# Amendments to the spec

`reji/Tutelora Atrium Shared Platform Services.docx` is dated 6 November 2026. It's kept as written, and read with this page: **where they differ, this page
wins.** Its diagrams show the old design too, so they're overtaken on the points below. Each point was the Architect's decision on 6 November 2026, and the
reasoning is in `reji/plans/2026-11-06-IA-identity-architecture.md`.

## Hosts

| The spec says | It's now |
|---|---|
| Sign-in at `accounts.tutelora.app` | `id.tutelora.com`, which also holds organisations, subscriptions and billing. No separate `admin` host |
| Module APIs and the console at `api.tutelora.app` | `api.tutelora.com` |
| Organisations hold accounts with roles | A membership says only that someone is in an organisation. Every product keeps its own roles; Atrium keeps owner, admin and billing for the organisation itself (CL-16, the Architect, 7 November 2026) |
| Each product handles its own custom domains | Atrium keeps one list of custom domains, owned by the organisation, one address to one product; the product serves them (CL-18) |
| Status page at `status.tutelora.app` | `status.tutelora.com`, following the others |
| `tutel.ink`; `*.tutelora.dev` for staging | The cPanel account runs `develop` on the real names (`api.tutelora.com`, `id.tutelora.com`) as staging until the VPS (the Architect, 9 November 2026, replacing `tutelora.dev`, 7 November 2026) |

## Modules

| The spec says | It's now |
|---|---|
| Accounts and organisations are one module, Clavis | **Clavis** (`accounts`) is accounts only. **Album** (`organisation`) holds organisations |
| An organisation is registered "with the list of Tutelora products it has switched on" | An organisation's record holds no product information. **Tabula** (`subscription`) holds the catalogue, entitlements, instances and billing, and links to the organisation by its ID |
| Billing "later", and payments only "until a second product takes payments" | Tutelora's own billing is built straight after Clavis, adapted from Desk's. Money products collect from their own customers stays with Aerarium, on the spec's trigger |
| Seven modules | Nine |

## Branding

| The spec says | It's now |
|---|---|
| "Branding-neutral", so outside consumers can white-label | Out of scope: no brand registry, and no per-product or per-client look in Atrium |

## The console

| The spec says | It's now |
|---|---|
| "Register apps, issue keys, set quotas, view usage" | A dashboard of the products' servers around Atrium, each with a side drawer; clients; usage. No separate clients or catalogue page for now |

## How people arrive

| The spec says | It's now |
|---|---|
| A school joins through "Start free" on a product | That, or by registering alone at `id.tutelora.com`. An account can also exist with no organisation at all |
| An organisation "can create accounts on someone's behalf" | Kept. Parents and pupils hold the same account as everyone else. They arrive by invitation or through the school's web address, and reach `id` quietly, with no registration step |
| An admin manages people in the organisation | At `id.tutelora.com` or inside the product, as one action with two doors |

## Building it

| The spec says | It's now |
|---|---|
| Step 0 "decides for each gap whether to extend TuteCore or add it in Atrium" | Always in Atrium. The TuteCore repository isn't changed, and each difference from 2.1.1 is listed in `PROJECT.md` |
| Step 0's "app and organisation registry" | Album's record and Tabula's core: catalogue, entitlement and instance. Software holding a key is a `server`. On the console an organisation is called a client |
| A build order of 0 to 7 | The order in the master plan, §3 and §4 (BO-1 to BO-3) |

## What this means for the spec's open decisions

- **Confirm Atrium as the platform name:** done, confirmed by the Architect on 6 November 2026.
- **The commercial arrangement for outside consumers, and whether they ever use Clavis:** open.
- **Retention for Tutela and OCR:** open.
- **Free-tier quotas:** open, and now joined by what a price is based on (TB-1).
- **Whitelist `tutel.ink` with the SMS provider:** not needed, since Sailup has no such step (the Architect, 7 November 2026). Whether a text's links are shortened is a setting (NS-11).
- **The sending domain:** `notify.`, not the spec's `mail.` (the Architect, 7 November 2026).