---
title: "Project manifesto"
description: "The durable product, platform, and engineering contract for StackShip."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.stackship.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Project manifesto

StackShip is a Terraform Cloud platform alternative for running Terraform
infrastructure. It gives teams and their agents one place to plan, review,
apply, and audit infrastructure changes.

## Product surfaces

| Surface | Production origin | Responsibility |
| --- | --- | --- |
| Dashboard | `https://stackship.run` | Human product experience |
| API | `https://api.stackship.run` | Product API and Better Auth |
| MCP | `https://mcp.stackship.run` | OAuth-protected agent tools |
| Docs | `https://docs.stackship.run` | Human- and agent-readable documentation |
| Analytics relay | `https://r.stackship.run` | First-party PostHog ingest |

## Platform commitments

- Cloudflare is the infrastructure platform.
- Cloudflare Workers run the Hono API, MCP server, Nimbus documentation, and
  the Next.js dashboard through OpenNext.
- PlanetScale PostgreSQL is the system-of-record database.
- Cloudflare Hyperdrive is the production database connection layer.
- Drizzle is the ORM and migration system.
- R2 stores Terraform plans, state artifacts, logs, and other objects.
- Workers Analytics Engine stores high-volume operational measurements.
- PostHog stores product analytics.
- All repositories are pnpm and Turborepo monorepos.

## Identity commitments

Better Auth is the identity and authorization foundation. StackShip supports:

- Google login
- Email and password
- Organizations and memberships through the organization plugin
- Enterprise OIDC and SAML SSO
- SCIM 2.0 user and membership provisioning
- An OAuth 2.1 authorization server for external clients
- OAuth 2.1-protected MCP access with PKCE and audience-bound JWTs

Authentication is served from `https://api.stackship.run/api/auth`. Google must
register `https://api.stackship.run/api/auth/callback/google` as a production
redirect URI.

## Documentation commitment

Documentation is part of the definition of done. A change is incomplete when it
changes product behavior, configuration, architecture, API shape, operations,
or a user workflow without updating the relevant Nimbus page.

Nimbus is deployed independently at `docs.stackship.run`. Its Markdown
alternates, `llms.txt`, `llms-full.txt`, sitemap, and canonical links are public
interfaces and must remain healthy.

## Interface commitment

Dashboard primitives come from shadcn/ui. Components use semantic StackShip
tokens rather than one-off colors. The visual language is white and red:
high-contrast white cards, cool neutral canvas and borders, deep ink type, and a
restrained red brand accent.

The dashboard behaves as an infrastructure control plane: organization and
environment hierarchy stay visible, run lifecycles are explicit from plan
through apply, and workspace health, drift, policy, cost, and audit signals are
first-class information. Documentation uses the same language in a denser
developer-portal layout.

See the [design system](/design-system) for the complete token contract.

## Analytics commitment

Product analytics uses PostHog through `https://r.stackship.run`. The current
client-safe project key is
`phc_C5vaHXvK3UcAmCcqPfboEMZpivVR4SGjZpBxmj8MoZQc`.

This `phc_` value is a public ingestion identifier, not a privileged PostHog
personal API key. Privileged PostHog keys must never be shipped to clients or
committed.

Source: https://docs.stackship.run/project-manifesto/index.mdx