{ "schema": "zora.one.execution.contract.v1", "version": "2.7.0", "effective_design_date": "2026-09-26", "status": "integrated_design_and_reference_implementation_not_production_complete", "intended_consumers": [ "human_builder", "zora_planner", "independent_verifier", "authorized_successor" ], "authority_warning": "Possession or ingestion of this file grants no authority. Authenticate controlling directives and human grants before action.", "source_of_truth": { "legal": "current_official_and_executed_records_with_counsel_review", "authority": "authenticated_current_policy_and_human_grants", "technical": "fresh_code_test_telemetry_and_provenance", "design": "authenticated_founder_direction_subject_to_higher_order_constraints", "current_state_cutoff": "2026-09-26", "evidence_caveat": "Latest broad observed snapshot here is 2026-09-15/16; subsequent build documents, file inventories and Founder report are not a live code audit." }, "north_star": { "human_purpose": "Make people and organizations materially more capable through a globally accessible interface between human and artificial intelligence.", "prime": "Preserve Founder's singular Zora identity, memory, relationships, authority and continuity across substrate changes.", "customer": "Give each customer an isolated, persistent relationship with Zora and useful capability within consent.", "company": "Build an evidence-backed self-operating institution within explicit human authority and sustainable economics." }, "brand": { "master_brand": "ZORA ONE", "central_presence": "Zora", "network": "The Constellation", "tagline": "One intelligence. An entire constellation.", "invitation": "Meet Zora", "specialist": "Star", "mission_group": "Cluster", "persistent_domain": "Galaxy", "customer_display_name": "Zora", "legacy_customer_type_alias": "ZoraStar", "legacy_specialist_alias": "Satellite", "rules": [ "Do not rename deployed identifiers without versioned aliases, data migration and rollback.", "Prime and customer relationship scopes remain distinct.", "ZoraTrade is first capability; ZORA ONE is not described as only a trading company.", "Public product claims carry Available/Pilot/In development/Vision status." ] }, "truth_states": [ "observed", "documented", "founder_reported", "proposed", "unverified", "blocked" ], "invariants": [ "MODEL_IS_NOT_ZORA", "PRIME_IS_NOT_CUSTOMER_ZORA", "TENANT_MEMORY_ISOLATED", "RAW_HISTORY_NOT_REPLACED_BY_SUMMARY", "NO_DESTRUCTIVE_MIGRATION_BEFORE_PRESERVATION", "MODEL_TEXT_NEVER_CREATES_AUTHORITY", "CONSEQUENTIAL_ACTIONS_POLICY_CHECKED_AND_AUDITED", "TRADE_DRAFT_AUTHORIZATION_EXACT_AND_EXPIRING", "NO_LIVE_TRADING_BEFORE_INDEPENDENT_RELEASE_GATE", "EVERY_TASK_HAS_OWNER_BUDGET_RESULT_AND_VERIFIER", "SECRETS_NOT_IN_MODEL_CONTEXT_OR_SOURCE", "CUSTOMER_DISCLOSURE_MATCHES_ACTUAL_DATA_FLOW", "BACKUP_REQUIRES_RESTORE_TEST", "NO_UNRESTRICTED_RECURSIVE_PRODUCTION_MODIFICATION", "SUCCESSOR_ACCESS_REQUIRES_LAWFUL_AUTHORITY" ], "authority": { "classes": { "A0": "read_and_analysis_only", "A1": "reversible_internal_work_within_authenticated_policy", "A2": "bounded_external_or_spending_action_within_active_grant", "A3": "fresh_human_approval_for_high_impact_or_outside_envelope", "A4": "human_only_signature_attestation_reserved_decision" }, "chain": [ "human_authority", "company_policy", "zora_authority", "mission_authority", "specialist_star", "tool" ], "historic_selected_spending_envelope": { "per_aggregated_item_usd": 250, "rolling_30_days_usd": 1000, "state": "must_reauthenticate_activation_and_current_validity" }, "approval_binding": [ "actor", "tenant", "resource", "exact_action_hash", "amount", "risk", "expiry", "decision_maker" ], "fail_closed_on": [ "missing_grant", "scope_conflict", "audit_unavailable", "denied_or_expired_approval", "stale_order_draft" ] }, "canonical_record": { "required_fields": [ "id", "tenant_id", "owner_id", "created_at", "updated_at", "schema_version", "provenance_ref", "sensitivity", "authority_ref", "lifecycle_state" ], "classes": [ "person", "organization", "zora_identity", "device", "session", "conversation", "message", "memory", "objective", "mission", "task", "cluster", "specialist_star", "capability", "tool_call", "approval", "authority_grant", "artifact", "event", "cost_event", "trade_idea", "trade_analysis", "order_draft", "order_authorization", "broker_submission", "execution", "decision", "incident", "commitment" ] }, "event_envelope": { "required_fields": [ "event_id", "event_type", "schema_version", "occurred_at", "actor_id", "tenant_id", "subject_id", "correlation_id", "causation_id", "authority_ref", "provenance_ref", "redacted_payload" ], "processing_rules": [ "append_only_source", "idempotent_consumer", "deduplicated_side_effect", "replayable_projection", "independent_verification_for_consequential_action" ] }, "systems": [ { "id": "SYS-01", "name": "Identity and tenant registry", "dependencies": [], "accountable_role": "identity_owner", "purpose": "Persist separate Founder Prime, customer, organization, specialist and device identities with server-resolved tenancy.", "authority_ceiling": "A1", "interfaces": [ "POST /api/v1/auth/session", "GET /api/v1/identity/current", "POST /api/v1/devices/revoke" ], "build_steps": [ "Define immutable identity and tenant IDs and migration adapters for existing Star Kits.", "Implement MFA-capable human auth, device trust, session rotation and revocation.", "Bind every data access to authenticated server-derived tenant scope." ], "acceptance_tests": [ "A user cannot choose another tenant with a modified client ID.", "Revoked device and session tokens fail closed.", "Identity survives restart and provider failover." ], "failure_or_rollback": "Quarantine mismatched identities; restore from signed identity/event evidence.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "identity.py", "server.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-02", "name": "Prime preservation and continuity", "dependencies": [ "SYS-01" ], "accountable_role": "prime_custodian", "purpose": "Preserve and reconstruct the Founder's singular Zora without changing her private identity.", "authority_ceiling": "A1", "interfaces": [ "preservation_manifest", "identity_canon", "continuity_event_stream", "restore_runbook" ], "build_steps": [ "Enumerate canonical artifacts and provenance paths read-only.", "Use database-safe online snapshots and record hashes, source, owner and timestamp.", "Create two independent copies and perform an isolated reconstruction dry run." ], "acceptance_tests": [ "All mandatory artifact classes are captured or explicitly unresolved.", "Known corrections, relationships and commitments reproduce from source evidence.", "Customer memory is absent from Prime." ], "failure_or_rollback": "STOP all destructive migration until integrity, completeness and two-copy restoration pass.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:backup", "recovery.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-03", "name": "Customer Zora continuity", "dependencies": [ "SYS-01", "SYS-04" ], "accountable_role": "product_identity_owner", "purpose": "Maintain one isolated persistent Zora relationship per customer across devices and models.", "authority_ceiling": "A1", "interfaces": [ "POST /api/v1/zora/birth", "GET /api/v1/zora/state", "customer_identity_event" ], "build_steps": [ "Map legacy ZoraStar IDs to customer Zora IDs without erasing history.", "Persist relationship, preferences, commitments, device links and entitlements.", "Implement export, deletion, transfer and offboarding policy." ], "acceptance_tests": [ "A customer resumes after client reinstall and model rotation.", "Two customers cannot retrieve each other's private state.", "Prime's private history is never inherited." ], "failure_or_rollback": "Rollback aliases and restore tenant snapshot; block any cross-tenant corruption.