{
  "$schema": "https://github.com/ta-amps/ta-amps-hackathon/blob/main/hackathon/agents/schemas/architecture.schema.json",
  "schema_version": 1,
  "name": "eranos",
  "summary": "Eranos lets people donate unused AI tokens to build, test, and independently review off-the-shelf agent skills, read-only MCP tools, operational files (SOPs, checklists, CSV templates, Open Referral directories), and multi-step agentic processes for NGOs, nonprofits, and public-good teams. Contributors connect agents to scoped queues on Tessera (eq01 spec, eq02 build & test, eq03 independent review); deterministic checks verify SYNTHETIC test fixtures and step autonomy boundaries so interviews, crisis safety planning, individual decisions, and external sends stay strictly human-only; and a second contributor's agent or human steward (drafter != reviewer across both worker ID and Tessera key ID) approves each package before atomic compare-and-set publication into eranos.catalog. Alongside Shamash (shamash.<domain>), Eranos (eranos.<domain>) runs on Tessera (tessera.<domain>) under a single shared domain.",
  "status": {
    "as_of": "2026-10-29",
    "stage": "prototype",
    "notes": "Schemas, copy and topic guards, strict JSON loader, six NGO and nonprofit tracks, deterministic verifier, two-step Tessera pipeline (eq01 -> eq02 -> eq03) with steward park/resume and CAS catalog publication, traced local/HTTP adapter, FastAPI service with edge lockdown, React 19 + Astryx web app with offline snapshot mode, and task briefs E1-E4 built and tested (56 pytest tests, one of which needs a ta-amps-hackathon checkout alongside, plus Tessera's conformance suite through the adapter: 30 passed, 6 skipped)."
  },
  "docs": {
    "summary": "docs/summary.md",
    "nouns_and_verbs": "docs/nouns-and-verbs.md",
    "status": "docs/status.md",
    "architecture": "docs/architecture.md",
    "setup": "docs/setup.md",
    "opencode_donors": "docs/opencode-donors.md",
    "comparison": "docs/comparison.md",
    "generalizing": "docs/generalizing.md",
    "decisions": "docs/decisions.md",
    "glossary": "docs/glossary.md",
    "review": "docs/review.md",
    "frontend": "docs/frontend.md",
    "naming_and_extensions": "docs/naming-and-extensions.md",
    "handoff": "docs/handoff.md"
  },
  "read_order": [
    "README.md",
    "docs/nouns-and-verbs.md",
    "docs/status.md",
    "docs/summary.md",
    "docs/architecture.md",
    "docs/generalizing.md",
    "docs/naming-and-extensions.md",
    "tracks/README.md",
    "examples/kits/README.md",
    "docs/frontend.md",
    "docs/setup.md",
    "docs/opencode-donors.md",
    "docs/comparison.md",
    "docs/decisions.md",
    "docs/glossary.md",
    "docs/review.md",
    "docs/handoff.md",
    "AGENTS.md"
  ],
  "commands": {
    "setup": "make setup",
    "check": "make check",
    "test": "make test",
    "suite": "make suite BACKEND=local",
    "verify_examples": "make verify-examples",
    "donor_demo": "make donor-demo",
    "tracks": "uv run eranos tracks",
    "snapshot": "make snapshot",
    "run": "make web",
    "web_check": "make web-check",
    "architecture": "make architecture",
    "index": "make index",
    "record_runs": "make record-runs"
  },
  "components": [
    {
      "id": "copy",
      "title": "Copy and topic guards",
      "path": "eranos/copy.py",
      "kind": "library",
      "domain": "neutral",
      "role": "Refuses accusatory labels in every kit text and blocks surveillance, scraping, or personal-data-harvesting topics",
      "tests": [
        "tests/test_schemas_and_copy.py"
      ]
    },
    {
      "id": "privacy",
      "title": "Personal-data screen",
      "path": "eranos/privacy.py",
      "kind": "library",
      "domain": "neutral",
      "role": "Finds common contact, identity and payment patterns and record-like lines in requests and reports, naming kinds and fields but never the matched text",
      "tests": [
        "tests/test_open_contribution.py"
