Skip to contentSaltar al contenidoAle nan kontni anПерейти к содержимомуדלג לתוכן
EstateDraftFL

For Florida law firms

The chained record, verification manifests, the decision packet and the file hand-over

firm lane · Deterministic — no model call

Current availability

ShippedConfigured and enabled: firm staff of the matter's firm; the ledger record and its Verify now are platform-admin only.

Where it lives
/admin/attestation (the ledger record) · /api/artifacts/manifest · /api/admin/decision-packet · /api/admin/matter-export?mode=handover
What unlocks it
firm staff on the matter's tenant for the decision packet and the hand-over; the artifact's own download rule for its manifest; platform admins for the ledger record

Status is evaluated against this deployment's configuration by the capability-status service at build time; the catalogue's facts were last reviewed on the date shown.

Capabilities

  • ShippedEvery row of the audit trail, the Verifiable Trust Receipts, the document provenance and the execution records is chained per firm by the database as it is written; a nightly check recomputes every entry from its source row and pages operations when a chain breaks.
  • ShippedOnce a day the chain heads that moved become one Merkle root, sent to two public OpenTimestamps calendars (the root is the only thing that leaves); a day is called confirmed only after a Bitcoin block header has been checked against its proof.
  • ShippedEvery canonical export has a verification manifest: the file fingerprints, each citation with a verdict a stranger can re-derive, the chained record of the version, its anchor tier, the issuer signature, and what nothing in it checked.
  • ShippedA decision packet for an approved, released version: its exact files, its manifest, the decision that approved exactly that version, the delivery receipt and the sources — as a firm-archive copy, or a client-safe copy that names internal notes as withheld.
  • ShippedA file hand-over bundle for a matter: every clean document's original bytes, the data as formula-guarded CSV and exact JSON, each sealed version with its manifest, the matter's chained audit trail and receipts with the linking entries, the anchor proofs, a README and a signed MANIFEST — checkable with the network off.
  • ShippedBoth exports are checked against the platform's inventory — the database's own count of the matter's records in every table that carries it, read from the catalog: the file's tables with what the platform holds and what the export carries, every gap named, and the firm's, the platform's and a person's own records kept out by a stated policy that never says which of them exist (master plan M-1003).
  • ShippedA packet approval and its receipt are recorded in one database transaction: no approval is ever recorded without its receipt.

Limits

  • Manifests and bundles are unsigned until the owner configures the issuer key and publishes its public half in the trust root; a sample key signs the published sample only.
  • A new anchor reads pending until a Bitcoin block confirms it (usually within a few hours); nothing claims an anchor is confirmed before the block header is checked.
  • The offline verifier cannot fetch Bitcoin block headers; it says so for every confirmed proof.
  • A hand-over carries up to 200 documents (50 MB each) in a bundle of up to 350 MB; a document whose stored bytes no longer match their recorded fingerprint is withheld, named, and reported to operations.
  • Download links last one hour; stored bundles and packets are removed after seven days.
  • A packet or a bundle never states that a document is legally valid or that a file is complete; what a client is entitled to on surrender remains the firm's judgment.
  • The supervision ledger is reserved; it is chained when the supervision register ships.

What EstateDraftFL refuses

Reason codeHTTPWhat it means
forbidden403The session is not firm staff (the ledger record: not a platform admin).
not-found404The version or matter is outside the caller's tenant context.
not-an-approved-version409A packet is made only for an approved, released version — never a working copy.
no-renditions409Render (download) the version first; a manifest or packet names the exact files.
not-delivered409A client's packet is available only for a version the firm delivered to that client.
firm-review-pending402The firm has not approved the reviewed generation this manifest would describe.
manifest-unavailable503The manifest could not be assembled from the record; nothing was issued.
packet-unavailable503The packet could not be assembled; nothing was issued.
handover-unavailable503The bundle could not be assembled; nothing was handed out.
verification-unavailable503The chain verification could not run; nothing was recorded — never a clean result.
receipt-unavailable503The receipt could not be written, so nothing was approved.
rate-limited429Packets, bundles and verification runs are limited per hour; the reply names the wait.

Evidence

  • docs/MANIFEST-SPEC.md
  • src/lib/ledger/server.ts
  • src/lib/anchor/server.ts
  • src/lib/manifest/build.ts
  • src/lib/handover/build.ts
  • src/lib/handover/inventory.ts
  • supabase/migrations/20260928230000_phase10c_matter_inventory.sql
  • src/lib/decision-packet/build.ts
  • supabase/migrations/20260925170000_phase6_ledger_chain.sql
  • docs/security/MASTER-PLAN-PHASE6-2026-09-25.md

Last reviewed 2026-09-28

← All surfaces