A powerful yet simple build system for HTML5 projects.

Substrat kernel contracts and services — pure TypeScript, no platform imports (D-14)

Scaffold a Substrat vertical — `npm create substrat <dir>`.

Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts

Substrat engine: reservations — resource + interval + capacity, one allocation invariant, no locks

The substrat CLI — authenticated deploy tooling: push a vertical to the platform, manage its versions and channels

Substrat engine: invoice basis — consumes billable events, snapshots lines with provenance, immutable once exported

Substrat engine: work orders + time + material — one engine, one state machine, append-only reporting

Substrat engine: invitations — invite by verified hashed identifier, accept-required, non-enumerable

Substrat engine: protocols, checklists and signed documents with the freeze → immutable invariant — versioned templates, append-only responses, verifiable content hash, counter-signatures on frozen content, and asynchronous multi-party signatures by exter

Substrat connector: Scrive eSign (Swedish BankID). Turns a protocol.signatures-requested event into a Scrive signing flow (create → set file → parties → start) and records the completed signature back into the scope through the #97 authority seam. Host co

Substrat engine: billable usage — an append-only, idempotent meter ledger (counters and gauges) whose closed periods are frozen billing evidence

Substrat engine: approved absence — an append-only entry ledger over an opaque subject, balance as a fold, approval as a state machine

The Substrat layer rules, enforced mechanically — R1–R5 static analysis for module code, in this monorepo or in a standalone vertical

Build-time tooling over a Substrat model — DDL emitted from the entity registry, and the journal reader that holds it honest

Substrat OIDC relying party — Authorization-Code + PKCE, workerd-safe (jose + Web Crypto). Shared by the platform apps (console, dashboard) and by @substrat-run/vertical-auth's RP provider.

The suite every scope-host adapter must pass, forever (D-14)

HTTP surface over HostAdmin — the audited control-plane transport (control-plane.md §4.5)

Pure-SQLite scope host — real kernel semantics with no Cloudflare dependency (D-14): local dev, CI, self-host/escrow

Cloudflare Durable-Object scope host (D-14): DO-per-scope, real kernel semantics on Workers