Add isolated Fixars product sites and deployment architecture

.cpanel.yml

@@ -0,0 +1,12 @@
+---
+deployment:
+  tasks:
+    # Canonical product origins are isolated. Connector subdomains only redirect.
+    - /bin/mkdir -p /home/fixarsgr/public_html/skillscanvas.co
+    - /bin/cp -R subapps/dist-products/skillscanvas/. /home/fixarsgr/public_html/skillscanvas.co/
+    - /bin/mkdir -p /home/fixarsgr/public_html/collaboard.co
+    - /bin/cp -R subapps/dist-products/collaboard/. /home/fixarsgr/public_html/collaboard.co/
+    - /bin/mkdir -p /home/fixarsgr/conceptsnexus.co
+    - /bin/cp -R subapps/dist-products/conceptnexus/. /home/fixarsgr/conceptsnexus.co/
+    - /bin/mkdir -p /home/fixarsgr/vestden.co
+    - /bin/cp -R subapps/dist-products/vestden/. /home/fixarsgr/vestden.co/

.github/workflows/subapps-quality.yml

@@ -0,0 +1,40 @@
+name: Sub-app quality
+
+on:
+  pull_request:
+    paths:
+      - "subapps/**"
+      - ".cpanel.yml"
+      - "docs/architecture/network-event-architecture.md"
+      - ".github/workflows/subapps-quality.yml"
+  push:
+    branches: [main]
+    paths:
+      - "subapps/**"
+      - ".cpanel.yml"
+      - "docs/architecture/network-event-architecture.md"
+      - ".github/workflows/subapps-quality.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: subapps
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: subapps/package-lock.json
+      - run: npm ci
+      - run: npm audit --audit-level=high
+      - run: npm run architecture:validate
+      - run: npm run build:products
+      - name: Verify committed product artifacts are reproducible
+        working-directory: .
+        run: git diff --exit-code -- subapps/dist-products

README.md

@@ -1,6 +1,6 @@
 # Fixars
 
-The connected productivity ecosystem: **invest in ideas (VestDen)**, **validate concepts (ConceptNexus)**, **collaborate on projects (Collaboard)**, and **showcase/book talent (SkillsCanvas)** — all from a single account with shared points, notifications, and real-time activity.
+The connected productivity ecosystem: **invest in ideas (VestDen)**, **validate concepts (ConceptsNexus)**, **collaborate on projects (CollaBoard)**, and **showcase/book talent (SkillsCanvas)** — all from a single account with shared points, notifications, and real-time activity.
 
 Underneath the apps sits the **Fixars Context Layer (FCL)** — the ontology/application layer where the durable value lives: models commoditise, your context compounds. See [`docs/fcl-spec.md`](docs/fcl-spec.md) (the layer's specification) and [`docs/strategy-sovereignty.md`](docs/strategy-sovereignty.md) (the positioning).
 
@@ -65,6 +65,13 @@ The currently deployed public waitlist is maintained as a separate project in
 [`landing-page/`](landing-page/). Keeping it isolated allows the waitlist to be
 deployed without publishing or changing the broader Fixars application.
 
+### Independent product sites
+
+The four standalone product-site implementations and their independently built
+artifacts live in [`subapps/`](subapps/). Their canonical domains, Fixars
+connector redirects, event boundaries, and cPanel deployment roots are recorded
+in [`docs/architecture/network-event-architecture.md`](docs/architecture/network-event-architecture.md).
+
 ## Contributing
 
