LumiBase

1. Project Story

Inspiration

Traditional CMSs were built for humans clicking through forms — create item, edit field, publish. That model breaks when small businesses need bilingual catalogs, SEO hygiene, tagging, and cleanup at scale, but cannot hire an editor, translator, and SEO specialist for every site.

We started LumiBase as an edge-native, multi-tenant headless CMS inspired by Directus’s database-first DX. Midway through, we asked a harder question: if AI agents are about to do most operational content work, why build another UI optimized for humans to click? That pivot — from CMS to Content Operating System — is the origin of LumiBase: humans set intent, taste, and accountability; governed agents do the operational labor.

What it does

LumiBase is a Content Operating System — a runtime where AI agents operate content while humans declare desired state and hold the veto.

You declare content SLOs (e.g. “every published product has ≥1 image, a 50–200 word description, and Vietnamese + English translations”). A reconciliation loop detects drift, raises goals, and converges content toward those SLOs within a write budget.

Core capabilities:

• Agent Harness — goals → plans → tool calls → artifacts → evaluation → publish, with audit trails
  
• Earned autonomy (L0–L4) — Shadow → Propose → Co-sign → Veto-window → Autopilot, per (site, agent, capability)
  
• Tenant Constitution — versioned publish-gate evaluators (rule DSL + LLM-judge); failing artifacts never publish
  
• Provenance-first revisions — every revision records agent/run/model, sources, constitution hash, and approver
  
• Studio Mission Control — exception inbox, trust ledger, kill switch — not just an editing surface
  
• Edge-first delivery — Cloudflare Workers + true multi-tenancy (site_id isolation), page-hydration API, Flows, search, extensions, MCP

How we built it

LumiBase is a Turborepo + pnpm monorepo:

Architecturally we treat the same business logic as portable: never import CF bindings in services — always go through c.get('runtime'). Dangerous AI skills (schema:write, delete*) require HITL. Domain IDs use nanoid(); audit IDs use uuidv7().

Challenges we ran into

1. Governance at scale — Binary HITL (approve everything dangerous) does not scale; approval fatigue kills safety. We designed a trust ladder and veto-window (silence-means-consent with absolute rollback).
   
2. CF ↔ Docker parity — One codebase for edge and self-host meant a strict runtime abstraction (cache, storage, queue, search).
   
3. Multi-tenant safety — Every domain table and query must be scoped by site_id; agents must never widen capability via prompt injection.
   
4. Product inversion — Refactoring from “human UI first” to “agent API first” (POST /agent/goals as the primary operating surface) forced Mission Control UX instead of another form builder.

Accomplishments that we're proud of

• Shipping the v0.5.0 Content OS foundation: reconciliation loop, trust ledger, constitution publish-gate, multi-agent newsroom patterns, provenance-first revisions
  
• A production-minded stack at v0.23.0: Git integration, Change Feed / CDC, MCP surface, compliance suite, Flows, marketplace extensions — under Apache 2.0
  
• Agent-native engineering: CLAUDE.md, AGENTS.md, .cursorrules, and machine-readable setup so coding agents follow the same non-negotiable rules as humans
  
• Dual deploy (Cloudflare Workers + Docker) without forking business logic

What we learned

The hard problem is not generation quality — it is accountability. Autonomy must be earned per capability, every publish must pass a tenant constitution, and every byte of content needs a lineage. When silence means consent (veto-window), rollback and kill switches are not optional — they are the product.

We also learned that “AI features bolted onto a CMS” and “a CMS designed as an agent control plane” look similar in demos, but only the second survives real multi-tenant ops.

What's next for LumiBase

• Grow the agent marketplace on the MCP / skill registry surface
  
• More role agents (Writer, Translator, Taxonomist, SEO) with tighter evaluation loops
  
• Managed hosting for SMBs and agencies (Hobby / Enterprise tiers)
  
• Deeper GitOps / preview environments and continuous reconciliation toward content SLOs
  
• Path to v1.0 against the project’s release criteria (security audit, scope freeze, upgrade-path tests)

Built With

• anthropic
• cloudflareworkers
• docker
• drizzleorm
• graphql
• hono
• htmlcss
• javascript
• logto
• mcp
• meilisearch
• nextjs
• node.js
• openai
• pnpm
• postgresql
• react
• redis
• tailwindcss
• turborepo
• typescript
• vite
• zod