Skip to content
A software architect steps back from a hand-drawn system blueprint on a whiteboard wall

Autonomous software portfolio OS

Strategy in. Verified software out.

Foundariq turns product strategy into governed Blueprints, reusable capabilities, autonomous engineering work, tested code and controlled releases across your entire software portfolio.

  • Connect GitHub — your code stays in your own repositories
  • Reuse what you have already built before anything new is created
  • Every automated change passes policy before it applies
A product manager sketches a product idea in a notebook at a café window
Demo data

Strategy

Build an AI-first web analytics platform. Reuse our existing identity, organisation, billing and event infrastructure. Connect customer data and actual revenue.

Foundariq analysisStrategy understood
Existing capabilities
14
Capabilities extended
3
New capabilities
4
Blueprint
Generated
Composition
Validated
Policy checks
Passed
Human decisions
1

Architecture reuse

76%

A demonstration analysis. The strategy asks for an AI-first web analytics platform reusing existing identity, organisation, billing and event infrastructure. Foundariq reports 14 existing capabilities, 3 capabilities extended, 4 new capabilities, a generated Blueprint, validated composition, passed policy checks, one human decision, and 76 per cent architecture reuse.

The premise

Software should be designed before AI starts writing code.

Coding agents are capable, but a prompt and repository access is not software architecture. Foundariq converts business intent into a structured Blueprint first — and only then does generation begin.

Coding agents start with code. Foundariq starts with business truth.

The six layers

  1. 01

    Strategy

    What the portfolio should do next, in business language.

  2. 02

    Blueprint

    That intent, made structured: entities, workflows, actions, policies.

  3. 03

    Capability composition

    What already exists, what extends, what has to be created.

  4. 04

    Policy + validation

    Deterministic checks and rules, before any model is asked an opinion.

  5. 05

    Build + AI engineering

    Plan, implement, open pull requests against your repositories.

  6. 06

    Verification + release

    Independent review, tests, certification, provenance, release.

In the Blueprint

  • Customers
  • Invoices
  • Workflows
  • Approvals
  • Permissions
  • Products
  • Events

Decided by the generator

  • Frontend framework
  • Backend framework
  • Database
  • Cloud
  • API style
  • Deployment

The Blueprint holds only the left column. Nothing in it names a framework, a database or a cloud — which is why the same Blueprint can target a web application, a mobile application, an API or an internal tool without being rewritten.

Blueprints

Business truth should survive technology changes.

A Blueprint describes what the software means: customers, invoices, workflows, approvals, permissions, products, events. Generators decide how it is implemented. That separation is what makes a portfolio portable and what makes it something AI can reason about reliably.

Two engineers review a printed architecture diagram together at a workshop table

Reuse first

Before Foundariq builds something, it asks whether you already have it.

Most new products are mostly old products. The strategy is checked against the capability library before a single new thing is designed, and the answer is usually that most of it exists.

Demo data

This strategy requires

Already available · 6

  • Authentication
  • Organisation management
  • Subscription billing
  • CRM contacts
  • Email delivery
  • Analytics dashboards

To be created · 2

  • Survey management
  • Survey responses

Build two capabilities instead of eight.

Capability Graph

Your portfolio becomes a library of what your company knows how to build.

Every capability carries a key, a version, an owner, a status, its dependencies and the products consuming it. Changing one is a decision with a visible blast radius.

Capability graph

Identity

  • Login
  • Sessions
  • Multi-factor
  • Password reset

CRM

  • Companies
  • Contacts
  • Pipeline
  • Activities

Billing

  • Invoices
  • Payments
  • Subscriptions

Workflow

  • Approvals
  • State machines
  • Task assignment

Four capability domains: Identity containing Login, Sessions, Multi-factor, Password reset; CRM containing Companies, Contacts, Pipeline, Activities; Billing containing Invoices, Payments, Subscriptions; Workflow containing Approvals, State machines, Task assignment.

Demo data

Capability

CRM contact management

crm.contact_management@v1

Contacts with profiles, relationships and engagement history, including the permissions that decide who sees which record.