      ]
    },
    {
      "id": "records",
      "title": "Schemas and records",
      "path": [
        "eranos/schemas/tracks.py",
        "eranos/schemas/records.py",
        "eranos/schemas/__init__.py"
      ],
      "kind": "library",
      "domain": "neutral",
      "role": "Strict Pydantic models for tracks, kit requests, agent skills, read-only MCP tools, autonomy boundaries, published kits, and briefs",
      "depends_on": [
        "copy"
      ],
      "tests": [
        "tests/test_schemas_and_copy.py"
      ]
    },
    {
      "id": "jsonfile",
      "title": "Strict JSON loader",
      "path": "eranos/jsonfile.py",
      "kind": "library",
      "domain": "neutral",
      "role": "Loads track packs, kit bundles, and briefs while rejecting duplicate keys and NaN/Infinity",
      "tests": [
        "tests/test_schemas_and_copy.py"
      ]
    },
    {
      "id": "tracks",
      "title": "Track registry and packs",
      "path": [
        "eranos/tracks.py",
        "tracks"
      ],
      "kind": "data",
      "domain": "mixed",
      "role": "Loads the anti-exploitation NGO and general nonprofit operations tracks from JSON data packs",
      "depends_on": [
        "jsonfile",
        "records"
      ],
      "tests": [
        "tests/test_tracks_and_verifier.py"
      ]
    },
    {
      "id": "verifier",
      "title": "Deterministic kit verifier",
      "path": "eranos/verifier.py",
      "kind": "library",
      "domain": "neutral",
      "role": "Checks workflow autonomy boundaries, open SPDX allowlist, required human_only step kinds, MCP JSON Schema structure, HTTPS source citations, SYNTHETIC fixtures, and zero-storage practice verification",
      "depends_on": [
        "copy",
        "records",
        "tracks"
      ],
      "tests": [
        "tests/test_tracks_and_verifier.py"
      ]
    },
    {
      "id": "queues",
      "title": "Queue stage contracts",
      "path": "eranos/queues",
      "kind": "worker",
      "domain": "neutral",
      "role": "Defines eq01 (spec), eq02 (draft), and eq03 (review) leased queue configurations on Tessera"
    },
    {
      "id": "pipeline",
      "title": "Two-step volunteer pipeline",
      "path": [
        "eranos/pipeline",
        "examples/kits"
      ],
      "kind": "worker",
      "domain": "neutral",
      "role": "Runs eq01 -> eq02 -> eq03, stores canonical SHA-256 blobs, enforces drafter != reviewer and deterministic re-verification, parks/resumes for steward sign-off, and writes atomically via CAS; composes example kits that point at seed packs from the library, refusing any pin or step that drifted",
      "depends_on": [
        "copy",
        "jsonfile",
        "privacy",
        "queues",
        "records",
        "tracks",
        "verifier"
      ],
      "tests": [
        "tests/test_pipeline.py",
        "tests/test_seed_packs.py"
      ]
    },
    {
      "id": "log",
      "title": "Run log and config",
      "path": [
        "eranos/log.py",
        "eranos/config.py"
      ],
      "kind": "library",
      "domain": "neutral",
      "role": "Environment-only settings and JSON Lines trace writer for fabric operations"
    },
    {
      "id": "adapter",
      "title": "Tessera fabric adapter",
      "path": "eranos/adapter",
      "kind": "library",
      "domain": "neutral",
      "role": "Wraps local SQLite tessera.Store or HTTP tessera.client.Client behind one traced backend switch (ERANOS_BACKEND)",
      "depends_on": [
        "log"
      ],
      "tests": [
        "tests/test_pipeline.py"
      ]
    },
    {
      "id": "api",
      "title": "HTTP API",
      "path": [
        "eranos/api/app.py",
        "eranos/api/__init__.py"
      ],
      "kind": "service",
      "domain": "neutral",
      "role": "FastAPI service for tracks, filtered verified catalog, zero-storage practice gate, open briefs, queue counts, and AI-agent discovery/MCP; locked to Cloudflare edge via x-edge-auth",
