Next.js + TypeScript
The pages, server routes and actions live together in one strongly typed app. That keeps the distance between a screen and the code behind it small and easy to review.
Engineering
How Seven Gates is built
Seven Gates is a hackathon proof of concept, but the important parts are built like a real product: clear boundaries, secure defaults, small modules and rules you can inspect.
Neon Postgres as the source of truth
Cases, progress, employer requests and chat history are stored in Neon Postgres. A refresh does not lose work, and the data model can use managed pooling as traffic grows.
Modular domain code
The gate specification, predicates, resolver, language layer and portal screens are separate modules. A rule change is a data change, and the pure resolver can be tested without a browser or database.
Security at the boundary
Case IDs come from an httpOnly, same-site cookie, never from a request body. Server routes validate input, cap message size, use parameterised SQL and keep API keys on the server.
Signed employer links
Employer links use an HMAC and timing-safe comparison. They carry no case ID, so forwarding a link does not expose a member’s private record.
A tight browser surface
The app sends only the data needed for the current action. Content security policy, frame protection, no-store API responses and a disabled camera policy reduce the places a mistake can hide.
Deterministic and explainable
The countdown is computed from a dependency graph and critical path, not invented by an AI model. Unit tests cover ordering and mismatch behaviour, so the result is repeatable.
A practical scaling path
This proof of concept runs with a small pool and in-memory limits. For real load we would use shared rate-limit storage, a managed Postgres pooler, queues for slow work, structured logs, metrics and horizontally scaled stateless web instances.
Built to be honest about what comes next
We have not pretended that a demo with six members is production scale. We have made the seams explicit so the next step is clear: shared infrastructure for shared limits, managed database connections, background jobs for slow integrations, and observability before adding more traffic.