XFlow
The control plane: workspace identity, app catalog state, provider contracts, readiness, and workflow orchestration.
Technical evidence packet
A six-app product ecosystem built to show senior full-stack product engineering.
This page is the public reviewer landing page for the XFlow ecosystem. It summarizes the Phase 8 case studies, the Phase 7.5 screenshot proof assets, architecture boundaries, claim guardrails, and remaining verification work without claiming unverified production deployment.
Reviewer lens
What to evaluate
System boundaries
Real public surfaces
Cross-app routing
Operational proof
AI product judgment
30-second version
Plain-language map of the ecosystem.
XFlow is a six-app ecosystem where the technical signal is the way control-plane authority, validation governance, product workflows, proof scripts, and evidence assets connect across app boundaries.
Verixet
The governance authority: validation, usage admission, entitlements, and release/billing boundaries.
Rataify
The trust/risk layer: website credibility, scam-signal review, prioritized findings, and remediation workflow.
AudAiX
The audit/evidence intelligence layer: browser audits, evidence capture, findings, reports, and monitoring posture.
Crevux
The creative production studio: generation, enhancement, projects, galleries, credits, and export paths.
WordGeni
The writing/research workspace: source-grounded drafting, provenance, project memory, and export preparation.
Why this matters for hiring
The evaluation signal is ownership across a product platform.
This project demonstrates full-stack product engineering, platform thinking, auth, governance, data, deployment readiness, AI product judgment, and cross-app architecture. The evidence is not one polished screen; it is the connected set of authority boundaries, product decisions, proof scripts, dashboards, docs, and operational surfaces.
Full-stack product engineering across Next.js/React surfaces, API boundaries, auth flows, billing state, data models, and production route behavior.
Platform thinking through a control-plane model, app registry, shared contracts, authority boundaries, and cross-app routing.
Ownership of auth, billing, data, deployment, proof scripts, QA strategy, public routes, and guardrail documentation.
AI product judgment shown through practical workflows in WordGeni, Crevux, AudAiX, Rataify, Verixet, and XFlow rather than generic AI demos.
Cross-app architecture that separates control plane, validation governance, trust/risk, audit evidence, creative production, and writing/research surfaces.
Suggested reviewer path
A practical route through the evidence.
This order keeps the review grounded: start with the system map, then inspect the control plane, validation governance layer, domain workflows, screenshot proof, and claim guardrails.
- 1
Start with ecosystem overview.
- 2
Review XFlow as the control-plane case study.
- 3
Review Verixet as the validation governance case study.
- 4
Scan Rataify and AudAiX for trust, risk, audit, and evidence workflows.
- 5
Scan Crevux and WordGeni for creative production and writing/research workflows.
- 6
Review screenshot proof, claim guardrails, and remaining verification gaps.
What this demonstrates
A compact review of the engineering surface area.
The point is not that every product has the same maturity. The point is that Robert Schuelke's ecosystem exposes serious full-stack design decisions across six clear app boundaries.
XFlow control-plane model for identity, app catalog state, provider contracts, and workflow orchestration
Verixet governance authority for validation, usage admission, entitlements, and release/billing boundaries
Shared data architecture with app-separated product domains
Cross-app lander/auth/pricing routing
Public trust/security surfaces
Event ingest and operational proof flows
AI-assisted product features across writing, audits, media, and control-plane workflows
Deployment, monitoring, and readiness checks
Validation governance and billing-boundary design beyond basic Stripe Checkout
Frontend-safe billing DTO design
Subscription lifecycle visibility
Builder ownership / context
This is implementation evidence, not generic product marketing.
Robert Schuelke is a self-taught builder who created this ecosystem while working full-time. The important signal is ownership across architecture, product decisions, debugging, deployment, and proof discipline.
Builder context
Robert Schuelke designed and implemented this six-app ecosystem across product architecture, frontend UX, backend APIs, centralized auth, validation governance, entitlement and billing boundaries, data modeling, deployment readiness, QA proof scripts, and AI-assisted product workflows.
System architecture
XFlow centralizes account, app routing, control-plane visibility, and auth handoff decisions.
