Diamond Stone: everything that has to be built

Date: 2026-11-12. Revision 1. Companion to docs/REVIEW.md.

Every engine, generator, service, tool and connection the plan needs, whether or not a document names it. 116 items. It is a list for whoever estimates and builds; it is not a design.

How to read it. - Planned? ● specified well enough to design · ◐ mentioned only · ○ not in any document. - How: "build" means written by us. A named library or service is a suggestion compatible with the chosen stack; anything marked to check was not confirmed. - Size: S days · M weeks · L a month or more, for one experienced developer. Rough. - First: ★ needed for the smallest release in REVIEW.md section 9.

No estimate of total time is given. It cannot be made honestly until the data model and the processes exist (REVIEW.md section 10).

1. Codes, labels and printing

The owner asked about this group by name.

#	Thing	What it does	Planned?	How	Size	First
1	QR code generator	One service that makes a code for anything. Used on: every issued paper (to check it is genuine); crate labels; lot and slab labels; sample labels; staff invitations; business cards; "WhatsApp on this computer"; signing in to the portal at a desk; tracked links on print; a driver's job	◐	A Rust QR library, drawn into the PDF maker and into pages	S	★
2	Short links and tracked codes	A short address behind each code, so the code never changes even if the page does; counts scans by source	◐	Build	S	★
3	Document verification page	Scan a paper's code: genuine or not, and what it is, without showing amounts to a stranger	●	Build	S	★
4	Code scanner	The phone camera reads our codes and opens the right record	◐	The browser's own reader, with a fallback library	S
5	Label designs	Crate, lot, slab, sample: what each shows, in which size, on what material	○	To decide: printer, sizes, material	S
6	Printing from a phone	Labels at the factory and the yard	○	Android's own printing to a PDF-capable printer first. A Bluetooth label printer needs choosing and testing: the browser supports only some	M
7	Numbering	Gapless numbers per series and year for every paper	●	Build	S	★

2. Papers

#	Thing	What it does	Planned?	How	Size	First
8	PDF maker with template versions	Every paper, in English and Arabic	●	Typst	L	★
9	Archive-grade PDF with data inside	For e-invoicing later	◐	Typst, to check, with a named fallback still to choose	M
10	Arabic and mixed-text test set	Proves the papers render correctly	●	Build	S	★
11	Terms engine	Versions, which set attaches to which paper, the record of acceptance	●	Build	M	★
12	Sharing	Send log, links with an end date, "send all"	●	Build	M	★
13	Amount in words, English and Arabic		◐	Build	S	★
14	Stamp and signature placement		◐	Build	S
15	Export set and consistency check	Invoice, packing list, origin certificate data checked against each other	◐	Build	M
16	Datasheet and pack builder	Datasheet, specifier pack, submittal pack from the stone record	◐	PDF maker plus a zip	M
17	Spreadsheet and PDF exports	Lists, honouring what each role may see	◐	A Rust spreadsheet writer	S

3. Matching, stock and catalogue

#	Thing	What it does	Planned?	How	Size	First
18	Stone record	Names of every kind, variants, selections, readiness per place, "where used"	●	Build	L	★
19	Range capture and approval	Three photographs with labels; the customer's approval, by account or by link	◐	Build	M	★
20	Layout tool	Put a number on each piece of a layout photograph; map numbers to crates; produce the plan as a PDF; take a customer's request to change a piece; keep versions	◐ no method	Build: a drawing layer over the photograph	L
21	Sorting and inspection	Piece by piece or crate by crate; reasons for refusal; thickness readings; how many to sample	◐	Build	M
22	Camera with a guide	Frames the shot, checks sharpness and light	◐	Build	M
23	Colour correction from a colour card	Makes photographs comparable	◐	Build; to check	M
24	Marking a photograph	Circle a mark, tap a piece	○	Build	M
25	Lot and stock engine	Soft and firm holds, reservation, spare with an end date, in transit	◐	Build	L
26	Pricing	Price lists by customer type and currency, margin, discount limits	◐	Build	M	★
27	Quote builder	Versions, the customer's name for the stone, the one-lot check	◐	Build	L	★
28	Packing-list import	From a supplier's spreadsheet or a photograph	◐	Build, plus a document reader	M
29	Landed cost	Spreads freight and duty over a lot	◐	Build	M
30	Duplicate stone finder	By name and by photograph	◐	Build	M
31	"Find a match"	A customer's photograph against our stones	◐	Image similarity; to check	M
32	Search across all names, Arabic included	Staff and site	◐	The database's own text search, plus an Arabic normaliser	M	★
33	Calculators	Area, wastage, weight, container load, budget band	◐	Build once, used on site and in the app	M
34	Units	m² and ft², mm and inches, weight per m²	◐	Build	S	★

