Mutaaf Aziz · from the AI-Native Manifest, 1,776 ft
The EnsembleOne show. Six seats.
My apps are the actors. Between them runs a backstage crew of seven services that nobody in the audience sees. This page explains that crew six times, from the front row to the producer’s office. Sit wherever you like. Each seat sees more of the machinery, and none of them is the wrong one.
Dramatis personae
The company
Seven services, each named for a job backstage. Four of them were built in the same week, each only after copies of the same job had already gone wrong inside the apps.
The event bus. When something happens anywhere, Cue tells everyone who cares and writes it down.
The AI gateway. Every app’s AI calls go through it, and each app has a guaranteed share of the day.
Reads App Store Connect every hour and calls out when a review moves.
The one catalog of apps. Every other list is generated from it or checked against it.
Search and AI answers. It dresses each app’s front page at the edge so engines can read it.
The ad server, with the audience rules for kids’ games written in code.
Store art: screenshots, icons and video for every store, built by an engine and briefed by an agent.
Direction, taste, money and trust. The crew calls me for those, and the ideal is that it calls me for nothing else.
It’s time to light the lights
Imagine a school play. You only see the actors. But behind the curtain there are helpers, and each one has exactly one job.
Every app is an actor. The actors are busy remembering their own lines, so the helpers do everything else.
Before the helpers, every actor kept running to the front door to ask the same question: “Is the principal coming? Is she here yet? Is she here yet? How about now?”
That is a lot of running. Now one helper watches the door and rings a bell when it matters. Everyone else gets to stay on stage.
There are only 10,000 whispers a day, for everyone.
So every actor gets a jar with their name on it, and nobody can drink from someone else’s jar in the morning. By the evening, if a jar is still full, a thirsty actor may borrow from it.
Before the jars, every actor just took what they wanted, and one greedy actor could leave nothing for the rest.
Meet the helpers
When something happens, Cue rings a bell so every helper who cares hears it at once. Then it writes what happened in a notebook, so nobody can forget.
Some actors need help remembering what to say. The prompter can only whisper so many times a day, so every actor is promised their own number of whispers. If someone hasn’t used theirs by evening, a friend can borrow some.
Some shows need permission from the big theatre in town before they can open there. Stage Manager checks the mailbox every hour and says “we got a letter!” the moment one comes.
There’s one list of who is in the show. Everyone copies from it, and every few hours a helper walks around making sure all the copies still match.
So people, and the robots that help people find things, can read what the show is about before they come in.
The sign out front shows ads, which help pay for the show. Kids’ shows get gentler signs with stricter rules.
Every show gets beautiful posters, the right size for every theatre in town, made fresh whenever the show changes.
I decide which show we put on, how it should feel, and I pay for things. The helpers do the rest.
The not-yet part
- Only one of my shows has permission from the big theatre so far. Four more are waiting, and you can still try them early.
- When the bell rings for me, the note might be landing in the junk pile. That still needs fixing.
What “perfect” looks like from here
- A new actor joins, and the posters, programme, sign and list all appear by themselves.
- Nobody runs to the door anymore. Ever.
You’re gonna need a smaller list
You’ve done group projects. You know what happens when the syllabus lives in fourteen places, and when everyone keeps refreshing the group chat to see if the professor replied. That’s what this crew fixes, in software.
Polling: refresh, refresh, refresh
Every app asks every other system “anything new?” on a timer. Almost every answer is no, and each one still costs something.
Events: get a notification
The system that knows publishes one event when something actually changes. Whoever subscribed hears it once.
The crew is a heist team. Everyone is a specialist, nobody does two jobs, and the plan is written down before anyone moves.
This is the middle path you didn’t get taught. A monolith is one person doing every job. A microservice per feature is hiring forty specialists for a two-person job. Here there are seven, and each one was hired only after the same job had gone wrong in several apps.
Every member of the crew maps onto something you already know from campus.
The crew, as campus life
One place publishes “class cancelled”, and every subscriber gets it. It keeps 90 days of history, so you can scroll back and replay what happened.
Concepts: publish and subscribe, an event log, replay.The account gets 10,000 swipes a day of free AI. Each app has guaranteed swipes, and late in the day unused swipes can be lent out. Before Prompter, the apps’ own limits added up to more than 18,000, so one hungry app could empty the dining hall for everyone.
Concepts: quotas, rate limits, fair sharing.It can look up every app’s App Store status but can’t change anything. If its card is lost, nothing else breaks.
Concepts: least privilege, separate credentials.One official record. Everyone else’s copy is either printed from it or checked against it every six hours.
Concepts: single source of truth, drift detection.Written so search engines and AI assistants can understand each app and quote it correctly.
Concepts: SEO, structured data, llms.txt.Ads pay the bills, and the kids’ games follow stricter rules that live in code, not in a memo.
