{ "product": "Atelier ProfessionOS", "version": "0.2.0", "productType": "premium digital presence intake, recommendation, and local operations platform", "clearUser": "Professional, service-business owner, firm, clinic, creator, or selected Web3 identity client seeking a premium digital presence path.", "clearProblem": "The client does not know the right website format, package, add-ons, ownership path, domain/hosting lane, maintenance option, or safe next step.", "repeatableInput": "Self-submitted Digital Readiness Score intake covering identity, profession, goals, readiness ratings, domain/hosting status, renewal details, budget, urgency, and capability needs.", "repeatableOutput": "A local Atelier recommendation report with score, readiness band, recommended format, recommended package, top-ups now/later/not-now, domain/hosting guidance, legal/safe-access/ownership notes, renewal protection, support path, and next action.", "stateDatabase": { "type": "local JSON/JSONL for MVP with optional Supabase REST mirror for live lead-capture trials", "futurePath": "Postgres can replace local storage when the product moves from local MVP to shared control plane; Supabase REST can bridge reports and lead projections now.", "files": [ "data/leads.jsonl", "data/reports/{report_id}.json", "data/clients.jsonl", "data/projects.jsonl", "data/accounting.jsonl", "data/communications.jsonl", "data/access.jsonl", "data/support_tickets.jsonl", "data/renewals.jsonl", "data/complaints.jsonl", "data/maintenance.jsonl", "data/tasks.jsonl", "data/advisor_sessions.jsonl", "data/project_requests.jsonl", "data/quote_drafts.jsonl", "data/launch_kits.jsonl", "data/preview_approvals.jsonl", "data/deployment_packages.jsonl", "data/dns_plans.jsonl", "data/cost_events.jsonl", "data/consent_events.jsonl", "data/provider_actions.jsonl", "data/human_escalations.jsonl", "data/site_factory_packets.jsonl", "data/growth_kits.jsonl", "data/campaign_drafts.jsonl", "data/sales_pipeline.jsonl" ] }, "uiSurfaces": [ "/", "/score", "/advisor", "/showcase", "/experience", "/demo", "/submission", "/atlas", "/design-vault", "/costs", "/software", "/offer", "/alternatives", "/start", "/report/:id", "/brief/:id", "/launch-kit/:id", "/client-site/:id", "/factory/:id", "/growth/:id", "/admin" ], "apiContracts": [ { "method": "GET", "path": "/api/health", "output": "runtime status, route manifest, system nodes, storage mode" }, { "method": "GET", "path": "/api/production-readiness", "output": "admin auth, durable storage, public URL, and blocked live-action readiness" }, { "method": "POST", "path": "/api/score", "input": "score intake JSON/form", "output": "report id, report URL, full report JSON" }, { "method": "GET", "path": "/api/report/:id", "output": "full report JSON" }, { "method": "GET", "path": "/api/admin/leads", "output": "admin lead projections" }, { "method": "GET", "path": "/api/admin/export/leads.csv", "output": "local CSV export for human review" }, { "method": "GET", "path": "/api/admin/export/agent-routing.json", "output": "admin-only read-only agent routing JSON export" }, { "method": "GET", "path": "/api/admin/export/agent-stack-status.json", "output": "admin-only read-only agent stack status JSON export" }, { "method": "GET", "path": "/api/admin/followups", "output": "draft-only follow-up queue; no sending" }, { "method": "GET", "path": "/api/admin/tasks", "output": "server-side operator task ledger" }, { "method": "GET", "path": "/api/admin/earning-dashboard", "output": "lead, project request, and revenue task readiness summary" }, { "method": "POST", "path": "/api/admin/accept-report", "input": "reportId", "output": "local accepted-client draft workflow records" }, { "method": "POST", "path": "/api/support-ticket", "input": "reportId, summary, issueType", "output": "classified local ticket record" }, { "method": "GET", "path": "/api/service-packages", "output": "package ladder and compatible top-up routing data" }, { "method": "GET", "path": "/api/product-contract", "output": "this product contract and acceptance criteria" }, { "method": "GET", "path": "/api/alternatives", "output": "registry-derived local/free alternatives for paid-service dependencies" }, { "method": "GET", "path": "/api/assistant/status", "output": "local assistant status and safety boundaries" }, { "method": "GET", "path": "/api/fullstack-commercial-stack", "output": "AI assistant server plan, client fee summary, third-party cost categories, provider references, and activation sequence" }, { "method": "GET", "path": "/api/software-options", "output": "build-vs-adopt evaluation for AI UI, ClickSites, builder platforms, and future React migration" }, { "method": "GET", "path": "/api/website-atlas", "output": "website