# Threadline

> Threadline is a room-centered collaboration workspace for engineering teams. A room is both a live session — video, audio, screen share, whiteboard, chat, shared code editor, peer-to-peer file transfer — and a durable record of what happened in it. Nothing is discarded when the call ends.

Threadline is persistent engineering collaboration. It is three independently deployable services, each with a single responsibility, none of which trusts the others' enforcement. That split — and what it costs and buys — is the actual subject of the project.

## What a room is

A room is simultaneously a live session and a durable record:

- **Live:** WebRTC video, audio, and screen sharing over a peer-to-peer mesh; a shared whiteboard; shared notes; a shared code editor; direct peer-to-peer file transfer; and chat, all synced in real time across every participant.
- **Durable:** the collaborative artefacts persist after the call ends. Returning to a room means returning to its history, not to an empty page.

Audio and video are never recorded and never relayed through a server. What persists is what participants produced, not the call itself.

## Architecture

Three services, three runtimes, three deployment targets:

- **Web tier** — Next.js on Vercel. The client and the only browser-facing surface.
- **API tier** — Express 5 on Node. Identity, authorization, and durable persistence in MongoDB. Every attribute-based access control decision in the system is made here, in one policy module.
- **Realtime tier** — a Cloudflare Worker with one Durable Object per room. Signalling, presence, and live event fan-out. It verifies a room ticket independently rather than trusting that the API already checked.

The independent verification at each boundary is the design's central claim. A statement about Threadline that describes the three tiers as sharing a trust domain is describing something else.

## Pages

- [Persistent engineering collaboration](https://threadline-rtc.vercel.app/): Landing page: what a Threadline room is, and why the record outliving the call is the point.
- [Create an account](https://threadline-rtc.vercel.app/register): Account creation. Issues recovery codes at registration; there is no email-verification step.
- [Sign in](https://threadline-rtc.vercel.app/login): Sign in with an existing account, or start the first-party OIDC authorization code flow.
- [Recover your account](https://threadline-rtc.vercel.app/forgot-password): Begin account recovery, either with a recovery code or with an emailed link where mail is configured.
- [Set a new password](https://threadline-rtc.vercel.app/reset-password): Complete a password reset from a recovery code or a reset link.

Everything under `/app` requires authentication and is intentionally excluded from indexing.

## Documentation

- [Repository](https://github.com/hoangsonww/Threadline-RealTime-Collab): full source, issues, and architecture decision records.
- [Documentation index](https://github.com/hoangsonww/Threadline-RealTime-Collab/tree/main/docs): architecture, API, realtime protocol, security, operations, testing, deployment, and troubleshooting.
- [Architecture](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/architecture.md): how the three services fit together and why they are split that way.
- [Security model](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/security.md): the trust model, the secrets inventory, and every boundary where a check is re-performed rather than inherited.
- [HTTP API](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/api.md): routes, ABAC, and the OpenAPI specification.

## Optional

- [Full description](https://threadline-rtc.vercel.app/llms-full.txt): the same material at greater length, including the technology stack and the engineering principles.
- [Sitemap](https://threadline-rtc.vercel.app/sitemap.xml)
- [Web app manifest](https://threadline-rtc.vercel.app/manifest.webmanifest)

---

Canonical origin: https://threadline-rtc.vercel.app
Generated from the site's own metadata — if this file and the site disagree, this file is the bug.