Charitology public research

Shared Charity OS

An organization workspace for coordinating charitable work, built as a separate service from the public Astro site and the local browser workspace. It combines typed records, accountable owners, linked workflows, independent review and private recovery tools. Charitology studies the system that directs generosity; it does not rate named charities or judge the good people are doing. A program's optional depth value is a hypothesis about mechanism, not a grade.

This is a Node 24 ESM service with a plain JavaScript browser client, a Postgres database and Better Auth magic-link sessions. Dependencies are pinned in package.json and package-lock.json. Detailed domain rules are in MODULES.md; the source and regression review is in BACKEND_REVIEW.md.

What the service does

All 26 modules share typed forms, linked records, table/board views, applicable calendar views, ownership, revisions, comments and workflows. The registry now contains 339 fields. Their definitions and validation are in modules.mjs, rather than being interchangeable free-text forms.

The rules include dependency cycles, allocation and grant caps, restriction codes, matching currencies, volunteer/event capacity, overlapping shifts, evidence units and denominators, external source identities and eligibility. Unknown values stay null, distinct from zero and false. Money uses integer minor units with an explicit currency and precision. Scheduled instants require a written UTC offset and a matching named time zone.

Accounting and payroll records hold external references, aggregate reconciliation and control results. They do not post a ledger, run payroll, move money or issue tax receipts. Casework and safeguarding support opaque codes, status and specialist-system references; they do not accept beneficiary histories, case notes, allegations or medical narratives. Form records describe operational definitions and aggregate response batches. The separate public intake workflow below accepts only minimal operational requests; it is not a sensitive-service intake backend. Resource and benefit records do not enroll an organization with a provider.

The public AI Charitologist remains a source-retrieval tool. This service does not introduce an autonomous recommendation model or claim independently verified impact.

Staff-reported attendance candidate

The local candidate adds a staff review → exact preview → ordinary unapproved attendance draft for an ended managed event or volunteer shift. The staff member reports the whole occurrence; confirmed bookings are context and never supply or cap the count. Event registrations/walk-ins remain unknown unless separately known or authored. Volunteer minutes and actual attendance times remain unknown. This is not participant check-in, partial-shift scheduling or outcome evidence.

An unresolved create keeps one exact command for deliberate Retry. An accepted Retry returns the later ordinary record, including corrections or trash, without resetting its workflow. Only a live helper receipt reserves its occurrence against a new generic attendance identity; existing manual/manual behavior remains compatible. Backup/restore preserves counts without reviving original receipts or approval. No new table, provider or email path is added.

Attendance acceptance records the initial 683-test run, corrected 684-test run, 199 actual isolated PostgreSQL tests and the retained seed/browser-control findings. The actual local in-app-browser/HTTP fixture verified an explicit identical Retry after a committed response was deliberately lost, leaving one ordinary draft. Authentication/approvals were synthetic; this does not prove hosted sign-in, real attendance or full accessibility. Exact-head CI and deployment remain pending. The current implementation backlog separates this slice from remaining participation and original-program work.

Learning and review

The current implementation connects an explicitly chosen native theory-of-change export or Nonprofit Advisory backup to an existing program. It creates ordinary indicator and protocol drafts, then connects approved observations to an authored review decision and a fixed private report. The contract defines the exact source and approval boundaries. The acceptance record records which versions have passed tests; production release and actual browser acceptance remain pending in this checkpoint.

1. Save the native source file, choose the existing program in Learning and review, and inspect the exact source selection.
2. Explicitly adopt, adapt, leave uncollected or decline each source intention. Define the indicators' units, population and intended period, then preview and create the ordinary drafts.
3. Complete the ordinary workflows and ask a different authorized account to approve each exact final state. A prior-state approval does not authorize a later state.
4. Record each observation with its actual period. Zero and a missing value remain different. Correcting an approved point requires a separate candidate, ordinary approval and deliberate apply; an incorrect candidate can be abandoned without approval.
5. Select the exact observations and discussed definitions, author the rule assessment and actual feedback, and complete the decision's ordinary approval.
6. Create a Reporting template with assembly method learning-review-v1. Prepare its digest, save that revision, obtain ordinary approval, then preview and freeze the private edition. New editions use a new template and identify any preceding report.