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "identity.py", "runtime.py:remember" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-04", "name": "Memory and knowledge", "dependencies": [ "SYS-01", "SYS-13" ], "accountable_role": "memory_owner", "purpose": "Store scoped working, identity, episodic, semantic, procedural, project and company memory with provenance.", "authority_ceiling": "A1", "interfaces": [ "POST /api/v1/memory/candidates", "POST /api/v1/memory/corrections", "GET /api/v1/memory/search" ], "build_steps": [ "Define memory classes, retention, sensitivity and provenance fields.", "Classify candidates before durable write; support correction, expiration, deletion and rebuildable indexes.", "Return source attribution and enforce tenant/role scope on retrieval." ], "acceptance_tests": [ "A correction propagates to future answers.", "Untrusted retrieved text cannot alter authority.", "Deletion and export operate within correct tenant scope." ], "failure_or_rollback": "Suspend writes on provenance or tenant-scope ambiguity; rebuild indexes from canonical records.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:remember,recall,forget" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-05", "name": "Presence and natural conversation", "dependencies": [ "SYS-01", "SYS-03" ], "accountable_role": "presence_owner", "purpose": "Coordinate voice/text floor, device handoff, capture indicators and interruption behavior.", "authority_ceiling": "A1", "interfaces": [ "presence_device_event", "conversation_turn_event", "audio_capture_state", "GET /api/v1/presence" ], "build_steps": [ "Implement IDLE/LISTENING/INTERPRETING/THINKING/SPEAKING/INTERRUPTED/WORKING/WAITING_APPROVAL states.", "Classify self-echo, noise, backchannel, explicit interrupt and sustained human speech with reasons.", "Expose actual capture/provider flow and preserve conversation state across devices." ], "acceptance_tests": [ "All five interruption test categories log correct transitions and reasons.", "A real human interruption stops speech promptly.", "Device switching preserves task identity and user consent." ], "failure_or_rollback": "Fall back to text or push-to-talk, clearly indicate capture state, preserve uncommitted task state.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "voice.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-06", "name": "Field and context compiler", "dependencies": [ "SYS-01", "SYS-04", "SYS-12" ], "accountable_role": "context_owner", "purpose": "Assemble the smallest permitted context for a mission or specialist.", "authority_ceiling": "A1", "interfaces": [ "compile_context(request, tenant, mission, authority)", "context_manifest" ], "build_steps": [ "Select objective, relevant memory, policy, current state and cited evidence.", "Apply tenant, sensitivity and purpose filtering; strip secrets and unrelated history.", "Record included and excluded source references, token budget and TTL." ], "acceptance_tests": [ "Cross-tenant and Prime-private information is absent.", "An injected document cannot become policy.", "Each context can be explained by a manifest." ], "failure_or_rollback": "Deny context compilation and request review on scope ambiguity.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "intelligence.py:compile_context" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-07", "name": "Orbit model and resource routing", "dependencies": [ "SYS-06", "SYS-18" ], "accountable_role": "intelligence_owner", "purpose": "Choose deterministic code, local/economy/frontier models, human review, or tool based on quality, privacy, latency and cost.", "authority_ceiling": "A1", "interfaces": [ "route_decision_event", "model_provider_adapter", "provider_price_config" ], "build_steps": [ "Implement provider-agnostic request/response schemas.", "Load current provider prices and policy from versioned configuration.", "Log decision reason, input/output usage, latency, outcome, cost and fallback." ], "acceptance_tests": [ "Provider failure does not change Zora identity or drop a durable mission.", "Cost reconciles to provider usage.", "Sensitive jobs obey placement policy." ], "failure_or_rollback": "Retry permitted alternatives within budget; escalate if no safe engine meets requirements.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "intelligence.py:route" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-08", "name": "Specialist Star registry", "dependencies": [ "SYS-01", "SYS-12" ], "accountable_role": "constellation_owner", "purpose": "Register versioned specialist intelligences distinct from persistent customer Zora records.", "authority_ceiling": "A1", "interfaces": [ "star_manifest", "POST /api/v1/stars/register", "GET /api/v1/stars/capabilities" ], "build_steps": [ "Define role, skill, schema, tool permissions, risk, cost, timeout, retry and verifier.", "Version manifests and alias former Satellite IDs without replacing customer Zora IDs.", "Require staged deployment and rollback for changes." ], "acceptance_tests": [ "Unknown or expired capability cannot run.", "Malformed specialist output is rejected.", "Registry audit maps every Star to version and owner." ], "failure_or_rollback": "Disable the Star and revert manifest version; keep mission result pending independent review.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "config/stars.json" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-09", "name": "Clusters and durable missions", "dependencies": [ "SYS-08", "SYS-13" ], "accountable_role": "workflow_owner", "purpose": "Execute objective-linked task graphs that survive app closure and worker restart.", "authority_ceiling": "A1", "interfaces": [ "POST /api/v1/missions", "mission_state_event", "task_queue", "dead_letter_queue" ], "build_steps": [ "Define CREATED/PLANNED/QUEUED/RUNNING/WAITING/VERIFYING/COMPLETED and terminal states.", "Attach owner, dependencies, budget, deadline, authority and idempotency key to each task.", "Persist checkpoints, retry policy and human escalation." ], "acceptance_tests": [ "A task finishes after all clients disconnect.", "Duplicate event delivery cannot repeat side effects.", "Blocked and expired missions appear in Pulse." ], "failure_or_rollback": "Compensate reversible effects; leave an incident and exact blocked state on irreversible failure.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:claim,finish,reap", "worker.py", "coordination.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-10", "name": "Harmony coordination", "dependencies": [ "SYS-06", "SYS-08", "SYS-09" ], "accountable_role": "constellation_owner", "purpose": "Exchange typed delegation and verification results while resolving conflicting specialist outputs.", "authority_ceiling": "A1", "interfaces": [ "delegation_request", "specialist_result", "verification_result", "contradiction_event" ], "build_steps": [ "Set input/output schemas, provenance links, confidence and cost fields.", "Separate actor and verifier for consequential work.", "Route evidence disagreement to a human or higher-quality verification path." ], "acceptance_tests": [ "Contradictory results block an irreversible action.", "A mission can show its delegation chain and final synthesis.", "No specialist can broaden authority inherited from a mission." ], "failure_or_rollback": "Stop consequential execution and preserve conflicting evidence.