Status
Published
Owner
CRM domain
Dependencies
2
Last change
12 days ago

Used by 4 products

  • The CRM product
  • The analytics product
  • The content product
  • The survey product
Demo data

Composition

“A customer survey platform connected to CRM contacts and analytics.”

Existing
12
Requires extension
2
New
3

Reuse

  • Identity
  • Users
  • Teams
  • CRM contacts
  • Email delivery
  • Analytics
  • Audit

Extend

  • Consent
  • Event tracking

Create

  • Survey management
  • Response collection
  • Survey analysis

Composition

Reuse before generating.

A new requirement goes through capability search first. Where the portfolio can satisfy it, it is reused. Where it cannot, something new is designed — and only then.

Control

AI proposes. Policy decides.

An agent can propose a product change, a Blueprint operation, a new capability, architecture, code or a migration. None of it applies because the proposal was convincing. It applies because a rule evaluated it and said yes.

How a change gets applied

  1. Agent

    AI proposal

    An agent proposes a change in structured form.

  2. System

    Typed operation

    The proposal becomes a named operation, not a free rewrite.

  3. System

    Schema validation

    Structurally invalid changes stop here, before any model is asked.

  4. System

    Policy validation

    Actual rules are evaluated. No model is asked whether this is allowed.

  5. System

    Risk classification

    The change is graded, and the grade decides what happens next.

  6. Human

    Approval

    Automatic for low risk, a named human for high risk, refused where a rule forbids it.

  7. System

    Apply

    Only now does anything change, and the before state is kept.

AI never receives permission simply because its answer sounds convincing.

Typed operations

Not this

“Rewrite the user model.”

This

Operation
Add field
Entity
User
Field
timezone
Type
Timezone
Classification
Internal

A named operation on a named field is something validation can evaluate. A paragraph of instructions is not.

Typed operations

No uncontrolled AI edits.

A change becomes a named operation on a named field with a type and a classification, not a paragraph of instructions applied to your product definition. Validation can evaluate the first. It cannot evaluate the second.

Separation of duties

The builder is not the reviewer.

An architect proposes and an independent critic reviews. A coding agent opens a pull request and a different reviewer reads it. Foundariq separates creation from approval deliberately, and the model routing enforces it.

Blueprint change

  1. Architect agent
  2. Blueprint proposal
  3. Critic agent
  4. Policy engine
  5. Approval

Code change

  1. Coding agent
  2. Pull request
  3. Independent reviewer
  4. Tests
  5. Merge

Targets

One Blueprint. Multiple technology targets.

Because a Blueprint holds no framework, database or cloud choice, the same one can produce a web application, a mobile application, an API or an internal tool. Adding a stack is an adapter, not a rewrite.

One Blueprint

Blueprint

Technology-neutral

  • Web application
  • Mobile application
  • API
  • Internal tool
  • A stack you add later

Target adapters translate one Blueprint into an implementation stack. Adding a stack does not mean rewriting what the software means.

The engineering organisation

Strategy

  • Portfolio Strategist
  • Product Planner

Architecture

  • Blueprint Architect
  • Reuse Architect
  • Critic

Engineering

  • Engineering Manager
  • Coding Agents

Validation

  • QA
  • Security
  • Code Reviewer

Release

  • Release Manager

Every one of these operates inside the governance system. An agent has a scope, not an API key to everything.

AI Workforce

Then Foundariq puts an engineering organisation on top.

Strategy, architecture, engineering, validation and release — each a role with a defined scope. The distinction that matters is not that agents can do a lot. It is that they operate inside a governance system that decides what they may do.

Your role

You decide what should exist. Foundariq handles how it gets built.

Strategy, product direction, the architecture decisions that matter and the approval policy stay with you. The coordination between them does not.

A small engineering team holds a brief morning stand-up in a bright loft office

You decide

  • Strategy
  • Product direction
  • Major architecture decisions
  • Approval policy
  • Commercial priorities

Foundariq handles

  • Blueprint creation
  • Reuse detection
  • Planning
  • Architecture
  • Coding
  • Testing
  • Review
  • Release preparation
Demo data

Capability decision

Three products implement document classification independently

Create a shared capability: document classification, version 1.

