drferdi · cursor · Sep 4, 2026 · Sep 3, 2026
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -6,6 +6,6 @@ contact_links:
   - name: User support
     url: mailto:support@sentrabot.com
     about: Questions about using Sentra Bot or self-hosting help.
-  - name: Maintainer
-    url: mailto:elie@sentrabot.com
-    about: Reach the maintainer directly.
+  - name: Sentra Artificial Intelligence
+    url: https://sentrahai.com
+    about: Programme site, privacy, and terms.
diff --git a/AGENTS.md b/AGENTS.md
@@ -4,6 +4,7 @@
 - Sentra Bot is one product across web, Electron desktop, and Expo mobile; Electron hosts the web UI. Put shared behavior, contracts, API logic, and reusable UI in packages. Keep only genuinely native navigation, storage, permissions, and interactions platform-specific. Core workflows must cover every applicable surface or degrade safely for an explicit reason.
 - No hosted vendor is required to run the core product. Keep LLMs, sandboxes, memory, voice, integrations, and future external services optional and behind provider-neutral interfaces. Vendor SDKs, configuration, and translation belong only in adapters and composition roots. New providers must reuse shared contracts and deterministic offline conformance tests.
 - Keep UI and copy minimal. Show advanced capability progressively and only when it becomes relevant; do not add explainer text that repeats the interface. Frontends express intent and render state; the backend owns orchestration, authorization, validation, retries, recovery, and provider translation. Give controls concise accessible names when needed.
+- Product requirements live in `docs/requirements/` (ISO/IEC/IEEE 29148). Runtime topology lives in `docs/architecture.md`. Do not restate either in plans.
 - Keep code simple: reuse existing primitives and one source of truth, remove duplication and unused flexibility, and avoid speculative abstractions. Add an interface when it protects a real external or platform boundary, not for its own sake.
 - Treat auth, secret handling, sandbox boundaries, host commands, and integrations as security-sensitive. Keep tests deterministic and offline by default.
 - After creating a pull request, stay with it until CI and automated review bots have finished. Poll checks, reviews, review threads, and PR comments at roughly 60-second intervals; passing checks alone do not mean the review is complete. Address every actionable issue, push the fixes, and repeat the review cycle until no actionable feedback remains. Do not merge while review bots are still pending or review issues remain unresolved.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,7 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
-- Model picker includes Grok 4.6 (xAI) and Ox Alpha Free / GLM-5.3 (OpenCode Go).
+- Documentation: ISO/IEC/IEEE 29148 requirements package under `docs/requirements/`; README, architecture, and contributor files aligned to `@sentrabot/*` and the as-built surfaces.
 
 ### Added
 

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -0,0 +1,67 @@
+# Contributor Covenant Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and leaders pledge to make participation in the Sentra Bot community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our standards
+
+Examples of behaviour that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Taking responsibility and apologising to those affected by our mistakes
+- Focusing on what is best for the community
+
+Examples of unacceptable behaviour:
+
+- The use of sexualised language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others’ private information, such as a physical or email address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards and will take appropriate and fair corrective action in response to any behaviour they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces for this project, and also applies when an individual is officially representing the project in public spaces.
+
+## Enforcement
+
+Report incidents to **support@sentrabot.com**. Vulnerability reports go to **security@sentrabot.com** and must follow [SECURITY.md](SECURITY.md) — do not use public issues.
+
+All complaints will be reviewed and investigated promptly and fairly. Community leaders are obligated to respect the privacy and security of the reporter.
+
+## Enforcement guidelines
+
+Community leaders will follow these Community Impact Guidelines:
+
+### 1. Correction
+
+**Community impact:** Use of inappropriate language or other behaviour deemed unprofessional.  
+**Consequence:** A private, written warning, providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate.
+
+### 2. Warning
+
+**Community impact:** A violation through a single incident or series of actions.  
+**Consequence:** A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time.
+
+### 3. Temporary ban
+
+**Community impact:** A serious violation of community standards, including sustained inappropriate behaviour.  
+**Consequence:** A temporary ban from any sort of interaction or public communication with the community for a specified period of time.
+
+### 4. Permanent ban
+
+**Community impact:** Demonstrating a pattern of violation, or an egregious violation of community standards.  
+**Consequence:** A permanent ban from any public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1, available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html](https://www.contributor-covenant.org/version/2/1/code_of_conduct.html).
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -40,6 +40,8 @@ CI runs `pnpm lint`, `pnpm check`, production builds (including Electron preload
 
 The product path is **Pi + Docker + Graphile**. Emulator settings (`AGENT_RUNTIME=scripted`, `SANDBOX_PROVIDER=fake`, `WAKEUP_DRIVER=memory`) are for tests only.
 
