Cedar product architecture

Cedar is the development candidate for a merchant’s order intake, fulfilment and money workspace. The full preview is demo.soyrocoto.com/cedar. Its UI, prototype API, private provider services and seeded scenarios form one owned development experience. The shared kit supplies presentation primitives. Maintained-product adoption remains a separate decision governed by the repository’s existing backend, tenant and release contracts.

The operations hub contract refines daily preparation, setup, connected accounts, relative scenario dates and the assistant experience.

Customer lifecycle

flowchart LR
  Setup[Business setup] --> Channels[WhatsApp · Email · Phone]
  Channels --> Evidence[Source message · attachment · transcript]
  Evidence --> Review[Order draft and review]
  Catalogue[Products and prices] --> Review
  Review --> Sale[Sales and Delivery Note]
  Sale --> Request[Direct Yape / Plin request]
  Request --> Match[Prometeo bank evidence]
  Match --> Invoice[NubeFact invoice]
  Sale --> Money[Money dashboard]
  Match --> Money
  Invoice --> Money

Rocoto’s subscription payment unlocks business setup. Seller collection concerns customers paying for orders. Each has its own amount, payer, invoice, provider authority and accounting record.

Product surfaces

Money contains its invoice and payment history as nested views. A Delivery Note displays its own payment and transaction history, then links into those same Money records. Working capital and customer credit stand beside them and remain separate from bank balances; the bank connection is what opens working capital (FEED-IA §247.8).

Domain ownership

Account and data boundaries

The demo scenario chooses synthetic business/customer/product records. A provider authorization chooses a verified private account. Those are different selectors. Switching a scenario never grants access to a real WhatsApp, email, phone or bank account.

Country is a presentation selector within that same workspace. Peru presents the canonical synthetic commerce values in PEN. Spain converts those values at the scenario's fixed EUR/PEN rate and starts with Money hidden; its Money preference is retained independently when the person enables it. Frozen provider, payment and fiscal records keep their recorded amount, currency, timestamp and account binding. Peru-only collection and fiscal actions require the Peru country capability.

Money off hides every Money door (§247.9). With the Money capability off, the workspace keeps its ledger and shows none of it: the Money area and its seat in the rail and the phone's bottom row, the route #/money and the money setup pages behind it, the invoice and payment card and the payment badge on a Delivery Note, the Credit block on a customer sheet, the bank milestone in the Business setup ring, the bank step of onboarding, Money as a place in Find, the welcome screen's banking and money words, and the Bank account, Yape & Plin and Electronic invoices cards in Connections with the headings that would stand empty above them. The ring then counts one milestone — the order channel — and the channel's own Continue is the step that prepares the workspace. The provider read goes with the door: the ring's bank capability lives in BankMilestone, which mounts where the milestone does, so a Sales desk with Money off asks the money API for nothing. Settings → Money is the one way to bring it back, and every door returns with it.

WhatsApp reuses PR81’s verified provider/session implementation and encrypted account stores. The full Cedar origin uses a fixed loopback bridge to that existing development service and gets its own Secure/HttpOnly host-only cookie. The connection preview retains its callback and state. Reauthorizing a previously connected account reopens its saved history and retains once-only provider-operation guards.

Email and phone share an opaque, server-created Cedar channel workspace. Its private access record stores a token hash and expiry. Mailbox authorization must establish the actual provider account, while paid phone operations require explicit operator commissioning of account, numbers and allowed destinations. Browser-supplied customer IDs and demo casts grant neither capability.

Connected-account conversations have an explicit source view. Historical imports preserve their timestamps and remain source evidence; they never replay old messages as new customer orders. Proposed order changes retain message/attachment/final-utterance references and a review state.

Status vocabulary

A copied link becomes “sent” only through the explicit sending record. A seller-entered receipt remains manual evidence. A paid order requires matching accepted receipt amounts. A bank read establishes balance and observed movements, while invoice acceptance comes from the fiscal provider. New commercial drafts can collect before a fiscal number exists. Explicitly authorized drafts issue through NubeFact after the full amount has authenticated bank confirmation; uncertain submissions query their reserved fiscal identity.

