Client Platform — Off The Map Productions

Nautilus

The growth-operations system behind a managed engagement.

Nautilus is the private GrowthOS we built for Off The Map Productions — the tool the studio runs client social engagements on. It plans the content, measures every post, learns which hooks and pillars actually win on that account, paces goals honestly against the paid period, and produces the monthly report the service agreement promises.

Explore the platform Read the case study
6 Operator surfaces
1,231 Tests passing
0 Lines of client-side JS
Built for Off The Map Productions, LLC AI-accelerated creative studio · off-the-map.com
The Problem

Most growth dashboards are confident about things nobody measured

A studio selling a monthly retainer has to answer one question at the end of every cycle: did this work? Nautilus was built so that the answer always cites a recorded number, and stays silent when the numbers are not yet enough to speak.

Plan, Publish, Measure

Cycle content plans become dated slots with per-slot briefs. Publishing marks the slot; skipping records why. Every published post enters a measurement queue and stays there until its numbers land.

Winner Detection

Hook and pillar performance is compared per account. A comparison needs two measured posts per side and a 1.5× lead before it is allowed to state a conclusion — and the combination read fires only when neither dimension is decisive alone.

Honest Goal Pacing

Cycle-bound SMART goals pace inside a ±10-point band around elapsed time, so a client sees whether they are actually on track rather than a progress bar that only ever moves forward.

Competitor Watch

A structured watch list with follower trajectories captured over time, benchmarked against tracked competitors' median engagement. Snapshot-due pills surface a watch that has gone stale.

Prescriptive Advisor

The next move is prescribed from the client's own numbers, and every advisor sentence cites the record it came from. When measurement stops, the advisor says so rather than continuing to reason from stale data.

The Monthly Report

The client-facing summary the service agreement promises, generated from the cycle's recorded results — including paid-amplification disclosure. Print it and it is the deliverable.

Governance

Fail-closed by construction

A tool that can post, spend and message on a client's behalf is a tool that can do damage on a client's behalf. Nautilus ships every one of those capabilities disabled by policy.
External side effects off by default

Posting, spending, messaging, billing and provider calls ship disabled by policy

Digest-chained audit evidence

Every mutation writes a tamper-evident record; the chain is the evidence, not the log line

No allowance without a paid cycle

The entitlement kernel refuses work that no active, funded engagement authorizes

Refuses to own another system's truth

Polaris projections cannot be renamed locally; published slots cannot be moved

Invisible to search engines

robots.txt and X-Robots-Tag, with same-origin Referrer-Policy so external sites learn nothing

advisor/rules.py 
# A comparison that has not earned the right
# to speak stays silent.
def compare(a, b):
    if a.measured < MIN_POSTS or b.measured < MIN_POSTS:
        return Insufficient("two measured posts per side")

    lead = a.median / b.median
    if lead < DECISIVE_LEAD:  # 1.5x
        return Inconclusive(lead)

    return Finding(
        winner=a,
        cites=[p.id for p in a.posts],  # always
    )
Architecture

One service, one database, no front-end framework

Nautilus is a single FastAPI service rendering server-side HTML over PostgreSQL. The absence of a client-side application is a deliberate security and maintenance decision, not a limitation.
FastAPI, strict typing

Ruff and strict mypy clean as a merge gate, not a suggestion

PostgreSQL, forced RLS

Row-level security enabled and forced; the application role owns nothing

Signed Polaris inbox

Commercial terms and paid cycles arrive only as HMAC-signed events from Polaris

Drift detection in both directions

Verification asks what the migrations declare and what the live database actually has

The Boundary

What Nautilus is allowed to say, and what it must be told

Growth operations run on commercial facts — who the client is, what they agreed to, what they paid. Nautilus never guesses at any of them. It receives them from Polaris over a signed contract, and it emits its own facts back the same way.

Received from Polaris

polaris.client.onboarded

A client exists, with the social accounts the engagement covers

polaris.commercial.terms.agreed

What was signed, and therefore what the cycle is allowed to authorize

polaris.commercial.requirement.updated

A deliverable obligation changed; the plan has to answer for it

Emitted to Polaris

nautilus.service_cycle.*

Proposed, activated, ending soon, closed — the lifecycle of a paid period

nautilus.requirement.satisfied

A contracted obligation was met, with the record that proves it

nautilus.report.delivered

The monthly report the service agreement promises has gone out

nautilus.client.*

Created, renamed, archived, restored

Every type Nautilus emits has a projector on the Polaris side; there are no event types either end receives and quietly ignores. Ordering is per aggregate, so a cycle activation cannot land before the client it belongs to.

Operational software that tells the truth

Nautilus is one of three systems we built for a working studio. If you run a service business on spreadsheets and screenshots, this is the shape of the alternative.

Start a conversation Read the case study See Polaris