The single source of truth for what GoBuild words mean and how they are
written. If a term is defined here, this page wins. Each entry is a 1–2
sentence definition plus a link to the page where it is covered in depth.
This page defines the house style. A unit of work is a Job; the person you
build for is a Client. Never "Project", never "Customer". See
House style at the bottom.
Enforced across the product, the KB, and (where practical) the code:
sync_job_to_projectscope="customers").ai_bar and the CSS .kcc-* classesAdmin API — the hub's signed /_admin/* surface, the only door the
Control Plane uses to read or write a tenant's data. Every call is authed by a
short-lived (60s) RS256 JWT the CP signs and the hub verifies; no key ⇒ the whole
surface 403s (fail-closed). See Control Plane.
Atlas — the cross-org administration half of the Control Plane: list, inspect,
edit, suspend, and export every org across every hub, plus per-feature entitlement
overrides. The other half is the Fleet. See Control Plane.
BYO ("bring your own") — the credential class for walled-off providers (Stripe,
Twilio, BuildData): a pooled org must supply its own API key or the feature
simply does not send/charge — there is no shared or global fallback. Contrast
MANAGED. See credential wall-off.
Chatwoot — the self-hosted support/omnichannel inbox (at chat.gobuild.ca) that
backs the unified Messages inbox. A MANAGED integration: one shared account, data
scoped per-org. See Integrations catalog.
Client — the homeowner / property owner a Job is built for. House term —
never "customer". Clients touch the product only through token-authed
portals (no staff login). See Portals.
Command Center (CC) — a top-level hub in the left nav that folds a whole domain
(and all its former standalone pages) into one shell of native panes. The nav is
deliberately ⌂ Home + 5 Command Centers. Command Centers are sold à la carte
(gated by entitlements). See Hub overview.
The 5 Command Centers — the five domain hubs:
| CC | Route | Page |
|---|---|---|
| Jobs (portfolio) | /portal/jobs |
Jobs |
| Sales (the CRM) | /portal/leads |
Sales |
| Marketing | /portal/marketing |
Marketing |
| Reports & Finance | /portal/reports |
Reports & Finance |
| Team & HR | /portal/team-hub |
Team & HR |
Contact — a person in the org's directory (the unified Person spine). A Contact
attached to a Job is tagged Client; attached to a Lead, tagged
Prospect. The Contacts pane lists customers only (crew/subs live in Team & HR).
See Sales.
Control Plane (CP) — GoBuild's internal, staff-only admin app (branded GoBuild
Admin, internally Keystone Control Plane), a separate FastAPI app running as the
ops service at ops.gobuild.ca. It holds no client data — it reads/writes every
tenant live over the Admin API. Made of Atlas + Fleet. See
Control Plane.
CredentialResolver — the single module (app/services/credentials.py) every
integration reads its keys through; the one place the per-tenant wall-off is enforced.
Resolution order is own encrypted keys → legacy org settings → global .env, with the
last two available only to siloed orgs. See
credential wall-off.
Credential wall-off — the isolation model: one tenant can never send through
another's Twilio or charge through another's Stripe. Enforced by
CredentialResolver; BYO providers fail-closed for pooled orgs. See
Control Plane.
DeepSeek — the primary text LLM (OpenAI-compatible chat) behind
Keystone's planning + retrieval and all text generation. MANAGED (shared
platform key). ⚠️ The default base URL is China-hosted and may train on inputs —
which is why sensitive paths are pinned to Gemini. See
AI features.
Documenso — the self-hosted e-signature backend (at sign.gobuild.ca) used to sign
proposals, change orders, and POs. MANAGED. See
Integrations catalog.
Entitlement / has_feature — GoBuild's modular per-CC packaging. Each org has a
tier plus per-org overrides; has_feature(org, key) (the Jinja global + require_feature
route guard) decides whether a gateable feature is on. Gateable keys: sales,
marketing, ai_bar, procurement, quickbooks, hr, payroll, safety — core
screens (jobs, documents, invoices) are always on. See app/services/entitlements.py
and Hub overview.
