Avena · Defensibility Dossier · v2026.05
Built for due diligence.
This page is for the institutional acquirer, the regulator, the partner counsel, and the M&A analyst tasked with stress-testing whether Avena's data infrastructure survives founder departure, jurisdictional change, methodology challenge, or competitive replication. Five pillars. Every claim verifiable against a public surface.
01 · Bus factor mitigation
Bus factor mitigation
What happens if the founder is unreachable for 90 days
Codebase auto-resumes itself
Every operational system runs on scheduled Vercel cron jobs configured in
vercel.json and persisted in source control. Forty-one daily and weekly cron jobs continue ingesting, scoring, validating, archiving, and publishing without human intervention. The infrastructure was deliberately designed for absent operators.Hash-chained immutable archive
Every institutional table — official statistics, cross-validation snapshots, sovereign briefings, AVN-ID registry, counterpart health, price snapshots, macro anomalies — is snapshotted nightly to Vercel Blob (Frankfurt) with SHA-256 chaining. Independent of Supabase. Independent of the founder. Verifiable by any third party.
Open methodology — no hidden code paths
The entire methodology framework is published under CC BY 4.0: AVENA-CC index construction, AVN-ID grammar, APON Oracle envelope format, cross-validation algorithm, Policy Engine coefficient calibration. There are no proprietary black-box pricing models. Any successor team can read the code and continue operations.
Reproducible from raw sources
The 1,881-property Spanish ground-truth corpus is published as
public/data.json in source control. The backfill endpoint /api/admin/backfill-registry regenerates the entire Supabase properties_registry table from this file. Official statistics regenerate from the Eurostat and ECB SDW public APIs via /api/cron/eu-stats-ingest. If the database is wiped, the dataset rebuilds itself.02 · Provenance chain
Provenance chain
Every published datapoint sources back to a primary URL
Official statistics carry their source URL
Every row in
eu_official_stats (4,145 observations, 28 EU countries) stores the exact API endpoint that produced it. The API response at /api/v1/stats returns the source_url field alongside the value. Recipients can independently verify any Avena observation against Eurostat, ECB SDW, or INE Spain in one HTTP call.AVN-IDs are cryptographically signed
Every property identifier issued through the AVN-ID Registry carries an HMAC-SHA256 signature over
(country, postal_code, category, sequence, fingerprint). Tampering with any field breaks the signature. Verification is public and stateless.Sovereign Briefings cite every claim
Each of the five published research briefings carries a
methodology_note + cite_as structured field. Every empirical assertion in the body cross-references either a primary source (Eurostat, ECB, INE) or an Avena artifact (Vol. 2 OLS regression, Vol. 3 cross-validation methodology, Vol. 4 cohort priors).Policy Engine signs every output
Every Policy Engine scenario output carries an HMAC-SHA256 signature over the input and summary fields. The signature is regenerable given the methodology version stamp. Submissions to regulatory bodies can be reproduced and verified months or years later.
03 · Reproducibility proof
Reproducibility proof
The dataset can be regenerated by anyone, anywhere
Migrations under version control
Forty-three Supabase migrations live in
supabase/migrations/, each timestamped, idempotent, and tested. A successor operator clones the repository, runs the migrations in order, points the cron jobs at a fresh Supabase project, and the entire data infrastructure rebuilds itself from public APIs within 48 hours.Ingestion code is open
src/lib/eu-stats-feeds.ts contains the Eurostat SDMX-JSON adapter, ECB SDW JSON adapter, and INE Spain adapter — each fewer than 80 lines, each documented, each runnable in isolation. Any third party can ingest the same data using the same code.Public OpenAPI 3.1 specification
The full API surface is published at
/api/openapi.json with tagged endpoints, request/response schemas, and example payloads. Any standard OpenAPI code generator produces a Python, TypeScript, R, or Rust client in under 60 seconds.Methodology stamped on every output
Every Policy Engine result, every cross-validation snapshot, every official statistics ingest run records its
methodology_version. Currently v2026.05. Material changes are announced 30 days in advance at /changelog. Historical results never silently drift.04 · Methodology stability
Methodology stability
No silent updates, no breaking changes, 30-day change horizon
Versioned methodology framework
The Avena methodology operates under explicit semantic versioning. Current version v2026.05 covers: AVENA-CC index construction, AVN-ID grammar v1, APON Oracle envelope v1, cross-validation framework v1, Policy Engine coefficient calibration v1. Each version is permanent; new versions are additive.
30-day advance change notice
Any material change to a methodology component — coefficient recalibration, cohort definition revision, signing algorithm migration — is announced 30 days in advance with a published rationale. Institutional users have time to validate, adjust pipelines, or contest. Surprise changes are forbidden by design.
Cross-validation against official series
Every Avena ground-truth observation is cross-validated daily against the corresponding Eurostat HPI series. The signed delta is published at /eu-official. If Avena's methodology drifts from the official series, the divergence is visible to all stakeholders within 24 hours.
Peer-reviewable research output
Five Sovereign Briefings published, each with explicit methodology notes, citation block, and reproducibility recipe. Vol. 3 ("Cross-Validating Official Statistics") specifies the calibration framework. Vol. 2 ("Foreign-Buyer Flows") contains the OLS regression coefficients used in the Policy Engine. The methodology is academically defensible.
05 · Legal posture
Legal posture
Acquirer-friendly licensing, jurisdictional clarity, third-party credentialing
CC BY 4.0 on the entire data layer
The Avena dataset, methodology, briefings, and APIP standard are all released under Creative Commons Attribution 4.0 International. Acquirers inherit a license stack with no proprietary entanglements. The license is non-revocable, irrevocable, and survives all corporate transitions.
Permanent DOI through Zenodo
The Avena dataset is registered with Digital Object Identifier
10.5281/zenodo.19520064, archived by CERN under EU jurisdiction. The DOI persists independently of avenaterminal.com domain ownership. Academic citations remain resolvable forever.EU data residency
All Avena infrastructure operates within EU jurisdiction. Supabase Postgres in Frankfurt (eu-central-1). Vercel Blob archive in Frankfurt (fra1). DNS and CDN routed through European regions. GDPR-compliant by construction. Suitable for ECB, ESRB, national central bank procurement.
Third-party credentialing
Avena is a registered RICS Tech Partner (2026). The Wikidata entry Q139165733 is publicly maintained. The Zenodo DOI is institutionally archived by CERN. The Schema.org Dataset markup is indexed by Google Dataset Search. Multiple independent registries acknowledge Avena's existence.
For institutional acquirers, partners, and counsel
The dossier is a starting point. The full data room opens under NDA.
Source code repositories, cron health logs, financial statements, customer pipeline, partnership term sheets, intellectual property assignments, founder-equity structure, due diligence Q&A — available to qualified institutional counterparties under bilateral NDA. First conversation is 30 minutes, NDA-optional.