny + explicit allowlist
Service Accounts (10)
Least-privilege RBAC bindings
Server-Side Auth
Token refresh at edge, not browser
Audit Trail
HMAC-SHA256 tamper-proof logs
3-Tier Multi-Tenancy
Platform → Org → Tenant isolation
Container Security
Non-root, read-only, scanned

HTTP Security Headers

CSP HSTS X-Frame MIME Referrer Permissions XSS COOP

15 Custom Semgrep Rules

SOQL Injection API Keys JWT Secrets Weak Crypto Path Traversal BPMN Vars

SOC 2 Alignment: CC6.1 (Access) • CC6.6 (Encryption) • CC6.7 (Transmission) • CC7.2 (Monitoring) • CC8.1 (Change Management)

Zero-Trust Architecture: Defense in Depth

Default DENY • Explicit Allowlist • Complete Audit Trail

🌐 Network Isolation

NetworkPolicies (5 Active)
✗ default-deny-ingress
All pods blocked by default
✓ postgres-ingress
From: api, kb, workers, n8n
✓ neo4j-ingress
From: kb, api only
✓ redis-ingress
From: api, kb, workers, web
✓ cib7-ingress
From: api, workers, cloudflared

👤 Identity & Access

Kubernetes RBAC
10 Dedicated Service Accounts
• api-service
• web-service
• workers-service
• kb-service
• camunda-service
• n8n-service
• cloudflared-svc
• postgres-operator
• neo4j-operator
• redis-operator
Least-Privilege Role Bindings
No default SA usage

🔑 Access Control

API Authentication
38+ Controllers Protected
└── @UseGuards(JwtAuthGuard)
3-Tier Multi-Tenancy
├── Platform (admins)
├── Organization (agencies)
└── Tenant (clients)
Cloudflare Zero-Trust
├── Camunda Cockpit
├── Admin Dashboard
└── Email domain restrictions

Audit Compliance: HMAC-SHA256 tamper-proof logs • SOC 2 CC6.1 • HIPAA Security Rule • GDPR Article 30

Network Security Architecture

GCP Firewall + Cloudflare Zero-Trust: No Direct IP Access

🚫 External Traffic

BLOCKED: Direct IP
http://35.227.123.202:*
BLOCKED: Non-CF IPs
Priority 999: DENY 0.0.0.0/0
ALLOWED: Cloudflare Only
Priority 900: 15 CF IP ranges

☁️ Cloudflare Zero-Trust

Tunnel: rival-qa-tunnel
camunda
.rival.io
app
.rival.io
api
.rival.io
grafana
.rival.io
jaeger
.rival.io
n8n
.rival.io
Cloudflare Access: Email domain restriction

🔒 GKE Internal

Kourier Ingress
35.227.123.202 (CF only)
Knative Services
ClusterIP only (no external)
Databases
Postgres, Neo4j, Redis
NetworkPolicies
Default DENY + explicit ALLOW

GCP Firewall Rules (Priority-Based)

rival-qa-allow-cloudflare-only
Priority: 900 | Action: ALLOW
Source: 173.245.48.0/20, 103.21.244.0/22...
Target: gke-poetry-cluster nodes
rival-qa-deny-direct-ingress
Priority: 999 | Action: DENY
Source: 0.0.0.0/0 (all traffic)
Target: gke-poetry-cluster nodes

IaC: infrastructure/kubernetes/cloudflared-config.yaml | GCP: rival-qa-allow-cloudflare-only, rival-qa-deny-direct-ingress

Security Remediation: RIV-592 to RIV-600

9 Critical Security Issues Identified & Fixed (January 2026)

3
Critical Fixed
2
High Fixed
4
Medium Fixed
72→92
Security Score
Ticket
Vulnerability
Severity
Fix Applied
RIV-592
Hardcoded password123 fallback
CRITICAL
✓ Removed, require SSO
RIV-593
BPMN cross-tenant header bypass
CRITICAL
✓ JWT tenantId enforced
RIV-594
JWT secret fallback in production
CRITICAL
✓ Startup validation
RIV-595
Audit log secret fallback
HIGH
✓ Required secret
RIV-596
Missing security headers (Helmet)
HIGH
✓ Helmet + CSP
RIV-597
No global ValidationPipe
MEDIUM
✓ Global pipe added
RIV-598
CORS localhost in production
MEDIUM
✓ Env-based origins
RIV-599
NetworkPolicies not deployed
MEDIUM
✓ 5 policies deployed
RIV-600
Workload Identity not configured
MEDIUM
✓ GCP SA bindings
OWASP
Top 10 2021
NIST CSF
Protect & Detect
CIS Controls
v8 Aligned
SOC 2
Type II Ready

PR: #553 | Methodology: Multi-agent security review + LLM-as-Judge validation | Evidence: .claude/memory-bank/evidence/cdd/RIV-550/

Platform Cost Monitoring

Unified GCP Infrastructure + External Services Cost Intelligence

Master Cost Reporter
Unified orchestrator combining all cost intelligence sources
GCP Infrastructure
GKE Node Pools (Spot)
Persistent Disks
Cloud Storage Buckets
Artifact Registry
Forwarding Rules
Change Detection
New resources flagged
Removed resources tracked
Cost deltas per category
Snapshot diffing
Percentage changes
External Services (19)
Descope, Cloudflare, GitHub
OpenAI, Anthropic, Deepgram
Supabase, Twilio, Slack
Ad Platform APIs (5)
Free tier limit monitoring
70%
Spot VM Savings
19
Services Tracked
4x
Daily Reports
3
Alert Levels
Auto
Diff Detection
Report Delivery
CortexOne email (primary) with SMTP fallback. HTML + screenshot capture via Puppeteer. Knative scale-to-zero with K8s CronJob triggers.
Free Tier Monitor
Color-coded alerts: Green (<70%), Yellow (70-89%), Red (90%+). API-based usage checks for Descope, Cloudflare, GitHub, and more.

PR: #633 | Knative service: cost-reporter | Schedule: 6AM/12PM/6PM/12AM ET

The Future: Eyeballs to Botballs

SEO → AEO (Agent Experience Optimization)

Today: SEO

Optimize for
human clicks

Future: AEO

Optimize for
AI retrieval + actions

SD

Structured Data

Schema.org Product, Organization & LocalBusiness vocabularies in JSON-LD so AI reads meaning, not just words

RO

Retrieval Optimization

SSR for crawlable content, clean canonical URLs, XML sitemaps, /llms.txt declarations

BC

Bot Control

RFC 9309 robots.txt compliance, WAF-level enforcement, rate limiting & selective access

STD

IETF Standards

AI Preferences working group (aipref) for site-level machine-readable policy declarations

API

Agent-Actionable

Real-time product APIs, structured commerce feeds enabling AI agents to browse & transact

KPI

AEO Metrics

AI referral traffic, LLM citation tracking, bot crawl analytics & AI-driven attribution

Poetry's Competitive Advantage

As AI shopping agents become the new top-of-funnel, Poetry positions brands to be discoverable, trustworthy, and actionable for both human users AND AI retrieval bots.

Development Summary

Rival Platform - Agentic SDLC Metrics ↑ 69% Complete

238
Issues Completed
↑ from 345 total
392
PRs Merged
↑ 440 commits
244K
Lines of Code
29 packages
14
AI SubAgents
Full SDLC automation

Project Management / Jira (RIV)

Issue TypeDoneOpen
Epics214
Stories15468
Tasks4616
Bugs1719
TOTAL238107

Version Control / GitHub

PRs Merged392
PRs Closed405
PRs Open5
Commits (30d)440
Total Commits440

Codebase / Monorepo

Lines of Code244,172
Monorepo Packages29
BPMN Processes36
Decision Tables (DMN)8
CortexOne Functions21

Testing & Quality

Test Files113
E2E Test Suites39
E2E Tests380+
Lint✓ Active
TypeCheck✓ Active

Agentic SDLC - Active SubAgents

sdlc-orchestrator cdd-methodology pr-orchestrator jira-manager infrastructure-reporter dev-summary-reporter bpmn-validator bpmn-tester cicd-pipeline security-reviewer architecture-reviewer code-quality-reviewer test-coverage-analyzer critical-thinking

14 SubAgents automating the full software development lifecycle

Generated: 2025-12-28 | Data refreshed on demand via /dev-summary

Poetry Campaign Dashboard

Real-Time Performance Intelligence Powered by AI

ROAS
3.42x
↑ +12.5%
Ad Spend
$127.4K
↑ +8.2%
Conversions
4,321
↑ +15.3%
CTR
2.87%
↑ +0.4%
Google Optimal
3.8x ROAS
$52K spend
Meta Optimal
3.2x ROAS
$45K spend
TikTok Warning
2.1x ROAS
$18K spend
LinkedIn Critical
1.4x ROAS
$12K spend
AI Agent Activity
Bid adjustment applied
94% confidence • Auto-applied
Budget reallocation recommended
87% confidence • Pending approval
Creative fatigue detected
TikTok campaign • Refresh needed
Alerts & Recommendations 2
LinkedIn CPC spike +45%
Review bid strategy immediately
TikTok CTR declining
Refresh creatives within 48 hours
Meta audience expansion opportunity
Lookalike 3% performing well

Dashboard available at /campaigns/dashboard • Data refreshes every 15 minutes

Paid Media Campaign Simulator

What-If Analysis with Real-Time AI Predictions

6
Scenarios
12
API Endpoints
5
Platforms
55+
E2E Tests

Happy Path

Normal campaign performance baseline

📉 ROAS Crisis

Declining returns scenario simulation

💸 Budget Pacing

Overspend/underspend pacing analysis

Platform Failure

Single platform outage resilience

📈 Seasonal Spike

Holiday/event traffic surge modeling

😴 Audience Fatigue

Creative exhaustion prediction

Budget Allocation Sliders

Google
65%
Meta
50%
TikTok
30%
YouTube
40%
LinkedIn
20%

Available at /campaigns/simulator • CortexOne functions power AI predictions • RIV-491

Comprehensive Fixture System

6,500+ Records for Demo, Testing & QA

🏢 Tenant Strategy

Showcase (demo-tenant)
All features, all verticals, 90 days history
Nissan USA (nissan-usa)
Auto + Gaming + Education multi-vertical

📊 Data Volumes

Gaming: ~950 records
Education: ~1,015 records
Audit: ~3,700 records
BPMN: ~388 records
Integrations: ~104 records
Core: ~60 records
Total: ~6,500+ records

🎰 Gaming Compliance

NJ PA MI NV CO

State rules • Responsible gaming • GeoComply • HITL reviews

🎓 Education Compliance

IPEDS Accreditation GE Metrics TCPA

50+ institutions • Gainful employment • Lead gen consent

Seed command: pnpm --filter @rival/db seed • Located in packages/db/prisma/seeds/

Poetry: E2E Campaign Planning Demo

Complete workflow from campaign inception to creative brief with AI + DMN governance

🤖

5 AI Functions

  • 🎯 Media Mix Allocation
  • 📈 Performance Forecasting
  • 👥 Audience Identification
  • 📋 Campaign Framework
  • ✏️ Creative Brief

6 DMN Gates

  • Campaign Eligibility
  • Budget Guardrails
  • Forecast Quality
  • Audience Privacy
  • Naming Convention
  • Delegation of Authority
👤

5 User Reviews

  • 📊 Review Mix Allocation
  • 📉 Review Forecast
  • 🎯 Review Audiences
  • 🏗️ Review Framework
  • ✅ Final Review

AI ProposesDMN DecidesHuman ApprovesBPMN Enforces

Plan Campaign BPMN Process

Orchestrated workflow with DMN governance gates at each decision point

Plan Campaign BPMN Process

Process: plan-campaign.bpmn • Work Item: RIV-224

Campaign Lifecycle - Master Orchestrator

State machine controlling all campaign phases with message-based coordination

Campaign Lifecycle Master Orchestrator BPMN
DRAFT
Initial planning
ACTIVE
Running on platforms
PAUSED
Temporarily stopped
CLOSED
Completed & archived

Process: campaign-lifecycle.bpmn • Master state machine

Launch Campaign - Parallel Platform Deployment

Simultaneous deployment to 4 ad platforms with verification and rollback

Launch Campaign BPMN Process

Success Path

All platforms verified -> Status: ACTIVE -> Notify stakeholders

Rollback Path

Verification fails -> Pause all platforms -> Log details -> Notify team

Process: launch-campaign.bpmn • Parallel gateway pattern with rollback

Daily & Weekly Optimization

Tactical daily adjustments and strategic weekly reallocations

Daily Optimization

Daily Optimization BPMN
Trigger: 06:00 UTC daily or anomaly detection

Weekly Reallocation

Weekly Reallocation BPMN
Trigger: Sunday 00:00 UTC (Cron)

Adaptive Approval: Small changes auto-approve | Large changes require human review

Processes: daily-optimization.bpmn, weekly-reallocation.bpmn

Operational Controls: Pause, Resume, Close, Emergency

Campaign state management with DMN-driven authorization

Pause Campaign

Pause Campaign BPMN

Resume Campaign

Resume Campaign BPMN

Close Campaign

Close Campaign BPMN

Emergency Stop

Emergency Stop BPMN

Processes: pause-campaign.bpmn, resume-campaign.bpmn, close-campaign.bpmn, emergency-stop.bpmn

CortexOne AI Optimization

Advanced AI-powered campaign optimization with predictive analytics and autonomous execution

CortexOne AI Optimization BPMN Process
🔮
Predictive Engine
ROAS trend forecasting
🔒
Privacy Measurement
Signal quality analysis
📊
MMM Allocator
Bayesian budget optimization
🤖
Autonomous Executor
Validated change execution

Process: cortexone-optimization.bpmn • 4 CortexOne serverless functions

See: Agentic Architecture Details →

Feedback Workflow - Closing the Loop

AI-powered sentiment analysis with priority-based routing and closed-loop notification

Feedback Workflow BPMN Process
💬
Chat
Conversational feedback
📊
Insights
Dashboard feedback
📈
Reports
Report quality feedback
Approvals
Workflow feedback

Process: feedback-workflow.bpmn • Closed-loop feedback with AI sentiment analysis

Social Media Content Workflow

8-agent pipeline from brief intake to content calendar generation with parallel research phases

▶️ Live Demo (19 slides) 🔗 Domain-Wide Delegation Extract brand voice from org email history
Social Media Content Workflow BPMN
Brief Intake
Extract requirements
Parallel Research
Industry + Audience
Strategy
Pillars + Planning
Content Calendar
Output generation
🛡️ Intelligent Error Handling with ITSM Integration
Error boundary events on all 7 service tasks with intelligent classification (Rate Limit → P2, Timeout → P2, Permanent → P1). Auto-creates ITSM incidents via workflow-incident-create worker with priority routing to senior-engineers or incident-managers.