types, page types, feature modules, ecosystem layers, production lanes, and upgrade paths" }, { "method": "GET", "path": "/api/design-vault", "output": "Atelier signature animation research, palette families, structures, and premium add-on design tiers" }, { "method": "GET", "path": "/api/signature-experience", "output": "sellable Atelier motion, tone, optional sound concepts, safety policy, and own-site usage map" }, { "method": "GET", "path": "/api/proof-machine", "output": "Atelier proof-machine plan, niche showroom directions, capability deployment map, and design recommendation" }, { "method": "GET", "path": "/api/demo-journey", "output": "deterministic local demo journey including report, proof direction, brief, preview, launch kit, factory packet, growth kit, and advisor answer" }, { "method": "GET", "path": "/api/website-submission", "output": "whole-site local submission dossier with route inventory, acceptance criteria, proof inventory, readiness status, validation commands, and live-action blockers" }, { "method": "GET", "path": "/api/website-design/:id", "output": "report-specific website type design, pages, modules, server needs, costs, and blocked live actions" }, { "method": "GET", "path": "/api/agent-stack-status", "output": "admin-only controlled resource routing, dry-run status, blocked live actions, and next safe activation steps" }, { "method": "GET", "path": "/api/ai-runtime-status", "output": "server-side AI runtime readiness, provider key presence, budget guard, and local fallback mode" }, { "method": "POST", "path": "/api/project-request", "input": "reportId plus selected package/start preferences", "output": "project request, quote draft, and operator tasks" }, { "method": "POST", "path": "/api/advisor", "input": "reportId or mini questionnaire plus question", "output": "local advisor guidance and useful report/brief links" }, { "method": "GET", "path": "/api/site-brief/:id", "output": "professional website brief draft generated from a report" }, { "method": "GET", "path": "/api/launch-kit/:id", "output": "local launch readiness kit with invoice draft, message drafts, DNS dry-run, handoff, preview, and checklist" }, { "method": "GET", "path": "/api/client-site/:id", "output": "local client-site preview JSON; not published" }, { "method": "GET", "path": "/api/site-factory/:id", "output": "build lane, page blueprint, ClickSites prompt, production prompt packet, QA and approval gates" }, { "method": "GET", "path": "/api/growth-kit/:id", "output": "lead magnet, social, ads, sales pipeline, backtest and no-spend campaign drafts" }, { "method": "POST", "path": "/api/preview-approval", "input": "reportId plus reviewer notes", "output": "local approval note and launch gate blockers" }, { "method": "GET", "path": "/api/admin/launch-kits", "output": "launch kit and preview approval ledgers" } ], "workflowEngine": { "current": "Node.js local workflow functions, local advisor rules, website brief generator, project request workflow, launch kit workflow, server-side task ledger, and JSONL registries", "future": "n8n may orchestrate approved external lanes when it materially advances build, test, or deployment objectives; irreversible live actions remain explicit-approval gates.", "contract": "Every workflow must produce artifact paths, receipt/checkpoint data, ledger state, blocked actions, and next action." }, "executorLayer": { "current": "No live external executor is required by the current safe local trial path.", "future": "RTILA/browser/Playwright/API/deployment tools may be used for controlled QA, evidence, or implementation support when useful; public publish, account mutation, payment, messaging, spend, or destructive actions require explicit live authorization.", "outputShape": { "task_id": "string", "status": "complete|blocked|failed|needs_human", "artifact_paths": [], "receipt_path": "string", "blocked_reason": null } }, "receiptLedgerCheckpoint": { "receipt": "receipts/ATELIER_FULL_GAP_CLOSURE_RECEIPT.md and future receipts", "ledger": "data/*.jsonl local registries", "checkpoint": "report JSON plus admin projection and next action" }, "deploymentPlan": { "local": "npm run dev on 127.0.0.1:8791", "validation": "npm run validate", "github": "private/safe repository with local data ignored", "futureTrial": "Vercel or Docker can serve the stateless surfaces; set ATELIER_ADMIN_TOKEN plus durable storage before public lead capture; live provider actions remain controlled approval gates." }, "acceptanceCriteria": [ "homepage explains premium Atelier offer and Free Digital Readiness Score", "score intake creates a report from repeatable submitted input", "report includes