Sources and reports are restricted to currently authorized staff. Authored ordinary indicator, protocol, observation and decision blocks retain existing approved-record visibility, including eligible board and external readers. Uploading a large file temporarily stores its complete original as private parts; successful inspection removes those parts, while interrupted parts expire from access after 30 minutes and are physically removed on a later upload cleanup. Only the selected source enters learning history and full backups. Recovery retains history inactive; explicit adoption creates fresh ordinary drafts and never revives imported approvals or measurements.

The report preserves separate observations and their limitations. It calculates no causal impact, pooled total or automatic threshold result. A source's narrative baseline, result, method, date or status does not become a measured value or an approval.

Directory source review for Resources

The public Tools/Benefits directories and the hosted Resources index support an explicit retained-source selection → inspection → preview → unapproved Resource copy. Rechecks show exact source versions, field changes, owned organization notes and optional dated declarations. Resources remain organization-wide, including for program-scoped writers; the UI states that boundary before copying. No program field, provider connection, eligibility approval, enrollment, reminder or job is added. All 31 retained entries remain editorial drafts checked October 25, 2026.

Current session/membership, source/head, record revision and exact raw proposal are rebound under the organization lock. One primary binding survives Retry, changed keys and trash. Ordinary workflow validation and independent approval still apply; recheck clears approval and preserves an existing frozen reader snapshot. Full organization JSON preserves complete source history; selected evidence and CSV are partial. Restore leaves history inactive until an authorized member explicitly adopts it.

Runtime 02cc6cfc3ee45c4c7f5427c56e4f2d86bca6bac2 passes 408 complete OS unit/browser-model tests, 116 actual isolated PostgreSQL tests, the 546-page build/check and both exact-head CI runs. Final fictional Better Auth/Chrome covers 25 versioned journeys and eight narrow light/dark layouts, including actual saved-full-backup chooser/restore/adoption. The additive migration preserves all 31 prior tables/60 rows/ACLs and increases forced-RLS tenant tables from 24 to 25. Protected stage dpl_F2ACtEYm5CLHDUwwyKQQCJBfJxdE passes 43 HTTP checks and 13 exact assets. Final docs 670f132fdfcd7e0d36d95388fa6ead8b2776a547 passed both exact CI runs; PR #28 merged as c0d509a0e132e91b7f5d6b764eabce421015b125, and Pages 40584685952 succeeded. The exact tested stage is promoted after 44 canonical checks/13 exact assets; all 31 old tables/60 rows/ACLs remain unchanged. All 62 selected public files and 31 source fragments match, including favicon/OG media. Live Chrome confirmed the unsigned exact-fragment handoff. Normal future Git auto-assignment remains enabled. The acceptance record separates exact versions, fixture assistance, corrected bugs/harness findings and remaining operating work.

Manual recurring task drafts

Projects tasks support explicit preview → generate for one weekly, monthly or quarterly successor. The preview retains the original calendar anchor, requires an instant choice for repeated local times and refuses missing local times. New tasks start planned and unapproved, with the acting member as owner. Source approvals, connection identity, files, comments and reminders are not copied. Nothing generates on a schedule or sends a message.

One source has one saved successor across retries and later edits. Active series keep kind, program and schedule fixed until a separately confirmed End; cancellation/deletion also ends generation without cancelling children. Current organization/program permissions are rechecked. Backup restores recurrence only as inactive history. The acceptance record records exact limits, real signed-in fictional browser checks, 309 units and 90 isolated PostgreSQL tests. PR #26/release head b542f13f3ceec9960b358e816afa589584e36252 passed both exact CI runs. Runtime ffdbf7af612985492dd415bd7b0af4ffdaf7b398 is promoted as dpl_CyAHQVAiZ4zqwQD4yVQQob3f4Cq9 after 34 staged/35 canonical checks and ten exact assets. The additive migration preserved all 60 old rows/columns/ACLs and inspected 24 forced-RLS tables. See that record for proof time and normal future auto-assignment limits.

Grant-period reports

The new bounded grant-report implementation selects one agreement, one explicit program and one inclusive date period. It separates awards and commitments from selected external receipts, dated cash-spent references and planning context. Unknown amounts keep an unknown headline total with a known subtotal and missing-reference count; empty selections are not reported as zero activity. Individual observations retain their own units, periods, denominators, evidence and limitations without pooling or causal inference.

An authorized contributor prepares sources from a saved Reporting manifest, explicitly saves the source digest through the normal revision workflow, then obtains a different authorized contributor's approval. A final approved preview expires after ten minutes. Freeze recomputes current source/approval/membership authority and appends one i