Validation governance
Verixet owns validation posture, usage admission, entitlement decisions, release boundaries, and billing lifecycle surfaces where configured.
Shared data model
Supabase consolidation work is documented through schemas, migrations, rollout packets, and validation scripts.
Proof discipline
The repo includes static proof, smoke scripts, route checks, brand audits, readiness scripts, and generated proof artifacts.
My ownership vs AI assistance
AI is an acceleration tool inside human-owned engineering decisions.
The distinction matters for review: the architecture, product direction, boundaries, debugging calls, UX priorities, deployment decisions, and final implementation review are Robert-owned. AI assistance is used as leverage for implementation speed and review breadth.
Robert owns
Architecture decisions, product direction, system boundaries, debugging calls, UX priorities, deployment decisions, and final implementation review.
AI assistance accelerates
Coding, refactoring, documentation, testing ideas, and debugging support inside builder-directed implementation work.
Reviewer asset
Resume & Portfolio Snapshot
Download Robert Schuelke's full-stack developer resume covering the XFlow ecosystem, SaaS architecture, centralized auth, validation governance, entitlement and billing boundaries, Supabase/PostgreSQL, AI product workflows, and selected product portfolio.
Proof artifacts
Evidence reviewers can trace back to commands and reports.
The engineering proof packet ties this public review page to the non-mutating proof harness, release checklist, generated JSON/Markdown reports, browser smoke scripts, shared Supabase validation, billing regression coverage, assistant proxy checks, and deployment readiness artifacts.
Static ecosystem proof harness
The root proof command validates contracts, public routes, XFlow to Verixet status behavior, billing DTO safety, usage catalog rules, usage ingest hardening, and satellite writer boundaries.
Latest static ecosystem proof harness
68 pass, 0 warnings, 0 failures. This represents one focused static proof run, not the full validation surface.
Release proof checklist
Merge, staging, and production promotion gates require proof artifacts, report review, and hard-blocker checks before release movement.
Protected HTTP smoke
HTTP proof is manual and staging-only. It is ready for GitHub environment configuration and does not run by default on pull requests.
Proof coverage matrix
The 68-pass harness is one layer of a broader proof surface.
This matrix lists repo-backed proof layers without converting run-specific artifacts into inflated totals.
Static ecosystem proof harness
- What it validates
- Contracts, public routes, XFlow to Verixet status behavior, billing DTO safety, usage catalog rules, usage ingest hardening, and satellite writer boundaries.
- Apps covered
- All six apps
- Evidence source
- scripts/phase17-ecosystem-proof.mjs; output/phase17-ecosystem-proof-report.md
- Status / caveat
- Latest static harness: 68 pass, 0 warnings, 0 failures. One focused static run, not the total validation surface.
Typecheck, lint, build
- What it validates
- Compile-time safety, lint discipline, and production build readiness across app workspaces.
- Apps covered
- Six-app ecosystem scripts
- Evidence source
- App package scripts and XFlow focused validation commands
- Status / caveat
- Available as runnable gates; report current command output rather than implying every historical run is green.
Public route verification
- What it validates
- Public routes, showcase chrome, footer/nav coverage, and no-localhost public links.
- Apps covered
- XFlow plus public app surfaces
- Evidence source
- apps/XFlow/tests/showcase-chrome.test.ts; scripts/smoke-public-ecosystem-pages.mjs; output/live-production-readiness-proof-2026-05-10.json
- Status / caveat
- Repo-backed. Public QA artifacts are run-specific and should be read with their recorded failures/caveats.
Browser smoke validation
- What it validates
- Rendered public pages, CTAs, responsive screenshots, metadata, and cross-app destinations.
- Apps covered
- All six public apps
- Evidence source
- scripts/smoke-public-ecosystem-pages.mjs; output/playwright and output/wordmark-qa artifacts
- Status / caveat
- Evidence exists, but browser smoke is live-environment-sensitive and not claimed as permanently green.
Brand casing audit
- What it validates
- Public-facing XFlow, Verixet, Rataify, AudAiX, WordGeni, and Crevux naming discipline.