Concepts: policy as code.It makes the store screenshots, icons and videos, and does nothing (for free) on days with nothing to do.
Concepts: idempotent jobs, cheap checks first.Each app keeps its own data. The crew shares news about what happened, never the data itself.
Concepts: loose coupling, “share events, not stores”.Not yet
- Most lists are still checked against the catalog rather than printed from it. Only the launcher and the search routes are generated so far.
- The alert emails may be landing in spam. The domain isn’t set up to vouch for them yet.
The ideal, from the usher’s tour
- Every list is generated, so the audit has nothing left to find.
- Nothing anywhere polls on a timer.
There is no cron
Up in the rigging, the ropes are real. Cloudflare Workers on the free plan, 10 ms of CPU a request, Queues, D1, Durable Objects and service bindings. Here is how one event travels and what each service actually does with it.
Prompter is a drop-in for env.AI
// wrangler.jsonc: the app keeps calling env.AI.run() "services": [{ "binding": "AI", "service": "prompter", "props": { "app": "cold-gas" } }] // inside Prompter, per call: reserve(app, est = 20) // one Durable Object ledger run(model) → fallback chain // a failed model falls through stream back untouched; meter a copy settle(app, lastUsage) // last cumulative report wins
That last line is a scar. A stream can report usage more than once, cumulatively, so summing the reports charged 0.8 neurons for a call Workers AI billed at 0.59. Now the meter keeps the last report, and the five apps’ own parsers were fixed the same day.
Borrowing grows with the day: none at midnight, three quarters by 18:00. Nobody is starved in the morning, and the allowance isn’t wasted at night. Shares: Cold Gas 3,000 · Chalk Talk 2,500 · Hearth 1,500 · KIN 1,250 · Metaphases 1,250. Cap 9,500 of the 10,000.
The crew, as running code
Queues cue-events and cue-dead, D1 cue as the durable log, an hourly clock event, and an email subscriber. Seven event types today, from app.review.changed to coldgas.run.scored.
Stores counts, never prompts or answers. Refusals are plain errors, and Cue emails once per app per day. Bring-your-own-key calls never come here.
Scar: an AbortSignal can’t cross a service binding. Apps cancel the stream on their side, and only{ est } crosses.tick() over a service binding from Cue’s clock reads each app’s newest iOS version and publishes on a change. It uses the same event ids as Lobby’s watcher on my Mac, so while both run, Cue logs each change once.
catalog/apps.json with schema rules in CI. Feeds for the launcher, JSON-LD and drift. The audit reads 10 surfaces every six hours and publishes cast.drift.changed only when the set of mismatches changes.
A Worker on exact routes in front of each app. It fetches the page through a service binding and decorates it with HTMLRewriter. If decorating fails, the page is served untouched.
Exact routes beat each app’s wildcard route. Query-string URLs skip it.Apps load one same-origin script with data-app. Kids’ games get child-directed ads outside gameplay only. General-audience games can show a menu banner in a same-origin frame, and Cold Gas removes it before a run starts.
data-ad-slot collided with Google’s own markup and recursed. Banners use data-marquee.A free status check runs before any model wakes. On a day with no work it stops at $0. It pushes only to editable store versions, and has no command that submits.
The one working run on Nov 4 cost $1.77.Gameplay and authoritative scoring stay inside each app. A Cold Gas score replay already costs about 170 ms of CPU, so a network hop would only make it worse.
Share events, not stores.Not yet
- Queue retention is 24 hours. A consumer outage longer than that loses queued deliveries; the D1 log keeps the record, and nothing replays it automatically yet.
- Lobby’s watcher on the Mac still runs alongside Stage Manager until the cloud one has a clean record.
The ideal, from the rigging
- Every cross-app reaction is a subscriber to an event in a contract, with a test.
- Replay from the log is one command, and it’s been drilled.
Intermission
The house holds this many
The free plan is the fire code. Every design choice above was made against these numbers, and the day one binds, Cue says so.
Could isn’t should
Anyone can draw forty boxes. The interesting decisions here are the boxes that weren’t drawn, and the rule that decided which ones were.
A set designer doesn’t build a room for every scene. They build what the scenes share, and let each scene bring its own props.
The rule: a shared service exists only where duplication had already caused a failure in production, and the evidence comes first. Prompter came after five copies of provider code and caps adding up to 18,000 against a 10,000 allowance. Cast List came after fourteen lists disagreed. Stage Manager came after App Store Connect tooling was copied into four repos.
The anti-rule: no service per feature. Cold Gas had 7 recorded human sessions at the inventory. Splitting its scoring into a service would add hops against a 10 ms budget and buy nothing.
