local-loop-io · alpha912 · Jul 18, 2026 · Jul 18, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-18
+
+### Added
+- Core-DP `0.1.0-lab` applicability profile with normative v0.2.0 requirement manifest, profile requirement index, JSON Schemas, conformance vectors, EPCIS/CBV fixture metadata, and profile index documentation.
+- Validation coverage for Core-DP schemas, requirement links, normative `SPECIFICATION.md` RFC 2119 clause mapping, conformance vectors, semantic vector checks, and EPCIS fixture guardrails.
+- `npm run check:domains` script wrapper for the repository domain policy check.
+- Portable Core-DP schema conditionals for envelope body binding, choreography authority/state matrices, cross-node search auth/consistency, replay-window checks, and OpenAPI multi-header node-signature auth.
+- Executable Core-DP conformance harness (`profiles/core-dp/conformance/run-conformance.js`,
+  `npm run conformance:core-dp`) validating all conformance vectors against schemas and
+  their declared semantic checks, cross-referenced against requirement IDs.
+- `core-dp-requirements.json` enriched with rationale, owner, testability statement,
+  and evidence output per requirement.
+
+### Changed
+- OpenAPI now keeps the base v0.2.0 endpoints and adds the lab-only Core-DP Product search endpoint with direct refs to the profile search request/response definitions.
+
+### Fixed
+- `docs/governance/rfc-process.md` now points to `GOVERNANCE.md` §2 as the
+  authoritative RFC process for states/timing, resolving a conflict between
+  the two documents.
+- Corrected a stale `localloop.github.io` domain reference in the
+  `spec-implementation-divergence.md` audit doc.
+
 ## [0.2.3] - 2026-05-26
 
 ### Added

diff --git a/PROJECT_STRUCTURE.md b/PROJECT_STRUCTURE.md
@@ -48,6 +48,32 @@ loop-protocol/
 │   ├── 13-conformity-claims.json
 │   ├── 14-product-reuse-registration.json
 │   └── 15-product-offer-flow.json
+├── profiles/
+│   ├── README.md
+│   └── core-dp/
+│       ├── README.md
+│       ├── conformance/
+│       │   ├── README.md
+│       │   ├── trust/
+│       │   │   └── accepted-peer-keys.json
+│       │   └── vectors/
+│       │       └── core-dp-vectors.json
+│       ├── epcis/
+│       │   ├── README.md
+│       │   ├── fixtures/
+│       │   │   └── core-dp-transfer-object-event.json
+│       │   └── unsupported-features.json
+│       ├── requirements/
+│       │   ├── core-dp-requirements.json
+│       │   └── spec-v0.2.0-normative-manifest.json
+│       └── schemas/
+│           ├── choreography-message.schema.json
+│           ├── dna-operation.schema.json
+│           ├── envelope.schema.json
+│           ├── epcis-mapping.schema.json
+│           ├── error.schema.json
+│           ├── evidence-entry.schema.json
+│           └── search-contract.schema.json
 ├── docs/
 │   ├── faq.md
 │   ├── federation-handshake.md

diff --git a/README.md b/README.md
@@ -14,19 +14,22 @@ Local Optimization with Overflow Protocol. A federated circular economy concept
 - `schemas/`: JSON Schema definitions.
 - `examples/`: sample payloads for interop.
 - `contexts/`: JSON-LD contexts.
+- `profiles/`: applicability profiles, including the lab-only Core-DP contract and conformance vectors.
 - `docs/regulatory-alignment-roadmap.md`: long-horizon EU and German compatibility plan.
 - `rfcs/`: RFCs and design notes.
 
 ## Quickstart
 ```bash
 npm ci
 npm test
+npm run check:domains
 ```
 
 ## Usage notes
 - Specs and schemas are draft and subject to change.
 - No certified implementations exist at this time.
 - Use `examples/` to validate tooling and docs.
+- Core-DP is a lab-only applicability profile, not a full LOOP conformance claim.
 
 ## Links
 - Docs hub: https://localloop.urbnia.com

diff --git a/docs/audit/discovery.md b/docs/audit/discovery.md
@@ -0,0 +1,75 @@
+# Phase 1 - Discovery & Context Gathering
+
+> CURRENT-USE WARNING: This is a historical discovery snapshot, not current implementation, deployment, or readiness evidence. Its original snapshot date and analyzed commits were not recorded in this source; do not infer them. Use [CLAIMS-AND-MATURITY.md](../governance/CLAIMS-AND-MATURITY.md) and [RELEASE-CHECKLIST.md](../governance/RELEASE-CHECKLIST.md) for current decisions.