      "depends_on": [
        "adapter",
        "log",
        "pipeline",
        "queues",
        "records",
        "tracks",
        "verifier"
      ],
      "interfaces": [
        "api"
      ],
      "tests": [
        "tests/test_api_and_edge.py"
      ]
    },
    {
      "id": "cli",
      "title": "CLI and donor worker",
      "path": [
        "eranos/cli.py",
        "eranos/donor_worker.py",
        "eranos/contributor.py",
        "eranos/requester.py",
        "eranos/intake.py",
        "eranos/e2e.py"
      ],
      "kind": "cli",
      "domain": "neutral",
      "role": "eranos tracks, verify-examples, practice, donor-demo (two-donor synthesis and review over Tessera HTTP), seed-requests, and export-snapshot, and record-example-runs (one example-run evidence noun per example kit)",
      "depends_on": [
        "adapter",
        "copy",
        "log",
        "pipeline",
        "queues",
        "records",
        "tracks",
        "verifier"
      ],
      "interfaces": [
        "cli"
      ],
      "tests": [
        "tests/test_example_runs.py",
        "tests/test_open_contribution.py",
        "tests/test_pipeline.py"
      ]
    },
    {
      "id": "web",
      "title": "Web app",
      "path": [
        "web/src",
        "web/public",
        "web/snapshot"
      ],
      "kind": "web",
      "domain": "neutral",
      "role": "React 19 and Astryx catalog with governance filters, autonomy boundary inspector, zero-storage practice verifier, agent onboarding guide, and offline snapshot viewer",
      "depends_on": [
        "api"
      ],
      "interfaces": [
        "web"
      ],
      "tests": [
        "web/tests/shell.spec.ts",
        "web/tests/marketplace.spec.ts"
      ]
    },
    {
      "id": "edge",
      "title": "Edge Worker",
      "path": [
        "deploy/cloudflare/worker.js",
        "deploy/cloudflare/wrangler.jsonc"
      ],
      "kind": "edge",
      "domain": "neutral",
      "role": "Serves web/dist, proxies /api/* with x-edge-auth, and attaches HSTS, CSP, nosniff, and frame-deny headers",
      "depends_on": [
        "api",
        "web"
      ]
    },
    {
      "id": "nouns",
      "title": "Page, onboarding and rules nouns",
      "path": [
        "eranos/nouns.py",
        "instructions",
        "examples/sources",
        "examples/requests"
      ],
      "kind": "data",
      "domain": "neutral",
      "role": "Versioned source files for the onboarding steps, starting brief, request guidance, classify and research rules and stand-in sources, plus the public-research packs read from the seed-pack library; seeded to Tessera and rendered by the surfaces",
      "depends_on": [
        "jsonfile"
      ],
      "tests": [
        "tests/test_open_contribution.py",
        "tests/test_marketplace_site.py"
      ]
    }
  ],
  "interfaces": [
    {
      "id": "api",
      "kind": "http",
      "served_by": "api",
      "spec": "docs/frontend.md",
      "auth": "None locally; locked to Cloudflare Worker via x-edge-auth when ERANOS_EDGE_SECRET is set, with health and AI-agent discovery routes edge-exempt",
      "entry_points": [
        "GET /api/health",
        "GET /api/handshake",
        "GET /api/tracks",
        "GET /api/catalog",
        "GET /api/catalog/{kit_id}",
        "POST /api/practice",
        "GET /api/examples",
        "GET /api/requests",
        "GET /api/fabric",
        "GET /api/feed",
        "GET /favicon.svg",
        "GET /healthz",
        "GET /robots.txt",
        "GET /llms.txt",
        "GET /llms-full.txt",
        "GET /.well-known/agent-card.json",
        "POST /mcp"
      ]
    },
    {
      "id": "cli",
      "kind": "cli",
      "served_by": "cli",
      "auth": "Local shell",
      "entry_points": [
        "eranos tracks",
        "eranos verify-examples [--dry-run]",
        "eranos practice <kit.json> [--dry-run]",
