In-situ editing
The philosophy of "edit where you are." Implementation lives in [no-inline-editing](./no-inline-editing).
Single-tenant per shop
Every shop gets its own Worker, its own D1, its own R2. No tenant_id columns anywhere. The strongest data isolation the architecture can offer.
Data ownership
The shop owns its data. Kvick operates the software. Export is one click. Deletion is honored.
Audit everything
Every mutation writes an audit row. The chain is tamper-evident. Forensic reconstruction is always possible.
Privacy & PII
What counts as PII, where it lives, how it leaves the system, what gets redacted.
Observability
Every request emits a structured log line. Every error has a request_id. Every cron run reports counts.
Progressive enhancement
The base experience works without JavaScript. JavaScript adds polish, not function. Pages render fast and degrade gracefully.
Fail quietly, recover loudly
When something breaks during a sale, the sale completes. The error gets logged. The operator gets a polite notification. Nobody panics.
Boring tech
Choose the boringest tool that solves the problem. Save the novelty budget for the parts that actually need it.
AI-assisted development
How Claude Code and Claude API are used in building the Hub — and what we don't outsource to the model.
Focus stewardship
Every active module has one steward input that owns focus. Modals, print dialogs, blur-to-nothing, keyboard-idle, and stray scanner bursts all route back to it — automatically, quietly, by construction.
Work-area headers (icon doctrine — rolled back)
The icon-driven dual-action doctrine (Till / Bucket / Slot) was rolled back in v0.6.11. Replaced by a unified work-area header with explicit +Customer + Clear × controls. This page records both — the attempt and the replacement.
No Walk-In on Service
Why a service ticket cannot be attached to a walk-in customer, and the five-layer defense that makes the invariant structurally impossible to violate.
No-inline-editing — Till is read-only; each section earns a pill
The canonical edit pattern. Till is the aggregate read-only display; each section's header carries one Edit pill that opens a single-purpose popup for that section's fields. No contenteditable, no dashed-underline, no inline cells.
No AI in customer-facing prose
AI is woven through the Hub's operator tooling, but in any prose a customer, vendor, or partner can read, AI is not mentioned. "Our team" replaces any reference to AI. Internal engineering docs may name it plainly.
Public Surface Standards
Quality bar for the public-facing surface of every BWS. Two tiers — Baseline (default) and Strict Commercial-Plus (additive). CI-gated, universal across verticals.