ONEKernel

Architecture that keeps the business model coherent and the worst failure modes impossible.

INFOC ONE runs as one engine with strict module boundaries and a single shared contract, so finance, people, sales, inventory, and planning evolve without fragmenting the system.

Pattern

Modular monolithShared contractIn-process

Layers

PresentationDomain layerONE EngineInfrastructure

System Layers

Four layers, one shared contract.

Presentation, the domain layer, the engine, and infrastructure stay modular without losing a unified business language.

Presentation

ONE Atelier (web) and ONE Compass (mobile), built on the ONE Prism design system.

Domain Layer

A single chokepoint where authorization, audit, identity, and data-residency routing live, shared by web, mobile, and AI.

ONE Engine + ONEKernel

One deployable engine with strict, per-domain module boundaries, bound by the ONEKernel contract.

Compliance as Data

GST, CPF, and InvoiceNow values held as effective-dated, verified data, dated to each document and never hard-coded.

Infrastructure

Physical per-tenant database isolation, reliable background processing, object storage, and encrypted secrets.

Key Decisions

The choices that make the platform correct by construction.

Each decision exists to make a specific failure mode structurally impossible, not merely discouraged.

Modular monolith

One deployable engine with strict module boundaries gives clean ownership without the operational cost of many network services.

Shared contract (ONEKernel)

A single cross-cutting contract gives every business domain one language, so modules evolve without fragmenting the system.

Physical tenant isolation

Each tenant is a physically separate database, backed by a second isolation layer, so one company can never reach another company's data.

One writer for the ledger

Exactly one engine writes general-ledger entries through an atomic posting sequence, so the ledger rules are proven once and enforced everywhere.

Events through an outbox

Background work flows through a transactional outbox, so an event fires only if its data committed. There is no separate broker to operate.

AI provenance in the data

Every consequential action records who or what initiated it and whether a human reviewed it, as structured data rather than a log line.