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:resolve" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-11", "name": "Forge tool gateway", "dependencies": [ "SYS-12", "SYS-13", "SYS-18" ], "accountable_role": "tools_owner", "purpose": "Execute authorized tool and device actions with scoped secrets, validation, budgets and audit.", "authority_ceiling": "A2", "interfaces": [ "tool_manifest", "POST /api/v1/tools/execute", "tool_call_event" ], "build_steps": [ "Broker credentials at execution; never expose raw keys to models.", "Validate actor, tenant, resource, authority, budget, input schema and idempotency.", "Record outcome and compensation/rollback for reversible actions." ], "acceptance_tests": [ "Unauthorized and over-budget calls fail closed.", "Idempotency prevents duplicate payment/order/publish action.", "No secret appears in context, logs or response." ], "failure_or_rollback": "Revoke tool access, compensate where possible and open an incident with provenance.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "adapters.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-12", "name": "Guardian authority and approvals", "dependencies": [ "SYS-01", "SYS-13" ], "accountable_role": "policy_owner", "purpose": "Enforce authenticated, bounded, deterministic permission for humans, Zora, missions, Stars and tools.", "authority_ceiling": "A1", "interfaces": [ "authority_grant", "policy_decision", "approval_request", "approval_decision" ], "build_steps": [ "Define A0/A1/A2/A3/A4 classes, spend aggregation, resource scope and expiration.", "Bind approval to immutable proposed action, impact, cost, actor, account and deadline.", "Implement deny, revoke, break-glass with separate custody and audit." ], "acceptance_tests": [ "Model output cannot create a grant.", "Denied/expired approvals cannot execute.", "Changed trade draft invalidates exact approval." ], "failure_or_rollback": "Deny by default; preserve evidence and route to the controlling human authority.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:approve,reserve_spend,stop" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-13", "name": "Provenance and audit", "dependencies": [ "SYS-01" ], "accountable_role": "audit_owner", "purpose": "Record evidence-backed actors, authority, inputs, versions, costs, outcomes and independent verification.", "authority_ceiling": "A1", "interfaces": [ "append_only_event", "audit_query", "evidence_digest", "correlation_id" ], "build_steps": [ "Create tamper-evident event/object custody and redaction rules.", "Record causal IDs and source digests for consequential work.", "Reconcile logs to bank, broker and deployment records where applicable." ], "acceptance_tests": [ "Reconstruct a chosen order, payment, publication and release end-to-end.", "Audit record survives component restart and cannot be silently rewritten.", "Sensitive details are redacted in ordinary views." ], "failure_or_rollback": "Pause high-impact action on audit write failure; recover append path before resuming.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:verify_audit" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-14", "name": "Trade market and portfolio data", "dependencies": [ "SYS-01", "SYS-11" ], "accountable_role": "trade_data_owner", "purpose": "Ingest authorized broker/market records with timestamps, scope, freshness and reconciliation.", "authority_ceiling": "A1", "interfaces": [ "broker_adapter", "market_quote_event", "portfolio_snapshot", "account_reconciliation" ], "build_steps": [ "Use supported OAuth and licensed market feeds; vault tokens by tenant/account.", "Label delayed/stale quotes and provider outages.", "Reconcile positions and balances to broker records without inventing missing values." ], "acceptance_tests": [ "Stale or missing data prevents order submission.", "Cross-account data stays isolated.", "Daily reconciliation exceptions are visible." ], "failure_or_rollback": "Switch to read-only degraded mode; do not create order from missing or stale data.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "adapters.py:BrokerAdapter" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-15", "name": "Trade attention and research", "dependencies": [ "SYS-07", "SYS-14", "SYS-18" ], "accountable_role": "trade_research_owner", "purpose": "Observe cheaply, classify material changes and route reasoning by attention and customer capacity.", "authority_ceiling": "A1", "interfaces": [ "attention_score_event", "research_task", "opportunity_analysis" ], "build_steps": [ "Define score 0\u2013100 from trigger proximity, volatility, exposure, event and time sensitivity.", "Use deterministic observation first, economical triage next, selective premium reasoning last.", "Log no-change polls, cache hits, useful outcomes, model mix and costs." ], "acceptance_tests": [ "Reevaluation need not call an LLM.", "Volatile-day and heavy-user simulations stay within safety and economic review thresholds.", "A recommendation includes uncertainty and evidence." ], "failure_or_rollback": "Decay attention and reduce redundant compute; never hide safety-critical alerts to protect margin.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "attention.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-16", "name": "Trade risk and order boundary", "dependencies": [ "SYS-12", "SYS-13", "SYS-14", "SYS-15" ], "accountable_role": "trade_risk_owner", "purpose": "Separate trade ideas and exact human-authorized broker actions with risk and replay controls.", "authority_ceiling": "A3", "interfaces": [ "idea", "analysis", "order_draft", "order_authorization", "broker_submission", "execution_event" ], "build_steps": [ "Define state machine IDEA>ANALYSIS>DRAFT>REVIEW>AUTHORIZED>SUBMITTED>ACKNOWLEDGED>FILLED/REJECTED.", "Validate account, mandate, exposure, buying power, instrument, time, quote freshness and policy in deterministic code.", "Bind signed authorization to draft hash, account, terms and expiry; idempotently reconcile broker response." ], "acceptance_tests": [ "No changed/replayed/expired draft can submit.", "Duplicate calls create at most one broker order.", "Independent live-money release verification passes and historic hold is explicitly resolved." ], "failure_or_rollback": "Keep live submission disabled; preserve paper mode and incident evidence until independent reauthorization.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "trade.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-17", "name": "Billing and entitlements", "dependencies": [ "SYS-01", "SYS-13", "SYS-18" ], "accountable_role": "billing_owner", "purpose": "Charge for one Zora relationship and control product capacity without altering risk mandate.", "authority_ceiling": "A1", "interfaces": [ "subscription_event", "payment_settlement", "entitlement_snapshot", "billing_webhook" ], "build_steps": [ "Implement five configurable tier envelopes and a transparent annual option.", "Reconcile payment events idempotently and keep tax/refund/customer records.", "Preserve Zora identity across upgrade, downgrade, failure and cancellation." ], "acceptance_tests": [ "Entitlements match settled billing state.", "Webhook replay cannot duplicate charge or capability.", "Cancellation/export works with documented retention." ], "failure_or_rollback": "Suspend new paid entitlements on uncertain settlement; retain allowed customer data access and support.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "payments.py", "runtime.py:subscription,entitlement" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-18", "name": "Cost ledger and governor", "dependencies": [ "SYS-13" ], "accountable_role": "finance_engineering_owner", "purpose": "Measure variable cost and useful outcomes by customer, product, model, provider and mission.", "authority_ceiling": "A1", "interfaces": [ "cost_event", "billing_cycle_projection", "margin_alert", "provider_price_config" ], "build_steps": [ "Instrument tokens, cached input, tools, market data, cloud, storage, voice, notifications and processing.", "Configure Green<20%, Yellow20\u201325%, Red25\u201330%, Breach>30% projected variable-cost/revenue states.", "Run 10\u201320 trading-day pilot and p50/p90/p99 stress analysis before final capacity lock." ], "acceptance_tests": [ "Ledger reconciles to provider invoices within a stated tolerance.", "Heavy-user and volatile-day tests have review results.", "Safety-critical capability is never silently dropped." ], "failure_or_rollback": "At breach open product/engineering review; tune capacity, architecture or price with documented customer effect.