dev-procfile/report/02-business-domains.md

Business-domain map

Core domains

• Tokenization: asset definition, issuer/network metadata, price, supply/buy limits, policy, whitelist, and publisher-owned ICO sell orders.
• Custody and settlement: user wallets, Kuknos trustlines, internal/external transfer, deposit/withdrawal, balance locks, commissions, and blockchain tracking.
• Primary sale: quote -> agreement -> claim-once acceptance -> taker order -> settlement against the authorized token publisher's live maker order.
• Secondary market: buy/sell orders, contracts, matching/settlement, cancellation, history, and market clearing.
• Fiat rails: Mellat IPG deposit confirmation, IRT withdrawal approval, accounting and withdrawal logs.
• Redemption: token return, repayment calculation, bank destination, and operational payout record.
• IAM/compliance: OTP/JWT/TFA, identity/KYC data, bank accounts, roles, route permissions, and asset-level admin permissions.
• Financing: BNPL plans, applications, companies, schedules, supported assets, and locked balances.
• Audit/accounting: Wallet transaction lifecycle, immutable GL journals/events, balances, replay, and explorer.
• Legal evidence: versioned agreements/contracts/policies, acceptance, signer, 2FA proof, and transaction linkage.
• Collateral authorization: third-party API clients, scoped lock requests, approval/denial, reservation, release, and consumption.

Key invariants already expressed

• GL monetary journals are immutable, atomic, idempotent, fixed-point, and balanced per asset.
• A primary-sale maker must be an open ICO sell order owned by a user with the stable token-publisher role.
• Agreement acceptance is claim-once; settlement rechecks price, commission, order status, and remaining volume.
• Transaction inserts and GL/event outbox writes share the Wallet database transaction.
• A market/ICO operation must reserve spend and inventory before asynchronous execution; rejection or failure must release the same reservation exactly once.
• IRT withdrawal is a stateful approval workflow, not a direct transfer: request -> freeze -> admin decision -> settle/release.

Ownership problem

AdminPanel can still mutate unmanaged replicas of core tables directly. These writes bypass Wallet validation, Kuknos operations, transaction events, and GL recording. Until mutations go through authenticated internal RPCs and legacy models become read-only, the business invariants are not system-wide.