What is a CRM framework?

CRM framework, defined

People ask this as: what is a crm framework, open source crm framework for developers

A CRM framework is source code a development team composes into its own CRM application: the framework supplies the runtime contracts — records, services, workflows, policies — and the team supplies the domain. A CRM product is configured; a CRM framework is programmed, and the resulting application belongs to whoever wrote it rather than to a vendor. Accordo is an open source CRM framework for developers and their coding agents, MIT-licensed, with SQLite as a Node built-in and one pinned pg@8.23.0 driver for PostgreSQL — and nothing about the term makes the result deployable: this one ships no authentication, application composition supports SQLite and dedicated PostgreSQL, and it has no hosted offering.

Where this stops

Read this before the rest of the page. Every line below is a thing this does not do.

  • A CRM framework is not a CRM product. What you run is an application in your repository; the managed Cloud is the separate hosted offer (L-07).
  • 'Open source CRM framework' describes the licence and the source, not a distribution channel. The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08).
  • 'CRM for developers' does not make the result deployable. No authentication ships (L-01), and persistence supports SQLite and dedicated-database PostgreSQL (L-02).
  • SQLite needs no third-party driver; PostgreSQL carries the pinned pg@8.23.0. That is a property of the framework, not of the application you build on it.
  • The definition on this page is not a measured comparison. No benchmark has been run against building from scratch or against any product (L-03).

No authentication ships: the framework authenticates nobody. Production Spine v1 (ADR-038) gives the framework verified identity, organizations and memberships, server-authoritative authorization and one tenant per application instance — so tenancy and authorization now exist and are enforced. What does not exist is authentication: no login, password, session or OIDC implementation ships, and a deployment must supply the adapter that verifies the request. Production mode refuses to start without one. In local-development mode an actor header is accepted as an assertion and is not an identity, which is the default developer posture. This is not shared-database multi-tenancy and it is not a readiness claim. Every claim and every limitation is on one page.

The definition, and the line it draws

A CRM framework is a body of source code that a development team builds a customer relationship management application on top of. It provides the mechanics every CRM needs — a way to declare records, persist them, mutate them through services, run multi-step workflows, apply business policy and expose an API — and it deliberately does not provide the finished CRM. The domain (what a lead is, when a discount needs approval, what happens after a deal is won) is the application author's to write.

The line this draws is between configuring and programming. A CRM product — hosted or self-hosted — is configured: custom fields, automation rules, permission sets, all expressed inside the vendor's runtime and only meaningful there. A CRM framework is programmed: the output is an application in the team's own repository, reviewable in a diff and owned outright. 'CRM for developers' can mean either a product with a good API or a framework; the two are different categories, and the test is what you are left with if the vendor disappears — an account export, or a codebase.

'Open source CRM framework' adds a licence to that, not a capability. It says the framework's source may be read, changed and kept under the stated terms. It does not say the result is deployable, secure or complete, and a licence page is not an architecture page.

How Accordo implements the term

Accordo's unit of composition is a module manifest: the author declares a record's fields once, and the framework turns the declaration into a migration, a service, a REST resource, an SDK method and Admin screens, with no page code written by hand (C-01). Business behaviour is not generated — services, workflows and policies stay explicit, reviewable source, which is the property that makes the framework usable by a coding agent under human review.

Domains larger than one record live in packages. A customer-authored domain package attaches with one static import and detaches with the kernel's fingerprint unchanged, reaching other packages only through capabilities it declares (C-13) — so extending the CRM means adding a package, not forking a platform. Every mutation in the composed application goes through a module service or a named workflow and leaves an audit event and a step-level trace behind it (C-16).

The dependency posture is part of the definition here: Node 22, its built-in SQLite adapter, its built-in HTTP server and test runner, and one pinned pg@8.23.0 driver if you select PostgreSQL — no ORM (C-17). That is a property of the framework, not of your application; the next library you add is yours to carry.

Open source, with the distribution mechanics stated

The licence is MIT, confirmed by an ADR rather than assumed, and it covers this framework only — it decides nothing about the licence of the applications generated with it, which belong to their authors. That is the 'open source CRM framework' reading in full: source you may keep, read and change.