- Apps covered
- All six public brands
- Evidence source
- scripts/audit-public-brand-casing.mjs
- Status / caveat
- Static audit gate; rerun before release.
Billing regression tests
- What it validates
- Plan selection, checkout routing, lifecycle summaries, frontend-safe status payloads, and Stripe catalog rationalization.
- Apps covered
- Verixet authority, XFlow consumers, satellites as billing consumers
- Evidence source
- apps/Verixet/src/lib/billing/*.test.ts; apps/Verixet/src/lib/commerce/*.test.ts
- Status / caveat
- Repo-backed regression coverage; no fake customer, revenue, or uptime metrics are inferred.
Entitlement and usage admission checks
- What it validates
- Usage catalog rules, Verixet-owned admission decisions, source-app restrictions, and sanitized satellite reporting.
- Apps covered
- Verixet, Rataify, AudAiX, WordGeni, Crevux, XFlow status surfaces
- Evidence source
- ecosystem-contracts/types/usage-metrics.ts; scripts/phase17-ecosystem-proof.mjs; usage ingest and reporter tests
- Status / caveat
- Static and unit-level proof surfaces are present; mutation endpoints are not called by the static harness.
Shared Supabase validation
- What it validates
- Shared schema direction, service-role boundaries, RLS proof, rollout packets, backup readiness, and app migration plans.
- Apps covered
- All six apps plus shared packages
- Evidence source
- scripts/validate-supabase-*.mjs; docs/shared-supabase-*.md; supabase/migrations
- Status / caveat
- Backed by scripts and docs; production cutover claims stay scoped to documented readiness state.
Assistant proxy smoke tests
- What it validates
- XFlow assistant proxy contracts, per-app service-token wiring, JSON envelopes, and support conversation routing.
- Apps covered
- XFlow, Verixet, Rataify, AudAiX, WordGeni, Crevux
- Evidence source
- scripts/smoke-ecosystem-assistant-production.mjs; docs/ecosystem-assistant-production-rollout.md; proxy smoke logs
- Status / caveat
- Smoke path exists; production runs depend on configured tokens and live app URLs.
Local persona/runtime proof
- What it validates
- Unauthenticated route access, protected route denials, role/persona route contracts, and non-mutating security simulation.
- Apps covered
- All six apps
- Evidence source
- scripts/authenticated-persona-security-simulation.mjs; output/authenticated-persona-security-simulation-2026-05-10.json
- Status / caveat
- Latest inspected artifact had 78 pass and 9 blocked authenticated personas due to missing env/cookies.
Deployment/readiness checks
- What it validates
- Production public routes, health/ready endpoints, Railway/Sentry env documentation, and launch readiness preflights.
- Apps covered
- All six deployed public surfaces
- Evidence source
- scripts/production-readiness-proof.mjs; scripts/verify-railway-sentry-env-docs.mjs; docs/observability/*; output/live-production-readiness-proof-2026-05-10.json
- Status / caveat
- Readiness evidence exists; no permanent uptime or certification claim is made.