+Engineering requirements: [docs/requirements/](docs/requirements/). Runtime topology: [docs/architecture.md](docs/architecture.md). Conduct: [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
+
 **Integrations** can use [Composio](https://composio.dev/) or Pipedream Connect as optional managed
 app catalogs. Users can also install HTTPS MCP servers (including Treg) and bounded OpenAPI tool
 sources. Connector tests must stay deterministic and offline. Never put connector credentials in
@@ -58,4 +60,5 @@ capability config, fixtures, logs, or snapshots; use the encrypted secret store
 | --- | --- |
 | [security@sentrabot.com](mailto:security@sentrabot.com) | Vulnerabilities only — see [SECURITY.md](SECURITY.md) |
 | [support@sentrabot.com](mailto:support@sentrabot.com) | User and support questions |
-| [elie@sentrabot.com](mailto:elie@sentrabot.com) | Maintainer |
+| [GitHub issues](https://github.com/drferdii/sentrabot/issues) | Product bugs and self-host reports (use the templates) |
+| [sentrahai.com](https://sentrahai.com) | Programme and public site |
diff --git a/LICENSE b/LICENSE
@@ -14,4 +14,5 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 
-Copyright 2026 Rakazo contributors
+Copyright 2026 PT Adianda Putri Iskandar
+Portions Copyright 2026 Rakazo contributors
diff --git a/NOTICE b/NOTICE
@@ -3,5 +3,9 @@ D:/DEV/Sentraverse/sentrabot, requested at commit d17a138.
 
 The source project includes Apache-2.0 licensed material attributed to
 Rakazo contributors. That attribution is retained for provenance and legal
-compliance. Sentra Bot migration changes include architecture, naming,
-security controls, dependency integration, and repository topology changes.
+compliance. Sentra Bot changes include architecture, naming, security
+controls, dependency integration, repository topology, and the requirements
+baseline under docs/requirements/.
+
+Product identity: Sentra Bot, programme Sentra Artificial Intelligence,
+legal entity PT Adianda Putri Iskandar. Package namespace: @sentrabot/*.
diff --git a/README.md b/README.md
@@ -40,7 +40,7 @@ The autonomous intelligence layer of Sentra Artificial Intelligence.
 
 **[Sentra Bot](https://sentrahai.com/)** is the operating layer for persistent, composable AI teammates you actually own — agents that can hold memory, execute routines, use computers, and work against your own models, your own data, and your own machines.
 
-The repository is not a single chatbot and not a thin model wrapper. It contains the full runtime surface: API, web and desktop clients, background worker, job orchestration, memory, computer providers, connectors, artifacts, realtime infrastructure, and a deliberately read-only clinical reconnaissance bridge.
+The repository is not a single chatbot and not a thin model wrapper. It contains the full runtime surface: API, web, desktop, and mobile clients, background worker, job orchestration, memory, computer providers, connectors, artifacts, realtime infrastructure, and a role-template catalog. Clinical write access is out of scope.
 
 The objective is precise: **make autonomous intelligence useful without making authority invisible.**
 
@@ -233,7 +233,10 @@ flowchart TB
 - `apps/api` — HTTP API, auth, typed orchestration
 - `apps/web` — React + Vite client
 - `apps/desktop` — Electron shell for Sentra Bot
+- `apps/mobile` — Expo client (same API contracts)
 - `apps/worker` — routines, wakeups, jobs, run continuation
+- `apps/site` — marketing site (npm package name `cora`)
+- `apps/docs` — public Mintlify documentation
 
 </td>
 <td width="50%" valign="top">
@@ -246,6 +249,7 @@ flowchart TB
 - `core` — pure domain logic
 - `db` — Prisma schema, migrations, repositories
 - `memory` — per-bot markdown memory
+- `bot-templates` — 66 Chief-of-Staff role packages
 
 </td>
 </tr>
@@ -267,6 +271,7 @@ flowchart TB
 
 - `infra/compose` — Docker Compose topologies, Caddy, deployment assets
 - `infra/sandboxes` — bot computer images + supervisor
+- `infra/updater` — Compose updater sidecar
 - `scripts` — backup / restore utilities
 
