Sprint planningCustomer-awareGoverned by default

Plan the sprintthe customeractually bought.

Nihub joins customer operations and delivery operations in one multi-tenant system. Leads, opportunities, commitments, portfolio, sprints, release evidence and the status your client reads all sit on one chain, and every link is inspectable.

Governed sprint intelligence ships disabled. No external model provider is enabled and no outbound data path exists.

System index

01What it isTwo halves
02The gateGoverned
03The traceOperable
04TenancyEnforced
05ReachAccessible
06Get inTwo doors

Intelligence, default state

Disabled

Turn it on and you get deterministic, evidence-linked recommendations that still cannot apply themselves. A human who is not the proposer has to approve, and the application stays reversible.

No external provider. No outbound data path. Immutable receipts on every decision, including the refusals.

Isolation

Row-level security in the database

Tenant separation is enforced by PostgreSQL, not by remembering to add a clause to a query.

Authorization

Deny by default

Role and relationship checks refuse anything they have not been explicitly told to allow.

Evidence

Append-only audit

Consequential actions leave a record with actor, target, result and correlation, and it is not edited afterwards.

Commands

Exact idempotent replay

A replayed command returns its first result instead of doing the work twice.

Constraint

Capacity is not a suggestion

Planning is workload-aware, so a sprint cannot quietly exceed the people who have to deliver it.

Presentation

WCAG 2.2 AA is the target

Four themes, full keyboard operation, and a locale, time-zone and number policy the tenant sets.

01 · What it is

Two halves of the same job, in one system.

Most teams run the customer half and the delivery half as separate tools and reconcile them by hand. Nihub keeps both in one tenant so the reconciliation is not a job anybody has to do.

The customer half

Commercial truth lives beside delivery instead of in a tool the delivery team cannot read.

Leads and atomic conversion. A lead becomes an Account, a Contact and an Opportunity in one transaction, or it becomes nothing.
Proposals and contracts. Revisions are immutable, acceptance is a snapshot, and contracts derive from what was actually accepted.
Client-safe publication. Editions are immutable, the assigned client reads them in a portal, and the acknowledgement is idempotent.

The delivery half

Planning that knows what the work protects, and refuses to pretend about capacity.

Portfolio and programs. Governed dependencies, versioned scenario overlays, and comparison that does not activate anything.
Capacity-aware sprints. An atomic sprint start, workload-aware limits, and a baseline that freezes the workflow version it was planned under.
Risk with an owner. Signals carry their evidence, decisions carry a rationale, and interventions carry a name and a date.

02 · The gate

A recommendation is not a decision.

Most delivery tools are adding a model that changes your plan and tells you afterwards. Nihub puts a boundary in front of that and makes the boundary the product.

Proposed

Deterministic, and it shows its work.

A bounded recommendation is derived from the sprint. Same input, same output, with a link to every piece of evidence it used.

Held

Nothing applies itself.

The change waits at an approval boundary. A stale recommendation is denied rather than quietly reapplied to a plan that moved.

Applied

A second human, or it does not happen.

Someone other than the proposer approves. The application is reversible and the receipt survives the reversal.

This ships disabled. There is no external intelligence provider and no outbound data path, and the executor and retention roles are isolated from each other.

03 · The trace

From the lead that caused it to the status the client reads.

Operate it. Pick a commitment, advance the chain, and watch what happens when a governed recommendation meets the approval boundary. Keyboard works throughout.

Trace consoleDrawn in this page

Commitment

Console

Trace

Stage detail

Commitment · CMT-0342

The Opportunity becomes a delivery commitment with a date and an owner that the delivery side can actually read.

Due: Close of sprint 24
Authorization: Account ancestry, deny by default

Receipts

No decision has been taken in this console yet.

The console opens with the first three links already traced. Advance it, or pick any stage to read its evidence.

Drawn in this page from fixed demonstration data. The three accounts are invented for this console. Nothing here reads a tenant, calls a network or resembles a screenshot of the product. It exists so the two rules underneath the trace are operable rather than described.

04 · Tenancy

Isolation you can point at.

Multi-tenancy is treated as a product feature with tests behind it, not as a deployment detail somebody will harden later.

Enforced, not remembered

Forced PostgreSQL row-level security. Separation holds at the storage layer, so a missed filter in application code is not a data breach.
Identity-derived tenancy. The organization comes from the session, never from a browser field or a URL alone, and the gateway overwrites untrusted tenant headers.
Owning-service resolution. The service that owns a resource decides whether you may reach it.

Provable after the fact

Append-only audit. Actor, target, result and correlation, with sensitive values redacted and retention controlled.
Exact idempotent replay. Replay is evaluated before current state, so a retried command cannot double a consequential action.
Scoped machine identities. Service accounts get expiring credentials, targeted containment, and no path to consequential commercial transitions.

05 · Reach

Legible before it is impressive.

WCAG 2.2 AA is the target for supported workflows. Presentation is a tenant policy with personal overrides, so the way dates, numbers, language and colour appear never changes what anyone is allowed to do.

SystemFollows the device

LightPlatform default

DarkSame tokens, inverted

High contrastForced colours respected

Presentation is a policy

Locale, time zone, date and number format. Set once for the tenant, overridable per person, projected with an exact precedence.
Right to left. Direction is derived from the locale rather than configured separately, so it cannot drift out of agreement.

Motion has a floor

Reduced motion is a first-class state. Every animated surface renders its complete settled state, not a blank one.
Keyboard throughout. Planning, board, list and retrospective workflows are operable without a pointer.

Get in

Open it, or read how it refuses.

Nihub is built to be audited before it is admired. Start with the workspace or start with the boundary. Both doors are on this page.

Plan the sprintthe customeractually bought.

Governed sprint intelligence ships disabled. No external model provider is enabled and no outbound data path exists.

Two halves of the same job, in one system.

The customer half

The delivery half

A recommendation is not a decision.

Deterministic, and it shows its work.

Nothing applies itself.

A second human, or it does not happen.

From the lead that caused it to the status the client reads.

Commitment

Console

Trace

Stage detail

Commitment · CMT-0342

Receipts

Isolation you can point at.

Enforced, not remembered

Provable after the fact

Legible before it is impressive.

Presentation is a policy

Motion has a floor

Open it, or read how it refuses.

Opening the delivery room…

Two halves of the same job, in one system.

The customer half

The delivery half

A recommendation is not a decision.

Deterministic, and it shows its work.

Nothing applies itself.

A second human, or it does not happen.

From the lead that caused it to the status the client reads.

Commitment

Console

Trace

Stage detail

Commitment · CMT-0342

Receipts

Isolation you can point at.

Enforced, not remembered

Provable after the fact

Legible before it is impressive.

Presentation is a policy

Motion has a floor

Open it, or read how it refuses.