| Proof layer | What it validates | Apps covered | Evidence source | Status / caveat |
|---|---|---|---|---|
| Static ecosystem proof harness | Contracts, public routes, XFlow to Verixet status behavior, billing DTO safety, usage catalog rules, usage ingest hardening, and satellite writer boundaries. | All six apps | scripts/phase17-ecosystem-proof.mjs; output/phase17-ecosystem-proof-report.md | Latest static harness: 68 pass, 0 warnings, 0 failures. One focused static run, not the total validation surface. |
| Typecheck, lint, build | Compile-time safety, lint discipline, and production build readiness across app workspaces. | Six-app ecosystem scripts | App package scripts and XFlow focused validation commands | Available as runnable gates; report current command output rather than implying every historical run is green. |
| Public route verification | Public routes, showcase chrome, footer/nav coverage, and no-localhost public links. | XFlow plus public app surfaces | apps/XFlow/tests/showcase-chrome.test.ts; scripts/smoke-public-ecosystem-pages.mjs; output/live-production-readiness-proof-2026-05-10.json | Repo-backed. Public QA artifacts are run-specific and should be read with their recorded failures/caveats. |
| Browser smoke validation | Rendered public pages, CTAs, responsive screenshots, metadata, and cross-app destinations. | All six public apps | scripts/smoke-public-ecosystem-pages.mjs; output/playwright and output/wordmark-qa artifacts | Evidence exists, but browser smoke is live-environment-sensitive and not claimed as permanently green. |
| Brand casing audit | Public-facing XFlow, Verixet, Rataify, AudAiX, WordGeni, and Crevux naming discipline. | All six public brands | scripts/audit-public-brand-casing.mjs | Static audit gate; rerun before release. |
| Billing regression tests | Plan selection, checkout routing, lifecycle summaries, frontend-safe status payloads, and Stripe catalog rationalization. | Verixet authority, XFlow consumers, satellites as billing consumers | apps/Verixet/src/lib/billing/*.test.ts; apps/Verixet/src/lib/commerce/*.test.ts | Repo-backed regression coverage; no fake customer, revenue, or uptime metrics are inferred. |
| Entitlement and usage admission checks | Usage catalog rules, Verixet-owned admission decisions, source-app restrictions, and sanitized satellite reporting. | Verixet, Rataify, AudAiX, WordGeni, Crevux, XFlow status surfaces | ecosystem-contracts/types/usage-metrics.ts; scripts/phase17-ecosystem-proof.mjs; usage ingest and reporter tests | Static and unit-level proof surfaces are present; mutation endpoints are not called by the static harness. |
| Shared Supabase validation | Shared schema direction, service-role boundaries, RLS proof, rollout packets, backup readiness, and app migration plans. | All six apps plus shared packages | scripts/validate-supabase-*.mjs; docs/shared-supabase-*.md; supabase/migrations | Backed by scripts and docs; production cutover claims stay scoped to documented readiness state. |
| Assistant proxy smoke tests | XFlow assistant proxy contracts, per-app service-token wiring, JSON envelopes, and support conversation routing. | XFlow, Verixet, Rataify, AudAiX, WordGeni, Crevux | scripts/smoke-ecosystem-assistant-production.mjs; docs/ecosystem-assistant-production-rollout.md; proxy smoke logs | Smoke path exists; production runs depend on configured tokens and live app URLs. |
| Local persona/runtime proof | Unauthenticated route access, protected route denials, role/persona route contracts, and non-mutating security simulation. | All six apps | scripts/authenticated-persona-security-simulation.mjs; output/authenticated-persona-security-simulation-2026-05-10.json | Latest inspected artifact had 78 pass and 9 blocked authenticated personas due to missing env/cookies. |
| Deployment/readiness checks | Production public routes, health/ready endpoints, Railway/Sentry env documentation, and launch readiness preflights. | All six deployed public surfaces | scripts/production-readiness-proof.mjs; scripts/verify-railway-sentry-env-docs.mjs; docs/observability/*; output/live-production-readiness-proof-2026-05-10.json | Readiness evidence exists; no permanent uptime or certification claim is made. |
Claim guardrails
What this page is not claiming
No unsupported compliance certification is claimed.
No invented customer, revenue, uptime, or scale metrics are used.
No static proof result is presented as a permanent production guarantee.
No claim is made that every live smoke artifact is currently green.
No public deployment proof is claimed for the six apps unless separately verified.
Protected staging HTTP proof remains separate from the static harness and is not described as complete unless the release checklist says so.
Architecture map
Six apps evaluated as one connected system.
This map is intentionally technical: it shows authority boundaries and product responsibilities instead of treating the ecosystem as a loose collection of landing pages.
Audit/evidence intelligenceAudit evidence, browser checks, findings, reports, monitoring posture, and production-readiness review.
Creative production studioCreative production studio for generation, enhancement, projects, galleries, credits, and export paths.
Control planeControl plane for workspace identity, app catalog state, provider contracts, readiness, and workflow orchestration.
auth authorityevent ingestcross-app routingoperator visibility
Validation governanceGovernance authority for validation, usage admission, entitlements, and release/billing boundaries.