 </td>
@@ -277,16 +282,20 @@ flowchart TB
 <summary><b><code>REPOSITORY MAP // CANONICAL LAYOUT</code></b></summary>
 
 ```text
-sentra-agent/
+sentrabot/
 ├── apps/
 │   ├── api/          # HTTP API + auth + orchestration (Hono, port 3100)
 │   ├── web/          # React + Vite client (port 5173)
 │   ├── desktop/      # Electron shell hosting the web client
-│   └── worker/       # Background worker: routines, wakeups, jobs
+│   ├── mobile/       # Expo client
+│   ├── worker/       # Background worker: routines, wakeups, jobs
+│   ├── site/         # Marketing site
+│   └── docs/         # Public Mintlify docs
 ├── packages/
 │   ├── adapter-kit/  # Shared ports & interfaces
 │   ├── adapters/     # Sandboxes, executors, realtime, connectors, secrets
 │   ├── auth/         # Better Auth wiring
+│   ├── bot-templates/# Role catalog (66 packages)
 │   ├── chat-ui/      # Cross-platform markdown rendering
 │   ├── contracts/    # Shared typed RPC / service contracts
 │   ├── core/         # Pure domain logic
@@ -297,7 +306,9 @@ sentra-agent/
 │   └── ui-web/       # Shared React UI components
 ├── infra/
 │   ├── compose/      # Compose topologies + Dockerfile + Caddy + DEPLOY.md
-│   └── sandboxes/    # Computer, desktop, supervisor images
+│   ├── sandboxes/    # Computer, desktop, supervisor images
+│   └── updater/      # Product-update sidecar
+├── docs/             # Architecture, operator docs, requirements package
 └── scripts/          # backup.sh / restore.sh
 ```
 
@@ -503,7 +514,7 @@ Production uses `backup-prod.sh` with a systemd timer, seven-day rotation, and m
 | `OPENROUTER_API_KEY` / `PI_DEFAULT_PROVIDER` / `PI_DEFAULT_MODEL` | Model provider configuration and defaults. |
 | `E2B_API_KEY` / `DAYTONA_API_KEY` / `DAYTONA_API_URL` / `DAYTONA_TARGET` / `BOX_API_KEY` / `BOX_API_URL` | Computer-provider credentials. |
 | `COMPOSIO_API_KEY` | Optional plugins / connectors. |
-| `EXPO_PUBLIC_API_URL` / `RAKAZO_WEB_URL` | Client overrides for a central origin. |
+| `EXPO_PUBLIC_API_URL` / `SENTRABOT_WEB_URL` | Mobile production origin and Electron web-URL override. |
 | `SMTP_URL` / `VAPID_*` | Optional email and push. |
 | `OTEL_EXPORTER_OTLP_ENDPOINT` / `LOG_LEVEL` | Observability. |
 
@@ -581,7 +592,7 @@ curl --fail https://app.example.com/health
 3. Start `docker-compose.supabase.yml`.
 
 ```bash
-pnpm --filter @rakazo/db exec prisma migrate deploy
+pnpm --filter @sentrabot/db exec prisma migrate deploy
 
 docker compose --env-file .env \
   -f infra/compose/docker-compose.supabase.yml \
@@ -599,7 +610,7 @@ pnpm db:generate
 pnpm db:migrate
 
 # production alternative
-pnpm --filter @rakazo/db exec prisma migrate deploy
+pnpm --filter @sentrabot/db exec prisma migrate deploy
 ```
 
 ---
@@ -671,11 +682,11 @@ flowchart TB
 ### `10 / CLINICAL BOUNDARY`
 
 > [!CAUTION]
-> **The RME bridge is read-only clinical reconnaissance. It is not a clinical write path.**
+> **Sentra Bot is not a hospital information system and has no clinical write path.**
 
-The v0.1 adapter opens the RME in a headed Chromium browser, reads **one patient**, and produces structured, validated JSON.
+This repository does not ship an electronic medical record (RME) adapter. Healthcare role templates in `packages/bot-templates` are operating-layer prompts and policies, not access to a patient record.
 
-The boundary is deliberate:
+The product doctrine for any future clinical integration remains:
 
 ```text
 MANUAL LOGIN
@@ -691,12 +702,10 @@ MANUAL VERIFICATION
 NO WRITE
 ```
 
-- Credentials are never requested, stored, or committed.
-- Login remains manual.
-- The adapter does not write to the patient record.
-- Scope does not expand to all patients or clinical AI until one-patient read behavior is manually verified end to end.
+- Clinical credentials are never requested, stored, or committed in this baseline.
+- Do not document a shipped RME bridge until the adapter exists in code and is verified end to end.
 