+
+## 1.1 Project Structure Analysis
+
+### Top-level layout
+- Root contains four git repos plus shared `AGENTS.md` and `CLAUDE.md`.
+- Repos:
+  - `localloop.github.io` — public docs hub (Next.js static export).
+  - `localloop-backend` — Bun + Fastify API (interest registry + lab demo).
+  - `loop-protocol` — protocol specification + schemas + RFCs.
+  - `org-github-profile` — GitHub org profile docs.
+
+### Source directories
+- `localloop.github.io`
+  - `app/` — Next.js App Router pages and layouts.
+  - `public/` — static assets + mirrored protocol content.
+  - `scripts/` — domain checking + aggregation.
+  - `tests/` — smoke + Playwright e2e.
+- `localloop-backend`
+  - `src/` — Fastify server, routes, DB, SSE, queue, schemas.
+  - `prisma/` — schema and Prisma config.
+  - `scripts/` — lab demo + federation simulations.
+  - `tests/` — Bun test suite (routes, SSE, queue, auth).
+  - `deploy/` — systemd + nginx example config.
+- `loop-protocol`
+  - `schemas/` — JSON schemas for core entities.
+  - `contexts/` — JSON-LD contexts.
+  - `docs/` — governance, security, implementation guidance.
+  - `rfcs/` — RFC index and drafts.
+  - `examples/` — JSON examples.
+- `org-github-profile`
+  - `profile/` — public org profile README.
+
+### Key config files
+- `localloop.github.io`
+  - `package.json`, `next.config.js`, `playwright.config.ts`, `scripts/check-domains.cjs`
+- `localloop-backend`
+  - `package.json`, `tsconfig.json`, `Dockerfile`, `docker-compose.yml`, `.env.example`, `.env.docker.example`, `prisma.config.ts`
+- `loop-protocol`
+  - `package.json`, `package-lock.json`, `scripts/validate-schemas.js`
+
+### Context files
+- Root: `AGENTS.md`, `CLAUDE.md`
+- `org-github-profile`: `AGENTS.md`, `CLAUDE.md`
+
+### Requirements / PRD / Specs
+- **No PRD or REQUIREMENTS.md found.**
+- Primary requirements-like document: `loop-protocol/SPECIFICATION.md` (Protocol v0.1.1).
+
+## 1.2 Documentation Inventory
+
+### API documentation
+- Backend runtime OpenAPI via Fastify swagger (`GET /openapi.json`, `GET /docs`).
+- Protocol OpenAPI artifact: `loop-protocol/openapi.json` (mirrored in docs hub).
+
+### Architecture docs
+- No dedicated `ARCHITECTURE.md` found.
+- Protocol docs: `loop-protocol/docs/implementation-guide.md` and security/compliance docs.
+
+### Deployment docs
+- Backend: `localloop-backend/Dockerfile`, `docker-compose.yml`, `deploy/localloop-backend.service`, `deploy/nginx.conf`.
+- No Kubernetes manifests found.
+
+### Developer guides
+- `localloop.github.io/CONTRIBUTING.md`
+- `localloop-backend/CONTRIBUTING.md`
+- `loop-protocol/CONTRIBUTING.md`
+
+## Tech Stack Summary
+- **Frontend**: Next.js 16 (App Router), React 19, Playwright tests.
+- **Backend**: Bun runtime, Fastify 5, Prisma 7, PostgreSQL (PostGIS), Redis + BullMQ, MinIO (S3).
+- **Protocol**: JSON-LD + JSON Schema; AJV for schema validation.
+- **Infra**: Docker + Traefik on VPS; optional systemd + Nginx config.
diff --git a/docs/audit/infrastructure-readiness.md b/docs/audit/infrastructure-readiness.md
@@ -0,0 +1,74 @@
+# Phase 4 - Infrastructure & Deployment Analysis
+
+> CURRENT-USE WARNING: This is a historical audit snapshot, not current deployment, security, backup, or readiness evidence. Its original snapshot date and analyzed commits were not recorded in this source; do not infer them. Use [CLAIMS-AND-MATURITY.md](../governance/CLAIMS-AND-MATURITY.md) and [RELEASE-CHECKLIST.md](../governance/RELEASE-CHECKLIST.md) for current decisions.
