The process cannot go out of bounds.

Provable compliance, not remembered diligence

An agent following a written procedure can depart from it. A lifecycle whose steps are decision tables cannot. On the Rental rail, a round that has not published its criteria will not accept candidates, and a candidate who did not attend the viewing cannot be put forward to the landlord. On the Sale rail, a sale cannot be awarded until the office's compliance member has recorded the client checks on both parties, and only the seller can accept the award. On both, a mandate that is not signed and rooted on the owner's sealed declaration will not let a property be marketed. Each of those is a rule the software evaluates, not a practice it recommends — and every gate is a person's act: nothing is decided by the software alone.

That is the offensive half of the argument, and it is the one your customers feel: the floor is raised for every rental and every sale, including the ones nobody is watching. Stated at its edges: on the Rental rail the deposit cap and the written-agreement duty are not yet encoded, and the obligation stays with the agency — Ravel makes meeting it provable.

The defensive half follows from it. Every act is appended to a chain, so a later change is a new entry and never a quiet edit of an old one — which is what makes the first claim checkable rather than merely asserted.

The lifecycle, as models you can open

Ten process models and twenty-two decision tables, in BPMN and DMN, openable in any conformant modeller. The thing that runs is the thing you read.

Both lifecycles, bound to the law that governs them, with the proof built in. A credential is minted, presented, disclosed and revoked; a property is listed, published, rented out or sold, and relisted; a mandate is signed by both legs, rooted on a declaration, and ended. One home can be on offer for rental and for sale at once — each offer is its own round. Every action is sequenced against the law that governs it and cited where it lands, so how a decision was reached is as auditable as the decision itself.

Rental

• MandateThe landlord instructs. Nothing may be marketed until the mandate is signed on both legs and rooted.
• ListingRent, regime and the requirement a candidate must meet are fixed before anything is published — so the criterion is public before anyone is judged against it.
• CandidatesEach answers the published requirement with a sealed verdict. The funnel has one door, and everything entering it is recorded.
• ViewingsScheduling, attendance and what followed are part of the same record, not a calendar beside it.
• SelectionWhen someone is held back, the requirement that was applied is recorded and shown. A decision without its criterion cannot be written.
• ConclusionThe award needs a second pair of eyes, and the landlord who gave the mandate approves what it produced.
• Relationship endEnding a tenancy withdraws the marketing that started it. The obligation to stop is as executable as the permission to begin.

Sale

• MandateThe seller instructs at the fee agreed with them — never pre-filled. The selling mandate rests on the seller's sealed declaration and is checked again at publication and at the award.
• OfferAsking price, price condition, what is sold and the energy label the advert must state are confirmed before anything is published.
• DisclosureThe seller's disclosure is shared version by version, and each buyer's receipt is signed — the record of what the buyer knew.
• BidsA bid is recorded against a buyer the issuer cleared at that amount. Co-buyers stand in one candidacy, none of them leading; a bidder stands until the sale is irrevocable.
• AwardThe client checks on both parties are recorded first. The office proposes; the seller accepts in their own portal, by passkey. An award reported by a connected system arrives as a prompt for a person to confirm, never as a decision.
• TransactionThe agreement's clocks — the buyer's reflection period, each condition's deadline — the security, the registration and the deed date, as one envelope the issuer states the consequences of.
• Notary & transferThe notary receives a handover link to the sale's sealed references and states. At the deed, the declarations and the listing's liveness are revoked as fulfilled.

Disclosure is granted, never taken

An agent can ask to see a candidate's verdict. Only the person holding it can grant that, and the grant is recorded with what was asked for and why. Withdrawing the request is the agent's to do; refusing is the candidate's word alone, and is never written on their behalf.

Ravel holds the attestation key, and what that key signs is bounded: the audit record and the federation tokens that let the catalogue trust a session. It cannot sign a credential. Nothing Ravel produces can be presented as a verdict — that is the issuer's alone, and the separation is structural rather than procedural.

When the law changes

Rules carry a validity window, and an expired rule stops deciding — the window binds at evaluation rather than sitting decoratively in the schema. A rule dated for a future indexation can be loaded and inspected before it takes effect, and the cutoff is read from the application's clock rather than the database's, because those are not the same clock.

What that means for a rental already in the funnel, stated plainly: it is re-evaluated against the rulebook in force at each request, not pinned to the version in force when it opened. A credential already issued is the opposite — it carries the rulebook version that decided it, permanently. The asymmetry is deliberate: a process should follow the law as it stands, while an answer should remain judgeable against the law that produced it.

The mechanism for superseding one governed value with another — closing a row and inserting its successor — is present in the schema and has not been exercised. It is a roadmap item, and the first indexation is what will open it.

Two ambitions, one asset

Ravel is complete enough to be either, and neither is an upgrade on the other.