Jijibora Features → Interfaces Map

Scope: Feature→interface map for developers integrating or building on Jijibora. One table per plane (claim desk + desks, truth fabric, identity/vault, integration gateway, commerce), rows: capability | visible interface | consumer | guarantee behavior. Plus three working integration walks: create claim; guard; revive/consume. Status: as of 2026-11-09 Blueprint sources: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs; Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc); Architecture — Design Thesis and Planes (Developer Concept Doc); Apache Camel Compliance Gateway (compliance-camel, :8181); docs/platform-map/system/api/ (file list: Sovereign OS API Orchestration Bridge — OpenAPI 1.0.0, L3 Application BFF — Full API Reference — OpenAPI 1.0.0, Generic Processing Claims API (cross-vertical) — OpenAPI 1.2.0, Community starter desk — OpenAPI 1.0.0, Sovereign OS Compliance iPaaS API — OpenAPI 1.0.0, Sovereign OS Compliance API — OpenAPI 1.0.0, Sovereign Agent BFF — Configuration Fragments UI Soft — OpenAPI 0.1.0-soft, Sovereign OS — Dify Agent Tools — OpenAPI 1.0.0, Sovereign Agent BFF — Handler Dispatch Engine — OpenAPI 1.0.0, Lifelong Entities API (non-fungible lifespan) — OpenAPI 1.0.0, fsm-worker.md, GenMfg Façade API — OpenAPI 1.1.0, Sovereign Git Forge + Scenario Soft API (EGOV-99) — OpenAPI 1.0.0-soft, Unified Interaction Requests API (adapter-agnostic) — OpenAPI 1.0.0, Materra Compliance Programs API — OpenAPI 1.0.0, Sokobora Sourcing Console API (fragment) — OpenAPI 1.1.0, Sovereign Agent BFF — manifest & workspace fragment — OpenAPI 1.0.0, Sovereign Agent BFF — UIC BBS+ & Information Vault — OpenAPI 1.0.0); apps/agent-bff/src/processing-claim-routes.js; apps/agent-bff/src/building-reflex-routes.js; apps/agent-bff/src/jijibora-event-ontology.js; datasets/lookups/lookup.claims..json; datasets/lookups/lookup.jijibora..json; datasets/scenarios/scenario.claims.*.json

What this means for you

Every Jijibora surface is a declared client of a platform plane — the same REST paths, subjects, and capability catalogue serve every vertical. Build against the interface column, not against Jijibora-internal state; if the plane guarantees it, the vertical inherits it.

Details (features/interfaces)

Conventions

Consumer names the caller class (WhatsApp/USSD channel, mobile web, BFF, workflow engine, external partner). Guarantee behavior states the honesty contract the caller may rely on (refusal, dry-run, outbox durability, fail-closed). (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs; Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc).)
Declared value groups live in datasets/lookups/lookup.claims..json and are loaded at runtime from NATS KV SOVEREIGN_LOOKUPS; scenario packs live in datasets/scenarios/scenario.claims..json and scenario.jijibora.*.json and are loaded from SOVEREIGN_SCENARIOS. (Source: apps/agent-bff/src/processing-claim-routes.js scenario-packs/soft-apply handler; apps/agent-bff/src/community-starter.js header.)

Plane 1 — Claim desk + desks

All paths under /v1/claims/processing. Static routes registered before parameterised routes; ordering matters. The plane is a single generalised primitive: the data plane enforces the lifecycle, the runtime resolves declarative policy values from value groups and scenario packs, and the transactional outbox carries lifecycle events to the spine consumer. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §§1–2; apps/agent-bff/src/processing-claim-routes.js registerRoutes.)

