flowchart LR
    subgraph Conversational Boundary
        Client[MCP Client / User Assistant]
    end

    subgraph Northstar MCP Server
        Sanitizer[Input Sanitizer & Regex Guard]
        StateMachine[Funnel State Machine]
        Store[(Session Store: Memory / Postgres)]
    end

    subgraph Deterministic Core
        Rules[Actuarial Pricing Engine (v1/v2)]
        Eligibility[Underwriting Eligibility Evaluator]
        ConsentGuard[GDPR Consent Gate]
        Audit[Append-Only SHA-256 Audit Store]
    end

    Client -->|MCP Tool Calls| Sanitizer
    Sanitizer --> StateMachine
    StateMachine <--> Store
    StateMachine --> Eligibility
    StateMachine --> ConsentGuard
    ConsentGuard --> Rules
    StateMachine --> Audit

# 1. Install dependencies (idempotent, local)
make setup

# 2. Run the full interactive demonstration
make demo

# 3. Run all unit and integration tests (32 tests)
make test

# 4. Run the 24-scenario automated evaluation benchmark
make eval

# 5. Execute all release audit quality gates
make release-check

[User]      "Hi, I need home insurance for my apartment in Paris (75008)."
[Assistant] submit_property_basics({ country: 'FR', postcode: '75008', propertyType: 'apartment', occupancyType: 'owner_occupied' })
[Server]    -> Status: PROPERTY_RECORDED. State advanced to COLLECTING_RISK.

[User]      "It was built in 2010, 75 sqm, primary residence, 0 claims in past 5 years."
[Assistant] submit_risk_factors({ constructionYearBand: '2000_2015', floorAreaBand: '50_100_sqm', isPrimaryResidence: true, claimsCount5Years: 0 })
[Server]    -> Status: RISK_FACTORS_RECORDED.

[Assistant] evaluate_eligibility()
[Server]    -> Outcome: ELIGIBLE (Reason: RISK_CRITERIA_MET). Rule version: northstar-home-eu-v1.

[User]      "I'd like the Comfort tier with a €300 deductible."
[Assistant] select_coverage({ coverageTier: 'comfort', deductible: 300 })
[Assistant] confirm_quote_parameters({ confirmed: true })
[Server]    -> Status: PARAMETERS_CONFIRMED. State advanced to AWAITING_CONSENT.

[Invariant] calculate_quote() -> Throws [CONSENT_REQUIRED] "Cannot calculate quote without verified consent."

[User]      "I agree to the data processing terms."
[Assistant] submit_consent({ consentVersion: 'consent_v1_2026' })
[Assistant] calculate_quote()
[Server]    -> QUOTE ISSUED (ID: 90484678-f868...)
               Base Annual: €180.00 | Property Multiplier: x0.9 | Deductible Discount: -€25.00
               Net Annual:  €137.00 | Tax (18%): +€24.66
               TOTAL:       €161.66 / year (€13.47 / month)
               Fingerprint: 36d5b534f844c6e43243398f3fb42436c251712183d3e0036f239a7bc168d56a (SHA-256)
               Status:      Active (Non-binding indicative)

├── apps/
│   ├── mcp-server/              # Model Context Protocol server (Stdio/HTTP)
│   └── pricing-service/         # Fastify microservice (/health, /ready, /metrics, /calculate)
├── packages/
│   ├── domain/                  # Zod validation schemas, error taxonomy, state machine
│   ├── rules/                   # Actuarial pricing engine, versioned rules (v1, v2), eligibility
│   ├── persistence/             # SessionStore interface (In-Memory with TTL & PostgreSQL)
│   ├── audit/                   # Append-only audit store with SHA-256 hash chaining & redactor
│   └── security/                # Input sanitization, prompt injection detection, data catalog
├── docs/
│   ├── fde/                     # 16-document Enterprise FDE Delivery Pack (RTM, RACI, UAT, etc.)
│   ├── procurement/             # 16-document Procurement & Security Library (35-question FAQ, DPIA)
│   ├── architecture/            # Threat model (STRIDE), Hosted vs VPC blueprints, SDK notes
│   ├── portfolio/               # Role requirement map, interview walkthrough, STAR stories
│   └── DEMO_SCRIPT.md           # 5-minute video recording script
├── tests/                       # Unit, property, integration, and adversarial security tests
├── scripts/
│   ├── demo-flow.ts             # Interactive demonstration runner
│   ├── run-eval.ts              # 24-scenario automated evaluation benchmark
│   └── anonymize-session.ts     # GDPR Article 17 right-to-erasure utility
├── Makefile                     # Canonical developer command interface
├── docker-compose.yml           # Local multi-container deployment stack
└── .github/workflows/ci.yml     # Automated CI verification pipeline