Process: social-media-content-workflow.bpmn • Styx Workflow Suite

Content Creation Workflow

8-agent hub-and-spoke pattern for multi-channel content production with Opus quality gate and configurable workspace output

Content Creation Workflow BPMN - rendered with bpmn-js
Brand Voice + Planning
CortexOne + Sonnet editorial strategy
Parallel Creation
Newsroom + Executive + Social (Sonnet)
Localization + Review
Multi-market + Opus quality gate
ClaudeAgentWorker Pattern
6 workers converted from mock to real Claude Agent SDK. Sonnet for content generation, Opus for editorial review quality gate with 5-dimension scoring.
WorkspaceProvider
Configurable output: Google Workspace (Drive, Docs, Sheets, Slides) or Microsoft 365 (Graph API + docx/exceljs/pptxgenjs). Tenant-level selection.

Process: content-creation-workflow.bpmn • Styx Workflow Suite • ClaudeAgentWorker + WorkspaceProvider

Customer Service Workflow

6-agent linear workflow for automated ticket handling with intelligent escalation and SLA enforcement

Customer Service Workflow BPMN
Ticket Intake
Parse & classify
Customer Lookup
Identity enrichment
Response Draft
AI-generated reply
Escalation Path • Sentiment analysis triggers human-in-the-loop for negative cases

Process: customer-service-workflow.bpmn • Styx Workflow Suite

Reporting & Analytics Workflow (Wayfinder)

9-agent data pipeline with collapsed sub-processes for collection, analysis, and visualization

🔗 Domain-Wide Delegation Org-wide Gmail, Drive, Calendar access
Reporting & Analytics Workflow BPMN
Data Collection
  • Source Connector
  • Data Ingestion
  • Standardization
Analysis
  • Query Translation
  • Data Analysis
  • Reasoning & Insights
Output
  • Summarization
  • Visualization
  • Report Generation

Process: reporting-analytics-workflow.bpmn • Styx Workflow Suite • Wayfinder Pattern

Crisis & Reputation Workflow (Spectre)

6-agent event-driven pipeline for early risk detection, assessment, and coordinated response

🔗 Domain-Wide Delegation Internal comms for early warning signals
Crisis & Reputation Workflow BPMN
Detection
Signal + Context evaluation
Assessment
Issue + Response planning
Response
Execution + Monitoring
Spectre Domain LLM • Listening + Analysis agents power real-time reputation monitoring

Process: crisis-reputation-workflow.bpmn • Styx Workflow Suite • Spectre Pattern

External Task Workers - The Execution Layer

109 specialized workers execute BPMN service tasks across 6 categories

🎯

Planning Workers

  • poetry-media-mix
  • poetry-forecasting
  • poetry-audience
  • poetry-framework

Execution Workers

  • poetry-platform-deploy
  • poetry-tracking-setup
  • poetry-verification
📈

Optimization Workers

  • poetry-daily-optimize
  • poetry-weekly-reallocate
  • poetry-cortexone-bridge
🎛️

Control Workers

  • poetry-pause-platforms
  • poetry-resume-platforms
  • poetry-emergency-stop
📊

Reporting Workers (13)

  • reporting-data-source-connector
  • reporting-data-ingestion
  • reporting-data-standardization
  • reporting-reasoning-insights
  • reporting-summarization
  • reporting-visualization
  • google-sheets/slides/pdf-output
  • report-distribution
🔔

Notification Workers

  • notification-slack
  • notification-email
  • notification-webhook

All workers registered with Camunda 7 external task API

DMN Decision Tables

Policy-as-code governance with auditable decision logic

Eligibility

Campaign Eligibility

Input Rule
Privacy FrameworkGDPR/CCPA required
Tracking Enabled+30 pts if true
Client TierMin budget by tier

Hit Policy: COLLECT (SUM)

Budget

Budget Guardrails

Tier Range Max Δ
Enterprise$50K-$10M50%
Growth$10K-$500K30%
Starter$1K-$50K20%

Hit Policy: FIRST

Quality

Forecast Quality Gate

Metric Threshold
Confidence Score≥ 0.70
Variance≤ 25%
Coverage≥ 80%

Hit Policy: FIRST

Privacy

Audience Privacy

Check Rule
Data Sources1st/2nd party only
PII HandlingHashed required
ConsentExplicit opt-in

Hit Policy: COLLECT

Naming

Naming Convention

Level Pattern
Campaign[Client]_[Obj]_[Date]
Ad Set[Audience]_[Geo]
Ad[Format]_[CTA]_v#

Hit Policy: FIRST

DoA

Delegation of Authority

Budget Approver
< $25KManager
$25K-$100KDirector
> $100KVP/C-Level

Hit Policy: FIRST

Location: packages/bpmn/poetry/decisions/ • 34 DMN files total

DMN Industry Compliance - Regulated Verticals

Industry-specific decision tables for regulatory compliance validation

💊

Pharma

  • FDA/OPDP compliance
  • Fair balance requirements
  • ISI/PI disclosure rules
  • MLR approval workflow

pharma-fda-opdp-compliance.dmn

🏦

Financial Services

  • FINRA 2210 compliance
  • APR disclosure validation
  • UDAAP screening
  • Performance claims review

finra-2210.dmn

🏥

Healthcare

  • CMS marketing guidelines
  • Star rating display rules
  • AEP/OEP timing validation
  • Medicare compliance

cms-marketing-guidelines.dmn

43 total DMN decision tables • Industry-specific compliance rules

DMN Specialized Compliance

Defense, Alcohol/Cannabis, and AI Governance decision tables

🛡️

Defense

  • DoD contract compliance
  • ITAR/EAR screening
  • CUI detection
  • Cleared recruiting rules

dod-contract-compliance.dmn

🍺

Alcohol & Cannabis

  • State ABC rules
  • TTB COLA claims
  • Age verification gates
  • Cannabis state compliance

state-abc-rules.dmn

🤖

AI Governance

  • AI Act transparency
  • Algorithmic bias detection
  • Fair housing compliance
  • EEOC targeting rules

ai-act-transparency.dmn

Policy-as-Code • Version-controlled • Auditable • Business-owned rules

All DMN tables evaluated at process runtime via Camunda 7 decision service

Defense Compliance Gate - ITAR/EAR Workflow

6-stage HITL compliance pipeline for defense & aerospace advertising

Defense Compliance Gate BPMN Process

What is ITAR/EAR?

ITAR (International Traffic in Arms Regulations) - Controls export of defense articles on the USML. EAR (Export Administration Regulations) - Controls dual-use items on the CCL. Putting controlled data in a public ad = illegal export to the world.

Redact & Resubmit Pattern

Reviewers can choose REDACT instead of REJECT. Process ends, user removes controlled content, then starts a new process instance. Each submission is a separate audit record for DCSA compliance.

Process: defense-compliance-gate.bpmn • 5 DMN tables • 5 HITL gates • Work Item: RIV-268

Defense Compliance - 6-Stage Pipeline

Each stage is a DMN decision table with human escalation path

1. ITAR/EAR
Controlled technical data screening
→ Export Control Officer
2. Nationality
Embargoed country blocking
Auto-blocked
3. CUI
Controlled Unclassified Info
→ Security Officer
4. Recruiting
Citizenship disclosure
→ HR Compliance
5. Contract
FAR/DFARS allowability
→ CFO
6. Sign-Off
Final security approval
→ Security Officer
ITAR Nationality CUI Recruiting Contract ✓ APPROVED
Any stage can REJECT (fatal) or REDACT (fix and resubmit as new process instance)

Target: Lockheed Martin, RTX, Northrop Grumman, Boeing Defense, Anduril, Shield AI

E2E Demo Execution Results

Complete workflow executed via Rival Functions API + Camunda 7 orchestration

5
AI Functions
✓ All Completed
6
DMN Gates
✓ All Passed
5
User Tasks
✓ All Approved
100%
Completion
✓ Process Done
[poetry-media-mix] Using Rival Functions API with functionId: 69fa6c66-...
[poetry-media-mix] Invoking: https://cortexconnect.rival.io/api/v1/functions/...
[poetry-media-mix] Task completed successfully
[Budget] Budget guardrails passed (Growth tier, $250K)
[Task_ReviewMix] User approved allocation
[poetry-forecasting] Using Rival Functions API with functionId: 88c7c0bb-...
[poetry-forecasting] Task completed successfully
[Quality] Forecast quality gate passed (confidence: 0.85)
[poetry-audience] Demo mode - generating mock proposal
[poetry-framework] Demo mode - generating mock proposal
[poetry-creative-brief] Demo mode - generating mock proposal
Process COMPLETED - state: COMPLETED, endTime: 2025-12-24T05:53:18

Rival Functions API

poetry-media-mix → mmm-allocator (real API)

poetry-forecasting → predictive-engine (real API)

Demo Mode Fallback

poetry-audience, poetry-framework, poetry-creative-brief

Generate mock DecisionProposal when API unavailable

Process Instance: 364acb4f-e08c-11f0-9d52-f63bc50e7e8b • Business Key: demo-e2e-final

Decision Engines: When to Use DMN vs Rego (OPA)

Two complementary decision engines for different purposes

📊 DMN (Camunda)

Purpose: Business rules & regulatory compliance

Audience: Business analysts, compliance officers

Editing: Visual table editor (Camunda Modeler)

Integration: Native BPMN (businessRuleTask)

Use For:
  • Campaign eligibility gates
  • Budget guardrails
  • Regulatory compliance (GDPR, ITAR, FDA)
  • Approval routing
  • Performance thresholds

🔐 Rego (OPA)

Purpose: Authorization & access control

Audience: Developers, security engineers

Editing: Code editor (Rego language)

Integration: REST API or WASM (in-process)

Use For:
  • API access control (RBAC/ABAC)
  • Tenant isolation
  • Resource permissions
  • CI/CD system authorization
  • Infrastructure policy

Key Insight: Complementary, Not Competing

DMN answers: "What should happen next?" (business logic)
Rego answers: "Can user X do action Y?" (authorization)
35
DMN Tables
30+
Regulations
196
Rego Lines
<1ms
WASM Eval

DMN: packages/bpmn/poetry/decisions/ | OPA: packages/authority-management/policies/

Enterprise Authority Management

Delegation of Authority (DoA) with OPA WASM for sub-millisecond authorization

👔 Approval Hierarchy

CMO Unlimited
VP Marketing $500K
Director $100K
Manager $10K
Auto-escalate after 24h timeout

🔐 OPA WASM Architecture

Request
NestJS Guard
Attribute Resolver
WASM Eval
Allow/Deny
<1ms
Eval Latency
52x
Faster than Sidecar
0
Extra Containers
196
Lines of Rego

Threshold Routing

Auto-route to correct approver based on spend amount

Vacation Delegation

Temporary authority transfer with expiration

SOX Audit Trail

Complete decision log for compliance

Tenant Isolation

Customer-specific policies via Rego

Competitive Advantage

Most marketing platforms lack integrated Delegation of Authority. Rival provides enterprise-grade DoA with sub-millisecond authorization via WASM, enabling real-time policy evaluation without infrastructure overhead.

ADR: ADR-0003 (DoA) | ADR-0012 (WASM) | Policies: packages/authority-management/policies/

n8n Workflow Orchestration

Visual AI Agent workflows integrated with Camunda BPMN

n8n Why n8n?

  • 400+ integrations out of the box
  • Visual workflow editing for non-devs
  • Self-hosted for data sovereignty
  • Scale-to-zero on Knative

Camunda + n8n Integration

Camunda BPMN
N8nStrategy
n8n Webhook
CortexOne
Response
Research & Analyze
Predictive Engine + Knowledge Base
POST /webhook/research-analyze
Optimize Budget
MMM Allocator + Results Processing
POST /webhook/optimize-budget
11
Deployed Workflows
400+
Available Nodes
0
Idle Cost (Scale-to-Zero)
200ms
Warm Latency
Self-Hosted

When to Use n8n vs AgenticStrategy

n8n: Visual editing, rapid prototyping, 3rd-party integrations, non-developer users
AgenticStrategy: Complex logic, custom code, tight Camunda integration, production workloads

Workflows: packages/n8n/workflows/ | Strategy: packages/workers/src/unified/strategies/n8n-strategy.ts

Demo Persona Logins

All personas use password: Demo2025!Secure

👥 Client Portal

Sarah Johnson
Marketing Executive (CMO)
sarah.johnson@nissan-demo.com
Mike Chen
Brand Manager
mike.chen@nissan-demo.com
Lisa Rodriguez
Finance/Procurement
lisa.finance@nissan-demo.com

⚙️ Operations Portal

Alex Thompson
Campaign Manager
alex.thompson@poetry.ai
Jamie Support
Support Agent
jamie.support@poetry.ai
Dev Engineer
Developer
dev.engineer@poetry.ai
Morgan Kim
Administrator
morgan.kim@poetry.ai
Process Modeler
BPMN Modeler
process.modeler@poetry.ai
Compliance Officer
Compliance
compliance@poetry.ai
Tenant Admin
Tenant Admin
tenant.admin@poetry.ai
Platform Admin
Platform Admin
platform.admin@poetry.ai

🔍 Auditor Portal

External Auditor
Auditor
auditor@external-audit-firm.com

Quick Demo

Demo User
Campaign Manager
demo@rival.io
3
Client Personas
8
Operations Personas
1
Auditor Persona
12
Total Personas

Source: apps/web/e2e/fixtures/personas.ts | Seed: packages/db/prisma/seeds/users.ts

Enterprise Communication Hub

Unified multi-channel notification service for all platform workflows

⚙️
BPMN Workflows
Service Tasks
🔌
NestJS API
NotificationService
🤖
CortexOne
AI Functions
📧
Communication Hub
Intelligent Routing Engine
Priority Routing
P1→SMS+Slack
Template Engine
Resend Templates
Delivery Tracking
Status webhooks
Audit Trail
Full logging
✉️
Email
Resend (CortexOne)
💬
SMS
Twilio (CortexOne)
💼
Slack
Webhooks
📨
Email Features
Templates, validation, tracking
📱
SMS Features
2FA, alerts, approvals
🔔
Smart Routing
Priority-based channels
📋
Full Audit
Compliance logging

Source: packages/api/src/shared/notification.service.ts | Worker: packages/workers/src/cortexone/email-service.worker.ts

Poetry Intelligence System

AI-forward agency intelligence with causal validation and cross-client learning

🔬 Causal AI Layer

Proving causation, not just correlation

  • DoWhy/EconML integration
  • Lift validation on MMM
  • "Validated ROI" badge
40% ad spend validated

🧠 Temporal Memory

Zep/Graphiti bitemporal pattern

  • Event + ingestion time
  • Semantic entity subgraph
  • Community clustering
18.5% accuracy improvement

🌐 Cross-Client Learning

Network effect moat

  • Privacy-safe aggregation
  • Vertical pattern libraries
  • k-anonymity (min 5 clients)
100+ aggregate patterns
4
Neo4j Schemas
2
New CortexOne Functions
2
BPMN Workflows
8
Signal Categories
11
n8n Workflows

Competitive Advantage

Poetry's moat is NOT any single AI capability but the integration of three layers that competitors struggle to replicate: Causal AI (the "why"), Temporal Knowledge Graph (the "what"), and Workflow Orchestration (the "how").