Trust/risk layerTrust, risk, scam-signal review, website credibility, prioritized findings, and remediation workflow.
Writing/research workspaceWriting and research workspace for source-grounded drafting, provenance, project memory, and export preparation.
Identity boundary
Auth and handoff model
- XFlow acts as the central auth authority for public sign-in and sign-up flows.
- Satellite apps delegate entry into XFlow instead of becoming separate auth authorities.
- App, source app, selected app, intent, and safe return URL context are preserved through handoff links.
- The design is OAuth-style/OIDC-style without claiming standards compliance beyond what is implemented.
Commercial boundary
Validation, entitlement, and billing model
- Verixet owns validation governance, usage admission, entitlement decisions, and release/billing boundaries.
- Satellite apps consume governance and entitlement state instead of creating separate authority layers.
- Pricing and checkout entry points stay routed toward Verixet-controlled plan decisions where billing is in scope.
- Verixet does not treat every plan change as a simple checkout button. It includes preview-before-checkout safety, redundant/lower-tier purchase blocking, safe execution paths for known subscription items, lifecycle-aware billing dashboard states, and a frontend-safe billing status DTO that avoids exposing raw Stripe IDs to the browser.
Data boundary
Shared database / Supabase model
- The ecosystem is organized around shared identity, workspace, app, and product-context concepts.
- App-separated schemas keep product data separated while allowing shared platform-level patterns.
- Workspace scoping keeps user actions and operational records tied to the correct product context.
- Service-role boundaries are treated as authority boundaries, not casual frontend conveniences.
Release boundary
Production deployment model
- Readiness checks, route verification, status surfaces, and deploy proof are part of the product story.
- Environment and config readiness are treated as launch concerns instead of afterthoughts.
- Public domains, public routes, and cross-app links are validated for non-local production behavior.
- Monitoring concepts and operational review surfaces help explain what changed after release.
Trust boundary
Security model
- Authority boundaries separate XFlow operational control from Verixet validation, entitlement, release, and billing governance.
- Workspace scoping, least-authority routing, legal/consent awareness, and audit trails are explicit concerns.
- Trust surfaces make security, privacy, support, status, and policy pages reviewable.
- Browser-safe DTOs keep billing visibility useful without exposing raw Stripe customer, subscription, or subscription item IDs.
- No unsupported compliance claims are needed; the proof is in the visible boundaries and workflows.
Verification boundary
Testing and QA strategy
- Typecheck, lint, build, route coverage, public route verification, and app-specific checks catch regressions.
- Chrome/nav/footer tests guard public positioning, footer coverage, and no-localhost link behavior.
- Brand casing audit protects public trust across XFlow, Verixet, Rataify, AudAiX, WordGeni, and Crevux.
- Browser smoke validation checks public pages, CTAs, breadcrumbs, JSON-LD, and cross-app destinations.
- Billing regression tests cover preview blocking, safe execution, lifecycle summaries, checkout validation, and frontend-safe status payloads.
AI/product features
AI is integrated into product surfaces, not presented as magic.
Robert uses AI-assisted development as leverage, but the architecture direction, product decisions, debugging, UX judgment, system boundaries, and final ownership are founder-directed.
Source-grounded writing workflows, claim review, project memory, and export-ready publishing flow.
Audit workflows for Lighthouse, accessibility, UX findings, launch readiness, and reporting.
Creative production workflows for generation, enhancement, asset organization, credits, and export paths.
Assistant and control-plane workflows that connect events, readiness, and operator next actions.
Trust evidence workflows that turn public pages, policy checks, and issue evidence into proof surfaces.
Validation governance workflows around usage admission, entitlement state, release boundaries, and billing decisions where configured.
Screenshots and proof cards
Visible product evidence without fake metrics.
These cards use the Phase 7.5 dashboard screenshots captured from guarded local proof routes. The public page shows the images only; it does not expose or link to local-only screenshot routes.