+
+## 4.1 Docker Configuration Review
+
+### Dockerfile (`localloop-backend/Dockerfile`)
+- Base image: `oven/bun:1.3.5` (pinned) ✅
+- Multi-stage build: ❌
+- Runs as non-root: ✅ (`User=app`)
+- Health check: ✅ (HTTP `/health` via Bun fetch)
+- Signal handling: relies on Bun process default; no explicit `STOPSIGNAL`.
+- Installs prod deps + Prisma client inside image ✅
+
+### docker-compose (`localloop-backend/docker-compose.yml`)
+- Services: api, postgres, redis, minio
+- Dependencies: `depends_on` + health checks ✅
+- Volumes: `./data/postgres`, `./data/minio`, `./data/redis` ✅
+- Network: `proxy` external + default network ✅
+- Resource limits: ❌
+- Restart policy: `unless-stopped` ✅
+- Secrets management: ❌ (env_file contains secrets)
+- Image pinning: ✅ (redis/minio pinned by digest)
+
+## 4.2 Production Readiness Checklist
+
+□ Environment Configuration
+  - [ ] All secrets externalized (defaults include `change-me`)
+  - [ ] Environment-specific configs separated (no `.env.production.example`)
+  - [ ] `.env.production.example` exists
+
+□ Logging & Monitoring
+  - [ ] Structured logging implemented (Fastify logger is structured, but no log shipping)
+  - [x] Log levels configurable (via Fastify logger config)
+  - [x] Health check endpoints (`/health`)
+  - [x] Metrics endpoint (`/api/metrics`, in-memory)
+
+□ Security
+  - [x] HTTPS/TLS configured via proxy (Traefik labels)
+  - [x] CORS configured (allowed origins list)
+  - [x] Rate limiting implemented
+  - [ ] Input sanitization (no central PII or payload sanitization beyond schemas)
+  - [x] SQL injection prevention (Prisma + parameterized queries)
+  - [ ] XSS prevention (frontend is static; no CSP configured server-side)
+
+□ Performance
+  - [x] Database connection pooling
+  - [ ] Caching strategy (Redis used for queue, not cache)
+  - [x] Static asset optimization (Next static export)
+  - [ ] Compression enabled (no Fastify compression plugin)
+
+□ Reliability
+  - [x] Graceful shutdown handling (`SIGINT`/`SIGTERM`)
+  - [x] Database migrations versioned
+  - [x] Backup strategy documented (`docs/backup-restore-runbook.md`)
+  - [x] Rollback procedure documented
+
+## 4.3 VPS / Server Deployment Analysis
+
+### Reverse proxy
+- `deploy/nginx.conf` is HTTP-only (no TLS termination, no HTTP→HTTPS redirect).
+- Traefik labels exist in docker-compose for TLS, but Nginx config may be stale.
+- SSE endpoints may need proxy buffering disabled in Nginx/Traefik for reliability.
+
+### Process management
+- `deploy/localloop-backend.service` now configured for a non-root user; ensure the user exists on the VPS.
+- No log rotation config included.
+
+### Backups
+- Manual backup/restore runbook plus systemd timer/script artifacts added in `docs/backup-restore-runbook.md` and `localloop-backend/deploy/`.
+
+## 4.4 Required Infrastructure Work (Top Items)
+1. Add log rotation and alerting.
+2. Verify restore drills and add offsite sync for scheduled backups.
diff --git a/docs/audit/requirements-matrix.md b/docs/audit/requirements-matrix.md
@@ -0,0 +1,70 @@
+# Phase 2 - PRD/Requirements Evaluation
+
+> CURRENT-USE WARNING: This is a historical audit snapshot, not current implementation or conformance evidence. Its original snapshot date and analyzed commits were not recorded in this source; do not infer them. It is a historical spec-feature evaluation and is superseded as the current requirements inventory by the Core-DP profile requirements at `loop-protocol/profiles/core-dp/requirements/core-dp-requirements.json`. Use [CLAIMS-AND-MATURITY.md](../governance/CLAIMS-AND-MATURITY.md) and [RELEASE-CHECKLIST.md](../governance/RELEASE-CHECKLIST.md) for current decisions.
