How they fit together

Every LLM call goes through the gateway. Every person signs in through the identity provider. The products on top stay simple — and never hold a provider's key. Run together, they share one of each common component: one edge, one database server, one vector store, one set of dashboards.

pacod-gw · AI gateway

• pacod-id: With PGW_AUTH=oidc, people sign in to the console through pacod-id; the gateway registers its organisations and workspaces there and follows its feed of roles.
• pacod-ap: Every agent's LLM call goes through the gateway, which owns models, prices, keys and usage.
• pacod-cms: AI translation in the studio calls the gateway, so the CMS never holds a provider key.
• pacod-kb: The knowledge base's optional LLM clean-up pass, and its content scan's optional second opinion, are routed, priced and attributed by the gateway.
• pacod-demo: Runs the gateway beside the other products, with the response cache switched on and its mock provider when no provider key is set.
• pacod-benchmark: Measures what the gateway adds, with the gateway's own load agents and against a baseline straight to the mock, and publishes its reports into the console under Platform → Testing → Benchmarks.

pacod-cms · Content management

• pacod-id: The studio signs people in through pacod-id, which also holds their roles per organisation and per website.
• pacod-gw: AI features go through the gateway — the studio never holds a provider's key.
• pacod-demo: Runs the CMS with the other projects behind one Caddy, pacod-id and gateway — the live studio and three demo websites.

pacod-ap · Agent-building platform

• pacod-gw: Every LLM call goes through the gateway, attributed to the person, turn, agent and purpose; models, prices, provider keys, token limits, usage and cost are the gateway's.
• pacod-id: Accounts, passwords, sessions and roles live in pacod-id; people sign in through it, and the app and the gateway console share one account.
• pacod-kb: pacod-ap brings pacod-embeddings, the shared bge-m3 embedding and reranking service; run next to it, pacod-kb can embed and rerank through it instead of loading the model itself.

pacod-id · Identity and access

• pacod-gw: With PGW_AUTH=oidc the console signs people in through pacod-id; the core pushes the gw roles, registers organisations and workspaces, and follows the feed.
• pacod-ap: The app and its admin console sign in through pacod-id; the API pushes the pacod roles and follows the feed, so the app and the gateway console share one account.
• pacod-cms: The studio signs people in through pacod-id, which holds their roles per organisation and per website.
• pacod-kb: The UI signs people in through pacod-id; its viewer, editor and admin roles are granted there.
• pacod-benchmark: The UI signs people in through pacod-id, and the API checks every caller against its viewer, operator and admin roles, which it pushes at every start.

pacod-kb · RAG knowledge base

• pacod-id: People sign in through pacod-id; the viewer, editor and admin roles are granted there, and kb's members page uses its admin API.
• pacod-gw: The optional LLM clean-up pass and the scan's optional second opinion go through the gateway, which holds the provider keys, prices every call and attributes it.
• pacod-ap: Run alongside pacod-ap, kb can embed and rerank through its shared embeddings service, with the same BGE-M3 vectors.
• pacod-demo: Runs kb with the other products, on the shared Qdrant, PostgreSQL and embeddings service, behind the shared edge.

pacod-benchmark · Gateway benchmarks

• pacod-gw: The gateway it measures. It drives pacod-gw's load agents and mock, sets each run's scene up through the management API, and publishes its reports under Platform → Testing → Benchmarks.
• pacod-id: People sign in to the UI through pacod-id, and the API checks every caller against the roles of authz/bench.yaml, which it pushes to pacod-id at every start.
• pacod-demo: Runs at bench.demo.pacod.io next to the other products, managing the demo gateway with a token the bootstrap mints, on the gateway's own load agent and mock.

pacod-demo · The whole stack

• pacod-id: The one identity provider of the stack, with one realm that every product signs in with; the bootstrap gives the admin every product's role.
• pacod-gw: The one gateway of the stack, started with its response cache on; the bootstrap gives each product its own gateway key.
• pacod-ap: Runs the starter agent, a small fictional help desk, with its website, chat and admin console.
• pacod-cms: Runs the studio, with its AI writing help, and three demo websites, Demo Journal, Demo Notes and Starward.
• pacod-kb: Runs the knowledge base on the shared Qdrant, PostgreSQL and embeddings service.
• pacod-benchmark: Benchmarks the stack's own gateway on the gateway's load agent and mock; its reports show in the gateway console.

Built on a few firm ideas