The rules live in the database.

BLUE is self-initiated, not a client job: a free, open knowledge base where anyone can write, read and improve practical guides. Contributors draft. Peers vote to verify, with a written rationale required, not a thumbs up. Auditors and admins moderate.

It's feature-complete, and it's a demo. No real users, no real traffic, and I'd rather say so than dress it up. It exists to prove the hard parts: real accounts, real editing, real moderation, the machinery a brochure site never has to touch.

The interesting part isn't what it does, it's where the rules live. Row-Level Security runs throughout the database, so a user can't promote themselves to admin or edit their own role or standing even with a hand-crafted API call that skips the interface entirely. That's the checkable version of taking security seriously, rather than a claim about it.

Privileged actions, publishing, voting, approving, changing a role, deleting an account, run through fourteen database functions instead of being trusted to the browser. Each is a single transaction that also logs the action as it happens, so there's no window in which the record and the event can disagree.

Guides go live the moment they're published, and verification happens afterwards, in parallel, without hiding the guide while it waits. That's a deliberate product decision, not a shortcut: readers get the information sooner, and the record of what's checked and what isn't stays honest instead of implying everything was vetted before anyone saw it.