{
  "schema": "tiffany.systems/schema/architecture/1.0.0",
  "note": "The published publication architecture and the controlled private-to-public boundary. Tiffany's own architecture is not included because it has not been released — the entry below says so explicitly rather than being omitted.",
  "published": {
    "id": "publication-architecture",
    "title": "The publication architecture",
    "version": "1.0.0",
    "status": "PUBLISHED",
    "summary": "How a record becomes a public page, a machine document and a verifiable bundle. This architecture is fully published because it is this website, and every component of it is inspectable.",
    "nodes": [
      {
        "id": "records",
        "label": "Typed records",
        "role": "Claim versions, artifacts and the status ontology, in version control. The only source of truth.",
        "status": "AVAILABLE"
      },
      {
        "id": "policy",
        "label": "Policy as code",
        "role": "Fifteen deterministic rules plus state-machine invariants. Decides what may be published; no override path exists.",
        "status": "AVAILABLE"
      },
      {
        "id": "schemas",
        "label": "Schema enforcement",
        "role": "Every emitted document validated against its published schema. A failure stops the build.",
        "status": "AVAILABLE"
      },
      {
        "id": "build",
        "label": "Deterministic build",
        "role": "Zero dependencies. Same inputs produce the same bytes in any directory on any machine.",
        "status": "AVAILABLE"
      },
      {
        "id": "lock",
        "label": "Digest lock",
        "role": "Sealed digest of every published claim version. Editing a published version aborts the build.",
        "status": "AVAILABLE"
      },
      {
        "id": "human",
        "label": "Human surfaces",
        "role": "Script-free pages at three depths: understand, inspect, verify.",
        "status": "AVAILABLE"
      },
      {
        "id": "machine",
        "label": "Machine surfaces",
        "role": "Twenty-two endpoints, OpenAPI, schemas and portable bundles, generated in the same pass.",
        "status": "AVAILABLE"
      },
      {
        "id": "manifest",
        "label": "Build manifest",
        "role": "SHA-256 of every shipped file, so a reader can verify the whole site at once.",
        "status": "AVAILABLE"
      }
    ],
    "edges": [
      {
        "from": "records",
        "to": "policy",
        "label": "checked by"
      },
      {
        "from": "policy",
        "to": "build",
        "label": "gates"
      },
      {
        "from": "records",
        "to": "schemas",
        "label": "validated against"
      },
      {
        "from": "schemas",
        "to": "build",
        "label": "gates"
      },
      {
        "from": "lock",
        "to": "build",
        "label": "gates"
      },
      {
        "from": "build",
        "to": "human",
        "label": "renders"
      },
      {
        "from": "build",
        "to": "machine",
        "label": "emits"
      },
      {
        "from": "build",
        "to": "manifest",
        "label": "digests"
      }
    ],
    "invariants": [
      "A published version's bytes never change. Editing one aborts the build.",
      "Human and machine representations come from one record in one pass and cannot disagree.",
      "Classification fails closed: absent, unknown or ambiguous means internal, and internal is never published.",
      "Demonstration fixtures are excluded from every scientific index, feed, sitemap and endpoint."
    ]
  },
  "boundary": {
    "id": "export-boundary",
    "title": "The private-to-public boundary",
    "version": "1.0.0",
    "status": "PUBLISHED",
    "summary": "The one-way path material must travel before it can appear here. Nothing has travelled it yet.",
    "stages": [
      {
        "id": "private",
        "label": "Private environment",
        "note": "The authoritative scientific work. This site never reads from it."
      },
      {
        "id": "export",
        "label": "Explicit export",
        "note": "A deliberate act, never a sync."
      },
      {
        "id": "secrets",
        "label": "Secret scanning",
        "note": "MANDATORY before the first export. Not yet built, and nothing may cross until it is."
      },
      {
        "id": "sanitise",
        "label": "Sanitisation",
        "note": "Private inputs become attested transformations with digests, never disclosed inputs."
      },
      {
        "id": "classify",
        "label": "Classification",
        "note": "Fails closed. Absent or ambiguous means internal."
      },
      {
        "id": "licence",
        "label": "Licence and IP review",
        "note": "Ambiguous ownership is non-releasable."
      },
      {
        "id": "validate",
        "label": "Schema validation",
        "note": "Structure checked before meaning is trusted."
      },
      {
        "id": "policy",
        "label": "Release policy",
        "note": "The same deterministic rules that gate every claim."
      },
      {
        "id": "public",
        "label": "Public record",
        "note": "Immutable, digested, citable."
      }
    ]
  },
  "awaiting_publication": {
    "id": "tiffany-architecture",
    "title": "Tiffany system architecture",
    "status": "AWAITING_PUBLICATION",
    "summary": "No architecture of Tiffany itself has been released. This site will not draw a diagram of a system whose topology it has not been authorised to describe — a plausible-looking architecture diagram is the easiest thing on a technical site to fabricate and the hardest for a reader to check.",
    "prerequisite": "A separately authorised publication unit, with the same export controls that govern scientific records."
  },
  "schematics": [
    {
      "id": "publication-flow",
      "title": "How a record becomes public",
      "version": "1.0.0",
      "status": "PUBLISHED",
      "scope": "The publication architecture of this website.",
      "related": [
        "laboratory",
        "public-api"
      ]
    },
    {
      "id": "export-boundary",
      "title": "The private-to-public boundary",
      "version": "1.0.0",
      "status": "PUBLISHED",
      "scope": "The controlled path from the private programme to this site.",
      "related": [
        "tiffany-programme",
        "laboratory"
      ]
    },
    {
      "id": "verification-flow",
      "title": "What verification proves, and what it does not",
      "version": "1.0.0",
      "status": "PUBLISHED",
      "scope": "Six distinct things that are commonly conflated.",
      "related": [
        "verifier",
        "research-bundles"
      ]
    },
    {
      "id": "tiffany-topology",
      "title": "Tiffany system topology",
      "status": "AWAITING_PUBLICATION",
      "scope": "Not released.",
      "related": [
        "tiffany",
        "rci",
        "cios",
        "scientific-os"
      ]
    }
  ]
}