score, recommendation, package, add-ons, domain, hosting, safe access, ownership, renewal, maintenance, revision, legal, refund, handoff, and next action", "admin shows lead identity, location, profession, score, package, format, add-ons, domain/hosting, maintenance, renewal, legal, support/refund risk, Web3 interest, and next action", "accepted-client and launch-kit workflows create draft local records while payment, messages, DNS, hosting, and publishing remain controlled approval gates", "support ticket workflow classifies issues and logs complaint/refund paths locally", "production readiness reports trial/live status, admin auth, durable storage, and controlled live-action gates", "costs page and fullstack commercial API explain what the client pays Atelier, what is paid to third parties, and what may become recurring later", "website atlas explains practical website/page types, modules, ecosystem layers, upgrade paths, and complex-site production needs", "admin can inspect controlled agent/resource routing without enabling live automation", "AI assistant plan keeps provider keys server-side, logs sessions, limits spend, and falls back locally until a live provider is explicitly activated", "receipts and ledgers are written locally while credentials, messages, payments, DNS, hosting, deployment, account mutation, spend, and public publishing require explicit live authorization", "npm run validate passes" ], "revenuePath": "Convert a readiness score lead into a report, local advisor session, project request, launch readiness kit, human-reviewed scope call, quote draft, approved build fee, optional top-up tariffs, care plan, migration support, emergency ticket, or growth retainer.", "ethicalVisibilityAcquisition": { "status": "guardrailed_future_lane_not_live_in_mvp", "allowedModel": [ "compliant discovery", "lead/candidate registry", "website/readiness audit", "opportunity scoring", "personalised mini-audit", "pitch deck/email/video draft assets", "compliance gate", "human approval", "CRM/follow-up", "opt-in communication only" ], "blockedModel": [ "illegal scraping", "Google Maps page scraping", "captcha bypass", "stealth automation", "mass WhatsApp blasting", "unsolicited WhatsApp without opt-in", "fake urgency", "automatic outreach without approval", "private email harvesting" ], "rule": "WhatsApp, email, and similar outreach require opt-in, clear permission, or explicit human-approved compliance context before any sending provider is connected." }, "paidServiceResolution": { "source": "Derived from ARIA owned_stack_registry, paid_stack_capability_registry, and repo_signal_candidate_registry.", "policy": "Use local/free/open-source or already-owned tools first. Paid services, APIs, RTILA, n8n, browser automation, deployment tools, and configured integrations are controlled resources: use when useful, log actions, protect secrets, avoid destructive changes, and require explicit authorization for live/spend/account mutations.", "noPaidServiceRequiredForTrial": true, "currentTrialNeedsPaidServices": false, "alternatives": [ { "paidNeed": "External live advisor or hosted LLM consultation", "currentResolution": "Atelier uses a local rule-based advisor connected to the questionnaire, report, and brief engines.", "registryAlternatives": [ "GPTChain portable prompt packets", "pydantic_ai local agent scaffold", "LiteLLM runtime-gated gateway", "LangGraph runtime-gated workflow", "Chroma or LanceDB local retrieval store" ], "activationRule": "Provider keys, paid API calls, live consultation claims, and account actions are controlled resources requiring explicit approval, logging, and cost/privacy controls." }, { "paidNeed": "Paid page builder or instant website generator", "currentResolution": "The trial produces a professional recommendation report and website brief; Atelier delivery remains quality-controlled and human-approved.", "registryAlternatives": [ "vanilla Node/HTML/CSS app", "Vite or static HTML lane", "Ghost local publishing sandbox", "Penpot local design workspace", "Playwright screenshot/QA harness" ], "activationRule": "Automatic public website creation, publishing, DNS mutation, or hosting changes require a separate authorized production lane and receipt logging." }, { "paidNeed": "Paid lead-magnet, PDF, or document packaging service", "currentResolution": "Reports and briefs are available as local HTML/JSON artifacts and can be packaged in the local trial ZIP.", "registryAlternatives": [ "Stirling-PDF local loopback", "Docling local document conversion", "local HTML print/export", "workspace document libraries when available" ], "activationRule": "Generated documents remain drafts until human review and client approval." }, { "paidNeed": "CRM, client