The thinking
Before any of this was software it was a management problem and a way of working through one. This part is the argument the system is built on.
The management problem
The problem was never the data. It was the absence of a shared management view.
Analysis existed. It was produced by every function, on its own cadence, in its own file. What did not exist was a way to turn that operational information into a shared management language, a shared performance reference, and a management rhythm that spent its time on the business rather than on the pack.
Four connected problems, each one making the next harder to solve.
What did a unit cost last month, why did it move, and what would it take to move it back?
no single owner · no shared cadence · no file that holds it01Scattered analysis Production, quality, finance and procurement each held one part of the picture.
02No common language Reports could be technically correct and still hard to read outside the function that wrote them.
03No shared reference Nothing answered "how good are we?" the same way twice.
04Preparation time Management time went into building the pack rather than discussing the business.
From scattered reporting to a shared management system.
The management logic
Data, performance, diagnosis, decision, action.
Manufacture Terminal is designed around a management decision loop, not around dashboards. Each stage is a question the system has to be able to answer, and each question has a precondition. If the precondition is missing, the stage is decoration.
Most reporting stops at performance. Everything after it is where the work actually is, and that is where this system is aimed.
The loop
closes here
01Data Is this figure trustworthy?
02Performance Against what?
03Diagnosis What drove the change?
04Decision What are the options?
05Action Who owns it and what happens next?
What is built
Ten modules in use today, and one of them opened up to show how a module gets designed in the first place.
Current system
Ten modules, each answering a management question.
Not ten dashboards. Ten questions someone actually has to answer, each with a place to go and look. What a module displays matters less than the decision it makes possible.
Built In use behind authentication · all ten
BuiltExecutiveExecutive KPI
The question it answersWhere are we against the scorecard, and what has held critical for months?
BuiltExecutiveMarket Intelligence
The question it answersWhat outside the plant is moving against us?
BuiltOperationsProduction Capability
The question it answersWhat can each line actually run, and what is the binding constraint?
BuiltOperationsQuality Intelligence
The question it answersWhat escaped, at what rate, and did the fix hold?
BuiltFinanceManufacturing Finance
The question it answersWhat does a unit cost, and what moved it? Opened up in full below →
BuiltSupply chainProcurement Intelligence
The question it answersWhich inputs are repricing, and by how much?
BuiltSupply chainForecasting Studio
The question it answersWhat will demand be, and how wrong have we been?
BuiltPeopleOvertime Analytics
The question it answersWhere is overtime concentrating, and is it value-adding?
BuiltPeopleOEN
The question it answersHow does the organisation actually collaborate, versus the org chart?
BuiltFacilityPlant Map
The question it answersWhere is everything?
A module in detail
A module starts from a decision, not from a dashboard.
Every module begins with the management decision it has to enable, and works backwards from there to the data. Manufacturing Finance is the fullest worked example: its framework is the most developed in the system, and its decomposition reconciles exactly.
How it is architected
Two architectures that describe the same system — one in management terms, one in technical terms — and the point where ten modules become one answer.
Two architectures, one system
The technical architecture exists to support the management architecture.
Not the other way round. Every layer on the right is there because a stage on the left needed it — and nothing on the right is there for its own sake.
Management architecture
- DataIs this figure trustworthy?
- PerformanceAgainst what?
- DiagnosisWhat drove the change?
- DecisionWhat are the options?
- ActionWho owns it and what happens next?
Technical architecture
- Source dataOperational records, extracted from the systems that already hold them.
- ExtractionFigures are pulled, reconciled and embedded into each module ahead of time — so a review never waits on a query, and two people looking at the same period see the same number.
- Cloudflare WorkerThe application layer: serves each module and handles the API, with verified identity already attached.
- Cloudflare D1SQLite at the edge, alongside rather than in front — it holds what people record into the system, so a saved decision is shared rather than a copy on one laptop.
- ModulesTen self-contained modules, each answering one question.
- Control TowerWhere the ten answers are read across, not down.
- Management outputAn executive report, and a decision with an owner against it.
Technical and security architecture
Identity is verified before the application is reached.
Manufacture Terminal is deployed behind Cloudflare Access using a Zero Trust access model. The current authentication flow uses email-based One-Time PIN authentication.
Those are two different things, and the distinction matters. Zero Trust is the access model — every request evaluated on identity rather than on network location. One-Time PIN is the authentication method operating inside that model, and it can be changed without the model changing.