4. Messages and people

#	Thing	What it does	Planned?	How	Size	First
35	WhatsApp connection	Official platform: send, receive, delivery reports	◐	Build the adapter	M	★
36	Template manager	Approval state, quality watch, the 24-hour window, usage count	◐	Build	M	★
37	One-time code sender	By WhatsApp, with a text-message fallback	◐	Build; text provider to choose	S	★
38	Email connection	Shared mailboxes, threading, reading inbound mail	◐	Mail provider's API; to check	L
39	Mail domain trust, unsubscribe		◐	Configuration	S
40	Who is this?	One person across numbers and addresses; companies; undoable merge	●	Build	L
41	Inbox	Timeline, composer, notes, two people replying at once	●	Build	L
42	Live connection	For chat, "is replying", who is on duty	○	To choose	M
43	Website chat	With hand-off to WhatsApp	◐	Build	M
44	Automatic messages	Triggers, stop rules, caps, quiet hours	●	Build	M	★ small
45	Consent record	Per person, per channel; "stop" handled	◐	Build	M	★
46	Notifications	Push, digest, routing by duty, quiet hours	●	Build	M
47	Cases and help		◐	Build	M
48	Join to the separate social service		●	Build the adapter	M

5. Sign-in, rights and safety

#	Thing	What it does	Planned?	How	Size	First
49	Passkey sign-in, and "confirm it is you"		●	A Rust passkey library	M	★
50	Sessions, phones list, remote sign-out, recovery	For staff and for customers (customers' side unplanned)	● / ○	Build	M	★
51	Invitations	Single use, by link and code	●	Build	S	★
52	Rights engine	By area, action and reach; hidden fields; portal rights per project	◐	Build	L	★ simple
53	Approvals and limits	Cover when away; split detection	◐	Build	M
54	Audit trail that cannot be quietly changed		◐	Build	M	★
55	Bank-detail change control	A second person and a wait	●	Build	S	★
56	Origin masking	Applied on the server, to maps, papers and photographs	● / ◐	Build	M
57	Photograph cleaning	Location data removed from every photograph that leaves, not only published ones	◐	Build	S	★
58	Face, plate and label blurring		◐	A vision service; where it runs to check	M
59	Virus scan of uploads and mail attachments		○	To check	S	★
60	Spam and abuse protection	Forms, chat, uploads, sign-in	○	Cloudflare's challenge and rate limits	S	★
61	Retention, deletion and "my data" requests		◐	Build	M

6. Money

#	Thing	What it does	Planned?	How	Size	First
62	Rules core	Money, VAT, rounding, checks; the same code on the phone and the server	●	Build	L	★
63	Ledger, periods, close		●	Build	L
64	Currency	Dated rates, locking, short receipts, revaluation	●	Build; rate source to choose	M	★ part
65	Bank statement import and matching		○	Build, to the bank's own format: ask the bank first	M
66	Payment and salary files		◐	Build, to the bank's specification	M
67	VAT return, and export evidence		◐	Build	M
68	E-invoice connection	By 2027, date to confirm	◐	Build; provider to choose	M
69	Payment proof	Upload, check, mismatch	◐	Build	S	★
70	Card payment	For samples, especially from abroad	◐	A local payment provider; to check	M
71	Sample store	Basket, credit, courier tracking	◐	Build	M
72	People, leave, payroll		◐	Build	L