Distribution is narrower than the phrase usually implies, and this site states it rather than letting a reader discover it: what installs from npm is a scaffolder, not the framework. `npm create accordo` — the published `create-accordo@0.1.0` — scaffolds a working project by copying the framework source into it, and the same bootstrap runs from a checkout of this repository. Either way the framework is vendored into the project — so upgrading means merging changes into a copy, not bumping a version (L-08).

What the term does not buy

Being a framework does not make the output deployable, and this one is explicit about it. No authentication ships, so a deployment must supply the verifier (L-01); persistence supports SQLite and dedicated-database PostgreSQL (L-02); the managed Cloud hosts only Blueprint-configured workspaces — the framework's output is an application in your repository that you run (L-07).

Being a framework also does not make it measurably better than the alternatives. No benchmark has compared building on Accordo with building from scratch or with adopting a product: the build benchmark protocol is published and has not been run, so any number quoted for this project is not ours (L-03).

The evidence this page rests on

Claims and limitations are printed from site/claims.json word for word. Job statuses come from docs/benchmarks/jobs.json; a job with no page of its own is listed with its status rather than linked.

Claims

  • C-01 Write a module manifest; the agent turns it into a migration, a service, a REST resource, an SDK method and Admin screens — with no page code.

    LimitGenerated CRUD only. The factory does not generate workflows or approvals for a custom object — that is still handwritten (JTBD-06, partially supported).

  • C-13 A customer-authored domain package attaches and detaches with the kernel's fingerprint unchanged, and reaches another package only through a capability it declares.

    LimitThe scaffold that starts one writes an empty package and nothing else: no business logic, no composition, no global identity-uniqueness check. There is no registry, no marketplace, no publication and no sandboxing — package code runs with the host process's authority. Detaching leaves its data behind; there is no uninstall.

  • C-16 Every mutation goes through a module service or a named workflow, and leaves an audit event and a step-level trace behind it.

    LimitAudit records what the process did under an asserted actor. It is not a tamper-evident or externally attestable log, and it is not a compliance control.

  • C-17 SQLite is Node's built-in node:sqlite. PostgreSQL requires one pinned runtime driver, pg@8.23.0. There is no ORM, no query builder, no build step and no framework underneath your framework.

    LimitApplications that select PostgreSQL carry pg@8.23.0. The SQLite path still needs no third-party driver. This is not a production-readiness claim and not shared-database tenancy; composition is dedicated-database, not row tenancy.

Limitations

  • L-01 No authentication ships: the framework authenticates nobody. Production Spine v1 (ADR-038) gives the framework verified identity, organizations and memberships, server-authoritative authorization and one tenant per application instance — so tenancy and authorization now exist and are enforced. What does not exist is authentication: no login, password, session or OIDC implementation ships, and a deployment must supply the adapter that verifies the request. Production mode refuses to start without one. In local-development mode an actor header is accepted as an assertion and is not an identity, which is the default developer posture. This is not shared-database multi-tenancy and it is not a readiness claim.
  • L-02 Not shared-database tenancy. createAccordoAppAsync can boot one tenant onto dedicated PostgreSQL databases. Shared-database row-level tenancy is not implemented, and this is not a production-readiness claim.
  • L-03 The build benchmark has not been run. The protocol is designed and published; no Successful Agent Build Rate exists yet. Any number you see quoted for this project is not ours.
  • L-07 The framework is source you run; the Cloud hosts only what a Blueprint expresses. The framework is not a hosted service: its output is an application in your repository that you run. The managed Cloud is a separate offer: a free workspace on shared capacity configured through a Project Blueprint (record types, fields and approval gates), and a paid Dedicated Cell for custom application code.
  • L-08 Ownership means vendored source: there is no framework dependency to bump. The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08). The framework is copied into the project, not installed as a framework library dependency. The accordo npm name is an empty reservation; the @accordo scope is claimed and deliberately empty.

Jobs it covers