Services
Which outside services are live, and which run on sample data
2
Live
calling the real service
16
Simulated
running on Mehta Auto fixtures
4
Send these first
the keys that unblock the most
Every service
a key arrives, the row flips — nothing else changes
| Service | What it turns on | State | Setting the key today | Waiting on |
|---|---|---|---|---|
App connections Composio for the long tail; owned adapters where strategic (the Tally read-only agent, bank-alert mail rules) | One door to the company's apps — accounting, CRM, mail, files, messaging, support, projects — read-only scopes first, every write a separate named scope. What a person connects, and what Corto may read of it, is decided on /connectors. | Live | partialGmail and Drive connect, return and read, read-only. Also set COMPOSIO_AUTH_CONFIG_GMAIL and COMPOSIO_AUTH_CONFIG_GOOGLEDRIVE to the read-only auth configs. Nothing yet turns a read into a tracker or register row. | Nothing. |
Database Postgres in Docker, locally — no account, no bill, no lock-in | Remembers things between visits: conversations, answers, the org graph. Nothing a person says can persist without it.Today: Everything reads fixtures/mehta-auto and answers live in browser memory until the tab closes. | Simulated | worksAlready live on the local Postgres. | DATABASE_URL |
Claude Anthropic | Runs the conversations: the X-Ray probes, the founder interview, drafting goals, composing the Mirror and the morning brief. Judges every drafted goal against the reference before a person is asked to accept it. Forms each tenant's industry view — which lenses run, and the forces, rated only where a mechanism is named — before the founder sees the report. | Live | worksOpus 5 with adaptive thinking. Every Claude job switches from its scripted answer. | Nothing. |
File storage Cloudflare R2 / AWS S3 | Holds every file a person attaches — a receipt on a claim, a CV on an applicant, a photograph of a broken machine, the original of a document Corto read. Corto stores the FILE and the record of who attached it; what the file means is always a field on the record it hangs off, never guessed from the file itself.Today: Files are written to .data/files on this machine and listed exactly as the live store would list them. The path is the only thing that changes when the key arrives. | Simulated | do not set yetUpload to object storage is not written: uploads would fail. | FILES_BUCKET · FILES_ACCESS_KEY · FILES_SECRET |
Resend / AWS SES / Postmark | Sends the magic link that is the only way into Corto, and the joining invitations.Today: Links are printed to the server log and shown on screen in dev. | Simulated | do not set yetSending is not written: invitations and sign-in codes would fail instead of going to the outbox. | EMAIL_API_KEY · EMAIL_FROM |
Calendar cal.diy, self-hosted as a sidecar (MIT; Google, Microsoft 365, Zoho and CalDAV behind one API). Decided 2026-09-02. Replaceable by direct Google + Graph calls behind the same interface if the sidecar proves heavy. | Reads the founder's free/busy to offer real slots for the heads' meeting, and writes that one event into a connected diary. It is NOT what sends the invitation — Corto's own email does that, so the meeting happens whether or not anyone connects a calendar.Today: Slots come from the fixture's meeting window; the event is recorded in memory and shown on screen as created. | Simulated | label onlyNo cal.diy client is written. The meeting screen keeps typing a time. | CALDIY_URL · CALDIY_API_KEY |
The books On-prem Tally agent (own build) · Zoho Books for non-Tally tenants | Reads invoices, payments, parties and ageing — every rupee figure in the product traces here.Today: fixtures/mehta-auto/invoices.json, payments.json, parties.json. | Simulated | label onlyNo Tally agent endpoint exists. Finance is paused. | TALLY_AGENT_TOKEN |
Company records Probe42 / Tofler / Karza | The free outside-in report: filed financials, charges, directors, auditor history.Today: The Mehta Auto filing history in the outside-in fixtures. | Simulated | label onlyNothing reads this key. | COMPANY_RECORDS_API_KEY |
GST filings ClearTax / Masters India / Sandbox | Filing regularity and turnover band — the compliance-behaviour signal.Today: The twelve-month filing history in the outside-in fixtures. | Simulated | label onlyNothing reads this key. | GSP_API_KEY |