Control-plane dashboard
Verified Phase 7.5 local dashboard proof showing the control-plane purpose, readiness posture, app map, and operator actions without claiming live production health.
Validation governance dashboard
Verified Phase 7.5 local dashboard proof showing release-gate posture, validation governance, and operator next actions without synthetic traffic or production claims.
Trust/risk dashboard
Verified Phase 7.5 local dashboard proof showing the trust/risk workflow in an honest no-selected-site state with scan and billing services disconnected.
Audit/evidence dashboard
Verified Phase 7.5 local dashboard proof showing audit/evidence hierarchy with empty local portfolio data and no evidence mutations.
Creative production dashboard
Verified Phase 7.5 local dashboard proof showing creative production purpose, creation actions, asset workflow state, and empty local arrays.
Writing/research dashboard
Verified Phase 7.5 local dashboard proof showing source-grounded writing purpose, project actions, and honest empty project state.
Case-study map
The public page summarizes; the docs carry the deeper evidence.
The Phase 8 case studies remain the source-of-truth evidence library. This public page keeps the recruiter and senior-engineer path concise while naming the local repo docs that back each product story.
Control plane
Case-study focus: workspace orchestration, provider-state aggregation, readiness decisions, and operator action paths.
Evidence doc: docs/ecosystem/case-studies/xflow.md
Validation governance
Case-study focus: validation authority, usage admission, entitlement enforcement, release policy, and billing boundaries.
Evidence doc: docs/ecosystem/case-studies/verixet.md
Trust/risk layer
Case-study focus: ownership proof, reputation signals, trust scoring, policy evidence, and remediation ordering.
Evidence doc: docs/ecosystem/case-studies/rataify.md
Audit/evidence intelligence
Case-study focus: launch audits, route inspection, accessibility findings, evidence freshness, and monitoring delivery.
Evidence doc: docs/ecosystem/case-studies/audaix.md
Creative production studio
Case-study focus: creative job orchestration, asset lifecycle, review gates, export readiness, and production handoffs.
Evidence doc: docs/ecosystem/case-studies/crevux.md
Writing/research workspace
Case-study focus: grounded writing workflows, source handling, draft planning, revision controls, and publishing support.
Evidence doc: docs/ecosystem/case-studies/wordgeni.md
Links to all six apps
Review public surfaces without local-only proof routes.
Destinations use configured public app URLs or XFlow showcase paths. Screenshot proof routes remain local-only and are not linked from this page.
Control plane
Open the central workspace hub to review app status, routing, readiness evidence, and operator workflows.
Open public appValidation governance
Inspect the validation governance surface for policy posture, usage admission, entitlement proof, release boundaries, and billing handoff where configured.
Open public appTrust/risk layer
Review the trust layer for verification status, policy signals, reputation evidence, and public legitimacy checks.
Open public appAudit/evidence intelligence
Check the audit product for launch-readiness reports, route evidence, accessibility checks, and monitoring output.
Open public appCreative production studio
Inspect the creative app for generation jobs, asset readiness, export flow, and media production review loops.
Open public appWriting/research workspace
Review the writing app for document workflows, source coverage, draft planning, and publish-ready content tools.
Open public appCan evaluate quickly
Questions this page is designed to answer quickly.
A hiring manager should not have to infer the technical depth from generic marketing language. This checklist turns the project into direct evaluation signals.
Can this person reason across frontend, backend, auth, billing, data, deployment, and product UX?
Is this more than a landing page?
Are authority boundaries defined?
Are there real public app surfaces?
Are there testing/proof workflows?
Are AI features integrated into product surfaces?
Are security and trust models considered?
Is there evidence of multi-app systems thinking?
Known next improvements
The next work is evidence depth, not inflated claims.
These are practical gaps to keep improving the reviewer path and authenticated product proof without weakening the no-fake-claims discipline.
Add a public docs URL only after the central ecosystem docs are verified live.
Add authenticated runtime QA for configured safe workspaces.
Expand live cross-app demo coverage without fake metrics or private data.
Keep screenshots refreshed immediately after dashboard changes.
Continue shared package extraction only after the six-app boundaries stay stable.