Capability	Visible interface	Consumer	Guarantee behavior
Create a processing claim; attach voyage identity; dual-map to canonical claim	`POST /v1/claims/processing`	Channel / desk / workflow	Refuses with validation error (400) when `claim_id`, `claim_type`, or `subject_id` missing; conflict (409) on duplicate identity. Stamps one voyage identity: explicit voyage id → explicit correlation id → deterministic value. Returns `{ data, canonical }`. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §2; apps/agent-bff/src/processing-claim-routes.js Create Claim.)
List / stats / retrieve	`GET /v1/claims/processing`; `GET /v1/claims/processing/stats`; `GET /v1/claims/processing/:claimId`	Desk / console	Filters by subject, type, status with paging; `stats` is legacy aggregate — canonical §7 metrics moved to `/metrics` (deprecation marker). Unknown identity → 404. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §2; apps/agent-bff/src/processing-claim-routes.js List / Stats handlers.)
Guarded transition (move state + enqueue)	`POST /v1/claims/processing/:claimId/transition`	Desk / workflow	Moves claim to new state and enqueues the transition outbox row. Honestly reports the outbox outcome (`{ data, outbox }`). Invalid transition → 400. `E_CLAIM_NOT_FOUND` → 404. Never publishes directly. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §2; apps/agent-bff/src/processing-claim-routes.js Transition handler.)
Dry-run guard evaluation (no mutation)	`POST /v1/claims/processing/guard-check`	Pre-submit UI / channel	Evaluates guard, quorum, separation, evidence, external-verdict stages in order; returns verdict with honest status. Zero writes. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §2; apps/agent-bff/src/processing-claim-routes.js Guard-check handler.)
Finalise with PoCE receipt	`POST /v1/claims/processing/:claimId/finalize`	Desk / auditor	Accepts only approved/settled/rejected claims; requires an execution session. Appends finalise outbox row. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §§1–2.)
Declare PoCE gating; voyage projection	`POST /v1/claims/processing/poc/require`; `GET /v1/claims/processing/voyage/:voyageId`	Ops / trace consumer	`poc/require` declares scope+type PoCE-gated. Voyage projection is empty-ok: unfamiliar identities return an empty projection, never an error. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §2.)
Panel (roles + eligibility)	`GET /v1/claims/processing/panel/roles`; `POST /v1/claims/processing/panel/eligibility`	Assignment / sourcing	Roles from `lookup.claims.panel.v1.json`: broker (intake), adjuster (assessment), garage (repair), reinsurer (evidence). Returns eligible vs ineligible-with-reasons, zero writes, live gate unmet. Fail-closed on missing values. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §5; datasets/lookups/lookup.claims.panel.v1.json.)
Meter clock (SLA)	`GET /v1/claims/processing/sla/policy`; `POST /v1/claims/processing/sla/evaluate`; `POST /v1/claims/processing/sla/timeout`	Desk / alerting	Windows are values per type+severity. Evaluate is read-only clock arithmetic. Timeout recording writes one breach row + one action row via the outbox; live timeout with no sink refuses rather than inventing. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §5; datasets/lookups/lookup.claims.sla.v1.json.)
Quorum bands + open	`GET /v1/claims/processing/quorum/bands`; `POST /v1/claims/processing/quorum/resolve`; `POST /v1/claims/processing/quorum/open`	Approvals	Bands map amount×risk → named quorum; resolves zero-write, live gate unmet. Open refuses when signers below threshold or plane unavailable; never invents signers. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §5; datasets/lookups/lookup.claims.threshold.v1.json.)
VAS eligibility (answer only)	`GET /v1/claims/processing/vas/eligibility`; `POST /v1/claims/processing/vas/check`	Billing / coverage	Maps type+cover → entitled services with ceilings/evidence needs. Grants nothing — monetisation ceremony is separate. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §5; datasets/lookups/lookup.claims.vas.eligibility.v1.json.)
Intake maps preview	`GET /v1/claims/processing/intake/maps`; `POST /v1/claims/processing/intake/maps/:mapId/preview`	Intake adapters	Only two declared targets accepted (claim creation / provider upsert). Preview is read-only, validates against target contract, zero writes, live gate unmet. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §5; datasets/lookups/lookup.camel.intake.maps.v1.json.)
Scenario-pack validate	`POST /v1/claims/processing/scenario-packs/:scenarioId/soft-apply`	Pack author / seeder	Plan-only, zero writes, never `live_gate_met`. Validates pack references against value groups + CNS catalogue. Catalogue unavailable → 503 with `live_gate_met: false`. (Source: apps/agent-bff/src/processing-claim-routes.js §soft-apply; Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §4.)
Readiness / metrics (real probes)	`GET /v1/claims/processing/readiness`; `GET /v1/claims/processing/metrics`	Ops / dashboards	Readiness probes real dependencies (Surreal, NATS, Camel, Kestra, solver with `require_solver=1`) — live gate met only when every required probe is green, failing keys listed. Metrics computed from real rows; zero samples carry no value with a reason. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §2; apps/agent-bff/src/processing-claim-routes.js Readiness/Metrics handlers.)
Jijibora building-reflex desk	`POST /v1/community/properties/events`; `POST /v1/community/buildings/events`; `POST /v1/community/properties/:propertyId/playbook`; `POST /v1/community/properties/:propertyId/events/:eventId/complete`; `GET /v1/community/:domain/:id/poce`; `GET /v1/community/dlq`	Field sensor / manager	Canonical-envelope validation (schema 1.0.0, depth ≤ 8, criteria subject prefix `platform.criteria.v1.`). Playbook run returns `202`. DLQ read returns honest empty when no DLQ consumer. PoCE lookup reads `request_path_session` + `path_step_receipt`. (Source: apps/agent-bff/src/building-reflex-routes.js; apps/agent-bff/src/jijibora-event-ontology.js.)

