[Epic] B2B private fact-checking — org isolation, organizations & paid tiers

**Epic · B2B private fact-checking** — let organizations run private checks on Aletheia (isolated namespace, own members and branding), with a path back to the commons, an industrial data/API tier, and metered AI.

Full scoping doc: `Escopo_B2B_Levantamento_Construcao.md` (rev. 3, 2026-07-08) in the repo root — estimates, code pointers and closed product decisions live there.

# 🎯 Strategic Context

## Why Now?

The B2B discovery track needs the platform to host **private fact-checking for client orgs** (newsrooms, NGOs, institutions) without breaking the public commons. The namespace mechanism exists but was never hardened for confidentiality: public surfaces (sitemap, search, home, stats) dump the global catalog, and two collections are still fully global. Design partners cannot be onboarded — even hand-held — until the leak surfaces close.

## Closed product decisions (2026-07-08)

- **Commons model**: `personalities` and `topics` stay **global** (public figures / Wikidata mirror). What is private is the client's content: `claims`, `claim-reviews`, `review-tasks`, `verification-requests`, `sources`.
- **Sources isolation with collision fix**: compound unique `(nameSpace, data_hash)` replaces the global unique index — same URL once per namespace, no cross-org deadlock (#2536).
- **Organization ≠ Namespace**: `Organization` = people (membership, roles, invites, billing); `NameSpace` = content partition. **Benefits `main` too**: committee working groups become orgs inside the public namespace (#2538).

## Solution Hypothesis

Harden what exists instead of rebuilding: close public leak surfaces first (pilot blocker), scope the two remaining global collections, redesign source dedup per-namespace, and prove isolation with an automated leak-test suite. In parallel, build the Organization entity as the spine for roles, invites, billing tier and AI metering.

# 🧩 Child items

## Fase 1 — Private MVP (critical path)

**Track A — isolation** (senior dev):
- [ ] #2534 — **B2B-1 · Close public leak surfaces** (sitemap, search, home, stats) — **pilot blocker, do first**
- [ ] #2535 — **B2B-2 · Namespace-scope verification-requests**
- [ ] #2536 — **B2B-3 · Sources: per-namespace dedup redesign + sanitation migration**
- [ ] #2537 — **B2B-4 · Isolation leak-test suite + compound indexes** (quality gate)

**Track B — organizations** (parallel):
- [ ] #2538 — **B2B-5 · Organization entity + org roles + committee/namespace migration**
- [ ] #2539 — **B2B-6 · Member invitations** (org-scoped)
- [ ] #2540 — **B2B-7 · Namespace branding** (independent, fits anywhere)
- [ ] #2541 — **B2B-8 · Minimal manual billing** (plan/tier on Organization)

_Fase 1 total: ~8.5–10 SP · ~5–6 calendar weeks with 2 devs._

## Bloco 2 — Temporal exclusivity (NGO plan)
- [ ] #2542 — **B2B-9 · Private→commons reopen job**

## Bloco 3 — API & data tier
- [ ] #2543 — **B2B-10 · Read API keys + per-key rate limiting**
- [ ] #2544 — **B2B-11 · Bulk export (CSV/JSON)**
- [ ] #2545 — **B2B-12 · Versioned dataset snapshot + license**
- [ ] #2546 — **B2B-13 · Real health checks** (quick win, independent)
- [ ] #2547 — **B2B-14 · LGPD: export/deletion, consent, retention** (recommended early — low cost, high sales value)

## Bloco 4 — Metered AI
- [ ] #2548 — **B2B-15 · Copilot metering (UsageLog, quotas)**
- [ ] #2549 — **B2B-16 · Contribution-vs-payment gate**

# 🚦 Sequencing & pilots

- **Design partners before Fase 1 is done: OK** — provided #2534 ships first (~1 SP) and provisioning is manual. Without it the sitemap publishes client data to Google.
- The source **sanitation migration (#2536) must run before any contractual isolation claim** — existing shared source docs already mix namespaces.
- Scaling beyond hand-held pilots requires the full Fase 1 track A + B.

# Related
- #2503 — [Epic] Product & tech track
- #2490 — [Epic] Process & operations
- #2489 — [Epic] Instrumentation & data