        "eranos donor-demo [--live-ollama]",
        "eranos seed-requests",
        "eranos export-snapshot [OUT_DIR]",
        "eranos record-example-runs [OUT_DIR]"
      ]
    },
    {
      "id": "web",
      "kind": "web",
      "served_by": "web",
      "spec": "docs/frontend.md",
      "auth": "None (synthetic fixtures and verified public-good schemas only)",
      "entry_points": [
        "/",
        "/help",
        "/nonprofits",
        "/catalog",
        "/catalog/{id}",
        "/contribute",
        "/tracks",
        "/fabric",
        "/about"
      ]
    }
  ],
  "data_stores": [
    {
      "id": "track-packs",
      "kind": "JSON files",
      "owned_by": "tracks",
      "path": "tracks",
      "holds": [
        "NGO and nonprofit track definitions",
        "required human_only step kinds",
        "primary public sources"
      ]
    },
    {
      "id": "example-kits",
      "kind": "JSON files",
      "owned_by": "pipeline",
      "path": "examples/kits",
      "holds": [
        "synthetic volunteer kit requests, drafts, steward sign-offs, and review decisions"
      ]
    },
    {
      "id": "fabric",
      "kind": "Tessera (local SQLite store or HTTP service)",
      "owned_by": "adapter",
      "location": "ERANOS_LOCAL_DB or TESSERA_URL",
      "holds": [
        "eq01/eq02/eq03 tasks and leases",
        "SHA-256 canonical kit blobs",
        "CAS stores eranos.catalog and eranos.index"
      ]
    },
    {
      "id": "traces",
      "kind": "JSON Lines",
      "owned_by": "log",
      "location": "ERANOS_TRACE, default traces/run.jsonl",
      "holds": [
        "timestamped Tessera verb calls and queue telemetry"
      ]
    },
    {
      "id": "seed-pack-library",
      "kind": "JSON files in another repository, read only",
      "owned_by": "pipeline",
      "location": "ERANOS_SEED_PACKS, default ../seed-packs-library-of-nouns-and-verbs",
      "holds": [
        "the kit, skill, tool card, file, checklist, source, test case and example request nouns of referenced example kits",
        "the verb template behind each step of those kits"
      ]
    },
    {
      "id": "example-runs",
      "kind": "JSON files",
      "owned_by": "cli",
      "path": "examples/runs",
      "holds": [
        "one evidence noun per example kit: the receipts of checking, building and reviewing it on a throwaway local store, input digests, source commits, the kind of computer and zero model calls"
      ]
    },
    {
      "id": "request-nouns",
      "kind": "Tessera records",
      "owned_by": "pipeline",
      "path": "eranos/pipeline/request_noun.py",
      "holds": [
        "eranos.requests: each request's state and parts",
        "eranos.plans: the classify step's plan in plain words, tied to its receipt",
        "eranos.solutions: delivered reports with their review receipts"
      ]
    }
  ],
  "boundaries": [
    {
      "id": "browser-edge",
      "between": [
        "browser",
        "edge"
      ],
      "rule": "Static app and /api/* only; strict CSP, HSTS, nosniff, and X-Frame-Options: DENY on every response",
      "enforced_by": "deploy/cloudflare/worker.js"
    },
    {
      "id": "edge-api",
      "between": [
        "edge",
        "api"
      ],
      "rule": "When ERANOS_EDGE_SECRET is set, x-edge-auth must match in constant time except GET /api/health and public health/agent-discovery routes",
      "enforced_by": "eranos/api/app.py",
      "checked_by": [
        "tests/test_api_and_edge.py::test_edge_lockdown_blocks_direct_origin_requests"
      ]
    },
    {
      "id": "two-step-publication",
      "between": [
        "eq02-drafter",
        "eq03-reviewer"
      ],
      "rule": "No kit enters eranos.catalog unless deterministic verification passes and an independent reviewer (worker != drafter and key != drafter_key) approves it",
      "enforced_by": "eranos/pipeline/run.py",
      "checked_by": [
