Core platform

Core is Norbital's managed control plane. It takes your pod workspace source, builds every commit in isolated microVMs, provisions per-tenant databases, and serves live and preview environments. Core runs the same @norbital-ai/pod runtime — it adds hosted plugins, product UI, and managed operations on top.

Pod first, Core where it adds value

Everything in the Pod docs describes the authoring SDK and runtime. This section documents what the managed platform adds.

Core plugins

Two capabilities are Core-only — they are not shipped inside @norbital-ai/pod:

Checkpoints — immutable versioned releases with preview and live zones, sync, go live, and rollback
Agent — in-workspace AI assistant with metered usage (Agent docs)

Builders push source through Workspace Studio Sync and Go live — they do not run their own deploy pipeline.

Checkpoints & releases

The Checkpoints plugin treats workspace source as versioned infrastructure. Every successful build in a Core sandbox produces a checkpoint — a frozen bundle stored in Core's artifact store. Releases advance which checkpoint is active in preview and production.

Deploy zones

Edit — mutable source in Workspace Studio
Preview — latest synced checkpoint + preview tenant database
Production — live checkpoint + live tenant database

What a checkpoint contains

manifest.json — collections, hooks, apps, automations, remotes, policies
ddl/schema.sql — incremental schema migrations since prior checkpoint
dist/ — compiled tenant apps and runtime bundle

Checkpoints are immutable. A new sync or go live creates a new checkpoint; it does not mutate an old one.

Release steps

Save — persist edit-zone source only (no build, no DDL)
Sync preview — norbital build, apply preview DDL, set preview head
Verify — exercise tenant apps and policies against preview data
Go live — replay migration bundles on production DB, promote checkpoint to live head

Save is not apply

Database schema and automation schedules change on Sync and Go live — not when you save draft source.

Migrations

Build emits additive DDL by default. Destructive schema changes may require an explicit supplement SQL script before sync completes. Go live replays accumulated bundles on the production database; Core takes a pre-migrate dump for rollback safety.

Rollback

Production can be rolled back to a prior checkpoint: restore manifest artifacts, align production DDL, record a new checkpoint for audit. Preview is not rolled back — sync again from edit if preview drifted ahead.

What Core provides

Source store — versioned workspace source in object storage
Build orchestration — ephemeral sandboxes run norbital build, stream checkpoint to artifact store, destroy box
Checkpoint registry — system database tracks preview head, live head, rollback history
Tenant databases — provisions isolated Postgres per org; applies DDL at sync and go live
Runtime sidecar — warm isolate pool per checkpoint; binds db, storage, AI, secrets into guest
Auth & orgs — Better Auth, magic link, team invitations, impersonation
Billing — Builder / Executive / User seat licenses plus metered storage and AI
Workspace Studio — browser UI for source edit, release controls, people, policies, billing

What Core does not own

Core imports no pod TypeScript internals. It does not embed tenant logic directly. Collection operations proxy through host.invoke into the pod runtime where policies and SQL are evaluated.

Policy evaluation, approval gates, and SQL compilation always run inside the pod guest.

Organization lifecycle on Core

Signup — create organization stub and admin auth user
Onboarding — workspace details → Stripe billing trial → managed database provision
Author — builders edit source in Workspace Studio
Release — sync preview → verify → go live (or rollback)
Operate — users run tenant apps; executives use Agent; builders ship checkpoints

Two-database model

System DB — organizations, auth sessions, checkpoint metadata, billing
Tenant DB — per-org Postgres with collection data, policies, approvals, app records

Core authenticates against the system DB, then proxies collection reads and writes into the tenant DB through the pod runtime.

Seat types

Builder — Workspace Studio authoring, sync, go live
Executive — tenant apps + Agent, no builder access
User — tenant apps only

See pricing for Core seat fees and metered usage.