7. Delivery

#	Thing	What it does	Planned?	How	Size
73	Shipment record and proof of delivery	Legs, stops, events; collection by the customer (unplanned)	● / ○	Build	L
74	Driver's job link	Stage buttons, crate count, plan handed over, four languages	◐	Build	M
75	Signature capture		●	Build	S
76	Maps	Own map files, a pin, a masked region	◐	An open map library with self-hosted tiles	M
77	Container tracking	Free-time countdown	◐	Buy; vendor to choose	S
78	Carrier's view		◐	Build	M
79	Android driver app with location		◐	A native wrapper; to check	L

8. Website

#	Thing	What it does	Planned?	How	Size	First
80	Publishing pipeline	Builds the pages from records, swaps a whole version, rolls back, schedules, previews. Nothing in the stack runs this yet	◐	A build job, to design	L	★
81	Page blocks and editor	Pages from blocks; a library of facts; checks before publishing; broken-link check	◐	Build	L	★ small
82	Redirects	For names, renames and withdrawn stones	◐	Build	S	★
83	Generators	Sitemap, image sitemap, language pairs, structured data, preview images, crawler rules	●	Build	M	★
84	Search-engine reports	Reading what Google and Bing report back	◐	Build adapters	M
85	Product feed and business profile		◐	Google's own; access to apply for	M
86	Site search, and a log of failed searches		◐	A static search index	S
87	Image sizes and formats		◐	Build, or Cloudflare's paid service	M	★
88	Forms and the enquiry list		◐	Build	S	★
89	Consent notice and visit analytics		○	To choose	M	★
90	Campaign links and first-source record		◐	Build	M
91	Content pool, rights and consents with end dates		●	Build	L
92	Marketing tools	Firms list, weekly list, monthly email	◐	Build; email sender to choose	M
93	Translation workflow	Draft, native review, state	◐	Build	S

9. The app's shell

#	Thing	What it does	Planned?	How	Size	First
94	Components, Halo, Omnibar	96 planned; about 25 for the first release	●	Build	L	★ part
95	Glass and its fallbacks		●	Build	M	★ two levels
96	Installed-app worker, update prompt		●	Build	M	★
97	Install flows, wrong-browser detection		●	Build	M	★
98	Offline store and sync	Drafts, queued actions, a conflict screen. Scope contradicts itself, and encryption "unlocked by the passkey" has no method	◐	Build	L
99	Languages, right-to-left, plurals		◐	Build	M	★
100	Hijri dates and the Omani holiday calendar	For timers, quiet hours, payroll	○	Build	S

10. AI

#	Thing	Planned?	How	Size
101	Jev connection, with a fallback for every use	●	Build. Could be left out of the first release entirely	S
102	Language model connection: drafts, translation, summaries	◐	Build	M
103	Document reader, with the source of each field shown	◐	To check where it may run	L
104	AI log, budgets, own test set	◐	Build	M

11. Running it

#	Thing	What it does	Planned?	How	Size	First
105	Data model and its migrations	Does not exist. Blocks estimating	○	Build	L	★
106	Server skeleton and generated client		●	Build	M	★
107	Edge gateway	Session check, limits	◐	Build	M	★
108	Record stages and step log	Needs the twelve processes written first	◐	Build	L	★
109	Outbox and its worker	Everything that leaves, sent once	●	Build	M	★
110	Timers and working hours		◐	A cloud scheduler	M	★
111	File store	Signed links; public and private kept apart	◐	Build	M	★
112	Settings with history; feature switches		◐	Build	M	★
113	Build and release; a staging environment	Only development and production are named	● / ○	Standard	M	★
114	Monitoring; errors reported from phones; rules on personal data in logs		◐ / ○	To check	S	★
115	Backups and a restore drill; targets for downtime and data loss		◐ / ○	The cloud's own	S	★
116	Import tools	Customers, stones, prices, opening balances, stock	◐	Build	M	★
	Test rigs: screenshots at every size, sample data, real phones		◐	Standard	L	★

12. Not in any document

Fifteen things the plan needs and never mentions.