Plane 2 — Truth fabric

Capability	Visible interface	Consumer	Guarantee behavior
Graph traversal (lineage / hierarchy / attestation)	`fn::traverse_truth_graph` contract: start ref + direction (`outgoing`/`incoming`/`both`) + max depth + min strength + relation filter	Desk / audit / planner	Walks a bounded depth with strength floor and explicit relation filter; empty filter matches nothing by design. Scope/lease gates apply per node. (Source: Architecture — Design Thesis and Planes (Developer Concept Doc) §3.)
Semantic search + index maintenance	`fn::truth::semantic_search`; `fn::truth::index_node`	Discovery / console	Queryable graph without owning the claims record. Index/edge creation is idempotent (checks before creating `hse:`/`ir:` edges). (Source: Architecture — Design Thesis and Planes (Developer Concept Doc) §3.)
Claim↔graph dual-map	Claim create dual-maps to canonical claim; graph edges sync claim + node mutations	All writers	Every claim-eligible entity exists as a claim and is linked into the graph; graph typing and claim typing must agree. Mutation propagation is fenced: durable mutations emit delivery anchors first, index sync follows as a consequence. (Source: Architecture — Design Thesis and Planes (Developer Concept Doc) §3.)

Plane 3 — Identity / vault

Capability	Visible interface	Consumer	Guarantee behavior
Authenticate + resolve effective permission	Authentication session + effective-permission resolution ("what may this principal do in this scope")	Every BFF route	Returns resolved answer; callers never re-implement membership/role logic. Scope is isolation boundary; delegation depth hard-capped at 10 hops. (Source: Architecture — Design Thesis and Planes (Developer Concept Doc) §1.)
Cabinets / vault evidence export	`GET /v1/iso/evidence/export` (treasurer-facing audit pack); `GET /v1/community/:domain/:id/poce` (per-claim session steps)	Finance / auditor / donor	Evidence export sealed with proof receipt, federation event, and transactional outbox anchor before export. PoCE lookup reads session + path-step receipts. (Source: docs/jijibora-gtm/01_MARKET_AND_CUSTOMER.md §2; apps/agent-bff/src/building-reflex-routes.js PoCE route.)

Plane 4 — Integration gateway

Capability	Visible interface	Consumer	Guarantee behavior
Compliance dispatch (JSON direct vs Camel)	`POST /v1/compliance/workflow/start`; `POST /v1/compliance/workflow/callback`; `GET /v1/compliance/workflow/{bindingId}`	Compliance clients	Dispatched via Camel `:8181` over NATS JetStream. PoCE recorded when `governance_path_spec_id` supplied. Callback requires HMAC `X-Signature`. (Source: Sovereign OS Compliance iPaaS API — OpenAPI 1.0.0.)
Protocol routing rule	Subject families `egress.camel.{route}` → `ingress.camel.{route}.response` / `.failed` / `.error`	BFF dispatcher	JSON with explicit `camel_route` → Camel; JSON with `use_camel=true` → derived route; protocol `soap-xml`/`xml` → Camel with SOAP envelope; otherwise direct HTTP. SSRF guard blocks localhost/private/cloud-metadata hosts before dispatch. (Source: Apache Camel Compliance Gateway (compliance-camel, :8181) §5.)
External-gate verdicts (claimgen extgate)	`egress.camel.extgate.invoke` → `ingress.camel.extgate.response`	Claims guard (external-verdict stage)	Closed vocabulary only: `identity / content / sanctions / quota / customs`. Unknown class throws to DLQ; known-but-unwired answers `REFUSE` by design. (Source: Apache Camel Compliance Gateway (compliance-camel, :8181) §4 Bean 3.)
Capability → route resolution	Interface catalogue: CNS-typed capability → `{ bff_route, integration_route, camel_route, use_camel, fail_closed_on_missing }`	Agent BFF dispatcher	Queried at runtime; missing capability fails closed with HTTP 502/503 and PoCE receipt on success. No hardcoded route per capability. (Source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc) §6.)
Money subjects (separate family)	`platform.criteria.v1.money.billing` / `entitlement` / `settlement` / `refund`	Billing / solver bridge	Money events never carry claim payloads; billing middleware never reads claims subjects; money spine never advances a claim. (Source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc) §4.)

