{
  "schema_version": 1,
  "diagram_type": "architecture",
  "meta": {
    "title": "Kesita | External access to authoritative legal services",
    "quality_profile": "showcase",
    "locale": "en",
    "viewBox": [1360, 760],
    "views": [
      {
        "id": "public-api",
        "label": "Public API",
        "focus": ["api-client", "public-gateway", "identity-policy", "legal-core", "legal-db", "corpus-blobs"],
        "note": "External applications cross the public policy boundary; they never reach Legal Core or its stores directly."
      },
      {
        "id": "mcp-path",
        "label": "MCP",
        "focus": ["mcp-client", "mcp-server", "public-gateway", "identity-policy", "legal-core"],
        "note": "The Kesita MCP server maps bounded tools onto the same governed application API."
      },
      {
        "id": "comprocausa-path",
        "label": "ComproCausa",
        "focus": ["comprocausa", "public-gateway", "identity-policy", "legal-core", "legal-db"],
        "note": "ComproCausa replaces direct legal-database SQL with a versioned server-to-server contract."
      }
    ]
  },
  "components": [
    {
      "id": "api-client",
      "type": "external",
      "label": "Partner API client",
      "sublabel": "Server-to-server integration",
      "pos": [40, 80],
      "size": [230, 78]
    },
    {
      "id": "mcp-client",
      "type": "frontend",
      "label": "MCP host",
      "sublabel": "User-authorized assistant",
      "pos": [40, 250],
      "size": [230, 78]
    },
    {
      "id": "comprocausa",
      "type": "external",
      "label": "ComproCausa",
      "sublabel": "Owned product backend",
      "pos": [40, 420],
      "size": [230, 78]
    },
    {
      "id": "mcp-server",
      "type": "backend",
      "label": "Kesita MCP server",
      "sublabel": "Bounded tools · no corpus credentials",
      "pos": [350, 250],
      "size": [250, 78]
    },
    {
      "id": "public-gateway",
      "type": "backend",
      "label": "Kesita Public API",
      "sublabel": "Versioning · quotas · idempotency",
      "pos": [690, 250],
      "size": [250, 78]
    },
    {
      "id": "identity-policy",
      "type": "security",
      "label": "Identity and policy",
      "sublabel": "OAuth · client grants · entitlements",
      "pos": [690, 80],
      "size": [250, 78]
    },
    {
      "id": "legal-core",
      "type": "backend",
      "label": "Legal Core API",
      "sublabel": "Search · pinned versions · originals",
      "pos": [1050, 250],
      "size": [250, 78]
    },
    {
      "id": "legal-db",
      "type": "database",
      "label": "Legal PostgreSQL",
      "sublabel": "Authoritative metadata and indexes",
      "pos": [1050, 80],
      "size": [250, 78]
    },
    {
      "id": "corpus-blobs",
      "type": "cloud",
      "label": "Corpus originals",
      "sublabel": "Private versioned artifacts",
      "pos": [1050, 420],
      "size": [250, 78]
    },
    {
      "id": "audit-metering",
      "type": "database",
      "label": "Audit and metering",
      "sublabel": "Opaque IDs · usage · policy decisions",
      "pos": [690, 420],
      "size": [250, 78]
    }
  ],
  "boundaries": [
    {
      "kind": "security-group",
      "label": "Public integration boundary",
      "wraps": ["mcp-server", "public-gateway", "identity-policy", "audit-metering"],
      "pad": 24
    },
    {
      "kind": "security-group",
      "label": "Private legal data plane",
      "wraps": ["legal-core", "legal-db", "corpus-blobs"],
      "pad": 24
    }
  ],
  "connections": [
    {
      "id": "partner-to-api",
      "from": "api-client",
      "to": "public-gateway",
      "label": "HTTPS · OAuth client grant",
      "variant": "emphasis"
    },
    {
      "id": "host-to-mcp",
      "from": "mcp-client",
      "to": "mcp-server",
      "label": "MCP over HTTPS",
      "variant": "emphasis"
    },
    {
      "id": "mcp-to-api",
      "from": "mcp-server",
      "to": "public-gateway",
      "label": "Typed application calls",
      "labelDy": -33,
      "labelDx": -80
    },
    {
      "id": "comprocausa-to-api",
      "from": "comprocausa",
      "to": "public-gateway",
      "label": "HTTPS · service identity",
      "variant": "emphasis"
    },
    {
      "id": "policy-to-api",
      "from": "identity-policy",
      "to": "public-gateway",
      "label": "Principal · scopes · content policy",
      "labelDy": 24
    },
    {
      "id": "api-to-core",
      "from": "public-gateway",
      "to": "legal-core",
      "label": "Short-lived workload JWT",
      "variant": "security",
      "labelDy": -33
    },
    {
      "id": "api-to-audit",
      "from": "public-gateway",
      "to": "audit-metering",
      "label": "Usage and decision receipt",
      "labelDy": 24
    },
    {
      "id": "core-to-db",
      "from": "legal-core",
      "to": "legal-db",
      "label": "Scoped read SQL"
    },
    {
      "id": "core-to-blobs",
      "from": "legal-core",
      "to": "corpus-blobs",
      "label": "Checksum-verified read",
      "labelDy": 24
    }
  ],
  "cards": [
    {
      "dot": "emerald",
      "title": "One authoritative service",
      "items": [
        "Public API and MCP share contracts and policy",
        "Consumers never bind to corpus tables or blob layouts"
      ]
    },
    {
      "dot": "amber",
      "title": "Fail closed at the boundary",
      "items": [
        "Every call carries tenant, principal, scopes and content policy",
        "Raw prompts, legal text and credentials stay out of logs"
      ]
    }
  ]
}