A composable, multi-tenant, agentic telecom BSS

What it is

A working telecom BSS assembled from small, standards-conformant services — each exposing a TM Forum Open API, each owning its own database, all behind one gateway. Nothing is operator-specific: any OIDC identity provider, any PostgreSQL, any Kafka-protocol broker. Two demo operators (one English/EUR, one Norwegian/NOK) run side by side on a single deployment to prove the multi-tenancy.

• Commerce: TMF620 catalog, ordering, inventory, cart, qualification, appointments, stock, agreements, promotions — soft bundles, configured pricing, no SKU explosion.
• Money: a crash-resumable billing run, seven e-invoice formats as config, remittance by camt.054 / OCR giro / BAI2, a tokenized payment vault.
• Marketing & growth (built in, not bolted on): a full martech stack inside the BSS — event-triggered campaign journeys, A/B arms with an honest statistical verdict, and holdout-measured lift so you prove a campaign worked instead of claiming it; a per-tenant email seam with delivery receipts and bounce suppression, frequency caps and quiet hours, GA4 audience import and Meta-shaped Custom Audience / Lead Ads sync, and a TMF699 lead-to-opportunity sales funnel — no separate marketing cloud required.
• Personalization, consent-first: a "For you" rail ranked from the customer's own data, next-hit session reaction (the last thing you looked at shapes the next page), and "customers who bought this also bought" market-basket affinity — none of it collected or shown without consent.
• AI, governed: an AI control plane — every LLM turn metered, budgeted, kill-switchable and audited — under product/CSR copilots, a churn-prediction engine, and AI-authored personalization rules an operator can chat into existence.
• Agentic commerce, switchable: an Agentic Commerce Protocol merchant surface — the open standard behind ChatGPT Instant Checkout — plus the same catalog and checkout as MCP tools, so AI shopping agents can find, compare and buy. Checkout runs on a delegated, provably commerce-only token; every operator holds a per-tenant switch: off, discovery, or full.
• A digital workforce, employed: autonomous AI workers on the operator's own back-office and care queues — hired with a revocable staff badge, completion verified (a worker cannot mark done what is not done), refunds and cease only ever proposed for a human's click, and a Workforce dashboard with the KPIs that prove reduced workload: deflection, handle time, reopen rate, minutes saved. Hermes Agent is the documented reference runtime; any MCP agent hires in.
• Post-quantum ready (not "quantum-proof"): crypto-agile by construction — identity, transport and payment crypto behind seams, so migration is a swap, not a rewrite. AES-256-GCM at rest, PKCE S256, a hybrid X25519MLKEM768 TLS key exchange against harvest-now-decrypt-later; the one vulnerable primitive — RSA token signatures — named honestly and swappable to ML-DSA at the identity seam.
• Care & production: trouble tickets, an omnichannel interaction record, thin service orchestration and assurance, number porting.

Your only BSS — or the layer on top of the ones you have

First, what this is NOT: a wrapper. genalpha-bss is a full-fledged, next-generation BSS — catalog to order to activation to bill to cash, 38 components, 87 proof suites, 25 conformance kits at zero — sufficient to run as an operator's only BSS, and doing exactly that for every tenant in this repo. But most operators already run several stacks, and nobody rips one out — so the SAME product also deploys as the agentic layer on top: channels, governed AI, agents that buy from you and a workforce that works for you, over your existing estate through the per-tenant seam pattern that already carries the PIM, the ESP, the PSP and the bank — a legacy BSS is just another seam, with one rule that keeps overlays alive: never two writers. Then the roadmap makes itself: the next brand launches natively in minutes, workloads migrate at your pace, and retiring the old estate becomes an accounting decision. And the overlay is proven, not promised: suite #67 wraps a deliberately old-shaped legacy stack — federates its catalog into the agentic feed, sells from it, hands fulfilment back to the legacy queue, and has the digital workforce resolve a legacy incident with completion verified against the legacy system itself. The overlay strategy in full →

Read more

Proven, not promised

Eighty-seven Playwright suites drive real browsers across every surface; twenty-five official TM Forum Conformance Test Kits pass with zero failures — every kit the standards body publishes for a capability this suite serves; three production hardening waves are backed by live proofs (tick locks under two replicas, a backup that provably restores, GDPR rights as working endpoints); and the same Helm chart has run on local Kubernetes, AWS EKS and Azure AKS — the same application, every cloud difference absorbed by a seam. The honest gaps are written down, not hidden.

Ready for the agentic storefront

Commerce is moving into AI assistants: ChatGPT, Perplexity and their peers now shop for the customer, and the merchants they can see are the merchants that get bought from. genalpha-bss ships an Agentic Commerce Protocol (ACP) merchant surface — the OpenAI/Stripe open standard behind Instant Checkout, implemented to spec 2026-04-17: a public product feed projected straight from the TMF620 catalog, and the full checkout_sessions lifecycle (create, update, complete, cancel) riding the same cart and order components every human channel uses. The identical surface is exposed as MCP tools, so Claude-class agents buy through the same door. The details a CSP will actually ask about are answered: checkout uses a delegated token (OAuth token exchange) that can order and pay and provably nothing else — the proof suite decodes it; completion is idempotent, so an agent retry can never buy twice; every agent order is channel-marked and tenant-walled; and each operator controls its own exposure with one live-refreshed switch — off (dark to agents), discovery (findable, checkout stays human), or full. Default off: being shopped by AI is a choice the operator makes, not a default it discovers.

Before an agent can buy, an answer engine has to recommend — and AI crawlers execute no JavaScript, so a modern SPA shop is invisible to them. Here every offering URL dual-serves: humans get the app, GPTBot-class crawlers get complete HTML with schema.org Product/Offer markup rendered live from the catalog — the proof suite asserts the bot page's price equals the catalog's on every run, so the two faces are proven equal, never maintained equal. The operator holds this switch too: ai-visibility — open, search-only (classic search yes, AI answer/training bots no — the middle state most operators actually want), or dark — executed at robots.txt, the lever crawlers actually obey. And the honest note: llms.txt ships for open tenants, labeled as the speculative courtesy the adoption data says it is.

And the mirror image — agents that work FOR the operator: an extension package employs an autonomous AI worker (Hermes Agent documented end to end; any MCP-speaking runtime hires in) on the real back-office and care backlogs. The employment terms are the product: the badge is a revocable staff grant, task completion is verified against the source system, refunds/cease/erasure only ever become approval requests a human executes with their own token, one kill-switch stops workers and copilots alike — and the Workforce dashboard shows deflection, handle time, the reopen rate (the metric a vendor would hide), and minutes saved labeled as the estimate it is. Reduced human workload, with the receipts on the wall.

Post-quantum ready (not "quantum-proof")

The BSS is crypto-agile by construction — identity, transport and payment crypto all live behind seams, so migrating to post-quantum is swapping what a seam points at, not a rewrite. Today: SIM secrets are AES-256-GCM at rest, PKCE is SHA-256, and a hybrid X25519MLKEM768 TLS key exchange (ML-KEM-768, FIPS 203) guards recorded traffic against harvest-now-decrypt-later. The one classically vulnerable primitive — RSA token signatures at the identity provider — is named honestly and swaps to ML-DSA at the identity seam when the OIDC ecosystem lands it. We say post-quantum ready, receipts in the repo — never "quantum-proof," because a claim you can't back is the one thing this project won't make. The full crypto inventory →