Schemas: packages/knowledge-base/poetry/schema/ | Functions: cortexone-functions/

Comprehensive Signal Taxonomy

8 signal categories with real-time to quarterly capture frequencies

💰
Client Business
Revenue, LTV, churn
Real-time
📊
Media Performance
Impressions, ROAS, CPA
Hourly
🌐
Owned Channels
Web, email, app
Real-time
👥
Consumer Signals
Intent, sentiment, behavior
Daily
🏆
Competitive Intel
SOV, spend, creative
Daily/Weekly
📈
Market & Economic
GDP, inflation, trends
Monthly
🎭
Cultural & Social
Trends, viral, news
Real-time
Environmental
Weather, seasonal
Hourly

Tier 1: Built (USE NOW)

  • ✓ Meta Ads (9 workers)
  • ✓ Google Ads (8 workers)
  • ✓ LinkedIn ingestion

Tier 2: n8n (QUICK WIN)

  • ✓ GA4 signal ingest
  • ✓ News/RSS monitor
  • ✓ Slack alerting

Tier 3: Custom Workers

  • ▢ Meta Ad Library
  • ▢ Pathmatics/Vivvix
  • ▢ Brandwatch
1300+
n8n Nodes Available
11
Workflows Deployed
2-4h
Per Integration
$0
Idle Cost (Scale-to-Zero)

n8n: packages/n8n/workflows/ | Workers: packages/workers/src/ | Schema: signals-intelligence.cypher

Causal AI & Real-time Anomaly Detection

DoWhy/EconML causal inference + 67% faster anomaly detection

🔬 Causal Validator Function

MMM
DoWhy
Validate
Lift Prover
Validation Methods:
  • Geo Holdout (highest confidence)
  • Synthetic Control (medium)
  • RCT when available
40%
Wasted Spend Identified
95%
Confidence Interval

🚨 Anomaly Detector Function

Detection Types:
📈 Sudden Spike
📉 Sudden Drop
📊 Trend Shift
🔄 Pattern Break
Methods: Z-score, IQR, DBSCAN, Prophet
67%
Faster Detection
<2h
Time to Alert

Signal Aggregation Workflow

Daily 6AM trigger → Parallel n8n collection (GA4, News, Media, Competitive) → Anomaly detection → Slack alerts

signal-aggregation.bpmn

Anomaly Response Workflow

Severity routing (Critical: 1h, High: 4h SLA) → Causal analysis → Human-in-loop investigation → Resolution

anomaly-response.bpmn

McKinsey Finding: 40% of ad spend is wasted without causal validation. Poetry's integration of DoWhy/EconML with the MMM Allocator provides "Validated ROI" badges on recommendations.

Functions: cortexone-functions/causal-validator/, cortexone-functions/anomaly-detector/

Cross-Client Learning & Privacy

Network effect moat with privacy-safe aggregate patterns

🎬 Pharma CTV Fatigue Pattern

Format:Video (CTV) Frequency:>3.5 Days in Market:>21 Effect:CTR drops 30%+
Recommendation: Rotate creative or reduce frequency cap
8 clients 85% confidence

🎮 Gaming Channel Synergy Pattern

Channel A:Meta (Social) Channel B:Google Search Budget Ratio:60:40 Effect:+22% ROAS
Recommendation: Meta for prospecting, Search for conversion
5 clients 78% confidence

🔒 Privacy Guarantees

  • k-anonymity (min 5 clients)
  • No client-level data exposed
  • Aggregate-only patterns
  • Differential privacy layer

Pattern Types

Creative Fatigue
When to rotate
Channel Synergy
Better together
Audience Saturation
Targeting exhaustion
Seasonal Timing
Optimal windows
100+
Patterns Discovered
5
Verticals Covered
78%+
Avg Confidence
5+
Min Clients/Pattern
Network
Effect Moat

Schema: packages/knowledge-base/poetry/schema/cross-client-patterns.cypher

Marketing Optimization Process (MOP)

5-phase framework from strategy to continuous improvement

1️⃣

Business Situation

Industry, Competition, Economics

COMING SOON
2️⃣

Segmentation & Insights

Brand Audit, Customer Insight

COMING SOON
3️⃣

Big Idea

Creative Brief, Program Design

COMING SOON
4️⃣

Program Design

Media Mix, Forecasting, Launch

✓ BUILT
5️⃣

Continuous Improvement

Daily Optimization, Weekly Review

✓ BUILT
2/5
Phases Automated
3
Epics Created
10x
Target Speed Improvement
Q2 2026
Full MOP Target

PRD: .claude/memory-bank/prds/mop-phases-1-3.md • Jira: RIV-541, RIV-542, RIV-543

MOP Phase 1: Business Situation & Objectives

AI-assisted strategic context gathering • Coming Q1 2026

📊 Industry Analysis Agent

  • Market size & growth trends
  • Category dynamics & seasonality
  • Regulatory environment scan
  • Emerging opportunity identification

🎯 Competitive Monitor Agent

  • Share of voice analysis
  • Competitor spend estimates
  • Messaging theme extraction
  • Competitive gap identification

💰 Economic Context Agent

  • Macro-economic indicators
  • Consumer confidence signals
  • Profitability lever analysis
  • Environmental factors (weather, events)

👥 Strategic Segmentation

  • Customer segmentation analysis
  • Sub-segment identification
  • Revenue potential scoring
  • Prioritization recommendations

DMN Governance Gate: Business Context Approval • Strategic Planner review required before Phase 2 • Causal validation of market assumptions

Jira: RIV-541 • BPMN: business-situation.bpmn (planned)

MOP Phase 2: Segmentation & Insights

Deep customer understanding with causal validation • Coming Q1 2026

🏷️ Brand Audit Agent

  • Brand health metrics analysis
  • Perception mapping vs competitors
  • Positioning gap identification
  • Voice & tone consistency audit

🔍 Insight Generator Agent

  • Behavioral pattern discovery
  • Jobs-to-be-done mapping
  • Causal validation (DoWhy/EconML)
  • Cross-client pattern matching

🎯 Behavior Change Objectives

  • SMART objective generation
  • Business goal alignment
  • KPI definition & benchmarks
  • Measurement framework design

⚙️ Marketing Enablement Assessment

  • Tech stack readiness audit
  • Data availability assessment
  • Creative capability evaluation
  • Org readiness scoring

DMN Governance Gate: Insights & Objectives Approval • Account Director review required • Causal validation of behavioral insights • k-anonymity verification for cross-client patterns

Jira: RIV-542 • BPMN: segmentation-insights.bpmn (planned)

MOP Phase 3: Big Idea Generation

Creative strategy with cross-client pattern learning • Coming Q2 2026

💡 Big Idea Generation

  • 3-5 creative concepts
  • Cross-client pattern matching
  • Vertical-specific inspiration

📋 Program Design

  • Channel allocation strategy
  • Budget phasing recommendations
  • Milestone planning

📈 Impact Forecasting

  • Revenue projections
  • KPI targets with confidence
  • Scenario modeling

⚖️ Prioritization Engine

  • Impact × Feasibility scoring
  • Strategic fit alignment
  • Resource requirement analysis

✏️ Creative Brief Generator

  • Detailed agency brief
  • Brand voice guidelines
  • Reference examples

👤 CMO Approval Gate

  • Human-in-the-loop review
  • Strategic alignment check
  • Budget approval workflow

→ Handoff to Phase 4: Approved creative brief triggers plan-campaign.bpmn • Media Mix Allocation • Performance Forecasting • Campaign Launch

Jira: RIV-543 • BPMN: big-idea.bpmn (planned)

Poetry Intelligence System

Three-layer continuously learning architecture • The "Strategic Brain" differentiator

🧠

Layer 1: Causal AI

The "Why" - Validates causation, not just correlation

DoWhy/EconML
Causal inference validation
Treatment effect estimation
🕐

Layer 2: Temporal Knowledge

The "What" - Bitemporal memory for complete history

Zep/Graphiti Pattern
event_time: When it happened
ingestion_time: When we learned
🔗

Layer 3: Cross-Client Learning

The "How" - Privacy-safe aggregate patterns

k-Anonymity (min 5)
Network effect moat
No individual data exposed

Intelligence CortexOne Functions

Causal Validator
DoWhy integration
Anomaly Detector
Z-score, IQR, Prophet
Competitive Monitor
Multi-source intel
Pattern Matcher
Cross-client learning

Competitive Moat: Every new client makes the intelligence better for all clients. Only Poetry knows that "Pharma CTV campaigns with frequency >3.5 see 30% CTR decline after 21 days"

Schema: packages/knowledge-base/poetry/schema/ • 31 Cypher files

8 Signal Categories

Comprehensive signal taxonomy feeding the Knowledge Graph

📊 Client Business

  • Revenue & sales data
  • Customer lifecycle
  • Inventory signals
  • Pricing changes

📈 Media Performance

  • Paid media metrics
  • Creative performance
  • Channel efficiency
  • ROAS trends

🌐 Owned Channels

  • Web analytics (GA4)
  • Email/SMS metrics
  • App engagement
  • SEO performance

👥 Consumer Signals

  • Intent signals
  • Sentiment analysis
  • Behavior patterns
  • Journey mapping

🎯 Competitive Intel

  • Spend estimates
  • Share of voice
  • Creative monitoring
  • Messaging themes

💰 Market & Economic

  • Macro indicators
  • Category trends
  • Pricing dynamics
  • Supply chain

🌍 Cultural & Social

  • Trending topics
  • Platform changes
  • Cultural moments
  • Viral content

🌦️ Environmental

  • Weather patterns
  • Seasonal factors
  • Local events
  • Holiday calendars
40+
Data Sources
n8n Workflows
Neo4j Knowledge Graph
1M+
Nodes (Target)

Schema: packages/knowledge-base/poetry/schema/signals-intelligence.cypher

MOP + Intelligence: The Complete Vision

From strategic insight to continuous optimization in one intelligent system

🚀

Q1 2026

Phase 1 Beta

Business Situation

Q2 2026

Phases 2-3 Beta

Insights + Big Idea

Q4 2026

Full MOP GA

All 5 Phases Live

5
MOP Phases
14
CortexOne Functions
8
Signal Categories
31
KB Schemas
10x
Speed Target

The Poetry Advantage

Outcome-Aligned
Every decision ties to ROI
AI-Native
Fewer tools, less waste
Open Design
No walled gardens
Human Amplification
Smaller teams, smarter output

PRD: .claude/memory-bank/prds/mop-phases-1-3.md • Jira: RIV-541, RIV-542, RIV-543

Domain LLM

Poetry-LM: Fine-Tuned Intelligence

Embedding Agency Expertise into Domain-Specific Language Models

GraphRAG Alone Falls Short

  • Facts without agency voice
  • Generic marketing language
  • Can't generate creative copy
  • No tacit reasoning patterns

Poetry-LM Delivers

  • Client reports in agency voice
  • Brand-authentic ad copy
  • Expert anomaly explanations
  • Senior analyst reasoning
📝

Report Narratives

Agency writing style

Ad Copy

Brand voice generation

🔍

Anomaly Insights

Expert explanations

🧠

Media Planning

Senior analyst reasoning

ADR: .claude/memory-bank/decisions/ADR-007-poetry-llm-fine-tuning-architecture.md

Hybrid Architecture: Best of All Worlds

BPMN Orchestration + CortexOne Functions + GPU Training Compute

BPMN Orchestration (Governance, Human Tasks) Click to view process →

Start
Collect
Review 👤
Train
Eval
Approve 👤
Deploy

CortexOne Functions (Compute, ML)

poetry-data-prep
training-orchestrator
poetry-evaluator
poetry-deployer

GPU Training Compute (CortexOne Intelligent Routing)

🔥 CortexOne GPU Routing (10x faster)
QLoRA (~1% trainable)
💾 Checkpointing

BPMN: packages/bpmn/poetry/processes/poetry-llm-fine-tuning.bpmn

Strategic Value

Why Hybrid Wins

Strategic benefits of combining BPMN governance with CortexOne agility

🏛️

Orchestration + Control

BPMN for governance. CortexOne for intelligent compute. Human-in-loop where it matters.

🧩

Heterogeneous Compute

Functions run on optimal hardware - CPU, GPU, FPGA, or ASIC. Not locked to any cloud.

💰

Intelligent Routing

Workloads matched to best execution venue. GPU completes in 1/10th CPU time.

API-First Flexibility

Invoke CortexOne functions directly. No infrastructure awareness required.

🛡️

Enterprise Control

Processor-level encryption. Deploy on-premise, cloud, or managed.

📊

Proven Efficiency

90%+ cost/time reduction proven. 65x efficiency gains (STORM).