Plane 5 — Commerce

Capability	Visible interface	Consumer	Guarantee behavior
Revenue-split + entitlement policy	`lookup.finmon.revenue_split_profile.v1.json`; `lookup.finmon.entitlement_policy.v1.json`; `lookup.finmon.cohort_billing.v1.json`	Commerce pack / billing	Split and wallet rules are data in declarative planes, versioned and auditable — configuration over code. (Source: Architecture — Design Thesis and Planes (Developer Concept Doc) §7; datasets/lookups/lookup.finmon.revenue_split_profile.v1.json.)
Sourcing requirement → solver → match	Canonical subject `platform.criteria.v1.sourcing.requirement`; solver bridge subscribes, invokes `fn::matching::solver::greedy`, emits `platform.criteria.v1.match.fired`	Community sourcing	Every solver invocation emits an outbox anchor; failures produce typed errors, never synthetic success. (Source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc) §5; datasets/lookups/lookup.jijibora.community.sourcing.v1.json.)

Three working integration walks

All three walks use the same sequence spine proven by the claims dispatcher: create → transition → outbox row → relay sweep → consumed receipt. Transition/finalise only enqueue outbox rows; they never publish directly — the relay sweep performs the publish and marks the row. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §6.)

Walk 1 — Create claim (supervised intake)

Channel intake (WhatsApp/USSD or form) assembles claim_id, claim_type, subject_id and optional amount, currency, metadata ({village, floor, evidence refs}), scope_id.
POST /v1/claims/processing validates required fields; stamps one voyage identity (explicit voyage → explicit correlation → deterministic hash of claim/type/subject); calls fn::claim_processing::create_claim; dual-maps to the canonical claim; returns 201 { data, canonical }. Duplicate identity → 409. (Source: apps/agent-bff/src/processing-claim-routes.js Create Claim handler.)
Channel confirms receipt to the reporter with a durable ticket id — no claim-id invention. (Source: docs/jijibora-gtm/04_AI_DRIVEN_INTERFACE_AND_ORCHESTRATION.md §2.)

Walk 2 — Guard (dry-run before commit)

UI calls POST /v1/claims/processing/guard-check with claim, target state, actor — no mutation.
Runtime guarded runner evaluates gate → quorum → separation → evidence → external-verdict stages in order from declarative values in lookup.claims.transition_policy.v1.json, lookup.claims.sod.v1.json, lookup.claims.evidence.v1.json, and lookup.claims.outbox_subjects.v1.json. Any failing stage refuses with a validation error, never advancing silently. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §3; datasets/lookups/lookup.claims.transition_policy.v1.json.)
Dispatcher returns { ok, guards_passed, guard_details }. A failing stage blocks transition with the exact reason (e.g. missing evidence, quorum below threshold, self-approval barred). (Source: Generic Processing Claims API (cross-vertical) — OpenAPI 1.2.0 guard-check; Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §2.)

Walk 3 — Revive / consume (outbox → relay → receipt)

After a guarded transition succeeds, the route enqueues an outbox row — it does not publish. POST /v1/claims/processing/:claimId/transition returns { data, outbox } with honest enqueue status. (Source: apps/agent-bff/src/processing-claim-routes.js Transition handler §CLAIMGEN-04.)
Producer write shape: nats_outbox { subject, payload, correlation_id, trace_id, envelope_subject, status: 'pending', created_at } with bounded retry + (subject, status) auto-index so the relay does not full-scan. (Source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc) §2.)
Relay sweep reads pending rows (bounded prefix per subject), publishes to NATS JetStream, marks delivered on success, failed on failure, dead-letter after max retries with an audit row. (Source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc) §2.)
Claims-spine consumer (Kestra) subscribes on the lifecycle subject family in its queue group, validates the subject against the value-group allowlist, resolves the pack by claim type, runs enabled advisory hooks, publishes a consumed receipt. The live proof creates one motor + one ticket claim, transitions each to submitted, and awaits per-claim consumed receipts asserting the expected receipt shape. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §6.)
Negative probe: publishing an allowlist-external subject for a ghost identity produces no receipt, proving the allowlist drop. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §6.)

Open items / gaps

Government and community lines have no panel mesh in the seeded values; panel roles cover insurance lines only. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §4.)
No live billing or live settlement is claimed from the claims plane; VAS eligibility answers only; monetisation ceremony is separate. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs §5, Open items.)
Procurement threshold bands sit alongside the claims threshold values; the seam reads the claims keys explicitly. (Source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs Open items.)
Per-route .failed subjects and generic timeout ingress.camel.generic.error are documented in gateway prose; literal Camel YAMLs read for the map contain no onException/.failed step except nats:claims.intake.v1.dlq, and external-portal URLs are currently httpbin.org/post echo placeholders. (Source: Apache Camel Compliance Gateway (compliance-camel, :8181) §6.)
No external integration is wired for any external-gate class yet — the verdict router answers REFUSE by design. (Source: Apache Camel Compliance Gateway (compliance-camel, :8181) §6.)