# Package layout — Neo Governance (standalone) vs Academy

This repository contains **two products**. They must not depend on each other at runtime.

## 1. Neo Governance package (standalone)

Operable assurance runtime: controls, evidence lake, collectors, framework bindings, Trust Center.

| Path | Role |
|---|---|
| `practice/` | Collectors, SCF mapper, tracer, TPRM, sandbox helpers |
| `mappings/` | Lab CTRL catalog + SCF cache + satisfaction report |
| `evidence/` | Public pass/fail bundles + content-addressed `lake/` |
| `trust/` | **Trust Center export** (JSON + static `index.html`) |
| `world/` | **Scroll cinematic** — fly the assurance spine (standalone showcase) |
| `oscal/` | Profile + component definitions |
| `sandbox/` | Agent job image / deny fixtures |
| `deploy/evidence-cron/` | Lambda SAM + Actions template |
| `scripts/` | Offline verifiers |
| `wiki/` | Operator docs (optional to ship) |

```bash
PYTHONPATH=. python3 -m practice.evidence_lake cycle
# → evidence/lake/ + trust/trust-snapshot.json
# Open: trust/index.html (or any static host of trust/)
```

No Node.js. No `academy/` imports. Lake export target is always `trust/` (override with `--trust-dir`).

Scroll experience (live): https://kfcain.github.io/Neo-Governance-GRC-Agent/  
Local preview of the same tree: `./scripts/build-public-site.sh && python3 -m http.server 8765 --directory _site`

Installable entry (optional):

```bash
pip install -e .
neo-evidence cycle
```

## 2. Academy (completely separate)

Learning SPA under `academy/` — curriculum, scenario, boards. **Not** part of the deployable governance package.

- Does not host the Trust Center
- Does not receive evidence-lake exports
- Deploy independently (e.g. Vercel) if you want the teaching site

```bash
cd academy && npm install && npm run dev
```

`boards/` can accompany the academy for tldraw studios; it is also outside the Python package.

## What to ship to a real environment

Ship **package #1** only: Python modules + mappings + evidence/trust + deploy templates.  
Keep **academy** in a different deploy pipeline (or a different repo later).