The decisions, with what they cost
| Decision | Why | What it costs |
|---|---|---|
| One bus, few services | Traffic is small and CPU is 10 ms. Coordination, not throughput, was the problem. | Cue is a shared dependency, so publishing must never break the caller. |
| Share events, not stores | No two apps share a database, and none should start. | A question across apps needs a consumer that builds its own view. |
| D1 as the durable log | Queue retention is 24 hours. The log keeps 90 days and can be replayed. | Two writes to reason about. Delivery is at least once, so ids must be stable. |
| Source from the binding, not the body | A producer can’t claim another’s name. Tested. | Off-cloud producers carry tokens, stored hashed. |
| Two Apple keys | The upload key stays on my Mac with Lobby. A separate read-only key lives in the cloud with Stage Manager. Revoke one and the other survives. | Two keys to rotate. I install them; no agent ever handles the file. |
| Truth in three layers | Identity is changed by PR, store facts come from Apple, and drift is measured. Nobody types a store status. | A catalog change is a pull request, not a quick edit. |
| Generate or audit | Every surface that lists apps is either generated from the catalog or audited against it. | Ten readers to keep honest, each with its own quirks. |
| Left alone on purpose | Gameplay, scoring, each product’s database, static sites. Privacy-first apps emit only operational events, or none. | Some duplication is allowed to stay, until it fails. |
The crew, as contracts and boundaries
Contract first: an event type that isn’t in code can’t be published. That turns the bus into a schema registry by construction.
One ledger, one Durable Object, per-app shares named by the binding. The failure it prevents is a noisy neighbour switching AI off for everyone.
It exists so the key that can upload never has to leave the Mac, while status still moves to the cloud.
Its schema encodes policy: a kids’ app on a store must have a grown-up gate, and ads: false can never appear on Marquee.
It decorates pages it doesn’t own. Failing open was a deliberate choice: a broken decoration must never cost a visitor the page.
Audience splits ads, analytics and links downstream. Kids’ rules live in the server, so no app can forget them.
The engine holds the plumbing. Each app holds its meaning in store/lobby.json, and discovery finds new apps by walking the projects folder.
Usually systems copy the org chart. Here there is one person, so the services copy the jobs backstage instead.
Weak joints I know about
- Prompter’s ledger is a single Durable Object, so it is the one place every AI call waits on.
- The audit runs from a GitHub Action on a timer. It’s polling, in the service built to end polling.
- Shared operator auth and observability ingest are still copied per service. They are phase 5, and planned.
The ideal, from the drawings
- Each boundary above is enforced by a check, not described in a doc.
- Adding an app touches one catalog entry and one file in its repo. Nothing else is typed.
Yes, chef
From the booth you don’t watch the play. You watch the cue sheet, the budget and the exits. This is the operating view: what it costs, what can hurt, who holds which key, and how I’d know.
It runs like a kitchen brigade. Stations own one thing each, tickets come in, and the pass decides what goes out.
Cue is the pass. Every order crosses it. Prompter is the walk-in: shared stock, portioned per station. Stage Manager watches the door for the critic. Cast List is the menu, printed once. Playbill, Marquee and Lobby are front of house. The agents are the line cooks, and they never touch the money.
Mise en place is the contract: every event type, rule and schema is written down in a repo before anyone cooks.
Live readings from /cast/api/drift, /stage/api/health and /prompter/api/health on Nov 10, 2026. Open them for today’s.
The booth’s real job is deciding what reaches a human.
Everything is logged. Machines handle what machines can. Only critical events become an email, and only a decision about money, accounts, keys or a submission reaches me.
The narrow end of that funnel is the whole operating model.
The risk board
Closed · Nov 10
Search missed three appsCast List’s audit caught Playbill skipping Adhan Clock, Hinge Pop and Metaphases. Playbill’s routes and bindings are now generated from the catalog, and the audit reads 10 of 10.
Medium · open
Alerts may land in spamCloudflare reported the first alert delivered, but it couldn’t be found. The domain has no DMARC record yet. A second channel or SPF and DMARC closes it.
Medium · by design
Five of five cronsNo headroom for a sixth timer. Mitigated by design: new jobs subscribe to Cue’s hourly clock instead.
Medium · watched
One account, one judgementOn Nov 5 App Review sent the same rejection to four apps within a minute. Every reply now stays consistent across all five threads.
Low · planned
Copies still multiplyingOperator auth and observability ingest are duplicated per service. Phase 5 consolidates them, once copies cause a real failure.
Low · watched
The free tier endsWhen Prompter’s refusal email arrives most days, it’s time for Workers Paid at $5 a month. The trigger is written down, and the decision is mine.
The crew, as an operating model
Critical events are never shed and go straight to email. Normal events are capped so a chatty producer can’t eat the queue budget.
A spend ceiling that can’t be exceeded by any one app, and a written signal for when to pay.
The lowest Apple role that can read versions, kept only in Cloudflare’s encrypted secrets. The install script proves the key against Apple before uploading it.