The three implementations agree on the important behaviour and differ in naming. Promotion replaces roughly 4,300 lines with one capability and two adapters, and two further products become candidates.

Products affected
3
Impact
Medium
Recommendation
Promote
ApproveKeep product-specificRequest alternative

Decisions

See decisions, not agent conversations.

A decision arrives with the reasoning, the products affected, the impact and the options. Reading a chat log between two models is not a management interface.

Governance

Autonomous does not mean uncontrolled.

Foundariq gives AI freedom to reason inside boundaries enforced by software. The control plane does not ask a model whether something is permitted; it evaluates the actual rule.

Demo data

Policy evaluation

Policies evaluated
1,428
Passed
1,423
Warnings
4
Blocked
1

Blocked

Removal of a published capability without a migration path

Published capabilities cannot be removed without deprecation and a migration path.

No model was consulted. The rule is evaluated, not interpreted.

Reproducible

Know exactly what produced each artifact.

A release ties to a Blueprint version, a generator, a capability pack, a policy profile and a build hash — so a build is something you can reproduce rather than something that happened once.

Demo data

What produced this artifact

Blueprint
v17
Capability pack
2026.09.18
Policy profile
enterprise-standard@4
Build hash
9a3f1c7e

The same inputs produce the same artifact. A build is something you can reproduce, not something that happened once.

Demo data

Provenance

Product
The analytics product
Blueprint
analytics@17
Generated by
[email protected]
AI contributions
Architect, Critic, QA
Policy
enterprise-standard@4
Git commit
3fa32ab
Artifact
analytics-build-17

GitHub

knows the code.

  • Repositories
  • Branches
  • Commits
  • Pull requests
  • Reviews
  • CI
  • Releases

Foundariq

knows why the code exists.

  • Strategy
  • Blueprints
  • Capabilities
  • Policy
  • Decisions
  • Provenance
  • Portfolio

GitHub

GitHub remains your engineering source of truth.

Repositories, branches, commits, pull requests, reviews, CI and releases stay exactly where they are. Foundariq adds the layer that has always been missing above them.

Audit

Every step is reconstructable.

Who proposed, what validated, what the critic said, what policy returned, who approved and what published — append-only, and readable months later when somebody asks why.

Demo data

Audit trail

  1. 16:31AgentBlueprint Architect — Proposed change set 342
  2. 16:32SystemSchema validator — Passed
  3. 16:32SystemPolicy engine — Passed
  4. 16:33AgentCritic — Requested one change
  5. 16:35AgentBlueprint Architect — Submitted a revision
  6. 16:36AgentCritic — Approved
  7. 16:37HumanA named human — Approval granted
  8. 16:38SystemSystem — Blueprint v18 published

Append-only. The sequence can be reconstructed, which is what makes an automated change defensible after the fact.

Strategy to release

  1. 01Strategy
  2. 02Product interpretation
  3. 03Capability discovery
  4. 04Blueprint composition
  5. 05Blueprint architecture
  6. 06Critic review
  7. 07Deterministic validation
  8. 08Policy checks
  9. 09Human approval where required
  10. 10Engineering plan
  11. 11AI implementation
  12. 12GitHub pull requests
  13. 13Independent code review
  14. 14QA
  15. 15Build certification
  16. 16Release

End to end

From one strategic instruction to verified software.

Sixteen steps, most of them automatic, and the two that are not are the ones you would want to keep.

Compounding

Every product should make the next product easier to build.

Product number ten should start with everything you learned building the first nine. That only happens if what you learned was written down somewhere a machine can read.

Each product makes the next one cheaper

  1. Product 1

    + Identity+ Billing+ Audit

  2. Product 2

    reuses 3+ CRM

  3. Product 3

    reuses 4+ Analytics

  4. Product 4

    reuses 5+ Consent

Demo data

Already built, more than once

  • Authenticationused in 7 products
  • Company managementused in 4 products
  • Invoice generationused in 3 products
  • Event trackingused in 3 products

74% of the infrastructure required for your next product already exists.

