Atomic CRM and the Supabase starters, or a starting point with CRM machinery already in it?

Atomic CRM, Refine app-crm and the Supabase starters

People ask this as: atomic crm or supabase crm starter template vs a crm framework with workflows and approvals

Atomic CRM, Refine's app-crm and the Supabase starters are the closest neighbours this framework has: MIT-licensed code you copy into your repository and own outright. The research this page reads treats them as the honest baseline — total customization, no lock-in — and treats their emptiness as the finding: no workflow engine, no policy or approval, no audit, no CRM semantics. This framework is the bet that the machinery the templates leave out is the part worth generating. Both paths end in code you own; the difference is what the first commit already contains. Every fact traces to one dated file; nothing was run.

Where this stops

Read this before the rest of the page. Every line below is a thing this does not do.

Every fact about another project on this page is single-sourced to docs/strategy/COMPETITOR_MAP.md and dated 2026-08-04. Nothing from another project was installed, configured or run, and there is no network access here to re-verify any of it.

  • No hands-on evaluation: none of the templates was installed, configured or run to produce this page.
  • Every competitor fact is single-sourced to docs/strategy/COMPETITOR_MAP.md and dated 2026-08-04.
  • Licence descriptions are factual summaries of published texts, not legal advice.
  • This framework ships no authentication; in local-development mode an actor header is an assertion, not an identity (L-01).
  • The synchronous factory uses SQLite; the async factory supports one tenant on dedicated PostgreSQL databases. Shared-database row tenancy and general production readiness are not claimed (L-02). This is not a Supabase-specific starter.
  • Customer Data Foundation supports bounded JSON imports with preview/apply, per-row receipts and idempotency, deterministic duplicate candidates, and human-governed canonical identity as logical links. It does not provide CSV ingestion, physical merge, complete export/erasure, bulk editing, saved views or global search (L-06).
  • This is a framework whose output you run; the managed Cloud hosts a free Blueprint-configured workspace, and custom code only on a paid Dedicated Cell (L-07).
  • The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08).
  • No measured comparison in either direction — the benchmark has not been run (L-03).

No authentication ships: the framework authenticates nobody. Production Spine v1 (ADR-038) gives the framework verified identity, organizations and memberships, server-authoritative authorization and one tenant per application instance — so tenancy and authorization now exist and are enforced. What does not exist is authentication: no login, password, session or OIDC implementation ships, and a deployment must supply the adapter that verifies the request. Production mode refuses to start without one. In local-development mode an actor header is accepted as an assertion and is not an identity, which is the default developer posture. This is not shared-database multi-tenancy and it is not a readiness claim. Every claim and every limitation is on one page.

Where the templates win

Ownership with no argument attached. The research file this page reads — docs/strategy/COMPETITOR_MAP.md, dated August 4, 2026 — records the templates as code-first CRUD starting points under MIT: Atomic CRM is react-admin plus Supabase, distributed through the shadcn registry so the code is copied into your repository; customization is total because it is your code; hosting is wherever you host; and the lock-in column reads none. If the CRM you need is CRUD screens over your own schema on a stack you already know, a template gives you that today, with nothing to learn and nothing to disagree with.

The stack is one this framework does not offer. Atomic's recorded pairing is react-admin with Supabase, while persistence here supports SQLite and dedicated-database PostgreSQL through separate factories (L-02). The file also records .claude/ and .mcp.json checked into Atomic as developer affordances — good for humans working with coding agents, even though it records no runtime MCP surface for any of the templates.

And the kinship should be stated rather than hidden: distribution here today is closer to a template than to a package. The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08). The file reads Atomic CRM's fork-to-star ratio of about 0.63 as proof that developers want CRM code they own. That is this framework's bet too; the disagreement is only about what the copied code should already contain.

Where this is different

The research file's verdict on the templates is the entire case: no workflow engine, no policy or approval, no audit, no runtime MCP, no CRM semantics — and it calls that emptiness precisely this project's feature list. Here those are the primitives. A module manifest becomes a migration, a service, a REST resource, an SDK method and Admin screens with no page code (C-01). Commercial policy is deterministic code, and a renewal at or above the threshold stops and waits for a named human (C-03), with the refusal asserted by a test rather than promised in a README (C-04). Every mutation leaves an audit event and a step-level trace behind it (C-16), and modules evolve through explicit revisions and append-only named migrations (C-19).

The growth curve is the actual comparison. A template is strongest in its first week, when it is exactly the code you would have written anyway. The file's adjacent row on the do-it-yourself default path records what that costs when the process arrives: every project re-derives validation, approvals, audit and pipeline semantics by hand. Here that machinery arrives generated and consistent, so the fifth object costs roughly what the first one did — which is the opposite of how a hand-extended template ages.

The dependency surface differs by design. This framework is Node 22 and a checkout — no build step, no bundler, no framework underneath your framework; SQLite is Node's built-in adapter and PostgreSQL requires the one pinned pg@8.23.0 driver (C-17). The templates cannot have that property, because their point is to sit inside a stack you already run. Whether that is a cost or a benefit depends entirely on whether that stack is the one you wanted.

How to choose

Choose a template if the CRM is CRUD plus your own logic on your own stack; if react-admin, Refine or Supabase is where your team already lives; if the commercial process is thin enough that writing it by hand is a feature rather than a burden; and if you want no framework opinion between you and the code — the file records total customization and no lock-in, and nothing here contradicts it.

