Case Study
Aether SDK
15+
Adapters
2
Engine tiers
RLS
Tenant isolation
The Problem
Every integration project rebuilds the same plumbing: entity models, sync loops, webhook handling, secret management, and tenant separation — rewritten per tool, per client, per project. The plumbing is never the product, but it's always the risk.
Aether SDK is a universal, multi-tenant sync and orchestration substrate: one entity model, one adapter interface, and tenancy enforced from core to storage — so connecting a new system means writing an adapter, not an application.
Architecture
Adapter Registry BaseAdapter[T] — one interface
ITSM/Corp Jira · Linear · GitHub Issues · Slack · BambooHR
PKM Notion · Obsidian · Logseq
Media/Presence MyAnimeList · AniList · Trakt · Discord
Generic runtime OpenAPI adapter generator
↓
Dual Engines
Aether Lite synchronous FastAPI core — rapid integrations
Aether Pro NATS + Temporal — durable, distributed workflows
↓
Tenant-Scoped Core
TenantId stamped on every entity · JWT → ContextVar propagation
Storage keyed on (tenant, adapter, entity)
Postgres Row-Level Security · tenant-scoped secrets
Engineering Discipline
- Tenancy as an invariant, not a convention: every entity, storage call, adapter push, secret lookup, and webhook event carries a
TenantIdenforced from core to backend — adapters cannot write into another tenant's slice. - CI that blocks on isolation: a dedicated tenant-isolation end-to-end test suite runs as a required merge gate. A red mark blocks the merge.
- Tier-aware feature management: adapter access controlled across free / pro / enterprise tiers from a single flag manager.
- Single-tenant stays simple: deployments that don't need tenancy run unchanged under a stable default tenant.
Why It Matters Here
This is the systemized version of the integration work in my track record — the Docebo/Workday/Salesforce/SSO wiring done at Entrust and FHLBC, generalized into infrastructure that makes the next integration a config exercise instead of a rebuild.
Access: Aether SDK is an engine, not a demo — there is intentionally no public repo or hosted instance. Architecture, ADRs, and selected code are available to walk through in a working session.