SOMA-DevKit — the shared foundation
Every SOMA suite is built on a common foundation: SOMA-DevKit, a git submodule consumed by every suite workspace. It provides five libraries:
soma-infra
14 feature-gated modules, all optional. A service that only needs Postgres and crypto links zero LLM, push, or storage code. Every dependency in soma-infra is [optional] — there is no mandatory runtime footprint.
| Module | What it provides |
|---|---|
db | Postgres pool from environment (connect_from_env) |
crypto | AES-256-GCM, Argon2id, HKDF-SHA256, HMAC-SHA256, AES-KW, SHA-256 |
cache | Redis client with typed helpers |
storage-s3 / azure / fs | Object storage abstraction |
llm | Anthropic API client |
email | Postmark v1 transactional email (send_otp) |
kg | Knowledge graph on pgvector |
otlp | OTLP trace + metric emission |
iam-client | Server-side IAM token verification |
signal | Graceful shutdown future (shutdown_signal) |
config | Type-safe env-var helpers |
http | Preconfigured reqwest::Client with rustls + timeouts |
100% rustls, no OpenSSL. The TLS stack is consistent across every SOMA service.
soma-schema
Manifest-ordered Postgres migration runner, published on crates.io as v0.4.0.
- Execution order controlled by
migration-order.yaml— the manifest is the source of truth, not the filesystem sort order. - SHA-256 checksum on both UP and DOWN sections. Drift in a DOWN migration is detected before any rollback.
- Postgres advisory lock: safe for concurrent restarts across multiple replicas.
- Works as a library (embedded in server binaries, runs migrations at startup) or as a standalone CLI.
soma-ui
A growing catalog of typed Leptos components. Written in Rust, typed end-to-end, no JavaScript framework. Includes a SecurityGraph chart, self-hosted Outfit and Rajdhani fonts (no Google Fonts requests at runtime), and warm mahogany / near-black dual theme.
CSR-only today. Adding SSR support for use in the website is an optional future workstream — see the decisions doc.
soma-audit
Three-crate audit trail:
- core — zero-IO: HMAC-SHA256 chain, HKDF key derivation, Ed25519 seal/verify.
#![forbid(unsafe_code)]. - pg — Postgres sink with 6 migrations.
- client — outbox pattern with 2 migrations.
soma-sdks
- soma-crypto — Argon2id, ES256 JWT, AES-256-GCM primitives.
- soma-iam-sdk — JWKS verifier for validating IAM tokens server-side.
- soma-flags-core — IO-free, WASM-safe flag evaluation. Sub-millisecond local evaluation with no network round-trips.
- soma-sdk — Server-side and local evaluation wrapper.
License
All of it ships under the Apache License 2.0: every suite binary, every DevKit library (soma-infra, soma-schema, soma-ui, soma-audit, the SDKs), and this website. You can use, modify, and distribute under those terms — including commercially, without royalties, without asking.
There is no open-core split. No features are reserved for a paid tier. There is no plan to relicense. The Apache 2.0 commitment covers the codebase as it exists today and as it grows.
Repositories
The SOMA repos are on GitHub under the soma-platform organization. Repos go public per the roadmap — the platform is pre-1.0 and some suites are still in active early development. The roadmap page has the current state of every component.
Release order
SOMA-DevKit goes public first — it is the foundation everything else builds on (soma-schema is already on crates.io). SOMA-Control follows. The remaining suites open as they mature.
To follow along: watch this site's changelog, or check the GitHub organization directly for new public repos as they are opened.