Choose this framework if the process is the product — stages, approvals, discount policy, audit — and you want it generated as reviewable code with the boundaries tested, while choosing SQLite or dedicated-database PostgreSQL (L-02), supplying authentication and hosting, and completing the data operations your deployment needs (L-01, L-06).

If import, export and search are the feature list, neither column claims them: the file records no CRM semantics for the templates, and this framework records those absences in its own ledger (L-06). Both paths end in a repository you own. The choice is only what the first commit already contains, and who wrote it.

What this comparison does not cover

No hands-on evaluation. None of the templates was installed, configured, benchmarked or run in producing this page. Every fact traces to docs/strategy/COMPETITOR_MAP.md, researched on August 4, 2026, and this environment has no network access to re-verify any of it.

Nothing about Supabase the product. The file records it only as the backend half of Atomic CRM's stack; no statement about its database, authentication or hosting appears here, because the file carries none.

No code-quality judgement. The file does not review any template's code, so no opinion about react-admin, Refine or any starter's implementation appears here.

No time-to-value or build-rate comparison in either direction — the benchmark that could measure one has not been run, and any number quoted for this project is not ours (L-03).

When the competitor research is refreshed, this entry must be re-read against it. A dated page is only as good as its date.

The evidence this page rests on

Claims and limitations are printed from site/claims.json word for word. Job statuses come from docs/benchmarks/jobs.json; a job with no page of its own is listed with its status rather than linked.

Claims

  • C-01 Write a module manifest; the agent turns it into a migration, a service, a REST resource, an SDK method and Admin screens — with no page code.

    LimitGenerated CRUD only. The factory does not generate workflows or approvals for a custom object — that is still handwritten (JTBD-06, partially supported).

  • C-03 Commercial policy is deterministic code, not a model's judgement: a renewal at or above the threshold stops and waits for a named human.

    LimitProven for the built-in renewal object and its single value threshold. A general policy engine over arbitrary custom objects does not exist.

  • C-04 The agent cannot approve on the human's behalf. A test asserts the refusal, so the boundary is a property of the system rather than a promise in a README.

    LimitIn local-development mode the actor is asserted, not authenticated: no authentication ships, so an actor header there is not an identity. This holds a boundary against an honest agent, not against an attacker with network access.

  • C-16 Every mutation goes through a module service or a named workflow, and leaves an audit event and a step-level trace behind it.

    LimitAudit records what the process did under an asserted actor. It is not a tamper-evident or externally attestable log, and it is not a compliance control.

  • C-17 SQLite is Node's built-in node:sqlite. PostgreSQL requires one pinned runtime driver, pg@8.23.0. There is no ORM, no query builder, no build step and no framework underneath your framework.

    LimitApplications that select PostgreSQL carry pg@8.23.0. The SQLite path still needs no third-party driver. This is not a production-readiness claim and not shared-database tenancy; composition is dedicated-database, not row tenancy.

  • C-19 Generated modules evolve without rewriting history: explicit revisions, a checked-in state file and append-only named migrations.

    LimitThe view is source-only: what the checked-in revisions and migrations say is knowable; what a particular database has actually applied is not.

Limitations

  • L-01 No authentication ships: the framework authenticates nobody. Production Spine v1 (ADR-038) gives the framework verified identity, organizations and memberships, server-authoritative authorization and one tenant per application instance — so tenancy and authorization now exist and are enforced. What does not exist is authentication: no login, password, session or OIDC implementation ships, and a deployment must supply the adapter that verifies the request. Production mode refuses to start without one. In local-development mode an actor header is accepted as an assertion and is not an identity, which is the default developer posture. This is not shared-database multi-tenancy and it is not a readiness claim.
  • L-02 Not shared-database tenancy. createAccordoAppAsync can boot one tenant onto dedicated PostgreSQL databases. Shared-database row-level tenancy is not implemented, and this is not a production-readiness claim.
  • L-03 The build benchmark has not been run. The protocol is designed and published; no Successful Agent Build Rate exists yet. Any number you see quoted for this project is not ours.
  • L-06 Bounded customer imports and logical identity; incomplete data operations. Customer Data Foundation supports bounded JSON imports with preview/apply, per-row receipts and idempotency, deterministic duplicate candidates, and human-governed canonical identity as logical links. It does not provide CSV ingestion, physical merge, complete export/erasure, bulk editing, saved views or global search.
  • L-07 The framework is source you run; the Cloud hosts only what a Blueprint expresses. The framework is not a hosted service: its output is an application in your repository that you run. The managed Cloud is a separate offer: a free workspace on shared capacity configured through a Project Blueprint (record types, fields and approval gates), and a paid Dedicated Cell for custom application code.
  • L-08 Ownership means vendored source: there is no framework dependency to bump. The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08). The framework is copied into the project, not installed as a framework library dependency. The accordo npm name is an empty reservation; the @accordo scope is claimed and deliberately empty.
  • L-09 Personal-data readiness requires deployment work beyond the foundation. Customer Data Foundation supplies bounded import and identity governance, not complete personal-data operations. Authentication must be supplied by the deployment, and complete subject export and erasure remain absent; the framework alone does not establish compliance or suitability for real customer data. Lead scoring remains deterministic, versioned and explainable.

Jobs it covers