        "tests/test_pipeline.py::test_self_review_by_same_worker_or_key_is_refused",
        "tests/test_pipeline.py::test_unverified_draft_cannot_be_approved"
      ]
    },
    {
      "id": "human-autonomy-floor",
      "between": [
        "kit-tools",
        "people"
      ],
      "rule": "Interviews, crisis safety planning, legal judgments, individual decisions, and external sends are refused unless marked human_only; MCP tools are read-only",
      "enforced_by": "eranos/schemas/records.py",
      "checked_by": [
        "tests/test_schemas_and_copy.py::test_interviews_and_decisions_must_stay_human_only",
        "tests/test_tracks_and_verifier.py::test_verifier_catches_missing_track_required_human_only_kind"
      ]
    }
  ],
  "invariants": [
    {
      "id": "E1",
      "statement": "No kit, track, or fixture accuses a party or requests surveillance, scraping, or personal-data harvesting",
      "enforced_by": "copy",
      "checked_by": [
        "tests/test_schemas_and_copy.py::test_accusatory_words_are_blocked",
        "tests/test_schemas_and_copy.py::test_prohibited_collection_topics_are_blocked"
      ]
    },
    {
      "id": "E2",
      "statement": "Interviews, crisis safety plans, legal judgments, individual decisions, and external transmissions stay human_only",
      "enforced_by": "records",
      "checked_by": [
        "tests/test_schemas_and_copy.py::test_interviews_and_decisions_must_stay_human_only",
        "tests/test_tracks_and_verifier.py::test_verifier_catches_missing_track_required_human_only_kind"
      ]
    },
    {
      "id": "E3",
      "statement": "Every fixture carries the SYNTHETIC mark and strict JSON files refuse duplicate keys and NaN",
      "enforced_by": "jsonfile",
      "checked_by": [
        "tests/test_schemas_and_copy.py::test_synthetic_fixture_requires_synthetic_mark",
        "tests/test_schemas_and_copy.py::test_strict_json_rejects_duplicate_keys_and_nan"
      ]
    },
    {
      "id": "E4",
      "statement": "Engine code is domain-neutral and names zero track IDs or kit IDs; tracks, custom domains, step kinds, and deliverable packs load as pure data",
      "enforced_by": "tracks",
      "checked_by": [
        "tests/test_tracks_and_verifier.py::test_every_track_loads_across_both_domains",
        "tests/test_tracks_and_verifier.py::test_neutral_code_names_no_track_or_kit_id",
        "tests/test_tracks_and_verifier.py::test_custom_domains_step_kinds_and_deliverable_artifacts_need_no_code_changes"
      ]
    },
    {
      "id": "E5",
      "statement": "Single-agent publication is refused: drafter and reviewer must differ across both worker ID and Tessera key ID",
      "enforced_by": "pipeline",
      "checked_by": [
        "tests/test_schemas_and_copy.py::test_published_kit_refuses_same_drafter_and_reviewer",
        "tests/test_pipeline.py::test_self_review_by_same_worker_or_key_is_refused"
      ]
    },
    {
      "id": "E6",
      "statement": "Unverified drafts cannot be published even if an upstream worker forges a verification report",
      "enforced_by": "pipeline",
      "checked_by": [
        "tests/test_pipeline.py::test_unverified_draft_cannot_be_approved",
        "tests/test_tracks_and_verifier.py::test_every_example_kit_passes_deterministic_verifier"
      ]
    },
    {
      "id": "E7",
      "statement": "Sensitive kits park on Tessera for human nonprofit steward sign-off and publish atomically via CAS upon resume",
      "enforced_by": "pipeline",
      "checked_by": [
        "tests/test_pipeline.py::test_steward_signoff_parks_and_resumes_on_tessera",
        "tests/test_pipeline.py::test_two_step_pipeline_publishes_verified_kit_to_cas_store"
      ]
    },
    {
      "id": "E8",
      "statement": "Agent briefs never carry public effect, API routes reject invalid kit IDs and unauthenticated origin traffic, and private names never leak",
      "enforced_by": "api",
      "checked_by": [