Approach Governance Compute Efficiency Hardware Flex Hybrid ✓
BPMN Only✓ ExcellentLimited (CPU)None
CortexOne OnlyLimited65x gainsCPU/GPU/FPGAAPI-based
Hybrid✓ Excellent65x gainsCPU/GPU/FPGA✓ Automatic
65x
Efficiency
90%+
Cost Reduction
120x
GPU Acceleration

STORM: 3,120 → 48 compute hours via intelligent hardware routing

Implementation: Production-Ready

25 files, 5,774 lines delivering the complete fine-tuning pipeline

📐

BPMN Workflow

poetry-llm-fine-tuning.bpmn
  • • 5 execution phases
  • • 2 human review gates
  • • 6-hour SLA timer
⚙️

CortexOne Functions

cortexone-functions/poetry-*/
  • • data-prep, evaluator
  • • training-orchestrator
  • • deployer (canary)
🔥

GPU Training

cortexone-functions/training/
  • • GPU training job manifest
  • • QLoRA training script
  • • Checkpoint handling
<4h
Training Time
10x
Faster than CPU
0.75
BLEU Target
24h
Canary Window

PRD: .claude/memory-bank/prd/PRD-poetry-llm-fine-tuning.md • Branch: feature/RIV-500-poetry-llm-fine-tuning

AI Capabilities

Domain LLMs: Embedded Expertise

Fine-tuned models for agency-specific tasks powered by CortexOne intelligent routing

📝

Poetry-LM

Marketing Voice

  • • Client report narratives
  • • Ad copy generation
  • • Media plan reasoning
👁️

Spectre

Brand Reputation

  • • Sentiment analysis
  • • Crisis detection
  • • Brand monitoring
🧭

Compass

Investment Analysis

  • • Due diligence reports
  • • Market analysis
  • • Risk assessment
65x
Efficiency
90%+
Cost Reduction
120x
GPU Acceleration

CortexOne intelligent routing: CPU/GPU/FPGA/ASIC • Not locked to any cloud

Training: QLoRA fine-tuning • Serving: Knative auto-scaling • Governance: BPMN orchestration

ML Training Pipeline

Hallucination Detection: User-Powered Training

Continuous model improvement through user feedback on RAG responses

⚠️

1. Report Incorrect

User flags inaccurate RAG response with AlertTriangle button

✏️

2. Annotate Claims

AI pre-labels sentences, user confirms and categorizes errors

🎯

3. Export & Train

JSONL export feeds DeBERTa-v3 fine-tuning pipeline

unsupported_claim contradictory numerical_error date_error entity_confusion

Training Architecture: User Feedback → JSONL Export (70/15/15 split) → DeBERTa-v3 Cross-Encoder → Improved Hallucination Detector

Components: HallucinationModal.tsx • API: /api/hallucination/detect • Jira: RIV-666

The Hidden Cost of "Good Enough"

Every traditional agency relationship has the same problem.

🚪

Knowledge Walks Out

When talent leaves, so do your insights. Every transition resets your learning curve.

🔄

Starting From Scratch

Every campaign reinvents the wheel. Last quarter's learnings stay in someone's inbox.

💰

Paying for Old Insights

You're paying premium rates for insights your competitors got last quarter.

What if your agency got smarter with every campaign?

What If Your Agency Got Smarter Every Day?

Imagine an agency relationship where intelligence compounds over time.

Traditional Agency
Flat Learning Curve

Knowledge stays in people's heads

Poetry
Compounding Intelligence

Knowledge lives in the system

Year 1: We learn your business. Year 2: The system knows patterns you haven't discovered. Year 3: Insights compound faster than any competitor.

Introducing

Poetry

The Learning Agency

Every campaign makes us smarter for your business. Every insight stays in the system. Every quarter builds on the last.

5
AI Agent Types
6
Workflow Solutions
Compounding Intelligence

Powered by proprietary technology that captures, connects, and compounds every insight.

Proof: Results That Speak

Real outcomes from compounding intelligence

34%
ROAS Improvement
Year 1 → Year 2
67%
Faster Insights
vs. Traditional Agency
3.2x
More Patterns Found
Cross-Campaign Learning
90%
Knowledge Retention
vs. 0% at Traditional

"In Q3, Poetry identified a pattern across our campaigns that we'd never seen. It turned out our top-performing creative had a specific element that worked 3x better on mobile. That insight alone paid for the entire engagement."

VP
VP of Marketing
Fortune 500 Retail Brand

How It Works: The Intelligence Flywheel

Every interaction makes the system smarter

1

Listen

Data flows from every touchpoint. Signals from 8 categories feed the system continuously.

2

Analyze

AI agents find patterns, validate causation (not just correlation), detect anomalies.

3

Act

Recommendations flow to the right person at the right time. Human-in-the-loop approval.

4

Learn

Every outcome feeds the knowledge graph. The system remembers what worked—forever.

🔑 The secret: Every insight is connected to every other insight. Patterns emerge that no human could spot alone.

Your Challenges, Our Solutions

Three outcomes that matter most to marketing leaders

📈

Paid Media Intelligence

Optimize spend across channels with AI that learns your audience's patterns.

OUTCOMES:
  • ✓ Real-time budget reallocation
  • ✓ Cross-platform attribution
  • ✓ Predictive ROAS modeling
🎨

Content Performance

Know what content works before you publish. Learn from every piece of creative.

OUTCOMES:
  • ✓ Creative pattern analysis
  • ✓ Brand voice consistency
  • ✓ Social listening insights
📊

Reporting & Analytics

Dashboards that answer questions before you ask. Executive-ready insights.

OUTCOMES:
  • ✓ Automated anomaly detection
  • ✓ Natural language queries
  • ✓ Board-ready presentations

+ Social Media Management • Crisis & Reputation • Customer Service See all 6 solutions

The ROI Framework: Prove Value Together

How we measure success—and give your CFO ammunition

Our Measurement Approach

Incrementality Testing

We don't just measure correlation—we prove causation with holdout tests and causal AI.

MMM Integration

Marketing Mix Modeling that actually updates in real-time, not quarterly.

Privacy-First Attribution

Signal loss recovery that works in a post-cookie world. iOS 14.5+ ready.

📊 CFO-Ready Metrics

Customer Acquisition Cost ↓ 23% avg
Marketing Efficiency Ratio ↑ 31% avg
Time to Insight ↓ 67% avg
Knowledge Retention Rate 90%+ (vs 0%)

✓ Quarterly business reviews with executive dashboards
✓ Monthly ROI reports your CFO will actually read

Your Poetry Team: People + AI

The talent you'd hire if you could—augmented by intelligence that never forgets

👤

Account Director

Your strategic partner with full context on your business

📊

Data Strategist

Analytics expert backed by AI pattern recognition

🎯

Media Planner

Channel expertise enhanced by predictive modeling

🤖

AI Agent Team

5 specialized agents working 24/7 on your behalf

The difference: When your Account Director learns something, the entire system learns it. When they're out, the AI agents maintain continuity. Knowledge compounds—it never walks out the door.

Why Poetry vs. Traditional Agencies

The compounding advantage over time

Traditional Agency Poetry
Knowledge Retention Walks out with people Lives in the system forever
Learning Curve Resets with each campaign Compounds exponentially
Pattern Recognition Human memory limits AI finds hidden connections
Reporting Speed Weekly/monthly cycles Real-time dashboards
ROI Proof Correlation-based claims Causal AI validation

Year 3 with Poetry = More intelligence than Year 10 with a traditional agency

Getting Started: Simple as 1-2-3

Your journey to compounding intelligence

1

Discovery Call

30-minute conversation to understand your challenges and goals

Week 1
2

Pilot Program

90-day engagement on a focused initiative to prove value

Weeks 2-13
3

Scale Partnership

Expand across channels and watch intelligence compound

Ongoing

No long-term commitment required. Prove value in 90 days, then decide if the relationship is right for you.

What You'll Have in 90 Days

Concrete deliverables from your pilot program

Intelligence Dashboard

Real-time visibility into performance across all channels

Baseline ROI Report

CFO-ready metrics proving value vs. your previous approach

Pattern Discovery Report

At least 3 insights you didn't know about your audience

Knowledge Graph Seed

Your business intelligence captured and connected—forever

Optimization Roadmap

12-month plan for scaling the intelligence advantage

Dedicated Team

Account Director + Data Strategist + AI Agent access

The real deliverable: A foundation of intelligence that will grow more valuable every quarter.

Your Intelligence Starts Here

Ready to build an agency relationship where every quarter makes you smarter?

🧠

Intelligence that compounds, not resets

📊

ROI your CFO can measure

🚀

Prove value in 90 days

Schedule Your Discovery Call →
Email
hello@poetry.ai
Website
poetry.ai

Powered by the Rival intelligence platform

Enterprise Authentication

Secure, Flexible Identity Management Powered by Descope

🔐

Passwordless First

Passkeys, Magic Links, and biometric authentication eliminate password vulnerabilities

🏢

Enterprise SSO

SAML 2.0 and OIDC support for Okta, Azure AD, OneLogin, and custom IdPs

🔄

Multi-Tenant

Per-tenant identity configuration with isolated user pools and custom branding

Identity Provider
Descope Platform
Authentication
JWT + Session Management
Authorization
OPA WASM Policies

Authentication Methods

Multiple secure options for every user preference

🔑

Passkey / WebAuthn

Recommended
  • Biometric authentication (Face ID, Touch ID, Windows Hello)
  • Hardware security keys (YubiKey, Titan)
  • Phishing-resistant by design
  • Synced across devices via iCloud/Google
✉️

Magic Link

Passwordless
  • One-click email authentication
  • Time-limited secure tokens
  • No password to remember or steal
  • Ideal for occasional users
🌐

OAuth 2.0 / Social

Familiar
  • Google Workspace integration
  • Microsoft 365 accounts
  • GitHub for developers
  • Leverages existing identity
🛡️

Multi-Factor Auth

Enhanced
  • TOTP authenticator apps
  • SMS/Email OTP backup
  • Risk-based step-up authentication
  • Configurable per tenant

Enterprise SSO Integration

Seamless integration with your corporate identity provider

🔗 SAML 2.0

Industry-standard federation protocol for enterprise identity

Supported IdPs:

Okta Azure AD OneLogin Ping Identity Google SAML
  • SP-initiated and IdP-initiated flows
  • Attribute mapping for user provisioning
  • Signed assertions and encrypted responses

🔓 OpenID Connect (OIDC)

Modern OAuth 2.0-based identity layer for web and mobile

Compatible With:

Auth0 Keycloak AWS Cognito ForgeRock Custom OIDC
  • Authorization Code flow with PKCE
  • ID Token and Access Token support
  • Refresh token rotation

Centralized User Management

Automatic Provisioning

Single Sign-Out

Compliance Ready

SSO Setup Process

Simple onboarding for enterprise customers

1

Request SSO

Customer submits SSO request with IdP details

2

Configure Tenant

We create SSO connection in Descope

3

Exchange Metadata

SP metadata ↔ IdP metadata exchange

4

Test & Activate

Validate SSO flow and go live

📋 Customer Provides

  • IdP Metadata URL or XML file
  • Entity ID / Issuer
  • SSO URL (Single Sign-On endpoint)
  • X.509 Certificate
  • Attribute mapping requirements
  • Allowed email domains

📤 We Provide

  • SP Metadata URL
  • ACS (Assertion Consumer Service) URL
  • Entity ID / Audience URI
  • Relay State configuration
  • Attribute mapping guide
  • Test account credentials
Typical Setup Time: 1-3 business days from metadata exchange to activation

Multi-Tenant Identity Architecture

Isolated, secure identity management for each customer

🏢 Tenant A (Enterprise)

SSO: Okta SAML
MFA: Required
Domain: @acme.com

🏢 Tenant B (Mid-Market)

SSO: Google OAuth
MFA: Optional
Domain: @startup.io

🏢 Tenant C (SMB)

Auth: Passkey + Magic Link
MFA: Passkey is MFA
Domain: Any verified
Descope Identity Platform
Unified auth orchestration across all tenants
🔒

Isolated User Pools

🎨

Custom Branding

⚙️

Per-Tenant Policies

📊

Audit Logging

Live Demo

AI-Powered Social Media
Content Automation

End-to-End Workflow Demonstration

See how 7 AI agents collaborate through a BPMN-orchestrated workflow to generate a complete 8-week content calendar with human-in-the-loop quality gates.

Camunda BPMN Claude Agent SDK HITL Gates Google Sheets Output

Demo Overview

Nissan North America - EV Awareness Campaign

7
AI Agents
120
Posts Generated
8
Week Campaign
5
HITL Gates

Campaign Details

ClientNissan North America
GoalBrand Awareness
Duration8 weeks (Jan 29 - Mar 26)
Budget$150,000

Target Platforms

Instagram TikTok LinkedIn

Competitors Analyzed

Tesla, Ford Mach-E, Chevy Bolt, Hyundai Ioniq, Kia EV6

Workflow Architecture

BPMN-Orchestrated 7-Agent Pipeline

Brief Intake

38s

Industry Analysis

2m 11s

Audience Research

1m 50s

Messaging Pillars

1m 53s

Strategy

2m 52s

Content Planning

45s

Calendar Gen

1m
Sequential Parallel HITL Gate
||

Parallel Execution

Industry Analysis and Audience Research run simultaneously, reducing total execution time.

HITL Quality Gates

Confidence-based gates (≥0.85 auto-approve) ensure human oversight on low-confidence outputs.

Total Time: ~17 min

Full campaign strategy and 120 posts generated in under 20 minutes.

Agent 1: Brief Intake

Validates and structures the campaign brief

Input

{
  "clientName": "Nissan North America",
  "industry": "Manufacturing",
  "targetPlatforms": ["instagram", "tiktok", "linkedin"],
  "campaignGoals": "awareness",
  "audienceDescription": "Auto enthusiasts aged 25-45,
    eco-conscious consumers, first-time EV buyers...",
  "contentPeriod": 8,
  "competitors": ["Tesla", "Ford Mach-E", ...],
  "budget": 150000
}

Output

{
  "structuredBrief": {
    "clientName": "Nissan North America",
    "startDate": "2026-01-29",
    "endDate": "2026-03-26",
    "totalWeeks": 8,
    "platformCount": 3,
    "isComplete": true,
    "missingFields": []
  },
  "validationPassed": true,
  "confidence": 0.6
}

Duration

38 seconds

HITL Triggered

Yes - Confidence 0.6 < 0.85 threshold

Validation

All required fields present, dates calculated

Agents 2-3: Parallel Research Phase

Industry Analysis + Audience Research run simultaneously

IA

Industry Analysis Agent

Duration: 2m 11s | Confidence: 0.6

Competitors Analyzed

  • Tesla - Market leader presence
  • Ford Mustang Mach-E
  • Chevrolet Bolt
  • Hyundai Ioniq
  • Kia EV6

Market Trends Identified

Video Content Rise Authenticity Short-form
AR

Audience Research Agent

Duration: 1m 50s | Confidence: 0.6

Primary Persona

Age Range25-44
InterestsTechnology, Trends
ValuesQuality, Innovation
Pain PointsFinding reliable solutions

Preferred Content

Reels Carousels Morning Posts

Parallel Execution Benefit

Both agents completed in ~2 minutes total instead of ~4 minutes sequential. This pattern is enforced by the BPMN parallel gateway.

