kryvrox/unlock

Compliance calendar for Kenya SMEs # UNLOCK — outcome engine (production-architecture prototype) You state an outcome ("I want to open a small coffee shop in Nairobi"). UNLOCK resolves it into a dependency graph of real requirements, works the graph as far as it can on its own, and stops at the exact points where a human decision or an external system is genuinely required. ## Run it ```bash python -m venv .venv .venv/Scripts/python -m pip install -r requirements.txt # macOS/Linux: .venv/bin/python .venv/Scripts/python -c "import sys; sys.path.insert(0,'backend'); from db import init_db; init_db(fresh=True)" .venv/Scripts/python backend/app.py ``` Open . That is the real frontend calling the real API — every state on screen came back from a database query. Config via environment: `UNLOCK_DB_PATH`, `UNLOCK_HOST`, `UNLOCK_PORT`, `UNLOCK_DEMO_BOOTSTRAP=0` (disables the demo identity endpoints). ## Run the tests ```bash cd backend ../.venv/Scripts/python -m unittest discover -s tests -v ``` 62 tests covering: the full business-launch scenario end to end; a second and third goal type proving the engine is generalized rather than hardcoded; tenant isolation and IDOR at both the service and HTTP layers; RBAC including a genuinely read-only VIEWER; prompt-injection defense; network-timeout reconciliation with no duplicate side effects; external rejection with independent branches still moving; retry that cannot double-file; goal and workflow-run completion; emergency stop that survives the next tick; the outbox relay's at-least-once, exactly-once-per-row delivery; and workflow durability across a simulated process restart. ## How it fits together | File | Role | |---|---| | `app.py` | HTTP surface, auth/rate-limit gate, error mapping | | `goal_service.py` | Goal creation, the workspace payload, listing, stop | | `workflow.py` | The durable engine: plan → execute → verify → complete | | `requirements_engine.py` | Jurisdiction data → requirements + dependency edges | | `ai_gateway.py` | The only m …