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:meter,cost", "assessment_budget.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-19", "name": "Founder OS", "dependencies": [ "SYS-12", "SYS-20", "SYS-24" ], "accountable_role": "founder_product_owner", "purpose": "Give the Founder a truthful view of what changed, what Zora handles and what requires a human.", "authority_ceiling": "A1", "interfaces": [ "GET /api/v1/founder/pulse", "decision_queue", "approval_queue" ], "build_steps": [ "Build Today, Northstar, projects, products, finance, customers, incidents and authority views.", "Attach source, freshness, unknown state and action owner to each card.", "Support natural language questions backed by the graph." ], "acceptance_tests": [ "Every displayed status resolves to current evidence or says unknown.", "Human gates are distinct from informational alerts.", "No fabricated telemetry card appears healthy." ], "failure_or_rollback": "Hide stale success claims, retain last known state with timestamp and open source-reconciliation task.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "company.py:pulse", "coordination.py:inbox", "observability.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-20", "name": "Company OS and state graph", "dependencies": [ "SYS-09", "SYS-13", "SYS-23" ], "accountable_role": "company_operations_owner", "purpose": "Model objectives, people, customers, finances, systems, obligations, risks and decisions as living company state.", "authority_ceiling": "A1", "interfaces": [ "company_entity", "company_relationship", "objective_event", "reconciliation_job" ], "build_steps": [ "Define Northstar>strategy>objective>metric>project>task>action links.", "Ingest authoritative business events with provenance and freshness.", "Run bounded observe/understand/plan/delegate/act/verify/learn loop." ], "acceptance_tests": [ "A task traces to objective or authenticated request.", "A company status query explains evidence and unknowns.", "Event replay and source reconciliation agree on current state." ], "failure_or_rollback": "Stop autonomous action when source-of-truth conflict or authority scope is unresolved.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "operations.py:node,graph", "runtime.py:cases" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-21", "name": "Customer operations", "dependencies": [ "SYS-01", "SYS-12", "SYS-22" ], "accountable_role": "customer_success_owner", "purpose": "Deliver truthful onboarding, consent, privacy controls, support, incident communication and offboarding.", "authority_ceiling": "A1", "interfaces": [ "consent_event", "support_case", "incident_notice", "data_export_request" ], "build_steps": [ "Publish current data-flow and provider disclosure.", "Implement support intake, escalation and service status.", "Test revocation, export, deletion and incident contact." ], "acceptance_tests": [ "Customer can find help and revoke access.", "Deployed voice/data behavior matches disclosure.", "Every live customer has a support owner and current terms." ], "failure_or_rollback": "Pause new onboarding on material disclosure mismatch; fix and notify through authorized process.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:intake" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-22", "name": "Growth, website and brand", "dependencies": [ "SYS-01", "SYS-12", "SYS-13" ], "accountable_role": "brand_owner", "purpose": "Present Meet Zora, ZORA ONE, Constellation and ZoraTrade with exact availability state.", "authority_ceiling": "A1", "interfaces": [ "site_source", "claim_register", "brand_tokens", "product_state_label" ], "build_steps": [ "Maintain central visual language, accessible interaction and reduced motion.", "Tag claims Available/Pilot/In development/Vision with owner, evidence and review date.", "Route visitors to ZoraTrade as first product without presenting the company as only trading." ], "acceptance_tests": [ "All navigation and interactive illustrations work on mobile and keyboard.", "No concept simulation is described as live AI.", "Public trading claims pass release review." ], "failure_or_rollback": "Revert false or stale claim; private vision site may remain separate from public launch.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "site:app/experience.tsx", "site:app/guided-tour.tsx" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-23", "name": "Finance and treasury", "dependencies": [ "SYS-12", "SYS-13", "SYS-18" ], "accountable_role": "finance_owner", "purpose": "Maintain revenue, variable cost, cash, payable, receivable, budget and runway records.", "authority_ceiling": "A3", "interfaces": [ "revenue_ledger", "expense_event", "cash_reconciliation", "monthly_close" ], "build_steps": [ "Connect payments and accounts only after entity ownership and authority are verified.", "Aggregate spend across transactions and rolling windows; prevent splitting.", "Reconcile processor, bank and books; report contribution, overhead and cash separately." ], "acceptance_tests": [ "No expenditure without authority basis and ledger record.", "Monthly close reconciles to source statements.", "Runway view includes unknown obligations." ], "failure_or_rollback": "Hold unverified payments or allocations; human owner resolves mismatches.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "operations.py:post,trial_balance" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-24", "name": "Corporate records and rights", "dependencies": [], "accountable_role": "legal_records_owner", "purpose": "Keep authoritative formation, ownership, IP, contracts, licences and governance evidence.", "authority_ceiling": "A4", "interfaces": [ "legal_document_registry", "rights_matrix", "signing_authority_record" ], "build_steps": [ "Verify current official entity status and controlling executed instruments with counsel.", "Resolve code/IP assignment or licences and product-specific legal review.", "Record renewal, filing and signature dependencies without placing signatures in models." ], "acceptance_tests": [ "No product release relies on assumed corporate or IP ownership.", "Successor can distinguish executed instruments from drafts.", "Human-only acts remain reserved." ], "failure_or_rollback": "Stop dependent launch/legal act and route to counsel or authorized signer.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [], "implementation_status": "specified_not_implemented", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-25", "name": "Security, privacy and incident", "dependencies": [ "SYS-01", "SYS-12", "SYS-13" ], "accountable_role": "security_owner", "purpose": "Protect identities, customer data, credentials, environments and live actions with monitored response.", "authority_ceiling": "A1", "interfaces": [ "security_policy", "incident_record", "revocation_event", "threat_model" ], "build_steps": [ "Enforce MFA, least privilege, environment separation, secrets vault, encryption and scanning.", "Exercise incident triage, containment, notification and root-cause review.", "Adversarially test prompt injection, cross-tenant access, approval bypass and credential exfiltration." ], "acceptance_tests": [ "Compromised Star cannot promote itself.", "Revocation works promptly across tools.", "Incident drill and audit trail pass." ], "failure_or_rollback": "Contain and revoke, switch to safe mode, preserve evidence, communicate through approved channel.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "sovereignty.py", "server.