Agent 4: Messaging Pillars

Creates core brand messaging themes

1

Brand Excellence

"Nissan North America delivers exceptional value"

Innovation Quality
2

Community Connection

"Building relationships that matter"

Engagement Trust
3

Value Creation

"Delivering real results"

Performance ROI

Brand Voice Spectrum

Formal ↔ Casual5/10 - Balanced
Serious ↔ Playful4/10 - Professional
Reserved ↔ Bold6/10 - Confident
Traditional ↔ Innovative7/10 - Forward-looking

HITL Review

Confidence: 0.6 triggered manual review

Review Note: "Approved for Nissan Ariya EV campaign demo - messaging pillars look solid"

Agent 5: Strategy Development

Platform-specific strategies and posting schedule

IG

Instagram Strategy

Focus: Visual storytelling

Frequency5/week
Best Times9AM, 6PM
Content TypesReels, Carousels
TT

TikTok Strategy

Focus: Trend participation

Frequency4/week
Best Times12PM, 7PM
Content TypesShort videos, Duets
LI

LinkedIn Strategy

Focus: Thought leadership

Frequency3/week
Best Times8AM, 12PM
Content TypesArticles, Polls

Campaign Phases

Phase 1: Launch

Weeks 1-2: Brand introduction, awareness building

Phase 2: Growth

Weeks 3-5: Community engagement, user content

Phase 3: Conversion

Weeks 6-8: Call-to-action, lead generation

Agent 6: Content Planning

Weekly content mix and theme distribution

Weekly Distribution

DayPostsFocus
Monday3Week kickoff
Tuesday2Educational
Wednesday3Mid-week engagement
Thursday2Behind-the-scenes
Friday3Weekend prep
Saturday1Lifestyle
Sunday1Community

Theme Balance

Educational25%
Promotional20%
Engagement30%
Behind-the-Scenes15%
Thought Leadership10%

Agent 7: Calendar Generation

120 posts with captions, hashtags, and asset requirements

120
Total Posts
40
Instagram
32
TikTok
48
LinkedIn

Sample Post Output

{
  "id": "f43e6314-2bb2-4463-b345-fb279095f596",
  "platform": "instagram",
  "postType": "reel",
  "scheduledDate": "2026-01-30",
  "scheduledTime": "09:00",
  "dayOfWeek": "Friday",
  "weekNumber": 1,
  "caption": "[REEL] Brand Excellence - Short-form video showcasing Brand Introduction",
  "hashtags": ["#brandintroduction", "#NissanAriya", "#EVlife"],
  "assetRequirements": { "type": "video", "duration": "15-60s", "aspectRatio": "9:16" },
  "theme": "engagement",
  "pillarReference": "Brand Excellence",
  "callToAction": "Share your thoughts in the comments!",
  "status": "DRAFT"
}

Human-in-the-Loop Quality Gates

Confidence-based review triggers ensure quality

How HITL Works

≥ 0.85

Auto-Approve

vs

< 0.85

Human Review Required

Brief Intake

0.6

REVIEWED

Msg Pillars

0.6

REVIEWED

Strategy

0.6

REVIEWED

Content Plan

0.6

REVIEWED

Calendar

0.6

REVIEWED

Why This Matters

HITL gates ensure AI outputs meet quality standards before proceeding. In production, high-confidence outputs auto-approve for efficiency, while uncertain outputs get human oversight.

Execution Timeline

Complete workflow in ~17 minutes

Process Flow

Brief Intake

15:51:57 - 15:52:35 (38s)

Research Phase (Parallel)

15:52:35 - 15:54:46 (2m 11s)

Messaging Pillars

15:54:46 - 15:56:39 (1m 53s)

Strategy Development

16:03:24 - 16:06:17 (2m 52s)

Content Planning + Calendar

16:06:17 - 16:08:41 (2m 24s)

Key Metrics

Total Duration16 min 44 sec
AI Processing Time~10 minutes
HITL Review Time~7 minutes
Posts Generated120 posts
Posts/Minute~7.2 posts

Manual Comparison

A human content strategist would typically need 40-60 hours to create a comparable 8-week content calendar with this level of detail.

~200x Faster

BPMN Orchestration

CIB seven (Camunda 7 fork) manages workflow execution

78

Process Definitions

Total BPMN processes deployed across all solutions

7

External Tasks

AI agents implemented as external task workers

5

User Tasks

HITL review gates for human approval

Process Instance: 71299725-fd2a-11f0-8853-4e8806c1e7d6

Activity History (Path Taken):
StartEvent_SocialMedia     → Start (4ms)
Task_BriefIntake          → Brief Intake Agent (37.6s)
Gateway_ResearchSplit      → Parallel Split
Task_IndustryAnalysis     → Industry Analysis Agent (130.9s) ┐
Task_AudienceResearch     → Audience Research Agent (110.5s) ├ Parallel
Gateway_ResearchJoin      → Parallel Join                    ┘
Task_MessagingPillars     → Messaging Pillars Agent (112.8s)
Task_ReviewPillars        → HITL Review (7s)
Task_Strategy             → Strategy Agent (172s)
Task_ReviewStrategy       → HITL Review (15s)
Task_ContentPlanning      → Content Planning Agent (45s)
Task_ReviewContent        → HITL Review (7s)
Task_ContentCalendar      → Calendar Agent (0s)
Task_FinalApproval        → Final Approval (15s)
Task_GenerateOutput       → Google Sheets Export (60s)
EndEvent_Complete         → Complete

Technology Stack

Enterprise-grade AI workflow orchestration

🔄

CIB seven / Camunda 7

BPMN workflow orchestration with external task pattern for AI agent integration

🤖

Claude Agent SDK

AI agents with tool use, web research, and structured output generation

📊

Google Workspace

Content calendar exported to Google Sheets for team collaboration

🔒

OPA / WASM

Authorization policies for multi-tenant content access control

🌐

Next.js + NestJS

Modern React frontend with TypeScript API backend

☁️

GKE + Knative

Kubernetes orchestration with serverless scaling for workers

Business Value

Transform content creation efficiency

200x
Faster than Manual
$15K+
Labor Savings/Campaign
100%
Structured Output
5
Quality Checkpoints

For Content Teams

  • Instant campaign scaffolding
  • Consistent brand voice across platforms
  • Data-driven content mix optimization
  • Reduced creative block and burnout
  • More time for strategic work

For Agencies

  • Scale content production without headcount
  • Standardized quality across clients
  • Faster campaign turnaround
  • Human oversight where it matters
  • Competitive pricing advantage
Workflow 2

Content Creation Workflow

Multi-channel content production with brand consistency

7

AI Agents

Brand Voice → Editorial → Newsroom → Executive → Press-to-Social → Editorial Review

3

Parallel Tracks

Newsroom, Executive, and Press-to-Social run simultaneously

2

HITL Gates

Brand Voice Review + Final Content Approval

5

Channels

Press Release, LinkedIn, Instagram, Twitter, Executive Blog

Execution Summary

3:32
Total Duration
7
Agents Executed
2
HITL Approvals
5
Content Assets

Content Creation Agent Pipeline

Hub-and-spoke pattern with parallel content generation

1
Brand Voice
~30s
HITL
Voice Review
manual
2
Editorial Plan
~30s
3
Newsroom
4
Executive
5
Press-to-Social
6
Editorial Review
~30s
HITL
Final Approval

Newsroom Agent

Press releases, news articles, announcements with journalistic standards

Executive Agent

Thought leadership posts, executive memos, LinkedIn content

Press-to-Social Agent

Transforms PR content into platform-native social posts

Content Output Examples

Nissan Ariya EV Launch - Multi-channel assets

Press Release

Nissan Unveils 2026 Ariya: The Future of Electric Mobility

The all-new Ariya delivers 300+ miles of range with cutting-edge ProPILOT Assist 2.0 technology...

Executive Blog Post

Why Ariya Represents Our Electric Future

As we witness the transformation of the automotive industry...

LinkedIn Post

🚗⚡ The future is electric. Introducing the 2026 Nissan Ariya...

#ElectricVehicle #Sustainability #Innovation

Instagram Caption

Meet the all-new Ariya ⚡️ 300+ miles of pure electric power...

#NissanAriya #EV #ZeroEmissions

Workflow Comparison

Two complementary workflows for end-to-end content automation

Social Media Content

  • Focus: Social media calendar generation
  • Agents: 7 (Brief → Research → Strategy → Calendar)
  • Output: 120 posts for 8 weeks
  • Duration: 17 minutes
  • HITL Gates: 5 confidence-based

Content Creation

  • Focus: Multi-channel content production
  • Agents: 7 (Brand → Editorial → Content → Review)
  • Output: PR, blog, social assets
  • Duration: 3.5 minutes
  • HITL Gates: 2 approval-based

Combined Capability

From strategic planning to content production in under 25 minutes

Ready to Transform Your
Content Workflow?

See the full platform in action

1

Request Demo

See the complete platform with your own campaign data

2

Pilot Program

Run a 30-day pilot with one brand or campaign

3

Full Deployment

Enterprise rollout with custom integrations

Demo executed: January 29, 2026
Social Media: 71299725-fd2a-11f0-8853-4e8806c1e7d6
Content Creation: ca03c49c-fd2f-11f0-8853-4e8806c1e7d6

Camunda BPMN Claude Agent SDK HITL Gates Google Workspace GKE + Knative

{poetry}

Brand
Guidelines

The visual identity system for Poetry and all branded materials across the Arc Machina ecosystem.

Version 2.0 — January 2026
01 — IDENTITY

Logo

The Poetry logo is the word "poetry" wrapped in curly braces, rendered in a light serif-italic typeface.

{poetry}
{poetry}
Do
  • Always include curly braces
  • Use lowercase
  • White on dark / dark on light
  • Maintain clear space
  • Minimum 80px digital
Don't
  • Remove curly braces
  • Capitalize any letters
  • Apply color to logo
  • Rotate/distort/add shadows
  • Place on busy backgrounds
  • Substitute serif typeface
02 — COLOR PALETTE

Colors

Purple gradient system on a near-black foundation.

Primary Colors
Poetry Black
#0D0D0D
Poetry Purple
#7B2FBE
Poetry Violet
#9B4DCA
Poetry Lavender
#C084FC
Ultra Light
#E9D5FF
Secondary Colors
Deep Purple
#1A1A2E
Charcoal
#1C1C1C
White
#FFFFFF
Muted
#6B7280
03 — GRADIENTS

Gradients

Central to Poetry's visual identity.

Primary Brand
linear-gradient(135deg,
  #7B2FBE 0%,
  #9B4DCA 40%,
  #C084FC 70%,
  #E9D5FF 100%)
Dark-to-Purple
linear-gradient(180deg,
  #0D0D0D 0%,
  #1A1A2E 50%,
  #2D1B4E 100%)
Light Theme
linear-gradient(135deg,
  #F3E8FF 0%,
  #E9D5FF 30%,
  #DDD6FE 60%,
  #C4B5FD 100%)
Accent Bar
linear-gradient(90deg,
  #7B2FBE,
  #9B4DCA,
  #C084FC,
  #E9D5FF,
  #7B2FBE)
height: 4px
04 — TYPOGRAPHY

Typography

Host Grotesk for headlines. Inter for body. Serif italic for logo.

Display
Host Grotesk 300
48-64px
The next era of performance starts here.
H1
Host Grotesk 700
36-48px
Enterprise AI: The New Performance Infrastructure
H2
Host Grotesk 600
28-36px
Creative intelligence, engineered for impact.
Body
Inter 400
16px
Poetry is the AI-powered performance partner built for marketers who refuse to choose between speed and substance. We're designed for the operators who want automation that thinks like a strategist—not just executes like a bot.
Overline
Inter 600
12px uppercase
MEET POETRY
05 — VOICE & MESSAGING

Messaging

PRIMARY TAGLINE
The next era of performance starts here.
Positioning
The first AI-powered performance agency.
Differentiator
Automation was yesterday. Augmentation wins today.
CTA
Let's Engineer Your Next Stage of Growth
Mission
Built to amplify originality, velocity, and impact.
06 — BRAND PILLARS

Four Advantages

01
Outcome-Aligned
Every decision ties to ROI.
02
AI-Native, End-to-End
Fewer tools. Less waste. Faster lift. Compounding intelligence.
03
Open by Design
No walled gardens. No lock-in.
04
Human Amplification
Smaller teams → smarter output → greater efficiency.
07 — UI COMPONENTS

Components

Buttons
Advantage Cards
Outcome-Aligned
AI-Native
Open by Design
Feature Cards
Budget Optimization
AI-driven channel allocation
Real-Time Analytics
Unified performance dashboard
Accent Bar
The signature 4px gradient bar used as page dividers and section headers.
08 — SLIDE LAYOUTS

Presentation Layouts

Dark + Purple Wave
Hero Slides
Light + Purple Gradient
Messaging Slides
Dark Data Grid
Data Slides
Split Content + Visual
Content
Visual
09 — ECOSYSTEM

The Arc Machina Collection

Poetry is part of the Arc Machina startup studio ecosystem.

{poetry}
ARC
MACHINA
3rd Normal
arc
reputation
circle

Built inside a startup studio ecosystem, our ventures move faster, integrate deeper, and scale intelligence, not overhead.

📱

Native Mobile Apps

iOS (Swift/SwiftUI) + Android (Kotlin/Jetpack Compose)

2
Native Platforms
4
Feature Modules
7
Home Widgets
100%
Offline-First

Offline-First • Real-Time WebSocket • Biometric Auth • Push Notifications • Home Screen Widgets

Mobile Architecture Overview

Native Apps with Shared Backend Infrastructure

System Architecture

iOS App

Swift / SwiftUI

Android App

Kotlin / Compose

WebSocket Gateway

Socket.io at /api/mobile/stream

NestJS API

Camunda

PostgreSQL

Feature Modules (Per Platform)

📊
Dashboard
KPIs, Charts, Trends
Approvals
Swipe, Offline Queue
🔔
Alerts
Anomaly Detection
⚙️
Settings
Preferences, Auth

API Modules (NestJS)

Alerts API Sync API Mobile WS Push API Tasks API

Dashboard & Real-Time KPIs

Live Performance Data with WebSocket Updates

Dashboard Features

$42.3K
Total Spend
+12.4%
3.2x
ROAS
+0.4x
2.1M
Impressions
+8.7%
4.2%
CTR
-0.3%

Key Capabilities

Real-Time Updates
WebSocket pushes live KPI changes instantly
📷
Sparkline Charts
7-day trend visualization per metric
📋
Channel Breakdown
Meta, Google, TikTok, LinkedIn spend allocation
🔄
Pull-to-Refresh
Manual data sync with offline fallback

Approval Workflow

Swipe Gestures + Offline Queue for Uninterrupted Decision-Making

Approval List

Budget Increase: Meta
$5,000 → $7,500 • Campaign: Summer Q3
Pending
Creative Swap: TikTok
Replace video A with B • Impact: High
Urgent
Audience Expansion: Google
Add lookalike segment • +15K reach
Review
← Swipe left to reject • Swipe right to approve →

Offline Queue

🔌 Offline Mode Active
2 approvals queued for sync
Queue Limits
• Max 5 offline approvals
• 24-hour cache validity
• Optimistic locking prevents conflicts
• Auto-sync on reconnection
• Conflict resolution UI if version mismatch
Camunda Integration
Each approval completes a Camunda user task, advancing the BPMN workflow

Alerts & Anomaly Detection

AI-Powered Monitoring with Severity-Based Grouping

Alert Categories

Critical 2
ROAS dropped below 1.0x on Meta campaign
Warning 5
Budget pacing ahead of schedule by 22%
Info 8
Weekly optimization complete: 3 adjustments made

Alert Detail View

CRITICAL 2 hours ago
ROAS Anomaly Detected
Meta campaign "Summer Q3" ROAS dropped from 3.2x to 0.8x in the last 4 hours.
Suggested Actions

Offline-First Architecture

Delta Sync Protocol with Optimistic Locking

Mobile App

Local SQLite cache

Delta request

Sync API

Compare versions

Changed records

PostgreSQL

Source of truth

🔄
Delta Sync
Only fetch changed records since last sync timestamp
🔒
Optimistic Lock
Version numbers prevent conflicting writes
🔌
Offline Queue
Max 5 approvals queued, 24-hour cache window
Auto Reconnect
WebSocket reconnects with exponential backoff

Security & Compliance

Enterprise-Grade Mobile Security Architecture

👤

Authentication

✓ Descope magic link login
✓ Face ID / Touch ID (iOS)
✓ Fingerprint / Face Unlock (Android)
✓ Biometric re-auth for sensitive actions
🔐

Token Storage

✓ iOS Keychain (SecureTokenStorage)
✓ Android Keystore (EncryptedSharedPrefs)
✓ JWT token rotation
✓ Automatic token refresh
🛡️

Device Integrity

✓ Jailbreak / Root detection
✓ SSL certificate pinning
✓ App Attest (iOS) / Play Integrity (Android)
✓ Network security config
SOC 2
Compliant
All mobile data handling follows the same compliance controls as the web platform. Audit logging, PII protection, and access controls are enforced identically across iOS, Android, and web clients.

