PlatterPlatter first-release contract
This edition owns one firm's proposals and clients. It uses Base owner/member sessions and D1. Every domain handler checks native session or a revocable owner-bound agent key; browser mutations require the configured Origin and Host. Client invitations grant access only to their frozen offer, and email verification grants acceptance authority only for that invitation.
A draft has two GST-free AUD options, scope and deposit percentage. Only a person with the owner role approves an exact current revision or sends it. A revision clears approval. Sending freezes the offer; a replacement invitation can rotate access without changing it. Client acceptance requires a verified mailbox, typed name, one offered option and consent. A D1 transaction retains the exact approved snapshot and calculates the selected deposit in integer cents, rounding to the nearest cent.
An accepted agreement and its deposit CSV are immutable through the product. A unique proposal-to-invoice binding makes concurrent and repeated exports return one retained invoice. Re-downloading does not authorize importing the file into accounting twice. This seed does not move money or calculate GST.
The Client CSV kit reviews exact source bytes before applying. Base import-kit retains originals, fingerprints, journal and reversible native writes. Undo refuses changed clients or dependent proposals. Client erasure is limited to unused, non-imported records; Base portability fences older archives and in-flight transfers. Agreements remain retained business records.
Archives preserve business records, approvals, immutable acceptance and deposit CSVs. Credentials, sessions, client invitation links, verification state and mail do not travel. Restore requires an empty destination and valid integrity, with a newer erasure journal when restoring older data. Sent offers require fresh invitations after restore.
Local proposal mail is captured without provider delivery. Hosted mail is queued durably, claimed before contacting a configured sender, and retains uncertain outcomes without blind retry. Provider acceptance is not recipient delivery. Real hosting and mail delivery require the installer's account and provider configuration and were not exercised by this seed round.
Source acquisition and command effects follow SEED-COMMAND-CONTRACT.md. Domain acceptance is in ACCEPTANCE.md. Independent release review, provider proof and domain purchase remain later work.
The public run site is built with rer build --site: its homepage’s Run Platter action opens /run, and /docs renders the repository’s Markdown guides without JavaScript. The installed root stays the shared Lobby. Run-site deployment is guarded by RUN_SITE_DEPLOY and remains off pending its gate.