A framework fastened together.
Pegma is an MIT-licensed family of backend components — storage, authorization, audit, webhooks, sessions, a support desk — that a host application composes. Independent packages, one set of shared contracts, and honest limits stated up front.
Pegma is in early 0.x development. Some packages are published, none are stable,
and every component says so. What is stable is the approach — and everything below is public,
plans included.
Optimize for a fresh agent context window. How much must be read to make a correct change, and how does the change prove itself correct? Minimize the first, mechanize the second. — the governing principle, applied to every component
Every architectural decision assumes the assembler is an AI agent: minimal context to make a correct change, machine-verifiable correctness (types, conformance suites) over prose, explicit wiring over magic, and boring idiomatic code over novelty. The name is Greek — πῆγμα, a structure fastened together.
The stack today
-
Spine published
The small, stable contracts every component shares.
-
Storage Core published
Persistence without the component knowing what the database is.
-
Authorization Core in development
Provider-neutral roles, entitlements, and permissions between identity, billing, and your API.
-
Audit published
Append-only audit records that commit atomically with the change they describe.
-
Support Desk in development
A composable support queue for web and email, authorized by permissions from day one.
-
Webhooks planned
Inbound webhook receipts: idempotent dedup, poison quarantine, retention.
-
Sessions planned
Server-side session records: hashed ids, dual expiry, revoke-everywhere.
-
Rate Limit planned
Two honest tiers: in-memory abuse dampening, durable limits for expensive operations.
Snapshot as of 2026-07-27 — the roadmap has the phase-by-phase
picture, and each repository's docs/PROJECT_PLAN.md is the source of truth.
How the pieces hold together
Spine defines the handful of contracts everything peers on — principal identity, time, logging, events. Storage Core owns persistence: components declare collections and never learn what the database is, and adapters prove themselves against a conformance suite run on the real backend. Above those, each component owns one job and publishes what it refuses to do as prominently as what it does — because the most expensive failures come from tools that overpromise.
The stack runs in production behind retiregolden.org (Azure), the reference application every component is extracted from. This site is the second environment: it deploys on Cloudflare, from a public repo.