portal, helpdesk, or email campaign platform", "currentResolution": "The MVP writes local JSON/JSONL registries and displays leads, reports, draft follow-ups, tickets, and accepted-client records in admin.", "registryAlternatives": [ "Listmonk local loopback without SMTP sending", "Nextcloud local client-vault lane", "Chatwoot only after local image readiness", "JSONL admin registry" ], "activationRule": "Email, SMS, WhatsApp, portal invitations, and support messages remain draft-first until explicit live sending authorization and consent controls exist." }, { "paidNeed": "Hosted analytics, uptime, or monitoring service", "currentResolution": "The admin surface and local health endpoint provide operator review for the trial.", "registryAlternatives": [ "Plausible local loopback", "Uptime Kuma local loopback", "DuckDB local analytics", "JSON/CSV export for human review" ], "activationRule": "External trackers or monitoring must be privacy-reviewed, consent-aware, and explicitly approved before use." }, { "paidNeed": "Browser automation or dashboard execution service", "currentResolution": "The Atelier MVP performs no scraping, provider mutation, payment, DNS, hosting, or account automation.", "registryAlternatives": [ "RTILA local dry-run blueprints", "Browser harness for manual continuation", "Playwright for deterministic QA/screenshots only" ], "activationRule": "Credentials, live signup, dashboard mutation, or scraping require separate approval, safe handling, and receipt logging; CAPTCHA/2FA bypass remains disallowed." }, { "paidNeed": "Managed database or cloud backend", "currentResolution": "The MVP uses local file-based JSON/JSONL storage suitable for safe trials and GitHub review.", "registryAlternatives": [ "Postgres later via Docker Compose", "DuckDB for local analytics", "Chroma or LanceDB for local retrieval", "SQLite-style local ledgers if needed" ], "activationRule": "Paid cloud databases, credentials, or customer data sync require explicit approval, secrets handling, and data-retention controls." }, { "paidNeed": "Design suite, brand board, or creative production service", "currentResolution": "The current site uses the Cinematic Atelier design system in local HTML/CSS.", "registryAlternatives": [ "Penpot local design workspace", "Atelier CSS component library", "Artistly-style prompt packs as manual drafts only", "local screenshot review" ], "activationRule": "Client-facing copy must remain professional and must not imply automated mass-produced delivery." } ] }, "productionSafety": { "responseHeaders": [ "Content-Security-Policy", "X-Frame-Options", "X-Content-Type-Options", "Referrer-Policy", "Permissions-Policy" ], "inputGuard": "Sanitizes local trial submissions, strips control characters, limits field length, and rejects password/API key/token/private-key style material before storage.", "errorPolicy": "Server errors return safe public messages instead of internal stack traces or raw exception details.", "adminAccess": "Admin and operator APIs are open for local/trial mode only when ATELIER_ADMIN_TOKEN is unset; public exposure requires token configuration." }, "aiAdvisorStatus": { "current": "local rule-based assistant connected to the questionnaire, report engine, project request workflow, and task ledger", "notYet": "external LLM-powered live consultation, account actions, provider changes, and automatic website publishing are not connected in this trial path", "productionPlan": "Server-side advisor gateway: validate input, reject secrets/sensitive details, load report context, enforce rate and budget limits, call provider only if enabled, log cost/session/risk, and escalate regulated/payment/refund/domain/hosting matters to a human.", "reason": "The trial stays safe by using controlled resources: no secret exposure, no destructive changes, no unbounded spend, and explicit approval for irreversible live actions." }, "controlledResourcePolicy": { "allowedWhenUseful": [ "local tools", "scripts", "browser automation", "RTILA", "n8n", "APIs", "deployment tools", "configured integrations" ], "requirements": [ "never expose secrets", "never make destructive changes", "never create unbounded spend", "log live/tool actions in receipts" ], "explicitAuthorizationRequiredFor": [ "public publishing", "account mutation", "payments", "message sending", "domain purchase", "hosting purchase", "DNS mutation", "spend", "destructive deletion", "secret exposure" ], "currentTrialMode": "build, test, validate, package, and prepare deployment; keep irreversible live actions at approval gates" }, "neverAllowed": [ "secret exposure", "destructive changes", "unbounded spend", "search-position or revenue promises" ] }