Answer

Can I deploy this and let my team log into it?

A self-hosted deployment is possible, but this is not a ready-to-use hosted CRM. The framework enforces authorization and one tenant per application instance; the deployment supplies authentication. Self-hosted SQLite and dedicated-database PostgreSQL compositions exist, but are not a general production-readiness claim (L-01, L-02). Production mode requires a deployment authentication adapter; the local-development actor header is only an assertion and must not be exposed as authenticated access. The default starter is a local SQLite example (C-22), and there is no public hosted CRM account (L-07). The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08).

What the ledger says, word for word

Each entry below is copied from site/claims.json, where it is bound to the evidence that holds it — a test file, a document, or a named repository fact — and to the limitation that travels with it. The answer above summarises these; these are the claim.

C-22

One command composes the whole thing and then inspects it: 76 modules, 9 packages, 71 resources, 64 actions, 7 policies and 1 providers, applied from manifests and driven end to end — then it prints the eleven things the inspector says it cannot see.

LimitIt composes the starter's application, not yours, and it runs entirely locally against SQLite with no authentication. The counts describe what that starter applies; a different composition gives different numbers. Wall-clock time varies by machine and is deliberately not claimed.

tests/app-inspect.test.jstests/contracts-activation-e2e.test.jstests/delivery-economics-e2e.test.jsdocs/APPLICATION_INSPECTION.mdnpm run tour runs examples/starters/b2b-lead-qualification/install.mjs, which CI runs on every push, into a directory it keepsthe counts are the app inspect report of that composed projectscripts/tour.js exits non-zero if the composed application is ever empty

L-01 · No authentication ships: the framework authenticates nobody.

Production Spine v1 (ADR-038) gives the framework verified identity, organizations and memberships, server-authoritative authorization and one tenant per application instance — so tenancy and authorization now exist and are enforced. What does not exist is authentication: no login, password, session or OIDC implementation ships, and a deployment must supply the adapter that verifies the request. Production mode refuses to start without one. In local-development mode an actor header is accepted as an assertion and is not an identity, which is the default developer posture. This is not shared-database multi-tenancy and it is not a readiness claim.

JTBD-15tests/production-spine.test.jstests/actor-fails-closed.test.jsdocs/PROJECT_STATUS.mdREADME.mdDECISIONS.mdcrm app inspect reports a productionPosture that refuses to be read as a readiness claim

L-02 · Not shared-database tenancy.

createAccordoAppAsync can boot one tenant onto dedicated PostgreSQL databases. Shared-database row-level tenancy is not implemented, and this is not a production-readiness claim.

docs/PROJECT_STATUS.mddocs/strategy/PLATFORM_CAPABILITIES.md

L-07 · This is a framework, not a product you sign up for.

There is no hosted CRM, no free tier and no account. The output is an application in your repository that you run.

PRODUCT.mddocs/strategy/CATEGORY.md

L-08 · Ownership means vendored source: there is no framework dependency to bump.

The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08). The framework is copied into the project, not installed as a framework library dependency. The accordo npm name is an empty reservation; the @accordo scope is claimed and deliberately empty.

tests/project-bootstrap.test.jsdocs/PROJECT_STATUS.mddocs/plans/project-bootstrap-installability.mdthe project bootstrap writes a project from an empty directory, dry-run unless --applytests/create-accordo-package.test.js packs the publication twice, byte-identically, installs it offline and runs the generated project's own checkssite/brand.json records the registry status and the source status as two separate fields, and scripts/distribution-check.js fails if either disagrees with the treepublication is staged from CI through OIDC trusted publishing and goes live only after a human approves the staged version with 2FA

Where this stops

Nothing on this page implies deployment readiness. The framework ships no authentication verifier; authorization is framework-enforced; tenant isolation is one tenant per application instance, not shared-database row tenancy. Read the exact repository posture before deployment. Every claim and every limitation is on one page, and the questions this project refuses to answer are published beside them.