Why We Built Framework M: An Enterprise Open-Source Manifesto
Having spent over a decade building, scaling, and contributing to open-source business application ecosystems—including key leadership and community building around ERPNext—we have witnessed the immense power of open source to democratize business software. Open-source frameworks allow teams to rapidly prototype applications, automate complex workflows, and retain complete control over their digital infrastructure.
Yet, as open-source frameworks expand into large enterprises, regulated industries, and government organizations, severe friction points emerge. Traditional framework designs often force a choice between rapid initial development velocity and long-term architectural stability.
We built Framework M to eliminate that compromise. This is our story, our architectural manifesto, and our vision for enterprise-grade open source.
The Four Pain Points Inhibiting Enterprise & Public Sector Open-Source Adoption
When government agencies and large enterprises evaluate open-source application frameworks for mission-critical systems, they consistently encounter four systemic roadblocks:
1. Single-Vendor Commercial Lock-In
When an open-source framework is owned and controlled entirely by a single commercial company holding all trademarks and core repositories, enterprise adopters face existential risks:
- Sudden relicensing shifts (e.g., transitions to restrictive licenses or dual-license models).
- Essential enterprise capabilities (such as SAML/OIDC, advanced audit logs, or multi-region routing) being paywalled behind proprietary enterprise editions.
- Vendor-driven hosting constraints that penalize self-hosted or sovereign cloud deployments.
2. The Architectural Cliff
Many low-code business frameworks prioritize initial scaffolding speed over modular decoupling. They rely on monolithic, tightly-coupled architectures where ORM models, web controllers, background workers, and frontend templates are fused together.
As applications grow in complexity or traffic, teams hit a hard architectural cliff:
- Horizontal scaling requires deploying the entire monolithic codebase rather than scaling specific bottleneck services.
- Migrating from monolithic web setups to event-driven microservices, serverless scale-to-zero runtimes, or edge environments requires a complete, high-risk rewrite.
3. Retrofitted Security & Multi-Tenancy
Regulated enterprises and public sector applications demand non-negotiable multi-tenant data isolation, row-level security (RLS), pluggable SSO identity (OIDC/SAML), and deterministic data ownership handover hooks.
When frameworks attempt to retrofit multi-tenancy or security onto single-tenant monolithic foundations:
- Tenant data isolation depends on fragile application-level checks rather than database-enforced RLS policies.
- Ownership transfers during user offboarding or role changes risk dropping active tasks, leaking data, or breaking audit trails.
4. Fragile Context for AI Pair-Programmers
Generative AI agents and LLM pair programmers are transforming software development. However, legacy frameworks rely heavily on implicit magic, dynamic untyped dictionaries, and global state. LLM agents frequently hallucinate non-existent methods, generate invalid schemas, or waste context windows parsing human-targeted documentation.
How Framework M Solves These Pain Points
Framework M was engineered from the ground up as an AI-First, Zero-Cliff Enterprise Application Framework.
| Architectural Layer / Pillar | Core Guarantee & Capability |
|---|---|
| Non-Profit Foundation | Independent, neutral governance under a Section 8 non-profit entity |
| Pure Hex Architecture | Decoupled Python core (framework-m-core + framework-m-standard) & pluggable @framework-m/* npm packages |
| Security & Multi-Tenancy | Native database Row-Level Security (RLS) scoping & BaseController hooks |
| AI-First Machine Schemas | Studio CLI .jsonl exports (corpus, core, doctypes, ui, openapi) |
Principle 1: True Vendor Neutrality via Non-Profit Foundation
Framework M’s core monorepo, documentation, domain assets, and trademarks are owned by the Framework M Software Foundation—a non-profit Section 8 company incorporated under the Indian Companies Act, 2013.
No single commercial vendor can paywall core capabilities, restrict deployment targets, or alter open-source licensing terms. All adopters—from independent developers to multinational enterprises and public sector agencies—operate on equal footing.
Principle 2: Pure Hexagonal Architecture (Ports & Adapters)
Framework M enforces a strict Pure Hexagonal (Ports & Adapters) architecture across Python and TypeScript layers:
- Python Backend Engine: The primary
framework-mpackage combinesframework-m-core(pure domain metadata engine, DI container, and ports) withframework-m-standard(default SQLAlchemy, storage, and TaskIQ adapters). Core domain models and DocTypes never depend directly on specific web servers (Litestar) or database engines. - Pluggable Frontend Ecosystem: Frontend UI layers and Desk components are distributed as modular, pluggable
@framework-m/*npm packages (@framework-m/ui,@framework-m/plugin-sdk,@framework-m/vite-plugin), allowing teams to compose micro-frontends (MFEs) directly into custom application shells. - Swappable Enterprise Adapters: Default batteries (local storage, TaskIQ workers, Desk React UI) can be swapped for enterprise adapters (AWS S3/Cloudflare R2, NATS JetStream, custom corporate SSO, custom UI shells) without modifying business DocType models or service controllers.
- Zero Architectural Cliff: Move from a single-server developer setup to distributed microservices, serverless runtimes, or edge nodes without rewriting application code.
Principle 3: Built-In Security, RLS, and Data Ownership Handover
Security and tenant isolation are first-class primitives in Framework M:
- Database Row-Level Security (RLS): Scoping policies (
ImplicitTenantAdapterfor single-tenant mode,HeaderTenantAdapterfor multi-tenant gateway header resolution) inject deterministic RLS predicates at the database query builder level. - Controller Ownership Transfer Hooks: When transferring document or system ownership during offboarding,
BaseControllerlifecycle hooks (before_transfer_ownership,after_transfer_ownership) execute deterministic validation while maintaining immutable audit trails.
Principle 4: AI-First Machine Schemas (.jsonl)
Framework M treats AI coding assistants as first-class developer partners. Studio CLI (m docs export) automatically extracts machine-readable JSON Lines schemas under ./docs/machine/:
corpus.jsonl: Aggregate full-text RAG corpus scanning guides, ADRs, RFCs, and golden UI fixtures.core.jsonl: Python AST class signatures, method type hints, and docstrings.doctypes.jsonl: Structured JSON metadata definitions of all application DocTypes.ui.jsonl: Desk React component contracts and hook prop definitions.openapi.jsonl: Machine-parseable REST API endpoint specifications.
This allows AI coding agents (such as DeepMind Antigravity, Dify workflows, or local fine-tuned LLMs) to generate precise, zero-hallucination code targeting your exact application schemas.
Build Once. Scale Forever.
Open source should never force a compromise between developer agility and enterprise resilience.
By pairing a Pure Hexagonal Architecture with Native Security & AI Schemas and an Independent Non-Profit Foundation, Framework M provides a permanent, vendor-neutral platform for building mission-critical business software.
Join us on our journey:
- 📖 Explore the documentation at frameworkm.dev
- 🛠️ Inspect the source code and contribute on GitLab