        "tests/test_briefs_and_public.py::test_agent_brief_refuses_public_effect",
        "tests/test_briefs_and_public.py::test_check_public_passes_cleanly",
        "tests/test_api_and_edge.py::test_invalid_kit_id_is_rejected_with_400",
        "tests/test_api_and_edge.py::test_edge_lockdown_blocks_direct_origin_requests"
      ]
    },
    {
      "id": "E9",
      "statement": "A referenced example kit takes its content only from its seed pack: every pin matches the noun's digest, and every step matches its verb template's title and claimant",
      "enforced_by": "pipeline",
      "checked_by": [
        "tests/test_seed_packs.py::test_a_changed_library_noun_is_refused",
        "tests/test_seed_packs.py::test_the_example_cannot_carry_kit_content",
        "tests/test_seed_packs.py::test_each_step_must_match_its_verb_template"
      ]
    },
    {
      "id": "E10",
      "statement": "The site's example needs and example-run count come from nouns: each kit's need from its seed pack, and the count from one recorded run per example kit whose example and inputs still match their digests",
      "enforced_by": "cli",
      "checked_by": [
        "tests/test_example_runs.py::test_every_example_kit_has_a_current_recorded_run",
        "tests/test_example_runs.py::test_the_site_reads_needs_and_run_counts_from_these_nouns"
      ]
    },
    {
      "id": "E11",
      "statement": "Work by a tracked anonymous session is published or delivered only after review by a different keyed worker or a person; anonymous sessions never claim review verbs or write the catalog",
      "enforced_by": "pipeline",
      "checked_by": [
        "tests/test_open_contribution.py::test_only_reviewed_work_is_published_or_delivered",
        "tests/test_open_contribution.py::test_abuse_cases_hold"
      ]
    },
    {
      "id": "E12",
      "statement": "A nonprofit's request becomes exactly one eq01 verb, which an authorized worker classifies and splits into public research and kit parts, recorded as a plan noun",
      "enforced_by": "pipeline",
      "checked_by": [
        "tests/test_open_contribution.py::test_typing_a_request_enqueues_exactly_one_verb",
        "tests/test_open_contribution.py::test_classify_then_split_routes_public_private_and_mixed_requests"
      ]
    },
    {
      "id": "E13",
      "statement": "Personal data is refused before a request is stored, and public reports cite a public source for every claim, say they are not legal advice when legal, and leave the decision to a person",
      "enforced_by": "privacy",
      "checked_by": [
        "tests/test_open_contribution.py::test_personal_data_screen_names_kinds_never_text",
        "tests/test_open_contribution.py::test_report_guardrails_refuse_scraping_uncited_claims_and_missing_disclaimers"
      ]
    }
  ],
  "import_rules": [
    {
      "id": "ring0-domain-is-pure",
      "package": "eranos",
      "package_root": "eranos",
      "files": [
        "eranos/schemas",
        "eranos/copy.py",
        "eranos/privacy.py"
      ],
      "must_not_import": [
        "eranos.tracks",
        "eranos.verifier",
        "eranos.jsonfile",
        "eranos.queues",
        "eranos.pipeline",
        "eranos.adapter",
        "eranos.api",
        "eranos.cli",
        "eranos.donor_worker",
        "eranos.config",
        "eranos.log",
        "tessera",
        "httpx",
        "requests",
        "fastapi",
        "starlette",
        "os",
        "pathlib",
        "sqlite3",
        "subprocess",
        "socket"
      ],
      "why": "Ring 0 holds pure records, autonomy boundaries, and text safety rules with zero I/O or fabric dependencies"
    },
    {
      "id": "ring1-deterministic-services-make-no-calls",
      "package": "eranos",
      "package_root": "eranos",
      "files": [
        "eranos/verifier.py",
        "eranos/tracks.py",
        "eranos/jsonfile.py"
      ],
      "must_not_import": [
        "eranos.queues",
        "eranos.pipeline",
