Tomshley Labs · Open source
Every business runs on the same things around its core: the front doors customers and partners use, the orders, requests and data moving through, the rules that keep change safe, and the infrastructure underneath. We built them once, to a standard. They’re open source, and they run this site and our clients’ systems.
The paved road
Every business runs on the same four outer layers. Here’s how they usually get built, and what’s already here.
Edge · Surface
Usually built from scratch
A website from one agency, customer pages from another and partner connections from a contractor, each with its own look, login and copy of the data.
Already built
Pages built on the server from shared components, so everything you put in front of customers loads quickly and reads clearly on any device, and to the search and AI tools that read for your buyers.
Edge · Runtime
Usually built from scratch
Integrations written one at a time. Orders get doubled, uploads go missing and partner feeds fail quietly, and you hear about it from a customer.
Already built
Every request is signed, recorded before anything else happens and handled once. Large files are saved as they arrive and checked when they finish, and messages to your other systems go out in a registered format, only where you approved.
Rules · Build
Usually built from scratch
Business rules that live in a few people’s heads, releases saved for a quiet weekend, and a vendor change that means starting over.
Already built
Your core is kept apart from everything around it, so a channel, a vendor or a cloud can change without rewriting the business. Your rules are written as plain-language tests that gate every release, and a release that fails a check doesn’t go out.
Outside · Ship & run
Usually built from scratch
Servers in someone else’s account, settings nobody wrote down, and a scramble every time a security questionnaire or an audit arrives.
Already built
Infrastructure, networks, DNS, email and identity live as reviewed code in accounts you own, on Google Cloud or AWS, with the history to answer questionnaires and audits and to rebuild an environment when you need to.
What’s left to build: your core.
The part that makes your business different: your products, your rules, the way you serve customers. It’s the only part that should start from scratch. On this site the core is small: how we take in and answer inquiries.
How we build
From a website to a platform with many services and data pipelines, the work lands in the same set of repositories, in your accounts. It starts with the map.
Every engagement gets an architecture repository: your north star, the constraints everyone agreed to, the principles behind each choice, what must be possible and how it’s structured, with every decision on record.
Plain Markdown, versioned like code, and published where your team, your auditors and your AI tools can read it.
From a contact form to a data platform, the rules don’t change: recorded first, handled once, and nothing dropped without a word.
How this site is built
Tested in plain language, honest when something fails, and released only when every check passes, here and in client systems that answer to auditors. Three things you can check for yourself.
Rules · Acceptance gate
Written before the code, in words anyone can check, including what happens when something goes wrong. They run in real browsers on desktop and mobile, and nothing deploys until they pass.
Feature: Contact requests
Every request is answered once, and every failure is told plainly.
Scenario: A visitor sends a request
Given the contact page is open
When they send their name, company, email, phone and need
Then they read "Tomshley has your request and will be in touch."
And exactly one request is recorded
Scenario: The send fails, and the visitor is told plainly
Given the contact service is unreachable
When they send the contact form
Then they read that their request could not be confirmed
And everything they typed is still in the form
And no request is recorded or sentEdge · Runtime
Most forms have two outcomes: sent, or an error nobody wrote. Ours answers every case plainly, including the ones where it can’t be sure, and never records a request twice.
Try the contact formOutside · Ship & run
If any check fails, nothing publishes. Every release leaves a record of what changed and when.
Yours to keep
The usual worry with anything custom is being stuck with it. Here’s why you won’t be.
Pekko, Kafka, PostgreSQL, Kubernetes, Terraform and OpenTofu, on Google Cloud or AWS, through GitLab or Bitbucket. Any experienced team can run it.
Each Tomshley layer is a library or a template. Lift one out and replace it, and your core doesn’t change.
Your copy lives in your repositories and your cloud accounts, in your name.
Everything around your core is open source under the Apache 2.0 license, with no license fee. Use it, change it and run it in your own accounts.
Contributing
Each repository says what it’s for and what’s out of scope. Bug fixes, security, accessibility and documentation improvements are especially welcome.
Your core is the only part that should start from scratch. Tell us what it is, and we’ll tell you plainly whether we’re the right people to help.
Tell us where you’re stuck or write to [email protected]