Infinity

Infinity is a personal AI workspace: a tiled canvas of chat, notes, tasks, markets, a code editor, a server-side browser, and a document vault, with an assistant that can act across all of them. The interesting part is not the tiles. It is that the whole thing is multi-tenant from the schema up, and that the CI pipeline tests the container that ships rather than the source tree.

The one rule

Every piece of state belongs to exactly one account. No global singletons. Any function that reads or writes state takes an explicit account. If you cannot name the owner of a row, the schema is wrong.

The previous build of this product had the string account_id appear zero times in its backend. Retrofitting ownership into a few thousand lines that never had it is the most reliable way to ship a permission leak, and a leak is the one bug that ends the product. So the rewrite kept the design system, the tile components, the SSRF-hardened server-side browser, the MCP bridge and the chain engine, and replaced only the spine: auth, storage, state ownership, and the entry point.

Ownership is enforced at retrieval, not as an application-layer check. Per-account row ownership is a schema invariant, and there is a dedicated tenancy test in CI that is written to fail: it asks for another account's document and passes only if retrieval returns nothing. Markers are strict, so an unexpected pass fails the suite. A companion test asserts the owner can still retrieve their own document, because without it the suite goes green the day search breaks and returns nothing at all.

What is in the box

• Streaming REST endpoints for chat. Streaming is verified from a terminal with curl -N, because a browser fetch that awaits the whole body cannot tell a stream from a lump.
• Retrieval-augmented generation over a per-account vector store, with the same ownership rule applied to chunks.
• A chain execution engine for multi-step workflows the assistant plans and runs.
• A sandboxed server-side browser, hardened against SSRF, so the assistant can fetch a real page without the client touching the network.
• Fail-closed deployment. With no access token configured the service answers only its health endpoint. Setup is gated by a second token so a stranger cannot claim a fresh instance. State lives on a mounted volume so a redeploy does not reset the master password.

Testing the artifact, not the source

CI runs pytest, the TypeScript typecheck, a browser smoke suite that opens every tile in a real browser, and an end-to-end functional suite. All of it runs against the built container image. That choice was earned: several defects existed only in the image, including a .dockerignore rule that excluded the frontend and another that nearly dropped the skills content. Neither reproduced from the source tree.

Results