Notes on the architecture.
How Whity is built, and why — written for people who want the mechanism rather than the marketing.
The dependency watcher that could not see
PHP shipped fixes for two unauthenticated RCEs on 21 October. Our Dependabot had watched the base image for months and opened zero pull requests — because a floating tag gives it nothing to bump. The failure, and why the fix is a test rather than a version.
Read →Every API route is already an agent tool
Most products bolt a chat box onto an existing API and call it agent support. Whity derives its MCP tool catalogue from the same schema the router already generates — so the tools cannot drift, and an agent gets exactly the permissions its token carries.
Read →Arabic is not a translation pass
Bolting a second language onto a finished product produces a product that works in one language and apologises in another. Here is what treating Arabic as a first-class case actually cost us: a generated English catalogue, a sync that cannot overwrite a human, and layouts that mirror.
Read →Tenant isolation and the plugin boundary
How Whity enforces multi-tenancy three separate times, why plugins never touch core source, and why that boundary is also what makes closed-source plugins possible under the licence.
Read →