Titip Control Plane

Product authority, specifications, policies, contracts, release governance, and cross-repository orchestration for the Titip digital legacy platform.

This repository is not the main runtime application. It does not implement signup, vault storage, life-check scheduling, or delivery. Those belong in sibling repositories, and only after the relevant contract exists here.

The same documents are published at https://titip.suherman.net. That site is a reader. Edit the files here; do not treat the rendered pages as a second source of truth.

Authority rule

No runtime behaviour should become authoritative before its contract exists in the control plane.

If a screen, API, job, or model would decide what Titip is, what it stores, when someone is inactive, or when information may be released, that decision is written here first. Runtime repositories implement the contract. They do not invent it.

What this repository owns

Area	Path	Owns
Product	`product/`	Vision, positioning, principles, personas, terminology
Specifications	`specs/`	Normative product and domain requirements (TITIP-001–012)
Architecture	`architecture/`	System context, domain model, threat model, data classification, repository boundaries
Decisions	`adr/`	Accepted architecture decision records
Contracts	`contracts/`	API resources, domain events, and schemas other repositories implement
Policies	`policies/`	Security, privacy, retention, release safety, AI safety
Plans	`plans/`	Prototype, alpha, and production-readiness scope
Releases	`releases/`	How policy versions and release holds are coordinated

Headline principles

Engineering work is subordinate to product/principles.md:

Titip records guidance, not secrets.
Silence alone never means release.
Every recipient only sees what was explicitly assigned to them.
Release decisions must be explainable from auditable evidence.
AI may assist preparation, but never decide whether someone is dead, inactive, or eligible for release.

Repository topology

Do not create fifteen repositories on day one. The first wave is seven repositories. Sensitive domains stay as modules inside backend until a security boundary or operational ownership justifies extraction. That avoids a distributed monolith.

titip-labs/
├── control-plane     ← this repository (authority)
├── app               ← iOS/Android experience
├── web               ← marketing, trusted-contact portal, recipient portal
├── backend           ← modular monolith (core API and domain orchestration)
├── ai                ← preparation assistance only; never a release decider
├── infrastructure    ← environments and platform foundations
└── knowledge         ← curated guidance and templates; not legal advice

Later, only when traffic, team size, or a security boundary requires it:

identity, vault, life-check, delivery, contacts, notifications, observability, security, integrations, docs.

docs is optional. Engineering authority stays here until public developer documentation is actually needed.

Intended ownership, including backend modules for the first wave, is in architecture/repository-topology.md.

Build order

Start here. Do not start with AI, WhatsApp, blockchain, a death registry, or a password vault.

Control plane (this repository)
Web prototype
App prototype
Backend domain skeleton
Trusted contacts
Asset inventory
Vault
Life check
Audit trail
Simulation
Escalation
Recipient verification
Controlled delivery
AI assistant
External integrations

Stage goals and exit criteria: plans/prototype.md, plans/alpha.md, plans/production-readiness.md.

How to change a decision

A wording clarification that does not change behaviour: edit the document and note the change in its revision line.
A behaviour, storage, release, privacy, or security change: add or supersede an ADR, then update the affected spec, policy, and contract in the same change.
Never silently rewrite an accepted release or life-check rule. Policies are versioned. See releases/README.md and ADR-004.

Documents in this repository are the English engineering source of truth. Product copy shown to people in Indonesia may be Indonesian; the meaning still has to match these contracts.