System architecture

ariada is a seven-stop EAA-2025 compliance pipeline plus a TypeScript scanner runtime stack, distributed as separately versioned @ariada-org/* npm packages and a reusable GitHub Actions workflow. This page enumerates every component, its classification bucket, and its license — the same inventory cited in our NLnet Commons Fund proposal and the CRA Article 24 Open Source Steward declaration.

74% of the combined 35-component inventory ships under an open-source license (16 open-source + 6 HYBRID commodity-outer surfaces = 22 OSS-touching components out of 30 non-RETIRE rows; the remaining 8 are server-side operational surface or proprietary closed cores). The full architectural specification lives in docs/PLATFORM_SPEC.md in the public repository.

System diagram

Three buckets, colour-coded. Green is published under an OSI-approved license. Amber ships a substantial OSS commodity-outer surface with the proprietary algorithmic core retained closed. Red is closed by deployment (multi-tenant operational services and trademark-bound assets) or by deliberate proprietary reservation.

flowchart TB
    subgraph OSS["OSS surface (EUPL-1.2 / MIT / CC0-1.0)"]
      rules[wcag-rules-extended — EUPL-1.2]
      pipeline[eaa-pipeline — EUPL-1.2]
      statement[statement-generator — EUPL-1.2]
      penalty[penalty-estimator — EUPL-1.2]
      evidence[evidence-emitter — EUPL-1.2]
      engine[core-engine — EUPL-1.2]
      browser[core-browser — EUPL-1.2]
      playwright[core-playwright — EUPL-1.2]
      cli[cli — EUPL-1.2]
      scanflow[scan-flow-ui — EUPL-1.2]
      tokens[brand-tokens — MIT]
      badge[embed-badge — MIT]
      fixtures[test-fixtures — CC0-1.0]
    end

    subgraph HYBRID["HYBRID (OSS outer + closed inner)"]
      aiAuthorship[AI authorship attribution]
      haesLedger[HAES ledger]
      multiDomain[Multi-domain scanner]
      ciGate[CI differential gate]
      draculaViz[Dracula scan-flow visualisation]
      mcpServer[Regulatory-context MCP server]
    end

    subgraph CLOSED["Closed (proprietary core + hosted ops)"]
      llmCascade[Tiered LLM remediation cascade]
      backlogOpt[Predictive backlog optimiser]
      regressionDetect[Cross-deployment regression detection]
      canonicalScoring[Cross-tool canonical scoring]
      SaaS[Hosted SaaS dashboard]
      HAES[HAES Merkle anchor]
    end

Component matrix

Every component, its classification bucket, its license, its shipped/in-flight status, and a one-line purpose. The full per-component design contract lives in docs/PLATFORM_SPEC.md §3-§4.

Pipeline flow

The canonical user flow runs five stages. Every stage is independently usable — a downstream team may stop after any stage. The contracts between stages are file-on-disk artefacts, not in-process imports, so the pipeline degrades gracefully when one stage is held back a release.

1. Scan (owner: you, OSS scanner)
   core-engine orchestrates wcag-rules-extended against your built site, via the core-browser extension or the core-playwright Node adapter.
2. CI gate (owner: you, OSS reusable workflow)
   eaa-pipeline wraps the scan and downstream stages as a single uses: line. Fails the pull request on new violations. The differential-gate threshold semantics are part of the CI differential gate closed inner surface.
3. Evidence (owner: you, OSS bundler)
   evidence-emitter writes the VPAT 2.5 INT report, the EN 301 549 JSON conformance record, and a CycloneDX SBOM of the scanner itself.
4. Statement (owner: you, OSS generator)
   statement-generator produces the EN 301 549 art. 7 accessibility statement, deterministic and byte-identical across runs.
5. Penalty estimate (owner: you, OSS data package)
   penalty-estimator computes per-jurisdiction administrative-fine exposure ranges. 11 EU member states at v0.1; 27 EU + 3 EEA at Wave 4.

Optional hosted stages — the certificate authority, the HAES Merkle anchor evidence ledger, and the AI authorship attribution classifier — are proprietary and closed by deployment. Self-hosting adopters run the full OSS pipeline without these.

OSS surface percentage

Counting the 35-component combined inventory (22 baseline v2.1 architecture-review rows + 13 competitive-gap rows; excluding the one RETIRE row):

• 22 OSS-touching components — 16 open-source + 6 HYBRID
• 74% OSS surface on the combined inventory
• ~73% on the 22-row architecture baseline alone

For comparison against the mainstream open-core anchor band:

• GitLab Community Edition — ~70% OSS surface (MIT base, enterprise extensions closed)
• PostHog — ~100% OSS surface (MIT base, hosted Cloud extensions only)
• Sentry — ~95% OSS surface (Functional Source License server + MIT SDKs)
• Mattermost — ~85% OSS surface (MIT client SDKs + AGPL-3.0 Team Edition)
• Deque (axe-core) — ~5% explicit OSS surface (single rules engine MPL-2.0; remainder operations / Pro IGTs / Worldspace SaaS)

ariada at 74% sits inside the GitLab / Sentry / PostHog / Mattermost open-core leader band and exceeds the typical accessibility-vendor OSS surface by an order of magnitude. The classification was confirmed by maintainer direction after a multi-day review across three candidate scenarios, weighing the rationale and rejection reasoning for each alternative.

CRA Open Source Steward declaration

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) enters force progressively from 2025 with full applicability from 2027-12-11. Article 24 introduces a separate, lighter-touch regime for Open Source Stewards — legal persons (other than manufacturers) that systematically and on a sustained basis support the development of OSS products with digital elements, without monetising those products directly.

Agonist Development AB operates a dual-class CRA posture:

• Manufacturer obligations apply to the hosted SaaS surface placed on the EU market — conformity assessment, EU declaration of conformity, vulnerability handling, incident reporting under Articles 13-14.
• Open Source Steward obligations apply to the 16 open-source + 6 HYBRID OSS-surface modules — cybersecurity-policy publication, cooperation with national market-surveillance authorities, vulnerability-handling documentation appropriate to the OSS development model.

EUPL-1.2 Article 5 source-availability obligations and the project's REUSE compliance discipline (per-file SPDX headers, REUSE.toml per package, REUSE-CLI verification in CI) map cleanly onto the documentation expectations a national market-surveillance authority would place on an Open Source Steward.

Trademark notice

EUPL-1.2 Article 5 explicitly excludes trademark grant. The following wordmarks and brand assets are reserved by Agonist Development AB and are not licensed under any OSS license shipped on this site:

• Ariada — primary wordmark
• Ariadne — alternate wordmark / Ariadne-Thread logo
• Dracula — Dracula character wordmark
• Blamer, Clamper, Reverter — commercial product wordmarks

Downstream forks of any @ariada-org/* package must use a different name; the full trademark policy modelled on Mozilla Trademark Policy ships in TRADEMARK.md with the first tagged release.

Related pages

• Patent status — our filed IP positions and the EUPL-1.2 Article 2 patent peace for OSS users
• License matrix — per-package SPDX identifiers + rationale
• EAA pipeline — the five-stop reusable GitHub Actions workflow
• About — maintainer and stewardship statement

Maintained by Alexander Brichkin (Agonist Development AB, Sweden, org.nr 559452-5726).