Institutional Vocabulary Reference

CommunityPay uses a controlled vocabulary for its institutional artifacts and enforcement mechanisms. This reference defines each term precisely, maps it to the production code artifact that implements it, and identifies the lineage classification that governs its mutability.

This page is intended for CPAs, underwriters, escrow officers, and integration partners who need to understand exactly what CommunityPay means when it uses these terms in evidence packs, exports, and attestations.

Lineage Classifications

Every data artifact in CommunityPay has a lineage classification that determines its mutability rules:

These classifications are enforced at the application layer. ARTIFACT records use ImmutableModelMixin, which raises a ValueError on any attempt to update or delete.

Enforcement Constructs

EnforcementDecision

An immutable record of a financial authorization decision. Every production financial flow — journal entries, fund transfers, bill payments, invoice creation, payment receipts, and year-end closures — produces an EnforcementDecision before execution.

Lineage: ARTIFACT (immutable via ImmutableModelMixin)

Production status: Enforced since January 24, 2025. 100% of journal entries evaluated since cutover.

EnforcementDispatcher

The mandatory choke point for all enforcement decisions. A service — not a model. Every protected flow calls dispatcher.enforce_pre_persist() and receives an EnforcementOutcome.

Design law: "No decision logged = precise signal of bypass or bug."

Guard

A stateless enforcement primitive that checks one specific invariant. Guards are: - Stateless: Same inputs produce same outputs - Independent: No guard depends on another guard's result - Composable: Guards combine into chains via Flow configuration

Eight production guards are registered in the Guard Manifest:

Guard Manifest

A CI-enforced registry of all guards. Guard IDs are stable — changing or removing a guard ID would break the audit trail. The manifest includes a get_manifest_hash() function that produces a SHA-256 fingerprint of the entire guard configuration.

Flow

A named mapping from transaction type to guard sequence. Flows determine which guards run for each transaction type.

Six canonical flows exist:

AuditOverride

A controlled bypass of a guard decision. Overrides are never automatic. They require explicit user action, a documented reason, and an expiration date.

Lineage: ROOT_EVENT (status updates tracked)

EnforcementOutcome

The return type from enforcement evaluation. Contains the decision, all guard results, timing, blocking guard identification, and context fields for POST_PERSIST recording. This is a runtime dataclass — not persisted directly. The EnforcementDecision model is the persisted form.

Institutional Packet Types

InstitutionalPacket

The canonical record for every institutional output. All packet types share this model with type-specific evidence snapshots.

Lineage: ROOT_EVENT (lifecycle status mutable; evidence fields immutable)

HDEP (HOA Disclosure & Evidence Packet)

A comprehensive disclosure package for resale transactions. Contains financial summaries, reserve study status, governance attestation, vendor compliance, and assessment schedules for a specific unit.

Scope: Per unit (e.g., A204 for unit A204)

GCA (Governance Controls Attestation)

A board-facing report on internal control effectiveness. Measures control pass rates, override patterns, exclusion activity, and vendor compliance across a reporting period.

Scope: Per HOA/period (e.g., 2025-Q1)

Assessment levels: STRONG (>95% pass rate), ADEQUATE (>85%), NEEDS_IMPROVEMENT (>70%), DEFICIENT (<70%)

FADR (Funds Authorization & Disbursement Record)

A complete payment evidence chain for escrow and audit. Documents every step from bill creation through payment execution, including the full approval chain, policy snapshots, journal entry lines, and vendor compliance status at payment time.

Scope: Per HOA/period (e.g., 2025-01)

Verification status: VERIFIED, NEEDS_REVIEW, FLAGGED

RC (Resale Certificate)

A statute-mapped resale disclosure for unit sales. Generated from compliance profiles that define jurisdiction-specific requirements (e.g., WA RCW 64.34.425 for Washington condominiums).

Scope: Per unit

RSR (Reserve Study Report)

A reserve funding analysis with component inventory, remaining useful life calculations, funding scenarios, and 30-year cash flow projections.

Scope: Per HOA/period

Risk Intelligence Constructs

ExclusionTrigger

A versioned definition of conditions that create exclusions (bind blocks). Triggers define what signals to evaluate, what thresholds to apply, and what effect fires when conditions are met.

Lineage: SNAPSHOT (conditions immutable once ACTIVE; versioned)

Exclusion

An active hold on an entity. Created when an ExclusionTrigger fires. Exclusions are never deleted — they are resolved, expired, or overridden.

Lineage: ROOT_EVENT (status transitions tracked via ExclusionStatusHistory)

ExclusionTriggerHit

An immutable record that a trigger's conditions were met for a specific entity at a specific time. Contains the evaluated signals, computed values, and the trigger version that was active.

Lineage: ARTIFACT (fully immutable)

EligibilityRule

A declarative rule that defines eligibility criteria. Rules are versioned and immutable once published.

Lineage: SNAPSHOT (expression immutable once ACTIVE)

EligibilityEvaluation

An immutable record of a complete eligibility evaluation. Captures all rule versions active at evaluation time, all signal values, and the per-rule pass/fail results.

