The answer to “it doesn’t do that” is a branch.
Podium is MIT-licensed, so the copy you deploy is yours to change. What keeps that from being a one-way door is the machinery it was built with, and you get all of it in the clone.
Three things you inherit with the checkout.
Each one stops an agent, ours or yours, quietly inventing behaviour nobody asked for.
The rules were written down first
Entity names, every state a proposal can be in and which transitions are legal, who may read what, which fields are personal data. Prose with tables, not generated documentation, and it is what the code answers to.
An agent that goes outside it stops
The building agent ships in the repository. Its first move is to map the request onto the model, and it halts rather than inventing: a field the model lacks, a transition the diagram never drew, an event nobody catalogued. It asks for the model to change instead, which is a conversation you can have.
A machine checks the code back against the document
One command extracts every entity, field, enum, invariant, event and state machine from the specification and compares it with the code. Non-zero on a disagreement, and it runs on every push in the same job as the tests. Drift is a failed build.
Five commands say whether you broke it.
None of them needs a Cloudflare account. The first four also gate the deploy, so a change that fails one on your laptop would have failed ours.
| Command | What it holds you to |
|---|---|
npm test | 763 unit and integration tests, the integration half against real local D1, KV, R2, queues and durable objects |
npm run typecheck | the whole repository at once |
npm run drift | the model against the code; non-zero on a disagreement |
npm run security | every one of the 510 URLs in the app re-checked; a new one with no permission check fails |
node scripts/smoke.mjs | walks every screen as each persona against a local server |
A change you make is a merge you own.
This is the part that decides whether you regret the fork in eighteen months.
The unflattering half
- Nobody has upgraded a forked deployment in public. The migrations are append-only and the releases are ordinary git, and that is all anyone can honestly promise.
- There is no plugin API for domain behaviour. Changing how review quorum works means editing the code that does it, in a file you now maintain.
- The specification is the contract, so a change that contradicts it fails the drift check on your own machine. Change the document in the same commit, or the build says no — to you, exactly as it does to us.
What you do not have to fork for
- A provider nobody has written yet. Email, chat, storage, sync, first-pass review and workshop capacity are capability contracts; an adapter is a new file and a line in the registry.
- Anything the management API already does. It covers 193 endpoints, scheduling included, and it takes an idempotency key on every write.
- Your own fields. Custom fields on people, sessions and sponsors are configuration on a screen, not a schema change and not a migration.
The repository is also a Claude Code plugin.
Eight skills over the management API, and a CLI with no dependencies. Add the repository as a marketplace, then install it.
/plugin marketplace add sameersegal/Podium
/plugin install podium-ops@podiumOne skill per part of the job: the event and its call, the review pile, the schedule grid, speaker onboarding, sponsors, outreach campaigns, and exports with the health of your integrations. The eighth is the one an agent reads first, and it covers scopes, redaction, pagination, idempotency keys and what each typed error means.
The endpoint reference those skills ship is generated from the routes, all 193 of them. npm run plugin:check exits non-zero when a route has changed and the catalogue has not.
It points at an instance you are already running. You give it the URL and a key you minted, in a .env rather than an argument your shell history keeps.
What an agent still cannot do here.
The plugin above hands an agent the map to a running instance. It is not an assistant that runs your call for proposals.
There is no MCP server in this repository and no OpenAPI document. Anything driving a running instance is driving HTTP against 193 endpoints, with typed refusals that name the rule they broke.
No key submits a proposal and no key writes a review. Both calls refuse and say why: a first-person statement is made by the person, signed in as themselves. A key can still open a draft, and the submitter finishes it in their portal.
The first-pass review is a separate thing again: off unless you switch it on, its scores sit beside your reviewers' rather than inside them, and the evaluator in the box calls no external model.
What builds it, and what it runs on
- Cloudflare Workers
- TypeScript
- Vitest
- Claude Code
- GitHub