Scenario consistency

Use the existing Cedar casts and shared synthetic lifecycle. Cedar adapts the shared source cast into Peruvian soles once, using its existing fixed 3.90 scenario rate. Catalogue prices, costs, trading thresholds, orders, Delivery Notes, customer totals and exports use PEN. Money derives invoice lines and amounts directly from those PEN Sales IDs; new billing drafts use PEN source currency and a 1:1 rate. Existing frozen EUR-sourced invoices retain their recorded source currency, conversion and already-PEN totals. The migration versions Cedar-owned monetary state and preserves quantities, percentages and private provider accounts. Bank opening balance plus matched bank receipts determines the sample closing balance. Manual cash receipts settle receivables without inventing a bank credit. Sample forecasts combine due invoices and scheduled sales with source-document deduplication. A connected account charts its own observed credits, provider mode, currency and read-time window; its balance and history retain bank provenance.

New email/call examples reuse those customers, products, source dates and business context. The onboarding company, catalogue confirmation, sales amounts, customer balances and Money cards must agree after reload and after a scenario change. Reset affects only the selected synthetic scope; private connected-account history remains with its provider store.

Implementation and evidence

• Onboarding contract: ordered steps, reusable wrapper and recovery.
• Money contract: dashboard, invoice/payment navigation, working capital and customer credit.
• Collection contract: direct receiving, reconciliation and fiscal lifecycle.
• WhatsApp implementation: verified real signup/history and exact API.
• Email and document implementation: Unipile scopes, messages, attachments and private invoice upload.
• Phone implementation and call UX: Twilio, Deepgram, first-answer state and transcript custody.
• Channel handoff: WhatsApp integration ownership and source contract.
• Native collection service: persistent development transport and provider guards.
• Scenario data: ownership, formulas and shared lifecycle.

Deterministic tests, local HTTP/browser proofs, real provider observations and publication receipts record different evidence. Each implementation document lists its measured results and remaining account-specific verification. Public HTTPS and real provider callbacks retain the development role.

Workspace hierarchy — September refinement

Peter’s refinement brief supersedes the dense dashboard and visible demonstration terminology from the first delivery. Cedar has three layers: domain overview, searchable records, and the selected record or task. Money presents the receiving balance, incoming chart, and large Invoices, Payments and Transactions cards. Its two lower cards open working capital and customer credit. Transactions and credit ranking live at /money/transactions and /money/credit; invoice and Delivery Note links retain the same stable IDs. Overdue totals belong to invoices and individual unpaid documents.

Connections groups provider cards into Banking, Payments and Communications. Logos identify the provider; one status and one short description explain the account. Team numbers and accounting options expand beneath the main groups. Mailbox history starts with an Inbox and opens one thread at a time. Export categories expand to reveal their templates. The shared disclosure preserves focus boundaries while animating height and opacity for 400 ms; reduced motion removes travel.

The setup circle tracks two essential milestones: a receiving bank and one communication channel. Business identity, catalogue and invoice imports remain accessible through setup and Settings. The prepared development entry opens Sales with pricing enabled and stock disabled, preserving subsequent explicit choices. /welcome opens the setup entrance. A reset of synthetic scenario state preserves private provider-account history and its authorization boundary.

A full setup page has one close control; nested steps have their own Back control. The earlier extra “Return to workspace” action is removed. Browser history owns route changes; the existing dismissible-layer stack owns task overlays. An expanded message clue is subordinate to its source message, and a transcript is subordinate to a call inside its conversation.

Product-facing copy uses ordinary account and record language. Development designation, synthetic provenance, provider readiness and authorization remain in the models, manifests and proof records. Actual account authorization and real fiscal acceptance continue to require provider evidence.

Visual references and finance terms

The supplied Monzo Flex screenshot determines the repayment selection: principal at the top, large mutually exclusive choices, exact dates and instalment amounts, total interest and total repayment before confirmation. Monzo’s payment editing documentation confirms the per-purchase instalment-plan interaction; Cedar’s working-capital pricing is its own design. One month carries zero interest, three months 0.5% total and six months 0.9% total. These are total plan charges, not monthly rates. The S/ 1,000 principal therefore repays S/ 1,000, S/ 1,005 or S/ 1,009. Versioned accepted plans preserve previous terms and exact minor-unit allocation. Confirming a plan records it locally and moves the same card into repayment status; commissioning and funding are separate provider steps.

Tactile object artwork is reserved for feature moments, beginning with working capital. Provider logos and dense operational records keep their existing icon vocabulary. The artwork's source and authoring receipt live beside the assets; generated artwork belongs to Cedar development.

Wiring — 11 September continuation (FEED-IA §246–§247)

This section is the top-down map of the continuation: what each capability reads, which module owns it, and how it is proved. Each area's own document carries the detail; this table is the place a reader starts.