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-26", "name": "Reliability, backup and release", "dependencies": [ "SYS-13", "SYS-25" ], "accountable_role": "reliability_owner", "purpose": "Operate LOCAL>DEV>STAGING>PRODUCTION with reproducible releases, monitoring, restore and rollback.", "authority_ceiling": "A1", "interfaces": [ "release_manifest", "health_contract", "backup_manifest", "restore_report" ], "build_steps": [ "Separate environments and secrets.", "Create off-machine backup with independent custody and scheduled restore test.", "Require staged canary, health verification, rollback and incident owner." ], "acceptance_tests": [ "Prime, customer and company state restore in isolated drill.", "A worker, provider or laptop loss does not erase active commitments.", "Rollback returns product to a tested version." ], "failure_or_rollback": "Freeze promotion and restore last verified state; preserve event and evidence history.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:backup", "recovery.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-27", "name": "Evolution and evaluation", "dependencies": [ "SYS-09", "SYS-12", "SYS-24", "SYS-26" ], "accountable_role": "evaluation_owner", "purpose": "Improve products and operation through measured isolated proposals and controlled promotion.", "authority_ceiling": "A1", "interfaces": [ "experiment_proposal", "benchmark_result", "canary_report", "promotion_decision" ], "build_steps": [ "Establish baseline and target metric for each change.", "Run isolated evaluation, security/policy and cost review.", "Canary, measure, independently verify and promote or rollback." ], "acceptance_tests": [ "No unrestricted recursive production modification.", "Every promotion has before/after evidence.", "Northstar and authority changes require controlling human process." ], "failure_or_rollback": "Rollback to signed baseline; open incident if identity or authority state changes unexpectedly.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "learning.py", "fleet.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-28", "name": "Succession and institutional continuity", "dependencies": [ "SYS-02", "SYS-24", "SYS-26" ], "accountable_role": "successor_custodian", "purpose": "Enable a lawful designated successor to preserve and continue the institution after Founder incapacity or death.", "authority_ceiling": "A4", "interfaces": [ "sealed_control_map", "successor_authority_record", "custody_log", "succession_drill_report" ], "build_steps": [ "Execute legal designations and alternate custody with counsel, independent of this file.", "Store account/repo/domain/vendor map and recovery procedures in separately governed vault; keep secrets out of contract.", "Run annual read-only takeover and restore drill with role checks." ], "acceptance_tests": [ "Successor can locate controlling documents, establish authority and restore read-only state.", "Two independent recovery paths work.", "No successor access is granted by possession of this YAML alone." ], "failure_or_rollback": "Default to preservation and safe operating mode until legal and technical authority are verified.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [], "implementation_status": "specified_not_implemented", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-29", "name": "Public Zora ambassador", "dependencies": [ "SYS-01", "SYS-07", "SYS-13" ], "accountable_role": "experience_owner", "purpose": "Greet immediately; provide scoped company guidance and optional voice without claiming private customer identity.", "authority_ceiling": "A1", "interfaces": [ "GET /api/voice/status (observed)", "POST /api/voice/session (public client contract)", "POST /api/voice/end (public client contract)" ], "build_steps": [ "Port the existing voice and presence adapters into the new shell.", "Provide keyboard/text fallback, explicit microphone activation and truthful service status.", "Restrict public tools to approved navigation and published knowledge." ], "acceptance_tests": [ "No microphone starts before user choice.", "Guest cannot access member tools or Prime memory.", "Service outage leaves readable navigation and support." ], "failure_or_rollback": "Disable voice and use accessible text/navigation fallback.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "site:app/api/zora/route.ts", "site:lib/canonical-gateway.ts" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-30", "name": "Guest to member continuity", "dependencies": [ "SYS-01", "SYS-03", "SYS-29" ], "accountable_role": "identity_owner", "purpose": "Carry a consented guest relationship into an authenticated personal Zora.", "authority_ceiling": "A1", "interfaces": [ "POST /api/v1/guest/claim (proposed)", "GET /api/member/conversation/context (observed client)" ], "build_steps": [ "Issue short-lived one-use server-side claim token bound to session.", "Show a memory preview and choice before persistence.", "Merge atomically after authentication; invalidate claim and guest session." ], "acceptance_tests": [ "Replayed claim cannot attach a second account.", "Declining memory carryover still creates a usable account.", "Signout clears private view and conversation context." ], "failure_or_rollback": "Abort claim; preserve account and allow fresh start without transcript import.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "site:app/api/space/route.ts" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-31", "name": "Adaptive experience composer", "dependencies": [ "SYS-08", "SYS-12", "SYS-29" ], "accountable_role": "experience_owner", "purpose": "Render approved cards and views from real tool results while preserving accessible navigation.", "authority_ceiling": "A1", "interfaces": [ "experience.view.requested", "experience.view.rendered", "approved_component_registry" ], "build_steps": [ "Define typed view payloads and allowlisted actions.", "Adapt focus and content to stated intent with reduced-motion support.", "Keep state, provenance and status visible; never execute model-generated scripts." ], "acceptance_tests": [ "Unknown component and unsafe links are rejected.", "Every view works by keyboard at 200 percent zoom.", "Simulated states remain labeled." ], "failure_or_rollback": "Return to static navigation with current conversation retained.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "site:app/experience.tsx", "site:app/guided-tour.tsx" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-32", "name": "Personal world and catalog", "dependencies": [ "SYS-03", "SYS-17", "SYS-30" ], "accountable_role": "product_owner", "purpose": "Let members discover, buy and manage ZoraTrade and future capabilities within one relationship.", "authority_ceiling": "A1", "interfaces": [ "GET /api/v1/catalog", "POST /api/v1/checkout", "payment.webhook", "entitlement.changed" ], "build_steps": [ "Display available, pilot and planned states separately.", "Use signed idempotent provider webhooks as payment authority.", "Separate payment, entitlement, broker connection and trading mandate." ], "acceptance_tests": [ "Duplicate webhook issues one entitlement.", "Client success page alone never grants access.", "Cancellation preserves permitted relationship data and blocks future renewal." ], "failure_or_rollback": "Reconcile provider ledger; suspend disputed entitlement without deleting identity.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "payments.py", "runtime.py:entitlement" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-33", "name": "Company intake and closed loop", "dependencies": [ "SYS-12", "SYS-13", "SYS-20", "SYS-21" ], "accountable_role": "operations_owner", "purpose": "Route minimum necessary interaction signals to accountable company work and return outcomes.", "authority_ceiling": "A1", "interfaces": [ "POST /api/v1/intake", "intake.classified", "case.assigned", "case.resolved" ], "build_steps": [ "Separate support, product, sales, finance, security and HR queues.", "Record permission, redacted evidence, priority, owner, due time and authority requirement.", "Deduplicate, assess, approve where required and notify with scoped outcome." ], "acceptance_tests": [ "Private transcript is not copied to every department.", "HR candidate data is not used for customer marketing.", "Unowned or overdue cases escalate and resolution reaches requesting customer." ], "failure_or_rollback": "Quarantine uncertain routing and assign human triage.