+
+## 2.1 Feature Matrix (Derived from `loop-protocol/SPECIFICATION.md`)
+
+| Feature ID | Feature Name | PRD Status | Implementation Status | Completeness % | Notes |
+| --- | --- | --- | --- | --- | --- |
+| F-001 | MaterialDNA registration | Required | Partial | 50% | Implemented as lab demo `POST /api/v1/material`; search and broader discovery are still missing. |
+| F-002 | Offer publication | Required | Partial | 50% | Implemented as lab demo `POST /api/v1/offer`; no offer discovery. |
+| F-003 | Match acceptance | Required | Partial | 50% | Implemented as lab demo `POST /api/v1/match`. |
+| F-004 | Transfer completion | Required | Partial | 50% | Implemented as lab demo `POST /api/v1/transfer`. |
+| F-005 | Material lookup (GET by id) | Required | Implemented | 100% | `/api/v1/material/{id}` is available for lab material records. |
+| F-006 | Material search | Required | Not implemented | 0% | `/api/v1/material/search` missing. |
+| F-007 | Node info endpoint | Required | Partial | 60% | `/api/v1/node/info` now returns minimal lab node metadata; spec-style location/statistics fields are not implemented. |
+| F-008 | LoopSignal config endpoint | Required | Not implemented | 0% | `/api/v1/signals` missing. |
+| F-009 | Transaction creation | Required | Not implemented | 0% | `/api/v1/transaction` missing. |
+| F-010 | Federation announce/offer | Required | Not implemented | 0% | `/api/v1/federate/announce` + `/offer` missing. |
+| F-011 | Federation handshake protocol | Required | Partial | 40% | Implemented as `/api/v1/federation/handshake` (lab-only); no signature validation; schema differs from spec endpoint. |
+| F-012 | LoopCoin issuance/transfer | Required | Not implemented | 0% | Schemas exist; no API/service implementation. |
+| F-013 | LoopSignal voting | Required | Not implemented | 0% | Schemas exist; no API/service implementation. |
+| F-014 | LoopCost calculation | Required | Not implemented | 0% | No routing/cost calculator implemented. |
+| F-015 | Auth per spec (Bearer + TLS) | Required | Partial | 40% | API key + Better Auth optional; Bearer token support not enforced; TLS via proxy only. |
+| F-016 | Lab data minimization (no PII) | Required | Partial | 30% | Loop schemas enforce structure; no explicit PII redaction checks. |
+
+### Undocumented / Scope-Creep Features (Implemented but not in spec)
+- S-001 Interest registry + SSE (`/api/interest`, `/api/interest/stream`)
+- S-002 Payments intake (`/api/payments/intent`, `/api/payments/webhook`)
+- S-003 City directory/geojson (`/api/cities`, `/api/cities/:slug`, `/api/cities/geojson`)
+- S-004 Metrics counters (`/api/metrics`)
+- S-005 Public privacy notice (`/api/privacy`)
+
+## 2.2 API Contract Validation
+
+### Spec vs Implementation (Backend)
+
+| Method | Spec Endpoint | Implemented? | Closest Backend Endpoint | Notes |
+| --- | --- | --- | --- | --- |
+| POST | `/api/v1/material` | ✅ | `/api/v1/material` | Lab-only payloads; path aligned. |
+| GET | `/api/v1/material/{id}` | ✅ | `/api/v1/material/:id` | Implemented for lab material records. |
+| POST | `/api/v1/material/search` | ❌ | `/api/interest?search=` | Search exists but only for interest registry (not protocol). |
+| GET | `/api/v1/node/info` | ⚠️ | `/api/v1/node/info` | Minimal lab metadata exists; spec-style location/statistics are still missing. |
+| GET | `/api/v1/signals` | ❌ | — | Missing. |
+| POST | `/api/v1/transaction` | ❌ | — | Missing. |
+| POST | `/api/v1/federate/announce` | ❌ | `/api/v1/relay` | Relay is lab-only event log, not spec announce. |
+| POST | `/api/v1/federate/offer` | ❌ | `/api/v1/relay` | Same as above. |
+
+### Backend Docs vs Actual Routes
+
+| Method | Endpoint | Documented? | Implemented? | Notes |
+| --- | --- | --- | --- | --- |
+| GET | `/health` | ✅ (README) | ✅ | Root `AGENTS.md` says `/api/health` but code uses `/health`. |
+| GET | `/api/cities/:slug` | ❌ | ✅ | Undocumented in README. |
+| GET | `/openapi.json` | ✅ | ✅ | Swagger generated at runtime. |
+| GET | `/docs` | ✅ | ✅ | Redoc HTML. |
+
+### Missing Endpoints (Per Spec)
+- `/api/v1/material/search` (POST)
+- `/api/v1/signals` (GET)
+- `/api/v1/transaction` (POST)
+- `/api/v1/federate/announce` (POST)
+- `/api/v1/federate/offer` (POST)
+
+### Undocumented Endpoints (Per Implementation)
+- `GET /api/cities/:slug`
+
+## Divergence Documentation
+
+- Explicit divergence summary: `docs/audit/spec-implementation-divergence.md`
+- Protocol OpenAPI artifact: `loop-protocol/openapi.json` (mirrored to docs hub)
diff --git a/docs/audit/spec-implementation-divergence.md b/docs/audit/spec-implementation-divergence.md
@@ -0,0 +1,56 @@
+# Protocol vs Implementation Divergence
+
+> CURRENT-USE WARNING: This is a historical divergence snapshot, not current implementation or conformance evidence. Use [CLAIMS-AND-MATURITY.md](../governance/CLAIMS-AND-MATURITY.md) and [RELEASE-CHECKLIST.md](../governance/RELEASE-CHECKLIST.md) for current decisions.