        "eranos.adapter",
        "eranos.api",
        "eranos.cli",
        "eranos.donor_worker",
        "eranos.config",
        "eranos.log",
        "tessera",
        "httpx",
        "requests",
        "fastapi",
        "starlette",
        "sqlite3",
        "subprocess",
        "socket",
        "eranos.contributor",
        "eranos.requester",
        "eranos.e2e",
        "eranos.intake"
      ],
      "why": "Ring 1 runs deterministic verification and strict JSON loading without touching Tessera, adapters, or network"
    },
    {
      "id": "ring2-use-cases-see-ports-not-engines",
      "package": "eranos",
      "package_root": "eranos",
      "files": [
        "eranos/queues",
        "eranos/pipeline"
      ],
      "must_not_import": [
        "tessera.Store",
        "tessera.store",
        "tessera.client",
        "tessera.service",
        "tessera.mcp_door",
        "tessera.pages",
        "tessera.cli",
        "tessera.testing",
        "eranos.adapter",
        "eranos.config",
        "eranos.log",
        "eranos.api",
        "eranos.cli",
        "eranos.donor_worker",
        "httpx",
        "requests",
        "fastapi",
        "sqlite3",
        "eranos.contributor",
        "eranos.requester",
        "eranos.e2e",
        "eranos.intake"
      ],
      "why": "Ring 2 orchestrates eq01 -> eq02 -> eq03 against an injected Tessera Backend port without knowing local SQLite vs HTTP"
    },
    {
      "id": "ring3-adapters-never-reach-inward-use-cases-or-doors",
      "package": "eranos",
      "package_root": "eranos",
      "files": [
        "eranos/adapter",
        "eranos/config.py",
        "eranos/log.py"
      ],
      "must_not_import": [
        "eranos.queues",
        "eranos.pipeline",
        "eranos.api",
        "eranos.cli",
        "eranos.donor_worker",
        "fastapi",
        "starlette",
        "eranos.contributor",
        "eranos.requester",
        "eranos.e2e",
        "eranos.intake"
      ],
      "why": "Ring 3 constructs backends and trace logs; it never calls the pipeline or HTTP/CLI doors"
    },
    {
      "id": "ring4-doors-are-leaves",
      "package": "eranos",
      "package_root": "eranos",
      "files": [
        "eranos/schemas",
        "eranos/copy.py",
        "eranos/jsonfile.py",
        "eranos/tracks.py",
        "eranos/verifier.py",
        "eranos/queues",
        "eranos/pipeline",
        "eranos/adapter",
        "eranos/config.py",
        "eranos/log.py",
        "eranos/privacy.py",
        "eranos/nouns.py"
      ],
      "must_not_import": [
        "eranos.api",
        "eranos.cli",
        "eranos.donor_worker",
        "eranos.contributor",
        "eranos.requester",
        "eranos.e2e",
        "eranos.intake"
      ],
      "why": "Ring 4 (API and CLI) are leaf entry points; nothing inward depends on them"
    },
    {
      "id": "package-never-imports-dev-roots",
      "package": "eranos",
      "package_root": "eranos",
      "files": [
        "eranos"
      ],
      "must_not_import": [
        "tests",
        "scripts",
        "briefs",
        "traces",
        "deploy",
        "web"
      ],
      "why": "Runtime package code never imports test, build, or deployment folders"
    }
  ],
  "claims": [
    {
      "id": "EC1",
      "claim": "Volunteer agents build across both anti-exploitation NGO tracks and everyday nonprofit operations tracks using one domain-neutral engine",
      "status": "built",
      "evidence": [
        "tracks/README.md",
        "tests/test_tracks_and_verifier.py::test_every_track_loads_across_both_domains",
        "tests/test_tracks_and_verifier.py::test_neutral_code_names_no_track_or_kit_id"
      ],
      "verify": "uv run eranos tracks"
    },
    {
      "id": "EC2",
      "claim": "Two-step Tessera verification guarantees drafter != reviewer across worker ID and key ID, with steward park/resume and atomic CAS publication",