Presence Google Places + a SERP provider | Listings, reviews and the site check behind the free audit.Today: The presence audit fixture, four dimensions scored. | Simulated | label onlyNothing reads this key. | GOOGLE_PLACES_API_KEY |
Company files Google Drive + Sheets (Microsoft Graph for MS tenants) | Finds the trackers and reports that actually run the place, and reads the ones people register.Today: fixtures/mehta-auto/trackers.json and the artifact register. | Simulated | label onlyNothing reads this key; Drive comes through App connections (Composio) instead. | GOOGLE_CLIENT_ID · GOOGLE_CLIENT_SECRET |
Shared mailboxes Gmail API, shared-mailbox scope | Reads dispatch@ and sales@ only — the reports nobody described, and enquiries nothing counts.Today: The 61-sends-in-63-days traffic in the artifact register. | Simulated | label onlyNothing reads this key; mail comes through App connections (Composio) instead. | GOOGLE_CLIENT_ID · GOOGLE_CLIENT_SECRET |
Bank signal Alert-mail parsers now · Setu AA / Finvu later | What came in yesterday — parsed from bank alert mail until an Account Aggregator is consented.Today: The HDFC alert fixtures and metrics.json collections. | Simulated | label onlyNothing reads this key. | GOOGLE_CLIENT_ID · GOOGLE_CLIENT_SECRET |
Speech to text A transcription API with word-level confidence and Indian-English models — not chosen yet. Word confidence is a hard requirement, not a nice-to-have; a provider that returns only a transcript cannot be used. | Turns what somebody said into words Corto can read — Priya updating a deal from her car, Suresh reporting a dispatch from the gate. It returns a CONFIDENCE PER WORD, and that is the part the product depends on: a word below the threshold is shown to be checked and never written, and a recording below the floor is refused outright rather than guessed at (lib/dictation.ts).Today: fixtures/mehta-auto/dictation.json — three real recordings including one from a shop floor that is correctly refused. Choosing one plays back what was heard, uncertain words and all. | Simulated | do not set yetNo vendor is wired: dictation would stop rather than fall back. | SPEECH_API_KEY |
Push Web Push (VAPID) now; Firebase Cloud Messaging for the app later | Wakes a person for the five things that may wake them — a nudge on their work, an approval only they can give, a commitment due today, an ask Corto made of them, a mention. Everything else is stream-only.Today: My Corto ranks and marks exactly what would have woken a person, and says no device was woken. | Simulated | label onlyNothing sends a push yet, and the browser reads NEXT_PUBLIC_VAPID_PUBLIC_KEY, not this name. | VAPID_PUBLIC_KEY · VAPID_PRIVATE_KEY |
Public schemes myScheme / state DIC portals / a Haqdarshak-class aggregator — per market | Matches the business's own facts to public money — central and state schemes, grants, statutory levers — and tracks each application after a named human submits it. The agent prepares the pack; it never presses submit.Today: fixtures/mehta-auto/schemes.json — the Indian worked case, every worth a published ceiling or rate. | Simulated | do not set yetThe schemes screen would label its sample data as live. | SCHEMES_API_KEY |
Market data An index and filings data provider — per market; ACMA/RBI/MCA sources in India | Feeds the intelligence layer and the industry model: commodity indices, policy rates, industry-body series, named rivals' filings, tenders and events in reach.Today: fixtures/sector.json and fixtures/mehta-auto/intel.json. | Simulated | do not set yetThe intelligence screen would label its sample data as live. | MARKET_DATA_API_KEY |
Payments Razorpay | Subscriptions, once the pricing bands are decided.Today: Nothing is charged. | Simulated | do not set yetA payment reminder would show a made-up payment link as if it were real. | RAZORPAY_KEY_ID · RAZORPAY_KEY_SECRET |
How a key goes live
- 1Put it in .env.local — the names are in .env.example, with what each one turns on.
- 2Restart the dev server. That is the whole migration.
- 3This board turns the row green, and every screen that used the fixture starts using the real thing.