-**Clinical autonomy does not begin by granting write access. It begins by proving the read path.**
+**Clinical autonomy does not begin by granting write access. It begins by proving a read path — and that path is not in this repository yet.**
 
 ---
 
@@ -752,9 +761,11 @@ Typed contracts, deterministic tests, topology checks, canaries, runtime health,
 
 The product is **Sentra Bot**.
 
-Internal package identifiers historically retain the `@rakazo/*` namespace from the upstream codebase. This is intentional: user-facing branding changes what the product is called; compatibility-sensitive internal identifiers are not renamed without a technical reason.
+Internal packages use the **`@sentrabot/*`** namespace. Historical `@rakazo/*` identifiers from the upstream codebase **do not exist** in this repository.
 
-**License:** Apache 2.0 — see `LICENSE`.
+Engineering requirements (ISO/IEC/IEEE 29148) live in [`docs/requirements/`](docs/requirements/). Runtime topology lives in [`docs/architecture.md`](docs/architecture.md).
+
+**License:** Apache 2.0 — see `LICENSE` and `NOTICE`.
 
 Operational contracts and security boundaries live in:
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -15,7 +15,8 @@ We will acknowledge your report and work on a fix. Please do not file a public i
 ## Other contact
 
 - General support: **support@sentrabot.com**
-- Maintainer: **elie@sentrabot.com**
+- Public site: **https://sentrahai.com**
+- Product issues: **https://github.com/drferdii/sentrabot/issues** (not for unfixed vulnerabilities)
 
 ## Scope
 

diff --git a/SUPPORT.md b/SUPPORT.md
@@ -0,0 +1,9 @@
+# Support
+
+- **Product and self-hosting questions:** [support@sentrabot.com](mailto:support@sentrabot.com)
+- **Security vulnerabilities:** [security@sentrabot.com](mailto:security@sentrabot.com) — see [SECURITY.md](SECURITY.md)
+- **Bugs:** [GitHub issues](https://github.com/drferdii/sentrabot/issues) using the templates
+- **Programme site:** [sentrahai.com](https://sentrahai.com)
+
+Operator documentation: [docs/self-host.md](docs/self-host.md).  
+Requirements baseline: [docs/requirements/](docs/requirements/).
diff --git a/apps/docs/README.md b/apps/docs/README.md
@@ -45,6 +45,8 @@ Isi `docs/` berikut **tidak** dimasukkan karena bersifat internal. Jangan menamb
 | `docs/plans/*` | Spesifikasi MVP internal |
 | `docs/2026-agent-best-practices-brief.md` | Brief internal |
 | `docs/mobile-release.md` | Proses rilis internal |
+| `docs/requirements/*` | Paket persyaratan ISO/IEC/IEEE 29148 (internal) |
+| `docs/architecture.md` | Topologi runtime (internal; ringkasan operator ada di halaman pasang) |
 
 `docs/product/paket-free-batas-v1.md` **tidak** disalin utuh — halaman `mulai/paket.mdx` hanya
 mengambil bagian yang layak publik. Target COGS internal (Rp4.000/user/bulan), catatan pajak,

diff --git a/apps/docs/mulai/paket.mdx b/apps/docs/mulai/paket.mdx
@@ -23,7 +23,6 @@ Bot di atas batas **tidak dihapus** — hanya dijeda sampai paket dinaikkan kemb
 | Harga | Rp0 |
 | Bot aktif | **3** |
 | Managed AI | Termasuk, *fair-use* |
-| Target COGS AI internal | ≤ Rp4.000 / active user / bulan |
 | Pencarian web | 10 / hari |
 | Unggah berkas | 5 / hari |
 | Penyimpanan aktif | 250 MB |
@@ -40,6 +39,9 @@ Bot di atas batas **tidak dihapus** — hanya dijeda sampai paket dinaikkan kemb
 
 Sesi computer-agent dikunci di **3**, bukan rentang 3–5, agar kontraknya tegas.
 
+Angka paket selengkapnya dan aturan penurunan paket ada di sumber internal
+`docs/product/paket-free-batas-v1.md`. Halaman ini **tidak** memuat target biaya internal.
+
 ---
 
 ## Saat turun dari paket berbayar ke Free