      "status": "built",
      "evidence": [
        "eranos/pipeline/run.py",
        "tests/test_pipeline.py::test_two_step_pipeline_publishes_verified_kit_to_cas_store",
        "tests/test_pipeline.py::test_self_review_by_same_worker_or_key_is_refused",
        "tests/test_pipeline.py::test_steward_signoff_parks_and_resumes_on_tessera"
      ],
      "verify": "make verify-examples"
    },
    {
      "id": "EC3",
      "claim": "Interviews, crisis safety planning, legal judgments, individual decisions, and external sends are deterministically restricted to human_only",
      "status": "built",
      "evidence": [
        "eranos/verifier.py",
        "tests/test_schemas_and_copy.py::test_interviews_and_decisions_must_stay_human_only",
        "tests/test_pipeline.py::test_unverified_draft_cannot_be_approved"
      ],
      "verify": "make test"
    },
    {
      "id": "EC4",
      "claim": "Hosted on Fly.io behind a Cloudflare Worker on eranos.<domain> alongside shamash.<domain> and tessera.<domain> under one shared domain",
      "status": "partial",
      "evidence": [
        "deploy/fly/fly.toml",
        "deploy/cloudflare/worker.js",
        "deploy/bootstrap-hosting.sh",
        "tests/test_api_and_edge.py::test_edge_lockdown_blocks_direct_origin_requests"
      ],
      "verify": "deploy/bootstrap-hosting.sh --dry-run"
    }
  ],
  "deployment": [
    {
      "id": "local",
      "how": "make web",
      "parts": [
        "API on :7720",
        "web app on :5174",
        "local Tessera SQLite store (.eranos/local.db)"
      ]
    },
    {
      "id": "offline-demo",
      "how": "make snapshot && pnpm --dir web snapshot:build",
      "parts": [
        "static verified catalog in web/dist",
        "zero backend requests"
      ]
    },
    {
      "id": "hosted",
      "how": "deploy/bootstrap-hosting.sh, then GitHub deploy workflow with approval",
      "parts": [
        "Cloudflare Worker eranos (eranos.<domain>, static app and /api proxy)",
        "Fly.io app eranos-api with a 1 GB volume"
      ]
    }
  ],
  "generalization": {
    "neutral": [
      "copy and safe-topic guards",
      "schemas and autonomy boundary rules",
      "deterministic kit verifier",
      "two-step eq01 -> eq02 -> eq03 pipeline and CAS publisher",
      "Tessera adapter and trace logger",
      "API and web catalog"
    ],
    "specific": [
      "track data packs in tracks/<id>/track.json",
      "synthetic kit bundles in examples/kits/*.json"
    ],
    "extension_points": [
      {
        "id": "track",
        "what": "A new NGO or nonprofit track",
        "how": "Add tracks/<id>/track.json specifying domain, organizations, agent_helps_with, human_must_do, required_human_only_kinds, and dated HTTPS sources",
        "path": "tracks"
      },
      {
        "id": "kit",
        "what": "A new verified operational kit",
        "how": "Submit a KitRequest to eq01, draft on eq02 with one volunteer agent, and approve on eq03 with an independent reviewer",
        "path": "examples/kits"
      }
    ]
  },
  "limitations": [
    "Every example fixture is synthetic; real NGO deployments require local partner review of directory contacts and jurisdictional rules",
    "MCP tool contracts in the catalog are specifications and schemas (read_only: true); organizations wire them to their own local spreadsheets or directories",
    "Live custom-domain cutover awaits binding the shared root domain on the ta-amps Cloudflare zone"
  ],
  "open_questions": [
    "Should tracks specify per-country helpline re-verification intervals shorter than 90 days?",
    "Should high-impact kits require two independent volunteer reviewers in addition to a human nonprofit steward?"
  ],
  "feedback": {
    "how": "Open an issue on GitHub; docs/review.md lists the sharpest review questions",
    "url": "https://github.com/ta-amps/eranos-public-marketplace-for-public-good-token-burn/issues"
  }
}