Day one

The first thing Foundariq does is read what you already built.

Connect GitHub and it maps repositories, products, entities, repeated architecture and the capabilities hiding in more than one codebase. Nothing is proposed until the portfolio is understood.

Questions

The ones people actually ask.

What is Foundariq?

Foundariq is an Autonomous Software Portfolio OS. You decide what should exist; Foundariq handles how it gets built. Strategy goes in and becomes a Blueprint: the structured record of what your software means, which capabilities already exist, which must be created, and which policies apply. Generation, validation, review and release all run against that Blueprint, and every release traces back to a version of it. Strategy in. Verified software out.

How is this different from a coding agent in my editor?

A coding agent starts with code — a file, a prompt, a diff. Foundariq starts with business truth: what the product must mean, which capability already does this, which policy applies, who has to approve. Code generation happens here too, as the fifth of six layers, and the pull request it opens still faces an independent reviewer and the policy engine. Keep the agent in your editor; Foundariq governs the portfolio it types into.

Does it replace GitHub?

No. Repositories, branches, commits, pull requests, reviews, CI and releases stay exactly where they are, in your GitHub, under your account. Foundariq adds the layer above them: the Blueprint, the capability inventory, the policy profile, the provenance behind each change.

What is a Blueprint?

A Blueprint is the structured description of what a product does: entities, workflows, capabilities used or created, policies, approvals, and the limits on what agents may change. It holds meaning, not implementation — no framework, no database, no cloud choice, because generators and target adapters decide those. That separation is what lets business truth survive a technology change. Blueprints are versioned, and a published version is never edited, only superseded.

Why does the Blueprint come before the code?

Without it, generation guesses. The Blueprint is what makes the reuse check possible: you cannot ask whether a capability already exists if nothing records what exists. It is also what policy attaches to, because risk class, data classification and approvers are properties of the meaning rather than of a diff. And it is what makes a release traceable, since the release points back to the Blueprint version that produced it.

What happens if I already have a large codebase?

Foundariq reads your repositories and drafts a first Blueprint and capability inventory from what is already there — entities, workflows, and the things you have quietly built twice. You correct that draft; it is a starting point, not a verdict. Nothing is rewritten and no migration is required to begin. Your first change runs the same path as every other one: change set, validation, generation, independent review, pull request.

Can the AI change my production systems?

No. Agents produce change sets and pull requests; they do not deploy. What an agent may touch is set by your policy profile and evaluated deterministically, before any model judgement runs. Your branch protection, your CI and your deployment pipeline still stand between a merged pull request and production, and Foundariq has no path around them.

What stops an agent doing something destructive?

Agents can only request typed operations — a finite, schema-defined set — so a change outside that set cannot even be expressed. Each operation carries a risk class: dropping a field, changing an authentication rule or touching classified data routes to a named human approver. Deterministic validation runs before any AI judgement, and the control plane evaluates actual policy instead of asking a model whether something is allowed. What stops it is the schema and the policy profile, both of which you can read.

Who approves changes?

Your policy profile names the approver for each risk class, and the engine routes changes accordingly. Low-risk work clears automated validation and an independent critic review, then arrives as a pull request you merge. Higher-risk work waits for the named human, and nothing proceeds while that approval is outstanding. Every approval is recorded: who, when, which Blueprint version, which change set.

Does the AI review its own work?

No, and that is enforced rather than encouraged. An architect agent proposes, an independent critic agent reviews with its own context, the policy engine evaluates the change against your rules, and a human approves where the profile requires it. On the code side, the agent that wrote the change opens a pull request and a different reviewer reads it.

Read the documentation

Stop managing prompts. Start managing software strategy.

Connect your repositories. Let Foundariq understand what you have already built. Then tell it what your portfolio should build next.

Read-only to start · Your code stays in your GitHub · [email protected]