Lineage: ARTIFACT (fully immutable via ImmutableModelMixin)

Signal Provider

A pluggable component that gathers real-time data for eligibility and exclusion evaluation. Signal providers operate in namespaces (e.g., FINANCIAL, GOVERNANCE, COMPLIANCE) and return typed key-value pairs.

Vendor Intelligence Constructs

VECR (Vendor Eligibility & Compliance Record)

An institutional-grade vendor attestation. Contains credential status (COI, license, bond, W9), compliance history, performance metrics, and an eligibility determination.

Eligibility statuses: ELIGIBLE, CONDITIONAL, INELIGIBLE, REVIEW_REQUIRED

Content hash: SHA-256 of all sections for tamper detection.

BuildRated Score

A composite vendor quality score (0-100) computed from 18 signal categories across licensing, insurance, bonding, violations, payment history, and HOA relationship quality.

Compliance Alert

An automated notification generated when a vendor's credentials approach or reach expiration. Alert types include COI_EXPIRING, LICENSE_EXPIRED, BOND_LAPSED, and DEBARMENT_DETECTED.

CARI Constructs (Community Association Risk Index)

CARI

Community Association Risk Index. A deterministic, consent-gated index that summarizes attested governance, financial, and operational risk signals for community associations, derived directly from an authoritative system of record. CARI is not a credit score and does not make eligibility or lending decisions. See What Is a Community Association Risk Index? for an introduction and CARI Methodology and Scoring Framework for the full technical specification.

CARI Score

A composite numeric value (0-100, higher = healthier) computed from five weighted components: Financial Health (30%), Governance (25%), Vendor Risk (15%), Enforcement Integrity (15%), and Payment Behavior (15%). Scores are immutable after computation and include a SHA-256 calculation hash for deterministic verification.

Lineage: ARTIFACT (immutable via save override; append-only time series)

CARI Grade

A letter grade (A+ through F) derived from the CARI Score using published threshold mappings. Grade thresholds are defined in the active ScoreMethodology version.

CARI Confidence

An assessment of data completeness behind a CARI Score. Three tiers:

ScoreMethodology

A versioned, immutable record of scoring weights, grade thresholds, and confidence tiers. Only one methodology version is ACTIVE at any time. Historical scores always reference the methodology version used at computation time.

Lineage: SNAPSHOT (immutable once ACTIVE)

OracleConsent

An HOA's explicit authorization for third-party access to its CARI data. Score queries are rejected without active consent. Consent can be scoped to all subscribers, a specific subscriber, or a subscriber type.

Lineage: ROOT_EVENT (revocable; status transitions tracked)

OracleSubscriber

A third-party organization authorized to consume CARI data via API. Subscribers are classified by type (Lender, Insurer, Title Company, Escrow, Real Estate, Other) and tier (Basic, Professional, Enterprise) which governs rate limits and feature access.

APIKey

A hashed API credential for machine-to-machine authentication. The raw key is shown once at creation and stored as a SHA-256 hash. Keys have scoped permissions (score:read, report:generate, monitor:subscribe, webhook:manage) and optional expiration.

Lineage: ROOT_EVENT (revocable; last_used_at updated on use)

CARI Monitor

A subscriber's request to receive real-time notifications when an HOA's CARI Score changes. Monitors can filter by event type (score.changed, score.grade_changed, score.threshold_breached) and custom thresholds (floor/ceiling alerts).

CARI Report Types

All CARI reports are generated as InstitutionalPackets with SHA-256 content hashes, version chains, and full audit trails via BaseAttestationService.

Governance Constructs

GovernanceAttestation

A formal attestation of governance effectiveness for a specific period. Generated from weekly GovernanceDigest aggregations and exception register data.

Exception Register

An automatically generated register of governance exceptions. Populated from exclusion events, escalation events, and SLA breaches. Auditors typically build these manually; CommunityPay generates them from source data.

Control Plane Health Snapshot

Technical metrics about enforcement dispatcher operation: guard execution statistics, decision distribution, average evaluation time, and guard-specific performance data.

Export Constructs

Institutional Export

A machine-parseable JSON export designed for consumption by external validators.

All exports include ExportMetadata with a SHA-256 content hash.

Cryptographic Constructs

Content Hash

SHA-256 hex digest computed from canonical JSON serialization of an evidence snapshot. Canonical JSON uses sorted keys, minimal separators ((",",":")) and UTF-8 encoding to ensure identical data always produces identical hashes.

Previous Packet Hash

The content hash of the preceding version of the same packet type/scope, stored on successor packets to create a tamper-evident chain.

Conditions Hash

SHA-256 hex digest of an ExclusionTrigger's conditions JSON, computed at save time. Used to enforce immutability of ACTIVE trigger conditions — if the hash changes, the save is rejected.

Manifest Hash

SHA-256 fingerprint of the entire Guard Manifest configuration. Changes to the manifest (adding, removing, or modifying guard definitions) produce a different hash, enabling CI verification that the manifest hasn't been silently altered.