+
+**Original snapshot date (historical):** 2026-03-09
+
+This document explicitly records known divergences between the LOOP specification (v0.1.1) and the current backend + docs hub implementations. It is intended to prevent ambiguity for contributors and reviewers.
+
+## 1) API Surface
+
+### Spec-required endpoints (v0.1.1)
+The spec mandates `/api/v1/*` endpoints for core protocol operations.
+
+| Spec Endpoint | Status | Current Backend Endpoint | Notes |
+| --- | --- | --- | --- |
+| `POST /api/v1/material` | Implemented | `/api/v1/material` | Lab-only endpoint; path aligned with the spec. |
+| `GET /api/v1/material/{id}` | Implemented | `/api/v1/material/:id` | Read-by-id is available for lab materials. |
+| `POST /api/v1/material/search` | Missing | — | Not implemented. |
+| `GET /api/v1/node/info` | Partial | `/api/v1/node/info` | Implemented as a minimal lab metadata response; spec-style location/statistics fields are not exposed yet. |
+| `GET /api/v1/signals` | Missing | — | Not implemented. |
+| `POST /api/v1/transaction` | Missing | — | Not implemented. |
+| `POST /api/v1/federate/announce` | Missing | `/api/v1/relay` | Relay is lab event log; not spec announcement. |
+| `POST /api/v1/federate/offer` | Missing | `/api/v1/relay` | Relay is lab event log; not spec offer. |
+
+### Implemented endpoints not in spec
+| Backend Endpoint | Purpose | Notes |
+| --- | --- | --- |
+| `/api/interest` + `/api/interest/stream` | Public interest registry | Non-protocol feature. |
+| `/api/cities` + `/api/cities/:slug` + `/api/cities/geojson` | Demo data | Lab UI support. |
+| `/api/payments/*` | Manual payment intake | Disabled by default. |
+| `/api/metrics` | In-memory counters | Observability for lab only. |
+| `/api/privacy` | Lab data policy | Non-protocol. |
+
+## 2) Authentication & Security
+- Spec assumes Bearer token auth + TLS for protocol messages.
+- Backend uses optional API key protection and optional Better Auth (disabled by default).
+- TLS is provided via reverse proxy (Traefik/Nginx), not enforced in app logic.
+
+## 3) Content-Type & Schema Enforcement
+- Spec mandates `application/ld+json` and strict JSON-LD context usage.
+- Backend lab endpoints accept JSON schemas but do not enforce `@context` values beyond schema-level `const` checks.
+- `/api/v1/relay` now limits relayed traffic to the current lab event/entity families, but it still does not validate cryptographic signatures or full spec announce/offer payloads.
+
+## 4) Federation Handshake
+- Spec documents federation endpoints (`/api/v1/federate/*`), while backend provides a lab-only registry at `/api/v1/federation/handshake`.
+- Signature validation is **not** implemented; docs note signatures are placeholders.
+- The handshake response now uses the preferred v0.2.0 context and schema version, but the endpoint path remains lab-specific.
+
+## 5) Docs Hub vs Protocol Repo
+- The docs hub mirrors protocol artifacts, but lag can occur if mirroring is not run after updates.
+- Protocol OpenAPI artifact is now published as `loop-protocol/openapi.json` and mirrored at `https://localloop.urbnia.com/projects/loop-protocol/openapi.json` (corrected from a stale `localloop.github.io` reference — that domain does not exist; see `DOMAIN-POLICY.md`).
+
+## 6) Resolution Plan
+- Keep documenting the lab-only compatibility surface until `/api/v1/material/search`, `/api/v1/signals`, `/api/v1/transaction`, and `/api/v1/federate/*` are implemented.
+- Add signature validation if federation moves beyond controlled demos.
+- Align auth model (Bearer token vs API key) and document deviations.