Cloudflare Access
Zero Trust access model
Email one-time PIN
Cloudflare Worker
Application logic · API
D1 binding
Cloudflare D1
No application framework
A lightweight, platform-native architecture without a conventional frontend framework or a dependency-heavy runtime.
- Fewer abstraction layers
- No build step · one-command deploy
- Fewer dependency upgrade cycles
- Modules stay portable
- Direct use of platform primitives
Self-contained modules
Each module has clear boundaries and joins the shared Terminal architecture without coupling its internals to unrelated modules.
- Clearer boundaries
- Lower coupling
- Easier maintenance
- Module-level development
- Expansion without core change
Access control at the edge
Identity is verified before the application is reached, so access decisions do not live inside application code.
- No password for the system to hold
- Verified identity arrives with the request
- Access granted and revoked outside the app
- Records stamped with who made them
Worker and D1 as separate layers
The Worker is the application and business-logic layer. D1 is the structured data layer. The separation keeps them independent.
- Logic and data evolve separately
- Shared state, not local copies
- Data outlives any one module
Deliberately conceptual. Account identifiers, database identifiers, bindings configuration, environment values and internal URLs are not published here. What this section demonstrates is the shape of the architecture, not its configuration.
The Control Tower
The synthesis layer, not another dashboard.
The ten modules produce specialised analysis. The Control Tower is where those signals are read together — a production change, a quality change, a material cost change and a procurement change are four reports in a functional structure, and one business event when read as one.
- It derives rather than displays. Cost per unit decomposes exactly into material, labour, overhead and water — the bridge reconciles to the rupiah.
- It compares. Unit margin, the cost bridge between any two months, the performance matrix.
- It surfaces pressure. What is critical, what is repricing, what is constrained.
- It ends in an output. A full executive report for any period — month, quarter, half, year to date, full year or a custom range — generated in the browser as a PDF.
The Control Tower is the synthesis layer where specialised module analysis becomes one management view. In the product it resolves to six: factory state, unit economics, cost bridge, product economics, performance matrix, and where the pressure is.
- Performance
- Trends
- Variance
- Drivers
- Alerts
- Reporting
How it scales
Where additional capability attaches without the core being rebuilt, and where the current data foundation stops.
Scalable architecture
Additional capability can be introduced when the business needs it.
The system is designed so that new capability attaches to shared data, shared logic and a shared point of convergence, without the core being rebuilt. The eleventh module requires no change to the first ten.
New modules are built against a written brief rather than against the core, so extending the system does not mean reopening it.
The stack below is what makes that true: capability attaches at a defined layer rather than being threaded through the ten modules that already exist.
The contract that makes this true
Scalability is a claim. This is the seam that supports it — inspectable rather than asserted.
A module supplies
- One self-contained HTML file
- Its data in a declared payload tag
- A name, a group, and a one-line description
It receives, without core changes
- Registration on the homepage, with status control — live, beta, maintenance or offline
- The Terminal chrome and back navigation, injected
- Inclusion in the report extractor, which fails loudly if the module changes shape
- A database binding, if it needs to store anything
Current architectural limits
What the current data foundation can and cannot support.
Analysis is bounded by the data the source systems actually capture. Where a source system does not record something, the current architecture cannot produce a reliable figure from it — and the system does not produce an unreliable one instead.
Everything outside that boundary is absent from the system, and is not presented as fact anywhere in it.
Six of them, named.
These are the specific analyses the system refuses to produce, and the reason in each case. They are stated inside the executive report itself, not only here.
No OEE decomposition
No downtime or loss-event record exists, so overall equipment effectiveness is reported as the single figure the scorecard carries — never split into availability, performance and quality.
No process capability
The quality evidence is the customer complaint register: escaped defect, what reached a customer and came back. There is no in-process, laboratory or first-pass-yield data, so capability is not claimed.
No cost of poor quality
Complaints record the units affected, never the value of the failure — no replacement, freight or goodwill cost. So no COPQ figure is derived.
No supplier risk score
The procurement register holds prices only. Without delivery performance, lead time or quality history there is nothing to score, so no score is invented.
No exposure derived from price
The bill of materials does not reconcile with finance material cost — one product overstated by a factor of twenty-four. Price movement and material cost are therefore reported as separate evidence and never multiplied together.
No invented targets or owners
No target, owner, deadline, action or forecast appears unless a source system already holds it. A blank is shown as a blank rather than filled with a plausible number.
A number that cannot be defended is worse than a gap, because a gap is honest.