Home Screen Widgets & Push Notifications

Glanceable Intelligence + Proactive Alerts

iOS & Android Widgets

📈
KPI Widget
Configurable metric display with sparkline trend
🔔
Alert Count
Badge with critical/warning/info breakdown
Approvals
Pending approval count with quick-action tap
📊
Dashboard
Android: mini dashboard with top 3 KPIs

Push Notification Types

🚨
Anomaly Alerts
Immediate push for critical performance drops
Approval Requests
Budget changes, creative swaps needing review
📈
Daily Digest
Morning summary of key metrics and changes
🔗
Deep Links
Tap notification to open exact screen/action
Powered by Firebase Cloud Messaging (FCM)
15 — Native Mobile Apps

Multi-Tenant White-Label

ONE app binary that dynamically brands itself per tenant

Rival is B2B2B. Organizations like Poetry serve multiple tenants like Nissan and Toyota. Every user now sees their tenant's brand — colors, logo, fonts, tagline — instead of hardcoded Rival indigo.

Rival (Platform)
Platform operator. Indigo #6366F1. Default brand for all users.
Poetry (Organization)
Agency customer. Purple #7B2FBE. Host Grotesk font.
Nissan (Tenant)
End client. Red #C3002F. Montserrat font. Custom logo.
15 — Native Mobile Apps

Dynamic Tenant-Aware Theming

Same APK, Different Brand

Rival
Marketing Intelligence
Email address
Continue
NISSAN
Performance Dashboard
Email address
Continue
Poetry
Agency Intelligence
Email address
Continue
Colors adapt to tenant primary/secondary palette
Logo loaded via Coil (async image library)
Fonts bundled: Inter, Montserrat, Host Grotesk
Tagline from tenant configuration
Cached in SharedPreferences for offline cold start
15 — Native Mobile Apps

Tenant Discovery Login Flow

Login State Machine

EMAIL_ENTRY
LOADING
lookupTenants()
0 Tenants
Default tenant. Send magic link immediately with Rival branding.
1 Tenant
Auto-select. Apply pre-auth branding, then send magic link. No picker shown.
2+ Tenants
Show TenantPickerScreen. User selects org, branding applies, then magic link.
TENANT_PICKER
BRAND_REVEAL
MAGIC_LINK_SENT
Authenticated
15 — Native Mobile Apps

6-Phase Implementation

White-Label Architecture Overview

1
Data Models
TenantConfig, TenantTheme, TenantThemeManager, TenantFonts
2
Backend API
Tenant lookup (public) + config endpoint (JWT)
3
Auth Flow
lookupTenants, selectTenant, X-Tenant-ID header
4
Dynamic Theme
Reactive Compose theming with Coil for logos
5
Login Flow
State machine + TenantPickerScreen UI
6
Settings
Org switch with cache isolation
15 — Native Mobile Apps

Reactive Compose Theming

Core Pattern: TenantThemeManager

// TenantThemeManager.kt
object TenantThemeManager {
    val theme = mutableStateOf(
        TenantTheme.Default
    )

    fun loadTheme(config, ctx) {
        theme.value = TenantTheme
            .fromBranding(config.branding)
        // Cache to SharedPreferences
        cacheTheme(ctx, theme.value)
    }
}
mutableStateOf triggers automatic Compose recomposition when theme changes
SharedPreferences cache enables offline branding on cold start
TenantTheme.Default is Rival indigo (#6366F1) with Inter font
fromBranding() factory parses hex colors with safe fallbacks
Material You dynamic color disabled when tenant branding active
15 — Native Mobile Apps

White-Label Backend API

Two Endpoints, Two Auth Levels

POST /api/mobile/tenants/lookup
Public Rate-Limited
Takes email, returns List<TenantSummary>
Always returns 200 (prevents enumeration)
5 requests/minute per IP
Returns: id, slug, name, primaryColor, logoUrl
GET /api/mobile/config
JWT Required
Full TenantConfig for authenticated user
Complete branding (colors, fonts, logo URLs)
Feature flags from tenant settings
Merged: settings JSON → brand config → defaults
15 — Native Mobile Apps

White-Label Security

Built with Defense in Depth

Anti-Enumeration
Tenant lookup always returns 200 with empty array for unknown emails. No timing or status code differences.
Data Isolation
Tenant switch clears ALL caches: DataStore, SharedPreferences, image cache, offline data. Prevents cross-tenant data leaks.
OkHttp Interceptor
Automatic X-Tenant-ID header on every API call. No manual header management needed.
// RivalApiClient.kt
private val authInterceptor =
  Interceptor { chain ->
    val builder = chain.request()
        .newBuilder()

    getAuthToken()?.let {
        builder.addHeader(
            "Authorization",
            "Bearer $it"
        )
    }
    getTenantId()?.let {
        builder.addHeader(
            "X-Tenant-ID", it
        )
    }

    chain.proceed(builder.build())
}
15 — Native Mobile Apps

Lobby Screen

Premium First-Time Experience

Rival
Your marketing intelligence platform
Get Started
Already have an account? Sign in
Neutral Entry Point
First-time users see a premium dark screen with no branding bias. No mention of tenants or white-labeling — users don’t need to know the architecture.
Animated Mesh Gradient
Subtle 8-second looping gradient animation creates a living, premium feel without distracting from the CTA.
Frosted Glass CTA
Glassmorphism “Get Started” button with backdrop blur. Tapping leads to email entry → tenant identification.
Smart Routing
Returning users with a cached theme skip the lobby entirely — they see their branded login screen directly on cold start.
15 — Native Mobile Apps

Brand Reveal Animation

The “Wow Moment” — Generic to Branded in 1.5 Seconds

Animation Sequence
1
Tenant identified (auto or picker)
2
Expanding circle fills screen (~800ms)
3
Color lerp: Rival purple → tenant primary
4
Tenant logo fades in at center (~400ms)
5
Transition to branded magic link screen
Cross-Platform Implementation
Android: Canvas clipPath + Animatable<Float> with FastOutSlowInEasing
iOS: Circle().clipShape() with .spring(response: 0.8) animation
Nissan
#C3002F
Circle expands from center, transitioning from Rival purple to the tenant’s primary brand color
15 — Native Mobile Apps

Invite Link System

Pre-Configured Onboarding via Shareable Links

Invite Flow
1
Admin creates invite in web portal
2
User receives link: app.rival.io/invite/Xk9mP2
3
App resolves code → brand reveal → login
Deep Linking
Android: App Links (autoVerify) for instant open
iOS: Universal Links via Associated Domains
Fallback: Smart banner → App Store → deferred context
Backend Architecture
Database Prisma invitations table
Codes nanoid 12-char, 7-day expiry
Create POST /api/mobile/invites
Resolve GET /invites/:code (public)
Admin UI /settings/invites
Admin Portal
Web UI at /settings/invites with email input, role selector, pending invite table, copy-link, and status badges (Pending / Used / Expired).
16 — Infrastructure & Data Architecture

Three-Environment Architecture

Dev → QA → Production pipeline with infrastructure-as-code

DEV
Docker Compose
localhost
API :3000
Web :3001
CIB7 :8080
Workers
PG :5432
Neo4j :7687
Redis :6379
MinIO :9000
n8n :5678
KB :8000
Mailpit
Ollama
20 services • bridge network
QA
GKE • poetry-standard
us-east1-b • Spot VMs
API (1 pod)
Web (1 pod)
CIB7 (1 pod)
Cloudflared
PG 10Gi PVC
Neo4j 5Gi
Redis 1Gi
CF Tunnel
1 node • e2-standard-4 • 1.7 GiB used
PROD
GKE + Managed Services
us-east1 • HA • On-Demand
API (Knative)
Web (Knative)
Workers (0-5)
KB (0-5)
Cloud SQL
Memorystore
Neo4j Aura
CF Tunnel
Multi-node • Knative autoscale • scale-to-zero
Shared Across All Envs:
CortexOne Functions (16) Artifact Registry Cloudflare DNS Descope Auth Cloud Build CI
15.1 — Dev Environment

Local Development

Docker Compose with 20 services • Single docker compose up

Application Layer
NestJS API:3000
Next.js Web:3001
CIB7 Engine:8080
Workers130+ handlers
Knowledge Base:8000
n8n Workflows:5678
GraphRAG (TS + ML):8001 / :50051
Data Layer
PostgreSQL + pgvectorpg17
Neo4j Community5.26
Redis + AOF8-alpine
MinIO (S3)latest
4 DATABASES IN POSTGRES:
rival115 models (Prisma)
camunda49 tables (CIB7)
n8nworkflow engine
postgressystem default
Supporting & Optional
Mailpit (SMTP):8025
MCP Gateway:8082
OPTIONAL PROFILES:
tracingOTEL + Jaeger + Phoenix
voiceOllama + LiveKit Agent
agentClaude Code Container
mcpMCP Gateway (mTLS)
NETWORK: rival-network (bridge)
VOLUMES: 7 named volumes (postgres, neo4j, redis, minio, ollama, n8n, phoenix)
NODE: 22 LTS • pnpm 10 • Python 3.12
15.2 — QA Environment (Live)

QA — GKE Cluster Profile

Live data from poetry-standard cluster • Captured Feb 7, 2026

Running Pods & Resource Usage
POD IMAGE CPU MEMORY
apirival-qa-docker/api:latest2m295Mi
webrival-qa-docker/web:latest1m166Mi
cib7cibseven:run-2.1.03m657Mi
postgrespgvector:pg1720m70Mi
neo4jneo4j:5.159m502Mi
redisredis:7-alpine10m3Mi
cloudflared (x2)cloudflared:2024.12.28m35Mi
TOTAL (8 pods)53m1,728Mi
Cluster Node
Type: e2-standard-4
vCPU: 4 cores
RAM: 16 GiB
K8s: v1.33.5-gke
OS: Container-Optimized
Region: us-east1-b
Persistent Storage
postgres-data10 GiB
neo4j-pvc5 GiB
redis-pvc1 GiB
Total PVC16 GiB
Secrets
rival-secrets (34 keys)
cib7-secrets (5 keys)
cloudflared-token (1 key)
15.3 — Production Environment

Production Architecture

Managed services for data tier • Knative autoscaling • Multi-node HA

QA vs Production Differences
ComponentQAProduction
PostgreSQLIn-cluster (pgvector)Cloud SQL
RedisIn-cluster podMemorystore
Neo4jIn-cluster podNeo4j Aura
App ServicesStatic DeploymentsKnative (autoscale)
Image Tags:latest / :sha:stable
VMsSpot (70% savings)On-Demand (SLA)
Registryrival-qa-dockerrival-prod-docker
Knative Autoscaling Configuration
API Service
min: 1 • max: 10 • target: 10 concurrent • timeout: 30s
Web Frontend
min: 1 • max: 10 • always warm • timeout: 30s
Workers
min: 0 • max: 5 • scale-to-zero • 130+ task handlers
Knowledge Base
min: 0 • max: 5 • scale-to-zero • FastAPI + pgvector
n8n Workflows
min: 0 • max: 3 • scale-to-zero • hardened (CVE-2025-68613)
100% Infrastructure-as-Code
./bootstrap.sh --env qa Full rebuild from zero 73 BPMN + 11 n8n auto-deployed
15.4 — Database Architecture

PostgreSQL — Consolidated Database

Single PostgreSQL instance with pgvector • 4 databases • 3 users • 3 schemas in rival DB

Database Instances
rival PRIMARY
115 Prisma models • 109 enums • Owner: rival
Schemas: public (app), eams_audit (audit), knowledge_base (KB)
camunda BPMN ENGINE
49 tables • 42 foreign keys • 14 MB • Owner: camunda
CIB7 runtime, history, repository & identity tables
n8n WORKFLOWS
11 workflows • Signal ingestion • Owner: rival
GA4, RSS, Slack alerts, competitive intel
postgres SYSTEM
Default system database • Owner: postgres (superuser)
Camunda Process Engine (Live)
5
Process Defs
4
Decision Defs
10
Active Instances
6
User Tasks
Graph & Cache Databases
Neo4j 5.15
Knowledge Graph • 29 schemas • APOC enabled • Bolt :7687
Redis 7
Session cache • Rate limiting • Bull queues • AOF persistence
15.5 — Entity Relationship Diagram

ERD — Core Domain Models

Multi-tenant foundation • Organization → Tenant → User hierarchy • 115 models across 21 domains