Rules the table enforces: a connection entry reads a live selector and never a local draft; every posture other than ready shows the same static illustration and one connect action; language and market are two independent selectors; the map's ground is a build-time choice with the checked-in tiles as the ground that always exists; counts, totals and file sizes are derived once from the same selected set the artifact is generated from.

Reset

Settings → Reset Cedar offers two acts, each one action behind one question: Reset workspace data returns every synthetic store this workspace scope holds — orders, Money, setup progress, drafts, print history, the dismissals, the activation ledger, the display language and the country — to its seeded default while WhatsApp, phone and email keep their connections, and Reset and disconnect everything does the same and then disconnects WhatsApp through Meta's session route, every phone line through phoneApi.disconnectLine and every mailbox through the setup's own disconnect, so each setup flow starts at its first screen again while the messages those providers already hold stay with them. workspace-reset.ts owns the inventory of every browser store Cedar writes, with each key's owning module, its shape and its fate — workspace, connection or kept — plus, for a connection row, the account it mirrors and, where a store has one, the reset function Settings calls. A row whose writer has left the tree is marked retired with the change that retired it: the sweep still clears what an earlier build wrote, and the tool test holds the inverse — a retired key written anywhere in the tree fails. app/tools/test-workspace-reset.mjs reads every storage call in app/src on each run and fails when a key lands that the inventory never names, matches each key against its row's own shape so a new store under an existing family name (rocoto-app-print-preview-v2) is reported uncovered rather than swallowed by rocoto-app-print, and holds the reset functions the inventory declares to the ones storeResets() actually calls. Each provider states its own result with one retry, a refusal leaves the other results and the local reset standing, and a provider's own mirrors are cleared only for the outcomes disconnected and absent, so a mailbox that refused its DELETE keeps the cursor its intake reads from until a retry releases it. The card answers the route as well as Escape and the scrim, and the two windows answer it differently: once the sweep has landed the results card's own unmount performs the reload, so browser Back, a rail press or a hash edit all land a person on a freshly loaded Cedar, and Open the workspace is that same road taken deliberately. While the walk is still asking, the held card names the account it is asking (reset-asking) and carries a Stop, which shares one AbortController with the route, so a stopped walk asks no further account and stands the sweep down; the accounts that already answered disconnected or absent hand over their mirrors as settled facts, everything else stays exactly as it was, and the stopped card states every account with its retry and closes through Close. The workspace's channel access record survives both acts because it is the road the phone and email disconnects travel, and the event rocoto:cedar-workspace-reset carries {scope, disconnect} to every store holding a connection flag or a provider snapshot after the keys are cleared and every provider call has returned.

Illustration registers

Two registers, one palette, one white ground. Product paintings (library/paintings) identify products on rows and sheets. Feature objects (library/illustrations, Uber's 3D register, solid and clear at 88–184 px) stand at the top of setup states, popups and cards. A new feature object is one subject edit of the anchor's verbatim description, reviewed at drawn size before it is installed; the flat and painterly attempts of 11 September are kept as the rejected record.

Wiring — 14 September: unpaid orders, the advance, the dossier, campaigns (FEED-IA §249)

Four capabilities, each one a row: what it reads, which module owns it, which entries read it, how it is proved. The rules under the 11 September table hold here too: a live selector, one vocabulary, one clock, counts derived once from the same set the act runs on.

Ninety-day demo book · gap appendix, 15 September 2026

The three demo houses carry 96 calendar days of Sales, with Monday and Friday busiest and Sunday light. Money fixtures own the weekday schedule, payment spread, disputes and three seeded chase rungs. Each invoice and receipt derives from its Sales lines; the dashboard, collection runtime and ninety-day lender dossier reconcile to the same PEN ledger. Customer ids assign stable wallet/bank/cash methods. Pristine Money and reminder books roll forward together; authored records keep their calendar and the bank reads that retained anchor.

Order payment lifecycle · gap item 2

A collectible priced order owns its native Yape link automatically. Order payment and fiscal issuance have separate preparation and authorization. Delivery sends the payment link through the existing customer-conversation seam according to the Money timing policy; held orders show their reason and merchant send action. First contact anchors reminders at24,48 and72 hours. Exact dispatch text and stable message identity survive reload. The owner cursor poll imports receipts and updates the same order and link after partial or full payment. Money lifecycle owns the detailed dispatch, commercial revision, fiscal and fixture-retention contract.

Source document ↗