A data model, a list of server calls and a list of events.
A runner for publishing the website.
A live connection for chat.
Virus scanning.
Spam protection.
Bank statement formats and how matching works.
A label printer, label sizes and material.
Marking a photograph (needed by the layout and by claims).
Customer-side recovery: a lost phone, a changed number, removing a person.
Collection by the customer.
Consent and analytics.
A staging environment.
Error reporting from phones.
Targets for downtime and data loss, and a plan for a data breach.
Hijri dates and public holidays.

13. Technology risks to settle before building

#	Risk	Sev.
1	Built by several AI agents across accounts (decided 12 November 2026). They share no memory, so the data model, the processes, module owners and machine checks must exist first (`REVIEW.md` section 12)	High
2	Where data may be kept. Doha is not Oman; several services are abroad. Open since the first plan	High
3	The stages put selling before the catalogue, invoices and approvals it needs; no stage holds papers	High
4	Offline: scope contradicts itself; an acceptance confirmed by passkey cannot be checked without the server	High
5	Local data "unlocked by the passkey": depends on a feature whose support on Samsung and Apple phones is unconfirmed	High
6	The PDF maker's archive output with Arabic is unproven; no fallback is named	Med
7	Sign-in depends on WhatsApp being up and our number healthy; no text-message provider chosen	Med
8	The Cloudflare account is a free, personal one with other domains on it; daily limits apply	Med
9	Passkeys inside WhatsApp's own browser; customers changing phones	Med
10	Size of the app on a mid-range phone: the budget excludes the rules engine, maps and fonts	Med
11	No stated accessibility level	Med
12	Every record carries a company for a business with one company	Low

14. Added 12 November 2026: the Money desk

docs/MONEY-DESK.md adds sixteen components (table, tree, entry grid, document viewer, column mapper and the rest), a desk shell for the Money routes, keyboard handling, a print view, and sign-in at a computer by passkey or by scanning a code with the phone. Size: L. It depends on item 65, bank statement formats.

15. Added 12 November 2026: logistics

From docs/LOGISTICS.md: route and destination checklists held as editable data; the driver and vehicle record with fields that depend on the route, and timed removal of identity numbers; passes and their dates; loading capture (crate scan, seals, four photographs); collection authority and identity check; cut-off, free-day, claims and presentation clocks; release of a bill of lading held against payment; container weight from crate weights; a truck weight check against limits; proof of export stored against the invoice; dated port and line settings for surcharges and cut-offs. A connection to Oman's electronic transport document, once its form is known.

16. Added 12 November 2026: from the critique

Settings engine with levels, precedence, floors and ceilings, history and second approval (SETTINGS.md). Single-purpose signed links. A customer view of every record. An outgoing-message filter. Sign-in limits and the 24-hour hold. Numbered seals. A spare ledger. An order snapshot. The canary, takeover and slip tests. A forbidden-words test for public pages. A decisions log. Checklist, blocked action, outdoor template and piece picker components. "Log to Diamond Stone" from a chat; voice notes written out.

17. Added 12 November 2026

A connection to salespeople's Business app numbers by Meta's coexistence, through a solution provider (MODULES.md). The test suite of TESTING.md, with its reference data and approved pictures. Buyer inspection as a per-order choice. Padded hit areas, the status slot, the blocked action, the checklist, the outdoor template and the piece picker as shared components.

18. Added 12 November 2026: suppliers

From docs/SUPPLIERS.md: the price-request builder and its supplier suggestions; templates for request, confirmation, reminder and closing; a reply address per request for email; voice notes written out; the answer reader with sources and checks in code; comparison on landed cost; standing price lists with end dates; supplier registration with states, a link for self-registration, reading of a registration paper, duplicate detection, expiry reminders and the yearly re-check; the bank-detail check; the supplier's record; our own test set and its score. Optional: forms inside WhatsApp.