Carini

Someone working in Paris, Montreal or Dubai buys a plan for a parent who stayed in Tunisia. Carini dispatches real nurses, laboratories and clinics against that plan, and pays each partner for the work delivered. Five roles use the same system and see completely different things — buyer, beneficiary, partner, consultant, support.

Nothing about diabetes, or nursing, or groceries is written into the code. A plan is a template — PlanDefinition-shaped, versioned, frozen once published — and the engine underneath knows only about entitlements, schedules and state.

The person paying is not the person whose medical record it is. Tunisian law puts the beneficiary in charge of their own health data, so consent could not be a checkbox bolted on at the end — it had to be an object with a scope, a grantee and a revocation. A son pays for his mother's plan and arranges her care, but cannot read a word of it until she agrees.

Three gates, and the difference between them is the product: role asks what job you do, ownership asks whether this is your order, consent asks whether the beneficiary agreed — all checked in the service layer, never in a controller or a UI guard. Every staff read of a plan writes CARE_PLAN_VIEWED to the audit trail.

Carini is a modular monolith, and the modularity is structural rather than advisory. A module publishes an api — value objects, enums, ports — and its implementation is never exported, so importing another module's internals does not compile. There is no meeting to have about it.

Tests over the dependency graph cover what the build graph cannot see: layering direction, framework leakage into the domain, and the direction adapters are allowed to depend in. The pure domain is enforced, not hoped for.

An integration test follows one dinar from the buyer's card to the partner's bank account. Cash arriving is not revenue — it is an obligation to deliver care, drawn down one visit at a time.

The ledger is append-only double entry, and its balance is enforced by a deferred check in the database rather than by application code. A partner's balance is always derived from the ledger and never stored, because a stored balance is a second source of truth waiting to disagree with the first.

A plan bought in Paris has to become a nurse at a door in Tunis, repeatedly, for a year. Everything between those two facts is machinery whose failure mode must be a retry, never a silence.

Everything that raises work is idempotent on an origin key, because schedulers tick twice and events get redelivered — and a beneficiary must not receive two nurses on account of our retry policy.

Every unit of work runs the same lifecycle. What changes is what the states are called, which comes from the kind of service in the catalogue — so a delivery rider and a home nurse move through identical code and read entirely different words.

Support keeps the literal statuses and the full actor-by-actor trail, because “performed, but not yet verified” is exactly what they need when the phone rings. The family gets four milestones in plain language. Same data, two audiences, one source.

The interface is French, English and Arabic, and switching to Arabic mirrors the entire layout — navigation, tables, progress tracks — because it's written with CSS logical properties throughout, with language and direction derived from one choice in one place.