Drift is measured continuously and published as an event, so it shows up without anyone remembering to check.
An agent on its own server runs the weekly search loop through a scoped token, under written autonomy rules.
The audience policy was my decision once. Since then it’s been code that every app inherits.
A deterministic check gates the model. Most days cost nothing at all.
Submitting for review, money and accounts, and keys. Those are parked with the exact click I need to make. Everything else is a cue.
What I’d ask about, sitting in the booth
- No replay drill has been run yet.
- Nothing measures delivery latency end to end.
- There’s no cross-app funnel. Each app is measured alone.
The ideal, from the booth
- One alert channel that only carries decisions.
- Every limit on the intermission board has a reading and a threshold, and Cue raises it before it binds.
Who tells your story
From the producer’s office the question is simple: does this let one person run a studio? The answer so far is yes for making things, and not proven yet for selling them.
A producer’s job is to make the next show cheaper to open than the last one. The ensemble is that, in code.
Without it, each new app needs its own store art, search work, ad setup, AI budget, review tracking and a dozen hand-typed listings. With it, a new app is a catalog entry and a file in its repo, and the crew picks it up.
The honest ledger: the machinery is built, and proof that it brings people is still early. One app is approved, AdSense is in review, there are no sales yet, and search started from zero owned URLs in 33 searches.
The cost of opening the next show
| Opening a new app | Before | Now |
|---|---|---|
| Listed everywhere | 14 lists, typed by hand | One line launcher generated, rest audited |
| Store status and downloads | me, checking dashboards | Automatic automatic, hourly |
| Store art | a designer, per store | Automatic engine renders, agent briefs |
| Search routing | routes typed per app | Automatic generated from the catalog |
| Search copy | written per app | By hand still written per app |
| AI budget | each app capped itself | One line one line: a share |
| Ads | set up per app | One line one script tag, rules inherited |
| Review alerts | I find out eventually | Automatic an email within the hour |
Who works on which show
| Product | Cast List | Playbill | Marquee | Lobby | Prompter | Stage Mgr |
|---|---|---|---|---|---|---|
| Mutaaf Azizsite · web | ||||||
| OpenAerogame · web | ||||||
| OUTATIME 88game · web | ||||||
| Cold Gasgame · At App Review | ||||||
| Hearthapp · In beta | ||||||
| Adhan Clockapp · web | ||||||
| Chalk Talkapp · web | ||||||
| KINgame · web | ||||||
| Hinge Popgame · At App Review | ||||||
| Metaphasesapp · web | ||||||
| Moon Clubapp · On the App Store | ||||||
| The Leadership Librarylibrary · web | ||||||
| 17-0game · In beta |
The crew, as a business
Without it, nothing reacts to anything. With it, a store approval, an AI budget running out or a broken listing reaches the right place in minutes.
Every AI feature in the portfolio runs on a free allowance, fairly shared, with a clear signal for when to start paying.
I learn about a review decision within the hour, without opening a dashboard.
Every place the portfolio appears tells the same story with the same names. One game used to go by two.
Being found, and being quoted correctly by AI assistants, for the questions each app genuinely answers.
Ads across every app, with kids’ rules nobody can forget. Revenue starts when AdSense approves.
Store art for every store, kept current by an agent for the cost of a coffee on the days it works.
Concentration. One developer account, one reviewer’s judgement, one person. The ensemble makes the person scale; it doesn’t make them optional.
Places, everyone
The goal isn’t a bigger crew. It’s a show where every app joins the company on its first commit, nothing waits on a timer, every reaction is a cue, and the director is called only for direction, taste, money and trust. Here is how far along that is, row by row.
| The ideal | Today | State |
|---|---|---|
| Every AI call is budgeted | All five AI apps go through Prompter, with shares, lending and fallback. | Done |
| Store status is never typed | Stage Manager reads Apple hourly. Download buttons and labels follow it. | Done |
| One list, everything else follows | The launcher and search routing are generated. The rest are audited: 10 of 10 agree today. | Most of the way |
| A new app is one entry | Catalog, Lobby, the launcher and search routing pick it up. Its search copy and ad setup are still written by hand. | Most of the way |
| Nothing polls | Review tracking and the clock are events. The drift audit and the Mac watcher still run on timers. | Partway |
| Production writes the next ticket | Per app, routines turn errors and signals into tickets. Nothing joins them across apps yet. | Partway |
| The director is paged only for decisions | Alerts go by email, which may land in spam, and they carry facts rather than decisions. | Not yet |
| Shared auth and observability | Copied per service. Phase 5. | Not yet |
| Free until it pays for itself | $0 today, with the trigger for $5 a month written down. | Holding |
The show doesn’t need me on stage. It needs me in the one seat nobody else can sit in: the one that decides what the next show is.