Who it is for

Who it is for, and how far it goes.

This page answers three questions, in this order: whom the software lets act, on which deals, and where what it holds stops. The third is the one that decides. A register of decisions is not a document system, and it is better said before than after.

What the software authorises, and what it refuses

The software knows these roles, and these alone. This is an authorisation taxonomy, not a list of intended readers: it says whom the software lets act, not whom we address. Every read and every write names the roles it admits, and refuses everything else by default.

executive
legal
commercial
finance
editorial
production
public relations
technical
administration
external counsel
external viewer

The deal, the matter and the counterparty: Read admitted under the commercial and legal roles. The scope of an admitted read is that of the group: every filter carries the group identifier, and access from one group to another is refused, not silently emptied.
The audit journal: Read admitted under the administration, legal and executive roles. It returns the group’s events with no filter, no pagination and no export, and stops at five hundred rows served in ascending order of creation: beyond that, the most recent are not reachable by this read. We would rather write it than let it be discovered.
The editorial firewall review: Read admitted under the editorial, commercial and executive roles; deciding a review requires the editorial role, with one exception, which we state rather than pass over: on a BLOCKED review, executive standing may decide as well. Read under the commercial role alone, the review is confined to the deals for which the reader is the recorded commercial owner; let them also hold the editorial or executive role, and the restriction falls away.
The approval request: Read admitted under the executive, legal, commercial and finance roles. Read under the commercial or finance role, it is confined to the requests that call for one of the reader’s roles or that they themselves raised; beyond that, the request is reported to them as non-existent, and its reason is never disclosed to them.
The decision: No automated agent renders a binding decision: the human standing of the decider is required before any write. The author of an approval cannot decide it, and the transaction is settled without partial mutation. A decision once rendered is immutable; to reconsider is to open another.

Two reservations, rather than a silence. The external viewer role is declared in the enumeration and enters no admitted list: every read refuses it for as long as the scoping relation does not exist — it is therefore named as such, never as a reader we serve. And there is no alert of any kind: no model, no field, no route. What is read is read because it was opened, never because notice was given of it.

The four business lines, and what the code makes of them

These are four values of the model, not four brochure headings: a deal is attached to exactly one line when it is created, and that line must have been declared. A deterministic engine computes from what is declared to it and validates the deal type against a versioned catalogue; it infers nothing it has not been told. A single counterparty, for its part, appears on several lines.

LODGING: Lodging: the hotel’s operating, management and services agreements.
FOOD_AND_BEVERAGE: Food and beverage: concessions, delegated operations, supplies and front-of-house providers.
MEDIA_RIGHTS: Media rights: the only line with a built editorial firewall. A conflict of interest is blocked there, not discouraged — a review is raised under the editorial role, escalated under the editorial and commercial roles, and the deal does not proceed while the review is unresolved.
BRAND_FRANCHISE: Brand and franchise: banner licences, franchise agreements and representation agreements.

What the code does not do for these lines is named too: no template per line, no threshold per line, no compliance register per line. No price or monetary threshold, no artificial intelligence, no compatibility matrix. The editorial firewall is itself partial: its explicit commands and the blocking of the deal are built, its automation is deferred. Finally, a counterparty entered with its registration number cannot be created twice within the same group; without that number, the schema does not prevent two records of the same counterparty.

The scope, stated in advance

LCOS holds the cycle and the decision: the counterparty, the deal, the matter, the contract, the approval — who decided, when, and under which rule. It does not hold the document. It neither drafts nor generates any document; it holds no clause library, no contract template and no version comparison; it does not sign, and rests on no signature provider; it stores no file.

This is not a claim, it is a boundary that can be checked. The product’s data schema carries no model for a document, a clause, a contract version or a signature envelope; the architecture says so in plain words: no signature port and no object storage port are implemented. A contract reference there designates the record of the decision, never the body of the contract. What LCOS leaves to the document system, it leaves whole.

The specification counts forty modules — it is named, and the count can be redone. The repository, for its part, carries nine application modules, which can be listed: counterparties, deals, matters, contracts, approvals, approval matrix, editorial firewall, audit journal, identity. These two counts are not subtracted one from the other, and we do not subtract them: a module of the repository does not map term for term onto a module of the specification.

The five steps, one by one

What this page does not show

References and usage figures: This site presents no client reference, no testimonial, no third-party logo and no usage figure. We shall publish none until we have any. What is established, and what we can say: no real data has entered the system. This is deliberate — an architecture decision forbids any ingestion of real data until backup, exercised restoration and storage integrity checking are all three proven. Two of those three conditions are; the third is not. We do not open the gate two thirds of the way.
Road map: What comes next is specified; it is not dated. The master specification describes forty modules across seven phases. The foundation phase is partially built: the chain from counterparty to approval, the platform and the approval matrix are; the editorial firewall only partly, its automation being deferred, and the resilience gate is not passed. Every later phase carries the state “specified, not implemented”. We do not publish a schedule we have not settled.