Fleet — the infrastructure half of the Control Plane: the registry of running
hubs (FleetInstance rows), DigitalOcean droplet lifecycle, provisioning,
billing, and live monitoring. See Control Plane.
Gemini (Google) — the vision/audio/image/live-web LLM: receipt OCR, image
generation, grounded search, call transcription — plus the automatic text fallback
when DeepSeek errors. MANAGED; pinned for privacy-sensitive paths. See
AI features.
god-mode — informal name for cross-tenant admin power, of two kinds: (1) any
Admin API call (a CP-signed token unlocking /_admin), and (2)
impersonation ("Login as"). Every CP mutation is audited. See
Control Plane.
GoBuild Live — an org's live public website served off the hub (/p/{slug}, the
{subdomain}.gobuild.ca subdomain, or an attached custom domain), with lead-capture,
the Client login sub-flow, blog, local-SEO pages, and a per-site PWA. Live
folder-sites are what a Showcase mock becomes on go-live. See
Portals — Landing portal.
Hub — (1) the shipping product: GoBuild's FastAPI construction-management SaaS,
one app a builder owns, serving staff (/portal), clients, and prospects at once
(Hub overview); (2) infra sense: a running deployment serving the
Admin API, registered in the Fleet as pooled or siloed. "Command Center"
is also loosely called a "hub" in the nav — see the open questions.
has_feature — see Entitlement.
Impersonation ("Login as") — a staff operator entering a customer's account: the CP
authorizes over the Admin API, the hub mints a 90-second one-hop ticket, and
/_impersonate/consume swaps it for a 30-minute impersonation session cookie set on
the tenant's own host, with a persistent banner + audit trail. See
Control Plane.
Job — the unit of construction work GoBuild is built around. House term — never
"Project" in user-facing copy (OpenProject's internal "project" object is backend
plumbing). A Job carries its own Client portal via a client_token. See
Jobs and How to: Start a new Job.
Keystone — the name of GoBuild's AI. Two things wear it: the Keystone AI bar, the
always-on contextual copilot on every /portal screen (answer / fill / review-card /
nav — nothing commits without the user), and the internal Keystone Control Plane. The
bar is pm/office-gated. Internal spellings ai_bar (entitlement) and .kcc-* (CSS)
are not the product name. See AI features.
Lead — a prospective Job in the Sales CRM pipeline (new → contacted →
estimating → won → lost), captured from any channel (form, AI paste, estimator,
website). Winning a Lead (via an accepted Proposal) converts it into a Job.
See Sales.
MANAGED — the credential class for GoBuild-run infra shared across every org
(OpenProject, Chatwoot, Documenso, the AI keys): always on, per-org data
scoping inside the service, the operator never enters a key. Contrast BYO. See
credential wall-off.
MinIO — the self-hosted S3-compatible object store; today it holds Documenso's
signed contract PDFs (bucket documenso). Internal only. See
Ops runbook.
On-demand TLS — Caddy issuing an HTTPS certificate on the first request for a
partner/custom domain, gated by the hub's /internal/tls-allow allow-check (so only
domains we recognize get a cert). The one thing a client must do for a custom domain is
add the A record. See Ops runbook and
Portals.
Org / Tenant / Organization — the account boundary. The DB model is Organization;
every table carries organization_id. "Tenant" is the same thing seen from the
multi-tenancy layer — resolved from the Host header ({slug}.app.gobuild.ca) to a
slug to an org. "org" (lowercase) in body copy. See
Hub overview.
PIN — two unrelated numeric gates: (1) the staff/crew field PIN — a device-bound
numpad login shortcut for field workers (app/routers/pin.py); and (2) the optional
client-portal PIN — a static gate (last 6 digits of the primary contact's phone) an
org can turn on for /client/{token}. See
Hub overview and Portals.