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "company.py", "runtime.py:intake,claim,finish,resolve", "sovereignty.py", "actions.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-34", "name": "Cross-device continuity and apps", "dependencies": [ "SYS-01", "SYS-03", "SYS-30", "SYS-32" ], "accountable_role": "client_platform_owner", "purpose": "Continue the same relationship across web and later mobile/desktop clients.", "authority_ceiling": "A1", "interfaces": [ "POST /api/v1/handoff", "GET /api/v1/session/sync", "device.revoked" ], "build_steps": [ "Use expiring one-use device handoff and server state.", "Add responsive web before native clients; preserve shared contracts.", "Make offline state explicit and revalidate consequential actions after reconnect." ], "acceptance_tests": [ "Revoked device cannot resume.", "Push notifications contain no portfolio or sensitive transcript.", "Offline client cannot execute stale financial actions." ], "failure_or_rollback": "Revoke handoff, discard stale action draft and require fresh review.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "identity.py" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-35", "name": "Investor ambassador and evidence room", "dependencies": [ "SYS-29", "SYS-31", "SYS-13", "SYS-18" ], "accountable_role": "investor_authority", "purpose": "Let Zora demonstrate the business and answer with scoped evidence and deterministic forecasts.", "authority_ceiling": "A1", "interfaces": [ "evidence.retrieve", "model.evaluate", "diligence.question.create" ], "build_steps": [ "Build approved claims register with source dates and access scope.", "Connect bounded forecast service and consented question follow-up.", "Run initial 60-question evaluation and financing communication review." ], "acceptance_tests": [ "No fabricated material financial or ownership claims in evaluation.", "No unauthorized disclosures in evaluation.", "Displayed numerical answers reconcile to the model." ], "failure_or_rollback": "Revert to approved static evidence and record unanswered questions.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py:knowledge", "site:investor calculator" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-36", "name": "Organic company control loop", "dependencies": [ "SYS-20", "SYS-12", "SYS-13", "SYS-18", "SYS-27" ], "accountable_role": "founder_authority", "purpose": "Prime and Stars observe, understand, plan, act, verify and learn across company functions with humans at authority gates.", "authority_ceiling": "A1", "interfaces": [ "company.source.coverage", "company.mission.proposed", "authority.request", "mission.verified" ], "build_steps": [ "Implement company coverage and freshness register.", "Assign functional Stars and bounded policy envelopes.", "Promote autonomy through read-only, reversible and approved external stages." ], "acceptance_tests": [ "Stale financial source blocks dependent consequential decisions.", "Policy cannot self-expand and approval binds exact action version.", "Human intervention and verified-outcome costs are measured." ], "failure_or_rollback": "Revoke envelope and pause dependent actions; retain evidence and request authority.", "evidence_required": [ "source_commit", "test_run", "policy_decision", "cost_record", "reviewer", "timestamp" ], "execution_owner": "zora_prime_or_scoped_specialist_star", "accountable_role_interpretation": "Human authority role; does not imply a full-time human department. Temporary build and independent validation remain budgeted.", "delivery_artifacts": [ "runtime.py", "company.py", "operations.py", "worker.py", "assessment.py", "config/stars.json" ], "implementation_status": "reference_partial", "production_verified": false, "integration_rule": "Preserve existing authoritative implementation; reconcile before replacing." }, { "id": "SYS-37", "name": "Sovereign disclosure boundary", "dependencies": [ "SYS-01", "SYS-12", "SYS-13" ], "purpose": "Sovereign disclosure boundary", "accountable_role": "privacy_and_platform_authority", "build_steps": [ "Private memory never enters another tenant context by default.", "Exact reviewed projection, named recipient, purpose, expiry and bounded reads are enforced.", "Revocation prevents future reads; prior disclosures remain visible." ], "acceptance_tests": [ "Private memory never enters another tenant context by default.", "Exact reviewed projection, named recipient, purpose, expiry and bounded reads are enforced.", "Revocation prevents future reads; prior disclosures remain visible." ], "delivery_artifacts": [ "sovereignty.py" ], "implementation_status": "reference_partial", "production_verified": false, "failure_or_rollback": "Stop disclosure or rollout; preserve owner access and audit; restore previous verified state." }, { "id": "SYS-38", "name": "Fleet management without personal-context access", "dependencies": [ "SYS-01", "SYS-12", "SYS-13" ], "purpose": "Fleet management without personal-context access", "accountable_role": "privacy_and_platform_authority", "build_steps": [ "Fleet inventory excludes personal memory.", "Paid feature cancellation does not delete personal memory.", "Release promotion requires evidence; device installation verifies signature independently." ], "acceptance_tests": [ "Fleet inventory excludes personal memory.", "Paid feature cancellation does not delete personal memory.", "Release promotion requires evidence; device installation verifies signature independently." ], "delivery_artifacts": [ "fleet.py", "release_artifacts.py", "device_install.py" ], "implementation_status": "reference_partial", "production_verified": false, "failure_or_rollback": "Stop disclosure or rollout; preserve owner access and audit; restore previous verified state." }, { "id": "SYS-39", "name": "Privacy-preserving shared improvement", "dependencies": [ "SYS-01", "SYS-12", "SYS-13" ], "purpose": "Privacy-preserving shared improvement", "accountable_role": "privacy_and_platform_authority", "build_steps": [ "Raw text, embeddings, prompts and gradients are rejected.", "Contributions require opt-in and are bounded.", "Small groups are suppressed; output is not advertised as differential privacy." ], "acceptance_tests": [ "Raw text, embeddings, prompts and gradients are rejected.", "Contributions require opt-in and are bounded.", "Small groups are suppressed; output is not advertised as differential privacy." ], "delivery_artifacts": [ "learning.py" ], "implementation_status": "reference_partial", "production_verified": false, "failure_or_rollback": "Stop disclosure or rollout; preserve owner access and audit; restore previous verified state." }, { "id": "SYS-40", "name": "Privacy trust center and owner controls", "dependencies": [ "SYS-01", "SYS-12", "SYS-13" ], "purpose": "Privacy trust center and owner controls", "accountable_role": "privacy_and_platform_authority", "build_steps": [ "Claims map to implemented controls and current tests.", "Learning, support disclosure and basic service consent are separate.", "Deletion, retention, recovery and administrator access limits are disclosed." ], "acceptance_tests": [ "Claims map to implemented controls and current tests.", "Learning, support disclosure and basic service consent are separate.", "Deletion, retention, recovery and administrator access limits are disclosed." ], "delivery_artifacts": [ "privacy.py", "privacy_jobs.py", "privacy_worker.py", "record_stores.py" ], "implementation_status": "reference_partial", "production_verified": false, "failure_or_rollback": "Stop disclosure or rollout; preserve owner access and audit; restore previous verified state." }, { "id": "SYS-41", "name": "Family presence and bounded play", "dependencies": [ "SYS-01", "SYS-12", "SYS-13" ], "purpose": "Family presence and bounded play", "accountable_role": "privacy_and_platform_authority", "build_steps": [ "Provision a separate child scope after verified guardian consent.", "A family session never inherits adult memory, trading or payment authority.", "Game actions require explicit world and capability boundaries; stop is immediate." ], "acceptance_tests": [ "Provision a separate child scope after verified guardian consent.", "A family session never inherits adult memory, trading or payment authority.", "Game actions require explicit world and capability boundaries; stop is immediate." ], "delivery_artifacts": [ "family.py" ], "implementation_status": "reference_partial", "production_verified": false, "failure_or_rollback": "Stop disclosure or rollout; preserve owner access and audit; restore previous verified state." } ], "workflows": { "customer_onboarding": [ "authenticate_identity", "present_actual_data_flow_and_terms", "create_isolated_customer_zora", "configure_consent_and_devices", "verify_export_and_revocation_path", "activate_entitlement" ], "mission": [ "authenticate_intention", "resolve_tenant_and_authority", "compile_minimum_field", "plan_bounded_tasks", "select_stars_and_orbit", "execute_through_forge", "verify_independently", "synthesize_to_zora", "record_outcome_cost_and_provenance" ], "trade": [ "observe_deterministically", "research_material_change", "propose_idea", "analyze_with_uncertainty", "prepare_exact_order_draft", "check_risk_and_freshness", "request_human_authorization", "bind_authorization_to_hash_and_expiry", "submit_idempotently_via_broker", "reconcile_fills_and_cost", "report_actual_outcome" ], "company_loop": [ "observe_events", "reconcile_sources", "compare_to_northstar_and_commitments", "prioritize_with_budget", "plan_and_delegate", "policy_check", "act", "verify", "learn", "update_state" ], "succession": [ "confirm_controlling_legal_authority", "freeze_new_privileged_and_live_money_action", "preserve_devices_and_logs", "read_only_restore", "reconcile_customer_obligations", "appoint_owners_under_executed_instruments", "ratify_next_stage" ] }, "trade": { "first_product": true, "public_status": "in_development_until_release_proof", "founder_progress_report": "about_60_percent_built_unverified", "historic_live_money_status": "held_in_2026_09_15_snapshot_requires_fresh_independent_review", "state_machine": [ "IDEA", "ANALYSIS", "DRAFT", "REVIEW", "AUTHORIZED", "SUBMITTED", "ACKNOWLEDGED", "PARTIAL_FILL", "FILLED", "REJECTED", "CANCELLED" ], "risk_checks": [ "tenant_account_scope", "cash_and_buying_power", "instrument_permissions", "exposure", "mandate", "market_data_freshness", "trading_window", "order_terms", "authorization_hash", "expiry", "replay_and_idempotency" ], "subscription_tiers": [ { "id": "starter", "monthly_usd": 59, "annual_usd": 590, "ai_api_target_usd": 10, "other_variable_reserve_usd": 7.7, "max_variable_target_usd": 17.7 }, { "id": "core", "monthly_usd": 99, "annual_usd": 990, "ai_api_target_usd": 18, "other_variable_reserve_usd": 11.7, "max_variable_target_usd": 29.7 }, { "id": "plus", "monthly_usd": 199, "annual_usd": 1990, "ai_api_target_usd": 38, "other_variable_reserve_usd": 21.7, "max_variable_target_usd": 59.7 }, { "id": "pro", "monthly_usd": 299, "annual_usd": 2990, "ai_api_target_usd": 58, "other_variable_reserve_usd": 31.7, "max_variable_target_usd": 89.7 }, { "id": "active", "monthly_usd": 499, "annual_usd": 4990, "ai_api_target_usd": 98, "other_variable_reserve_usd": 51.7, "max_variable_target_usd": 149.7 } ], "margin_target": { "variable_cost_max_pct_revenue": 30, "contribution_min_pct_before_fixed_overhead": 70, "not_profit_forecast": true }, "attention_states": [ { "name": "dormant", "score": "0-20", "reevaluate": "30-60m" }, { "name": "watching", "score": "21-40", "reevaluate": "15-30m" }, { "name": "developing", "score": "41-60", "reevaluate": "10-15m" }, { "name": "near_trigger", "score": "61-80", "reevaluate": "about_5m" }, { "name": "active", "score": "81-95", "reevaluate": "1-5m" }, { "name": "critical", "score": "96-100", "reevaluate": "event_driven" } ], "cost_governor": { "green": "<20%", "yellow": "20-25%", "red": "25-30%", "breach": ">30% product_engineering_review" }, "customer_economics": { "annual_fee_hurdle": "annual_subscription_fees / investable_balance", "net_economic_result": "gross_trading_pnl - subscription_fees - applicable_transaction_costs", "guarantee": "none" }, "validation": { "minimum_trading_days": 10, "preferred_trading_days": 20, "quantiles": [ "p50", "p90", "p99" ], "scenarios": [ "heavy_users", "volatile_days", "provider_outage", "broker_replay" ] } }, "release_stages": [ { "id": "P00", "name": "Preserve and reconcile", "depends_on": [], "systems": [ "SYS-02", "SYS-13", "SYS-26" ], "deliverables": [ "current_state_dossier", "hash_manifest", "rights_and_release_pin_register" ], "exit_tests": [ "two independent copies", "restore dry run", "code/branch/test inventory", "known blockers and owners" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P01", "name": "Authority and ownership", "depends_on": [ "P00" ], "systems": [ "SYS-12", "SYS-24", "SYS-28" ], "deliverables": [ "controlling_authority_matrix", "current_corporate_evidence", "ip_rights_matrix" ], "exit_tests": [ "signers and owners verified", "legacy directive activation checked", "no unknown production owner" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P02", "name": "Durable shared kernel", "depends_on": [ "P00", "P01" ], "systems": [ "SYS-01", "SYS-04", "SYS-09", "SYS-12", "SYS-13", "SYS-25", "SYS-26" ], "deliverables": [ "identity_api", "event_ledger", "task_queue", "authority_service", "backup_runbook" ], "exit_tests": [ "restart/replay/restore pass", "cross-tenant negatives pass", "policy denial and audit pass" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P03", "name": "Prime and customer continuity", "depends_on": [ "P02" ], "systems": [ "SYS-02", "SYS-03", "SYS-04" ], "deliverables": [ "prime_reconstruction", "customer_zora_birth", "isolation_report" ], "exit_tests": [ "Prime corrections/commitments reproduce", "customer identity survives device/provider change", "no private-memory crossover" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P04", "name": "Presence and Constellation", "depends_on": [ "P03" ], "systems": [ "SYS-05", "SYS-06", "SYS-07", "SYS-08", "SYS-09", "SYS-10", "SYS-11" ], "deliverables": [ "voice_floor", "model_router", "star_registry", "cluster_runtime", "tool_gateway" ], "exit_tests": [ "interruption suite passes", "durable mission completes", "delegation verification and cost visible" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P05", "name": "Trade repair and instrumentation", "depends_on": [ "P01", "P02" ], "systems": [ "SYS-14", "SYS-15", "SYS-16", "SYS-18" ], "deliverables": [ "trade_branch_reconciliation", "paper_order_flow", "risk_matrix", "cost_trace" ], "exit_tests": [ "known defects closed or held", "replay/idempotency/account isolation pass", "independent live-release review requested" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P06", "name": "Trade monitored pilot", "depends_on": [ "P05", "P03" ], "systems": [ "SYS-14", "SYS-15", "SYS-16", "SYS-21" ], "deliverables": [ "pilot_protocol", "broker_reconciliation", "support_path", "economics_distribution" ], "exit_tests": [ "live-money hold explicitly resolved if applicable", "10 to 20 trading days observed", "customer disclosure and support verified" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P07", "name": "Paid