Organization PK id name type: OrgType status: OrgStatus slug domain settings: Json createdAt, updatedAt OrgUser PK id FK organizationId email, role: OrgRole descopeUserId Tenant PK id FK organizationId name, slug status: TenantStatus industry, website settings: Json maxUsers: Int features: String[] createdAt, deletedAt User PK id FK tenantId email, name role: UserRole descopeUserId preferences: Json ageVerified: Boolean lastLoginAt createdAt, deletedAt Campaign PK id FK tenantId name, platform objective status: CampaignStatus budget, spend startDate, endDate platformCampaignId AdSet PK id FK campaignId, tenantId name, status targeting: Json budget, bidStrategy Ad PK id FK adSetId, tenantId name, type: AdType creative: Json ComplianceEvidence PK id FK tenantId, controlId title, type content: Json contentHash (HMAC) status, collectedAt Incident (ITSM) PK id FK tenantId, assigneeId number, title priority, impact, urgency state: IncidentState slaBreached: Boolean AuditLog PK id FK tenantId, userId action, entity, entityId changes: Json ipAddress, userAgent 1:N 1:N 1:N 1:N 1:N 1:N 1:N 1:N 21 Domain Areas — 115 Models Multi-Tenancy (6) BPMN (4) Ad Platforms (10) Integrations (8) Compliance (9) ITSM (12) Gaming (10) Audit (5) Education (7) Personalization (4) Social Media (4) Styx Solutions (4) AI Chat (2) Feedback (1) • Allocation (3) • Modeler (5) • Alerts (1) • Functions (1) • Cost (1) • Performance (3) Key Architectural Patterns Tenant Isolation — Every model includes tenantId for strict data segregation Envelope Encryption — TenantEncryptionKey with KMS-wrapped DEK per tenant Cryptographic Audit — HMAC-SHA256 signatures on evidence and audit logs Soft Deletes + GDPR — deletedAt fields, consent records, erasure request tracking JSON Flexibility — Complex nested structures in metadata, config, rawData ITSM Polymorphism — WorkNotes, Activities, Attachments shared across record types Platform ID Mapping — External IDs (platformCampaignId, camundaProcessInstanceId) 109 Enums — Type-safe status workflows (Incident, Change, Release lifecycle)
17 — Solution Builder

Styx Solution Builder

Enterprise-grade 12-step wizard for agentic workflow creation, testing & deployment

12
Wizard Steps
13
Violations Fixed
0
Mock Data in Prod
T1
Operational Tier
3 PRs • 3 GitHub Issues • Full CDD Compliance

12-Step Wizard Pipeline

Each step calls real backend APIs — zero simulations, zero hardcoded data

1 — Define
📝
Basics
Name, category, billing
2 — Define
👥
Personas
Roles & permissions
3 — Define
📊
Data Schema
Fields & validation
4 — Define
Triggers
Events & schedules
5 — Build
🔧
Functions
CortexOne marketplace
6 — Build
🔔
Notifications
Channels & templates
7 — Build
🔄
BPMN Workflow
Visual process design
8 — Build
🛡
HITL Config
Human-in-the-loop gates
9 — Deploy
👀
Review
Summary & validation
10 — Deploy
🧪
Test
Real API validation
11 — Deploy
🚀
Provision
Environment setup
12 — Deploy
🎯
Launch
Go live & invite users

Key Capabilities

Four pillars powering the Solution Builder experience

🏪

Solutions Marketplace

  • Browse & install pre-built solutions
  • Live API-driven catalog (no hardcoded data)
  • Publish your solutions for other tenants
  • Category filtering & search
🔄

BPMN Process Designer

  • Embedded visual process modeler
  • Design workflows inside the wizard
  • Export BPMN 2.0 standard XML
  • Integrated with Camunda engine

CortexOne Functions

  • Browse CortexOne function marketplace
  • Request new functions with approval flow
  • Real API calls (no console.log stubs)
  • Attach functions to solution workflows
🧪

Test → Provision → Launch

  • Steps 10-12 call real backend APIs
  • Backend-driven test results (no setTimeout)
  • Real provisioning status & error handling
  • Launch with invitation delivery via API

Solution Management

Full lifecycle: dashboard, detail view, edit, and delete with confirmation

Solutions Dashboard

+ New Solution
Campaign Optimizer
Marketing • 3 personas
Published
Compliance Monitor
Governance • 5 triggers
Testing
Client Onboarding
Operations • 2 functions
Draft
Error states shown, not hidden as empty lists

Solution Detail View

Edit Publish Delete
4
Personas
3
Triggers
5
Functions
SHARED
Environment
Overview Personas Triggers Functions Config
Delete requires AlertDialog confirmation

Code Integrity Transformation

13 violations eliminated across Tier 3 Facades and Forbidden Patterns

BEFORE Tier 3 Facade / Forbidden
// TestStep.tsx — Fake test simulation
setTimeout(() => {
  // Math.random() for fake durations
  const duration = Math.random() * 3000;
  setTestResult({ passed: true });
}, 2000);
// ProvisionStep.tsx — Fake deploy
const shouldFail = false; // hardcoded
// LaunchStep.tsx — Never sends
sendInvitations(/* local only */);
AFTER Tier 1 Operational
// TestStep.tsx — Real API call
const result = await testSolution(
  tenantSlug, solutionId, getAuthHeaders()
);
setTestResult(result.test);
// ProvisionStep.tsx — Real deploy
const res = await provisionSolution(...);
setStatus(res.environmentType);
// LaunchStep.tsx — Real API
await launchSolution(tenantSlug, ...);
6
setTimeout Removed
3
Math.random() Removed
2
Hardcoded Stubs
13
Total Violations Fixed

Architecture & Data Flow

End-to-end flow from wizard UI to deployed solution with auth at every layer

Frontend (Next.js) API (NestJS) Orchestration Execution 12-Step Wizard (React) Solutions Dashboard Detail / Edit Pages Marketplace Browser Bearer Token AuthDescope JWT on every API call Solutions Controller CRUD + Test + Provision Launch + Marketplace Prisma ORM (PostgreSQL) TenantGuard + JwtAuthGuardMulti-tenant data isolation Camunda BPMN Engine Process Deployment External Task Workers HITL User Tasks Solution ScopedProcess per tenant + solution CortexOne Functions Notification Channels Data Connectors Marketplace Registry Function IsolationSandboxed execution per tenant

Implementation Summary

Delivered across 3 PRs with full SDLC orchestration and CDD compliance

PR #936 Core Pipeline
  • Fixed handleSubmit data persistence
  • Auth tokens on all API calls
  • Type alignment (wizard ↔ API)
  • Error response parsing
  • Detail + Edit pages
  • Delete with AlertDialog
PR #937 Steps 10-12
  • Replaced all setTimeout simulations
  • Real test API with backend results
  • Real provisioning with status
  • Real launch with invitations
  • Removed Math.random() durations
  • Removed hardcoded toggles
PR #938 Quality & Polish
  • Functions API (no console.log)
  • BPMN modeler embedded
  • Marketplace from live API
  • Error states (not hidden empty)
  • Keyboard navigation (Escape)
  • localStorage draft persistence
3
Pull Requests
13
Files Modified
0
Regressions
100%
CDD Compliance
📋

Release History

Platform Changelog & Version Tracking

Current Version: 2026.02.9 | Last Release: February 8, 2026

February 8 Release Wave

8 releases in one day: 2026.02.2 – 2026.02.9

Native Mobile Apps (2026.02.2)

  • iOS (Swift/SwiftUI) + Android (Kotlin/Compose)
  • 10 features: Auth, Dashboard, Approvals, Alerts, Widgets
  • 4 backend modules: Alerts, Sync, WebSocket, Push
  • Biometric login via Descope SDK

White-Label Onboarding (2026.02.3-5)

  • Multi-tenant branding: dynamic colors, fonts, logos
  • Lobby screen + brand reveal circle animation
  • Invite link system with deep links (iOS + Android)
  • Admin invite management portal

Report Scheduling (2026.02.7)

  • Cron-based scheduling with DST-aware timezones
  • Optimistic locking for multi-instance safety
  • Per-source connector sync cadence management
  • Next.js management UI with pause/resume

API Security (2026.02.9)

  • Encrypted push token storage (AES-256-GCM)
  • Optimistic locking on task completion (ETag)
  • TenantGuard + @CurrentUser() fixes
  • First-time user onboarding flow (iOS + Android)

Release 2026.02.1

February 7, 2026 • Security Pipeline Release

🔒 7-Gate Security Pipeline

  • Gate 1: SAST - ESLint + Semgrep
  • Gate 2: SCA - pnpm audit + Socket.dev
  • Gate 3: Secrets - Trivy filesystem scan
  • Gate 4: Config - Trivy IaC + Hadolint
  • Gate 5: License - GPL/AGPL/SSPL blocking
  • Gate 6: Container - Trivy + Grype
  • Gate 7: DAST - OWASP ZAP

Security Fixes

  • GCM auth tag length fix (CWE-347)
  • brace-expansion vuln → 5.0.1
  • Semgrep test file exclusions
  • Trivy secret scan filtering
Work Item: #683
Area Change Impact
Pipeline 7-gate security scanning based on policy2control Enterprise-grade security
Security GCM authTagLength: 16 for createDecipheriv CWE-347 vulnerability fixed
Dependencies @isaacs/brace-expansion → 5.0.1 SCA vulnerability resolved
Scripts license-scan.sh, dast-scan.sh added Gates 5 & 7 implementation

Release History

Version Date Type Key Changes
2026.02.9 Feb 8, 2026 Security Encrypted push tokens, optimistic locking, mobile onboarding
2026.02.7 Feb 8, 2026 Feature Report scheduling backend + UI, cron poller, connector sync
2026.02.5 Feb 8, 2026 Feature Premium white-label onboarding, brand reveal, invite system
2026.02.2 Feb 8, 2026 Feature Rival Mobile (iOS + Android): 10 features, 4 backend modules
2026.02.1 Feb 7, 2026 Security 7-gate security pipeline, GCM auth fix, license scanning
2026.01.7 Jan 25, 2026 Security Docker Trixie images, Snyk CVE fixes, KG Explorer
2026.01.6 Jan 20, 2026 Feature Social platform APIs, Google Workspace clients
2026.01.5 Jan 18, 2026 Feature Google Workspace integration, OAuth/SA auth

Versioning Scheme: CalVer

Format: YYYY.MM.release

  • YYYY: Year (2026)
  • MM: Month (01-12)
  • release: Release # within month

Platform Stats

Workers: 130+
BPMN: 44
Functions: 20
Schemas: 29
Full changelog: CHANGELOG.md

Google Workspace: Domain-Wide Delegation

Enterprise-grade access to organization-wide data via service account impersonation

Architecture Comparison

Individual OAuth (Current)

User A ──OAuth──► Their Data Only
User B ──OAuth──► Their Data Only
User C ──OAuth──► Their Data Only

⚠️ Requires each user to authenticate

Domain-Wide Delegation (Enterprise)

Service Account ──impersonate──► User A's Data
               ──impersonate──► User B's Data
               ──impersonate──► User C's Data
               ──impersonate──► All Users...

✓ No user interaction required

Enterprise Capabilities

📧
Org-Wide Gmail
All mailboxes
📁
All Drive Files
Cross-user search
📅
All Calendars
Org availability
👥
Admin Directory
User & group sync

Security & Compliance

  • Super Admin approval required in Google Admin Console
  • Explicit OAuth scope whitelisting per service account
  • Full audit trail in Google Workspace Reports
  • Credentials encrypted via GCP Secret Manager
🔍

Knowledge Extraction

Index all docs, emails, and files for AI-powered search

⚖️

Compliance & Audit

eDiscovery, retention policies, regulatory compliance

🤖

Background Sync

Automated data ingestion without user interaction

📊

Cross-Org Analytics

Aggregate insights across all users and teams

Powered Styx Workflows
KE Keo/Reporting SP Spectre/Crisis SM Social Media

Knowledge Graph Explorer

Interactive visualization of Neo4j knowledge entities with gap detection and AI ideation

@xyflow/react v12.10.0
Campaign Client Entity Signal Gap Detected
Interactive pan, zoom, and node selection
🔍

Entity Filtering

Campaign, Client, Signal, SemanticEntity types

🕳️

Gap Detection

Find disconnected clusters and isolated nodes

💡

AI Ideation

Suggest bridges between disconnected entities

📋

Detail Panel

Inspect node properties and relationships

Technology Stack

@xyflow/react Neo4j 29 schemas FastAPI + NestJS CortexOne AI
Graph API Endpoints
GET /graph/nodes
GET /graph/edges
GET /graph/subgraph
GET /graph/clusters
POST /graph/gaps/analyze
Route: /explorer

GCP Security Hardening

Fail-Closed Services, Least Privilege IAM, Key Rotation & Operational Safeguards

5
Phases
12
Files Hardened
3
Broad IAM Removed
90d
Key Rotation
60s
Cache TTL (Prod)
$250
Budget Alert

🔒 Fail-Closed Services

SecretsManagerService
Throws on SM connectivity errors in QA/Prod. Only NOT_FOUND falls back to env vars.
KmsEncryptionService
KMS required in prod/QA. Local key rejected in production for wrap/unwrap.
Cache TTL Reduction
Secrets & DEK cache: 60s in prod (was 5min). Rotated keys propagate faster.
Hardcoded Emails Removed
CF Worker: ALLOWED_EMAILS/DOMAINS moved to env vars via wrangler.toml.

🛡️ IAM Least Privilege

Secret Manager
Removed project-level grants. Per-secret IAM bindings only.
Storage Access
Removed project-level storage.objectAdmin. Per-bucket bindings only.
CI/CD Downgrade
storage.admin → storage.objectAdmin (no bucket mgmt).
Org Policies
SA key expiry: 90d. SA key creation: disabled (Workload Identity only).

Rotation & Safeguards

Secret Rotation
90-day rotation on DB URL, JWT secret, encryption key. Pub/Sub notifications.
Budget Alerts
$250/mo threshold. Alerts at 50%, 80%, 100%, 120%.
Essential Contacts
Security, billing, and technical alerts via GCP Essential Contacts.
SA Key Audit
Automated script flags keys >90 days old or unused >30 days.
Phase 1
Code Hardening
Phase 2
IAM Tightening
Phase 3
Key Rotation
Phase 4
Ops Safeguards
Phase 5
Cache TTL

PR: #947 | 12 files modified across API, Terraform, Cloudflare | GCP Security Advisory Response

Observability Platform

Three Pillars: Metrics, Logs, Traces — Unified with AI Governance

7
New Services
4
Dashboards
18
Alert Rules
36+
Recording Rules
8
GOV Controls
<5m
Target MTTD

📊 Three Pillars

Metrics (Prometheus)
rival_api_* + styx_* metrics. 36+ recording rules. API + Workers instrumented.
Logs (Loki + Promtail)
Docker container log aggregation. 30-day retention. Label-based filtering.
Traces (Tempo + Jaeger)
OTEL Collector → Tempo. API → Workers → CortexOne distributed traces.
AI Observability (Phoenix)
LLM-specific traces: token usage, cost, confidence, hallucination risk.