Pooled vs siloed — an org's isolation: pooled = many orgs share one hub + DB
(row-scoped by organization_id; strict BYO wall-off, no global credential
fallback); siloed = the org gets its own hub/droplet (legacy single-tenant deploys
resolve as sole_org, and may fall back to global creds). Set per-org from the CP. See
Control Plane.
Portal token — the per-record shareable secret in a URL that authenticates an
external surface without a login — e.g. Job.client_token, Proposal.public_token,
Invoice.public_token, Sub.clock_token. Optionally gated by PIN/OTP. See
Portals.
Proposal — a branded, priced, e-signable offer sent to a Prospect/Client
at /proposal/{token}. Accepting it (captured as a Documenso e-signature)
converts the Lead into a Job + Estimate; declining marks the lead lost. See
Sales and Portals.
Prospect — a not-yet-won party: a public website visitor, a Showcase mock
recipient, or a Contact attached to an open Lead. Becomes a Client
when their Proposal is accepted and a Job is created.
PWA (Progressive Web App) — an installable, offline-capable web app. Two live PWAs:
the office Hub (/portal, service-worker cache gobuild-hub-v10) and each org's
GoBuild Live site (auto-branded installable icon, distributed via an admin
QR/share card). See Hub overview.
QuickBooks — the live two-way accounting sync (Intuit QBO OAuth). ⚠️ The entitlement
label reads "QuickBooks / Xero sync" but Xero does not exist (empty package). See
Integrations catalog.
Resend — the HTTPS email-send provider (DigitalOcean blocks SMTP). A SHARED_DEFAULT
credential: every org sends through the one shared GoLive key/domain, dressed up per-org
(display name = org, reply-to = owner), with optional BYO white-label. See
Integrations catalog.
Showcase — the standalone prospect funnel app at showcase.gobuild.ca: GoBuild
hand-builds a browsable mock website (design variants) for a sales prospect, shares a
public /p/{token} link, captures pinned feedback, and on a "yes" promotes the chosen
mock to a live GoBuild Live tenant site. GoBuild's answer to "website builder". See
Showcase.
Sub / Vendor — an outside trade party. A Sub(contractor) works the field: a
walled /sub/{clock_token} PWA (tasks, geofenced clock, capture, PO approval) that never
sees the homeowner, margins, or contract value. A Vendor supplies materials and
submits an itemized bid at /bid/{token}. Both live in Team & HR, not the Contacts pane.
See Portals.
Tenant — see Org.
Terms used inconsistently in code / names worth standardizing (flagged while writing this page):
nav_consolidation_plan.md calls them "5 hubs"; and the code is split — sales_command_center / marketing_command_center vs reports_hub / team_hub. Meanwhile "hub" also means the whole product and a fleet node. Pick one user-facing noun (recommend Command Center) and reserve "hub" for the product/infra sense.ai_bar vs .kcc-*. The product name is Keystone, but the entitlement key is ai_bar, the CSS is .kcc-*, and the code/comments still say "Keystone Bar / AI bar." Should the entitlement key and CSS be renamed for consistency, or is Keystone strictly a display name?scope="customers" and comms.py describes it as "customers only." Rename the scope/labels, or accept "customer" as an internal-only spelling?sync_job_to_project and a "project" object throughout. Confirm this is backend-only and audit for any user-facing "Project" leak.Sub with clock_token = field labor; Vendor = materials/bids) but the words are used loosely and the bid/sub portals blur them. Lock the definitions: is a bidding party always a Vendor and a clocking party always a Sub?FleetInstance.kind, Org.isolation) but also as "single-tenant / legacy / per-droplet" in the resolver. Standardize on pooled / siloed everywhere?quickbooks entitlement is labeled "QuickBooks / Xero sync," but Xero is an empty package. Rename the label to just QuickBooks (or build Xero) so the glossary doesn't have to document vaporware.