Carini

Someone working in Paris, Montreal or Dubai buys a plan for a parent who stayed in Tunisia. Carini dispatches real nurses, laboratories and clinics against that plan, keeps the family informed in language they actually use, and pays each partner for the work they delivered.

Five roles use the same system and see completely different things: the buyer abroad, the beneficiary at home, the partner doing the visit, the consultant composing offers, and support — who needs the literal truth when a worried family calls.

Nothing about diabetes, or nursing, or groceries is written into the code. A plan is a template — PlanDefinition-shaped, versioned, frozen once published — and the engine underneath knows only about entitlements, schedules and state.

The person paying is not the person whose medical record it is. Tunisian law puts the beneficiary in charge of their own health data, so consent could not be a checkbox bolted on at the end — it had to be an object with a scope, a grantee and a revocation.

Which produces the sequence below. A son pays for his mother's plan, arranges her care, and cannot read a word of it until she agrees. When she revokes, the record goes dark again while he remains the buyer.

GET  /api/care-plans/{id}             buyer, no consent      → 404   never 403: "there is a plan here" leaks
POST /api/care-plans/{id}/checkout    same buyer             → 200   paying is not reading
POST /api/consents                    consultant records written evidence
GET  /api/care-plans/{id}             buyer, with consent    → 200

Three gates, and the difference between them is the product: role asks what job you do, ownership asks whether this is your order, consent asks whether the beneficiary agreed. All three are checked in the service layer — never in a controller, and never in a UI guard, which is a convenience rather than a control.

Staff read by role instead, and every such read writes CARE_PLAN_VIEWED to the audit trail. The proof-of-delivery code is returned by no endpoint at all: a partner who could fetch it could confirm a visit they never made.

Carini is a modular monolith, and the modularity is structural rather than advisory. A module publishes an api — value objects, enums, ports — and its implementation is never exported, so importing another module's internals does not compile. There is no meeting to have about it.

domain/            pure model — Money, Market, Recurrence. No framework.
platform/audit/    hash-chained audit trail used by every module
platform/outbox/   events publish only if their transaction committed
modules/<ctx>/api  contracts: value objects, enums, ports
modules/<ctx>/impl entities and services — never exported
adapters/          the only place a third-party SDK may appear
app/               the deployable: wiring, Flyway, boundary tests

Tests over the dependency graph cover what the build graph cannot see: layering direction, framework leakage into the domain, and the direction adapters are allowed to depend in. The pure domain is enforced, not hoped for.

An integration test follows one dinar from the buyer's card to the partner's bank account. Cash arriving is not revenue — it is an obligation to deliver care, drawn down one visit at a time.

buyer pays 180.000 TND      DEBIT  CASH:PSP                     CREDIT PLAN_DEFERRED_REVENUE:{plan}
lab delivers, verified      DEBIT  PLAN_DEFERRED_REVENUE:{plan} CREDIT PARTNER_PAYABLE:{lab}  40.800
                                                                CREDIT COMMISSION_REVENUE:TN   7.200
payout run                  DEBIT  PARTNER_PAYABLE:{lab}        CREDIT CASH:PAYOUT            40.800

The ledger is append-only double entry, and its balance is enforced by a deferred check in the database rather than by application code. A partner's balance is always derived from the ledger and never stored, because a stored balance is a second source of truth waiting to disagree with the first.

A plan bought in Paris has to become a nurse at a door in Tunis, repeatedly, for a year. Everything between those two facts is machinery whose failure mode must be a retry, never a silence.

Everything that raises work is idempotent on an origin key, because schedulers tick twice and events get redelivered — and a beneficiary must not receive two nurses on account of our retry policy.

Every unit of work runs the same lifecycle. What changes is what the states are called, which comes from the kind of service in the catalogue — so a delivery rider and a home nurse move through identical code and read entirely different words.

Support keeps the literal statuses and the full actor-by-actor trail, because “performed, but not yet verified” is exactly what they need when the phone rings. The family gets four milestones in plain language. Same data, two audiences, one source.

The interface is French, English and Arabic, and switching to Arabic mirrors the entire layout — navigation, tables, progress tracks. That works because the layout is written with CSS logical properties throughout, and because language and direction are derived from one choice in one place, rather than being two settings that can drift apart.

A right-to-left mode assembled from a second stylesheet is a mode that half-applies. This one has nowhere to half-apply.

A portfolio that only lists what works is a sales page. This is where the project actually stands.