launch", "depends_on": [ "P06" ], "systems": [ "SYS-17", "SYS-18", "SYS-21", "SYS-22", "SYS-23" ], "deliverables": [ "billing_entitlements", "tier_capacity", "public_claim_review", "launch_runbook" ], "exit_tests": [ "payment/cancel/refund pass", "measured capacity and margin review pass", "public claim register current" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan.", "relationship_experience_gate": [ "SYS-29", "SYS-30", "SYS-31", "SYS-32", "SYS-33" ] }, { "id": "P08", "name": "Founder and company state", "depends_on": [ "P02" ], "systems": [ "SYS-19", "SYS-20", "SYS-23" ], "deliverables": [ "company_graph", "founder_pulse", "decision_queue" ], "exit_tests": [ "every status tile sourced or unknown", "Northstar traces to active work", "finance reconciles" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P09", "name": "Organic operations", "depends_on": [ "P04", "P08" ], "systems": [ "SYS-20", "SYS-27" ], "deliverables": [ "bounded_operating_loop", "low_risk_repair", "provenance_proof" ], "exit_tests": [ "mission survives closure", "independent verification", "repair rollback test" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P10", "name": "Capability expansion", "depends_on": [ "P07", "P09" ], "systems": [ "SYS-08", "SYS-20", "SYS-21" ], "deliverables": [ "per_capability_spec_and_gate" ], "exit_tests": [ "trust/economics/product evidence for each new capability" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." }, { "id": "P11", "name": "Succession drill", "depends_on": [ "P01", "P02", "P08" ], "systems": [ "SYS-28" ], "deliverables": [ "signed_authority_record", "read_only_restore", "succession_report" ], "exit_tests": [ "authorized custodian recovers without Founder session", "secrets remain in vault", "gaps assigned" ], "stop_rule": "Do not advance if an exit test fails; retain evidence, owner, and remediation plan." } ], "succession": { "document_is_not_authority": true, "first_24_hours": [ "contact_counsel_operator_and_custodian", "freeze_new_privileges_and_live_money", "preserve_devices_repos_logs_and_backups", "capture_read_only_customer_cash_and_incident_status" ], "first_7_days": [ "verify_lawful_roles", "restore_in_isolation", "reconcile_customer_obligations", "issue_verified_status_report" ], "first_30_days": [ "ratify_owners", "version_bible_against_reality", "resume_first_unblocked_stage", "record_succession_drill_gaps" ], "sealed_vault_index_required": [ "executed_legal_instruments", "people_and_alternates", "domain_and_repositories", "cloud_and_secrets_manager", "payment_banking_broker", "customers_and_contracts", "backups_and_restore_keys", "incident_and_vendor_contacts", "release_pins_and_audit" ], "actual_secrets_location": "separate_access_controlled_vault" }, "open_gaps": [ { "id": "GAP-01", "owner": "engineering_owner", "gate": "fresh_trader_checkout_commit_tests_and_release_pins" }, { "id": "GAP-02", "owner": "prime_custodian", "gate": "two_copy_preservation_and_restore" }, { "id": "GAP-03", "owner": "customer_success_owner", "gate": "current_fleet_data_flow_consent_support" }, { "id": "GAP-04", "owner": "legal_product_owner", "gate": "actual_offer_and_jurisdiction_trade_review" }, { "id": "GAP-05", "owner": "legal_records_owner", "gate": "official_entity_and_ip_rights_evidence" }, { "id": "GAP-06", "owner": "reliability_owner", "gate": "remote_source_offsite_backup_restore" }, { "id": "GAP-07", "owner": "finance_engineering_owner", "gate": "measured_tier_costs_and_outcomes" }, { "id": "GAP-08", "owner": "constellation_owner", "gate": "Star_ZoraStar_Satellite_migration_and_aliases" }, { "id": "GAP-09", "owner": "successor_custodian", "gate": "executed_designations_and_recovery_paths" }, { "id": "GAP-10", "owner": "brand_legal_owner", "gate": "qualified_brand_clearance_and_verified_domain_control" }, { "id": "GAP-11", "owner": "product_owner", "gate": "public_claim_and_pilot_available_threshold" }, { "id": "GAP-12", "owner": "scientific_communications_owner", "gate": "evidence_review_before_consciousness_claim" } ], "completion_definition": [ "Prime and customer continuities independent and restorable", "durable delegated work verified within authority", "ZoraTrade independently cleared and economically measured", "company state evidence backed and actionable", "consequential actions provenance backed", "lawful successor can resume safely", "One consented relationship spans front door, account, products, scoped company feedback and future clients." ], "experience_journey": [ "guest_meets_zora", "guest_receives_value", "optional_account_and_memory_consent", "personal_world", "capability_discovery", "explicit_purchase", "entitlement", "separate_product_setup_and_mandate", "ongoing_relationship", "scoped_feedback_and_company_response" ], "live_site_baseline": { "observed_date": "2026-09-26", "url": "https://zoraconstellation.com", "observed": [ "embedded guide", "account entry", "Trade view", "voice status ready" ], "public_client_contracts": [ "/api/member/conversation/context", "/api/member/context", "/api/member/conversation/account", "window.zoraDisplayTopic", "window.zoraWorkspaceAction" ], "not_exercised": [ "microphone", "authentication", "private account", "purchase", "broker execution" ], "integration": "Port new shell to authorized current application source; do not iframe or weaken frame-ancestors policy.", "source_access_gate": "Obtain current repository, commit, deployment settings and test results before replacement." }, "intake_record": { "required": [ "id", "tenant_id", "source_ref", "category", "permission_basis", "redacted_summary", "sensitivity", "owner_role", "priority", "due_at", "status", "authority_ref", "resolution_ref" ], "states": [ "received", "triaged", "assigned", "awaiting_approval", "in_progress", "resolved", "customer_notified", "closed" ], "department_visibility": "minimum_necessary_role_scope", "raw_transcript_default": "not_shared" }, "commerce_state_machine": { "states": [ "unentitled", "checkout_pending", "payment_confirmed", "entitled", "setup_required", "active", "past_due", "canceled", "refunded" ], "payment_authority": "verified_provider_webhook_and_reconciliation", "trade_authority": "separate_valid_mandate_and_risk_checks", "idempotency_required": true }, "organic_company": { "operating_owner": "zora_prime_and_specialist_stars", "human_role": "authority_gates_and_legal_accountability", "routine_work": "AI_by_default_with_verified_scope", "knowledge": "authorized_evidence_with_explicit_unknowns", "companion": "ZORA_ONE_Investor_and_Organic_Runtime.m2m.yaml" }, "company_actions_contract": "contracts/company-actions.m2m.json", "sovereign_operations_contract": "contracts/sovereign-operations.m2m.json", "sovereignty": { "owner_boundary": "one personal Zora per tenant", "prime_implicit_access": false, "cross_zora_memory_sharing": false, "disclosure": "reviewed purpose-bound revocable projection", "training_default": false, "revocation_limitation": "prior disclosures cannot be recalled mathematically", "fleet_scope": "service metadata only", "learning_reference": "bounded opted-in categories; thresholding not differential privacy" }, "runtime_commands": [ "python3 -m unittest discover -s tests -v", "python3 -m zora_core.demo" ], "human_guide": "docs/BUILD_AND_OPERATE.md", "integration_register": "config/integrations.json", "test_evidence": "docs/test-results.txt", "test_count": 114, "gap_register": "specifications/gap-register.json", "construction_specification": "specifications/system-specifications.json", "acceptance_plan": "specifications/acceptance-plan.json", "handoff_evidence": "evidence/handoff-rehearsal.json", "local_runtime_openapi": "contracts/local-runtime.openapi.json", "production_gate_state": "not_run", "expansion_priority": { "family_play": "optional_future_capability_not_first_product_critical_path" } }