📋 Dashboards & Alerts

Platform Overview
Service health, request rate, error rate, P95 latency, CPU/memory.
Workflow Metrics
Active workflows, SLA breaches, agent execution, HITL tasks, confidence.
AI/LLM Monitoring
Model usage (Opus/Sonnet/Haiku), tokens, cost, governance compliance.
Infrastructure
CPU, memory, disk, OTEL self-metrics, log volume by container.

⚙️ Docker Services

Prometheus :9090
Metrics storage, 18 alerts, 36+ recording rules.
Grafana :3333
4 dashboards, 5 data sources auto-provisioned.
Loki :3100 + Tempo :3200
Log aggregation (30d) + trace storage (7d). Correlation built in.
Promtail + Node Exporter + AlertManager
Log shipping, system metrics, alert routing. All behind --profile observability.
Phase 1
Docker Infra
Phase 2
API Instrumentation
Phase 3
Dashboards
Phase 4
Alerting
Phase 5
Docs & Scripts

View Full PRD | ADR-0007 ACCEPTED | GOV-011 through GOV-018 | SOC2 CC7.2

Going to Production

From QA to rival.io — Phased Rollout for Enterprise Readiness

A comprehensive 7-phase, 5-week production deployment plan bringing the full Rival platform to a dedicated GCP project with HA infrastructure, observability, and enterprise SLOs.

7
Phases
5
Sprints
31
Tickets
$1-1.5K
Monthly Cost
99.5%
Initial SLA
<5m
Target MTTD

Production Architecture

Dedicated GCP Project • Regional HA • Cloudflare Edge

GCP Infrastructure

GKE Regional Autopilot
us-central1 • STABLE channel • Binary Auth
Cloud SQL HA
4 vCPU • 15GB • 100GB SSD • PITR 30d
Redis HA (5GB)
STANDARD_HA • VPC peered
GCS (4 Buckets) + Secret Manager
15 secrets • 90-365 day rotation

Cloudflare Edge

WAF + DDoS (Pro)
OWASP Core Ruleset • Rate limiting
Encrypted Tunnel
cloudflared DaemonSet • No public IPs
Access (Admin OTP)
Email OTP for ops.rival.io
SSL Full (Strict) + CDN
Edge caching • Origin cert on GKE

Application Tier

API (NestJS) Knative
38 modules • 2-20 instances
Web (Next.js) Knative
App Router • 2-20 instances
Workers Knative
141+ workers • 1-10 instances
CIB7 + Observability
45 BPMN • OTEL/Prometheus/Grafana
app.rival.io Web
api.rival.io API
ops.rival.io Admin

Phased Rollout Timeline

7 Phases over 5 Weeks — Each Phase Has Exit Criteria

Phase 0 — GCP Bootstrap
Week 1 • Create project, APIs, Terraform backend
Phase 1 — Core Infra
Week 1-2 • VPC, SQL HA, Redis HA, GKE, Descope
Phase 2 — Build + Data
Week 2 • Cloud Build, images, seed scripts
Phase 3 — App Deploy
Week 2-3 • Knative, migrations, BPMN, seed data
Phase 4 — DNS & Network
Week 3 • CF tunnel, rival.io DNS, SSL, WAF
Phase 5 — Observability
Week 3-4 • OTEL, Prometheus, Grafana, Loki, SLOs
Phase 6 — Validation
Week 4 • Smoke tests, auth E2E, load test, DR drill
Phase 7 — Go-Live
Week 5 • Canary rollout, 48h burn-in, retro
Week 1: Foundation
Week 2: Deploy
Week 3: Network
Week 4: Validate
Week 5: Go-Live

Integration Classification

Day 1: Launch-Critical • Day 2: Feature-Flagged Expansion

Day 1 — Required (7)

AuthDescope (magic link, SSO)
BPMNCIB7 / Camunda
DBPostgreSQL (Cloud SQL HA)
CacheRedis (Memorystore HA)
AICortexOne (functions)
EdgeCloudflare Pro (CDN, WAF)
EmailResend (transactional)

Day 2 — Feature-Flagged (13)

Google Ads API
Meta Marketing
LinkedIn Mktg
TikTok Mktg
Google Analytics 4
HubSpot CRM
Salesforce CRM
Google Workspace
Firebase (FCM)
LiveKit (Voice)
Slack Notif
Neo4j (KB)
YouTube Data
All gated via @rival/shared feature flags

Cost & SLO Targets

Optimized for Early Stage • Scales with Demand

Monthly Cost Breakdown

ComponentCost
GKE Autopilot (Regional)$450-650
Cloud SQL HA (4vCPU/15GB)$320-380
Redis HA (5GB)$140-175
GCS + Registry + Build + Egress$40-70
Cloudflare Pro + Descope$20
Observability (in GKE)$50-100
Total Baseline$1,050-1,500
Scaling: 10-20 tenants ~$1,800-2,500/mo • 50-100 tenants ~$3,500-5K/mo

Service Level Objectives

99.5%
Availability (90d)
<200ms
P50 Latency
<1s
P95 Latency
<0.1%
Error Rate
<5min
MTTD
<30min
MTTR
Error Budget (30-day window)
99.5% initial = ~3.6 hours budget/month • 99.9% after 90 days

Go-Live Checklist & Sprint Plan

31 Tickets across 5 Sprints

Infrastructure

GCP project created
Terraform applied
GKE nodes ready
Cloud SQL HA
Redis HA
GCS + CORS
Secrets populated
Tunnel running

Security

No DEV_AUTH_BYPASS
No DEMO_MODE
NODE_ENV=production
Binary Auth
Network policies
WAF active (Pro)
CF Access on ops
CORS locked

Observability

OTEL collecting
Prometheus scraping
Grafana dashboards
Loki receiving logs
Tempo traces
AlertManager
Uptime monitoring
SLO dashboard

Testing

Smoke tests pass
Auth flow works
BPMN E2E done
Load test baseline
DR drill complete
Security scan clean

Docs

On-call runbook
Architecture diagram
Secret rotation
Incident response
Rollback procedure
S1: Foundation (7)
S2: Deploy (7)
S3: Network (6)
S4: Validate (6)
S5: Live (5)

View Full PRD | 10 Terraform Modules | 7 Day 1 Integrations | $1,050-1,500/mo

Overview

Product Requirements Document: Paid Media Optimization Workflow

v2.2 Updated: Dec 24, 2025

ORIGINAL REQUIREMENTS (Source: Paid Optimization Workflow Outline)

This section documents the original 8 core functions defined in the client's "Paid Optimization Workflow Outline" spreadsheet. These are the baseline requirements against which all development is measured.

Planning Flow (5 Functions)

#FunctionOriginal DescriptionStatusImplementation
1Media Mix AllocationBudget distribution across channels (Meta, YouTube, Search, Programmatic, TikTok, LinkedIn, X) based on objectives, audiences, seasonality, and media approachIMPLEMENTEDpackages/workers/src/planning/media-mix.worker.ts
2Media ForecastingPredicts expected campaign performance using industry benchmarks, platform data, and historical results (CPM, CPC, CPE, CPV, CPL, ROI)IMPLEMENTEDpackages/workers/src/planning/forecasting.worker.ts
3Audience IdentificationAnalyzes channel targeting capabilities and produces unified targeting recommendation (interest groups, demographics, job titles, retargeting pools, lookalikes)IMPLEMENTEDpackages/workers/src/planning/audience.worker.ts
4Campaign Naming GeneratorCreates consistent, searchable campaign names following unified naming structureIMPLEMENTEDpackages/workers/src/planning/framework.worker.ts
5Campaign FlightingTransforms forecast and mix allocation into detailed flighting calendarIMPLEMENTEDpackages/workers/src/planning/framework.worker.ts

Monitoring Flow (3 Functions)

#FunctionOriginal DescriptionStatusImplementation
6Daily OptimizationReal-time spend/KPI monitoring, overspend/underspend detection, automated budget recommendationsIMPLEMENTEDpackages/workers/src/poetry/daily-optimization.worker.ts
7Weekly Reallocation7-day performance review, budget rebalancing, learning phase awarenessIMPLEMENTEDpackages/workers/src/poetry/weekly-reallocation.worker.ts
8Weekly Performance SnapshotWoW analysis, creative performance signals, strategic insights emailIMPLEMENTEDpackages/workers/src/poetry/snapshot.worker.ts

Required API Connectors (Per Original Spec)

All 8 functions require integration with:

Implementation Summary

CategoryImplementedRemainingCoverage
Planning Flow5/50100%
Monitoring Flow3/30100%
Total8/80100%

1. Executive Summary

The goal is to build an automated agentic workflow for optimizing paid media campaigns. This system will ingest user constraints, historical data, and live performance metrics to recommend budget allocations, forecast performance, assist with audience targeting, flighting, and ongoing optimization (daily and weekly).

Version 1.0 (MVP) focuses on 8 core agents for market launch with recommendation-based workflows. Enhanced capabilities including predictive intelligence, incrementality testing, and autonomous execution are planned for subsequent releases (see Section 2.1 Release Roadmap).

2. Terminology & Core Concept

The system is composed of 8 Core Functions or "Agents" that handle specific parts of the paid media lifecycle:

  1. Media Mix Allocation
  2. Media Forecasting
  3. Audience Identification
  4. Campaign Framework (combines Campaign Naming + Campaign Flighting)
  5. Creative Brief
  6. Daily Optimization (Daily Pacing)
  7. Weekly Reallocation
  8. Weekly Performance Snapshot

2.1 Release Roadmap

Version 1.0 (MVP) - Market Launch

Goal: Operational paid media workflow with core planning and optimization

#AgentFunctionPriority
1Media Mix AllocationBudget distribution across channelsP0
2Media ForecastingPerformance prediction using benchmarksP0
3Audience IdentificationTargeting recommendationsP0
4Campaign FrameworkFlighting & naming conventionsP0
5Creative BriefAsset management & assignmentP0
6Daily OptimizationReal-time monitoring & recommendationsP0
7Weekly ReallocationBudget rebalancingP0
8Weekly Performance SnapshotStrategic reportingP0

Execution Mode: Recommendation-only (human approval required for all changes)


Version 2.0 - Intelligence Layer (Post-Launch +90 days)

Goal: Add predictive capabilities and advanced measurement

#AgentFunctionBusiness Value
9Predictive Performance EngineROAS forecasting, fatigue predictionPrevent 30-50% performance drops
10Incrementality Testing OrchestratorCausal measurement, geo testsIdentify 20-40% wasted spend
11MMM-Driven AllocatorMarketing Mix Model integration5-15% efficiency gains

Version 3.0 - Autonomous Execution (Post-Launch +180 days)

Goal: Enable autonomous optimization with human oversight

#AgentFunctionBusiness Value
12Autonomous Execution EngineDirect platform API execution11% uplift, 30+ hrs/wk savings
13Privacy-First Measurement ManagerServer-side tracking, Conversion APIsFuture-proof for cookie deprecation

Safety Controls: Max change limits, anomaly detection, 15-min human veto window


Version 4.0 - Differentiation (Future)

#AgentFunction
14Cross-Channel Attribution ManagerMulti-touch journey mapping, Shapley value attribution
15Audience Learning SystemAuto-expand/contract audiences based on performance
16Dynamic Creative Optimization (DCO) EngineAI-generated creative variants
17Competitive Intelligence MonitorCompetitor spend and creative tracking

3. Functional Requirements

Scope: Version 1.0 (MVP) - All agents below are targeted for initial market launch

3.1. Media Mix Allocation

Goal: Determine how budget should be allocated across channels based on constraints and historical data.

3.2. Media Forecasting

Goal: Forecast performance outcomes based on the allocated mix using industry benchmarks.

3.3. Audience Identification

Goal: Identify and recommend target audiences using platform targeting capabilities.

3.4. Campaign Framework & Flighting

Goal: Structure the campaign flighting and naming conventions.

3.5. Creative Brief

Goal: Manage creative assets and their assignment.

3.6. Daily Optimization

Goal: Monitor daily spend and KPIs, making real-time adjustments.

3.7. Weekly Reallocation

Goal: Rebalance budgets weekly to hit monthly targets efficiently.

3.8. Weekly Performance Snapshot

Goal: Summarize weekly performance and provide strategic insights.


4. Client Portal & Enterprise Authority Management (V1.5)

Enterprise client portal with:

  1. Client Portal (External) - For customers
  2. Operations Portal (Internal) - For team managing campaigns

Enterprise Authority Management (DoA)


5. Future Capabilities (Post-MVP)

V2: Predictive Performance Engine, Incrementality Testing, MMM-Driven Allocator
V3: Autonomous Execution Engine, Privacy-First Measurement Manager
V4: Cross-Channel Attribution, Audience Learning System, DCO Engine, Competitive Intelligence


6. Technical Architecture Notes


Success Metrics & Industry Benchmarks

Research-backed performance targets based on 2024-2025 industry data.

Campaign Planning Efficiency

MetricIndustry BaselinePoetry TargetImprovement
Time to build media plan8-12 hours<30 min96%+ reduction
Planning completion rate40-60%>80%50%+ improvement
Recommendation acceptanceN/A (manual)>70%AI-enabled
Client NPS25-35 (agency avg)>5050%+ improvement

Platform-Specific Performance Benchmarks

Google Ads (Source: WordStream 2024)

MetricIndustry AveragePoetry TargetImprovement Goal
Search CTR6.11%7.5%++23%
Search CPC$4.22<$3.80-10%
Search Conversion Rate7.04%8.5%++20%
Display CTR0.46%0.55%++20%

Meta/Facebook Ads (Source: WordStream 2024)

MetricIndustry AveragePoetry TargetImprovement Goal
CTR1.49%1.85%++24%
CPC$0.40-$0.65<$0.55-15%
Conversion Rate8.25%10%++21%
CPM$5-$15<$10Optimized reach

TikTok Ads (Source: Industry Reports 2024)

MetricIndustry AveragePoetry TargetImprovement Goal
CTR0.84%1.0%++19%
CPM$9.16<$8.00-13%
Engagement Rate5.96%7.0%++17%
Video Completion60-70%>75%+10%

LinkedIn Ads (Source: LinkedIn Marketing 2024)

MetricIndustry AveragePoetry TargetImprovement Goal
CTR0.35-0.65%0.8%++40%
CPC$5.39-$8.00<$5.00-25%
Conversion Rate6.1%7.5%++23%
InMail Open Rate52%>60%+15%

AI Automation ROI Benchmarks

MetricIndustry ResearchSourcePoetry Target
Marketing Automation ROI544% averageNucleus Research600%+
Time Savings300+ hours/yearSalesforce400+ hours
Campaign Performance25-40% improvementMcKinsey Digital35%+
Manual Task Reduction60-80%Gartner75%+
Decision Speed3x fasterForrester4x

Document Version: 2.1 | Last Updated: 2025-12-22 | Status: Active - Research-Backed KPIs Added