 1. Branch from `main`

docs/architecture/network-event-architecture.md

@@ -0,0 +1,152 @@
+# Fixars Network and Event Architecture
+
+Status: approved direction, pre-deployment implementation plan
+
+This document combines the public-domain routing model with the internal event and webhook model. It does not assert that DNS, certificates, webhook endpoints, databases, queues, or production integrations are already live.
+
+## 1. Architectural boundaries
+
+- `FixarsGroup.com` is the corporate governance and portfolio site.
+- `Fixars.ai` is the public ecosystem hub, discovery layer, and read-only cross-product activity surface.
+- SkillsCanvas, ConceptsNexus, CollaBoard, and VestDen remain independently deployable products with separate canonical domains and data ownership.
+- Fixars.ai may hold derived projections for discovery and activity feeds. It must not become the authoritative database for every product.
+- The current Fixars.ai waitlist root remains isolated until a later, explicitly approved hub migration.
+
+## 2. Public routing
+
+| Product       | Canonical domain            | Fixars connector subdomain    | Fixars connector path        |
+| ------------- | --------------------------- | ----------------------------- | ---------------------------- |
+| SkillsCanvas  | `https://skillscanvas.co/`  | `https://skills.fixars.ai/`   | `https://fixars.ai/skills`   |
+| ConceptsNexus | `https://conceptsnexus.co/` | `https://concepts.fixars.ai/` | `https://fixars.ai/concepts` |
+| CollaBoard    | `https://collaboard.co/`    | `https://collab.fixars.ai/`   | `https://fixars.ai/collab`   |
+| VestDen       | `https://vestden.co/`       | `https://vest.fixars.ai/`     | `https://fixars.ai/vest`     |
+
+The standalone product domain is canonical. Connector subdomains and paths issue server-side permanent redirects and preserve the remainder of the path. For example, `https://fixars.ai/skills/passport` redirects to `https://skillscanvas.co/passport`.
+
+Connector URLs are not duplicate deployments and are not separate sources of truth. Canonical product HTML, sitemaps, analytics, and search signals live on the standalone domains.
+
+## 3. Network layers
+
+| Layer             | Responsibility                                               | Initial implementation                                                 |
+| ----------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------- |
+| Authoritative DNS | Resolve canonical and connector hostnames                    | AfeesHost zones, verified before changes                               |
+| Edge and TLS      | HTTPS, WAF/CDN where available, redirects, basic rate limits | One authoritative redirect layer only                                  |
+| Product origins   | Serve four independently validated builds                    | Four isolated document roots/build outputs                             |
+| Identity          | Shared login and consent                                     | Later `auth.fixars.ai` using OAuth/OIDC; no broad parent-domain cookie |
+| API gateway       | Route authenticated synchronous requests                     | Later `api.fixars.ai/{product}` to bounded product services            |
+| Event gateway     | Route asynchronous product facts                             | Later private `events.fixars.ai` service plus queue                    |
+| Inbound webhooks  | Receive narrow third-party notifications                     | Later `hooks.fixars.ai/inbound/{provider}` endpoints                   |
+| Product data      | Authoritative state and append-only records                  | Separate product-owned databases and policies                          |
+
+## 4. When to use each interaction
+
+- Browser navigation uses canonical URLs and redirects.
+- User commands and current-state reads use authenticated APIs.
+- Shared login uses OAuth/OIDC.
+- Server-to-server notifications use events, with webhook delivery where HTTP is the appropriate adapter.
+- Browser live updates use SSE or WebSocket connections fed from product projections.
+- Webhooks do not replace APIs, databases, identity, DNS, redirects, or browser realtime channels.
+
+## 5. Event flow
+
+1. A product validates and commits a state change in its own database.
+2. The same database transaction appends an event to that product's outbox.
+3. An outbox dispatcher publishes the event to the Fixars event gateway/queue.
+4. The gateway records delivery state and routes the event to approved consumers.
+5. Consumers process the event idempotently and update their own local projection or workflow.
+6. Fixars.ai updates a read-only ecosystem projection for discovery and activity display.
+7. Failed deliveries retry with exponential backoff and jitter, then move to a dead-letter queue for controlled replay.
+
+No consumer may treat receipt of an event as proof that another consumer completed its work.
+
+## 6. Initial event catalogue
+
+The machine-readable catalogue is in `contracts/events/catalog.v1.json`. The first contracts cover:
+
+- ConceptsNexus concept certification and required-skill publication.
+- SkillsCanvas verified-skill and passport updates.
+- CollaBoard capsule creation, artifact approval, and milestone approval.
+- VestDen diligence updates and restricted escrow-release requests.
+
+Event names use reverse-DNS style identifiers and explicit versions. Payloads carry identifiers and necessary facts, not whole product records or unnecessary personal data.
+
+## 7. VestDen consequence boundary
+
+Events may start a VestDen diligence or verification workflow. They must not directly release escrow, create a position, initiate a payment, or mark a payout successful.
+
+A consequence-bearing VestDen workflow must:
+
+1. Verify the event signature and replay window.
+2. Deduplicate the event ID.
+3. Fetch authoritative records through authenticated APIs.
+4. Recalculate server-owned gates and values.
+5. Apply legal, policy, and approval controls.
+6. Write an append-only decision record.
+7. Call a regulated provider only from an authorised server-side workflow.
+8. Reconcile the provider's independently verified response/webhook before changing financial state.
+
+## 8. Webhook delivery requirements
+
+- HTTPS only.
+- Per-producer or per-endpoint signing credentials.
+- Signature verification over the exact raw request body.
+- Signed timestamp and bounded replay window.
+- Unique event IDs and idempotent consumers.
+- Quick `2xx` acknowledgement after durable queueing, not after lengthy business logic.
+- Exponential retry with jitter, dead-letter storage, and audited replay.
+- Explicit event subscriptions; no receive-everything endpoints by default.
+- Payload-size limits, schema validation, rate limits, and structured security logs.
+- Separate sandbox and production endpoints, secrets, queues, and data.
+- Event metadata must not contain secrets or sensitive personal information.
+
+## 9. Deployment phases
+
+### Phase A: current static products
+
+- Produce four isolated frontend build outputs.
+- Create four hosting roots.
+- Attach canonical domains and HTTPS.
+- Configure subdomain and path redirects.
+- Keep webhook/event runtime disabled.
+
+### Phase B: first product backends
+
+- Define product-owned databases and APIs.
+- Implement shared event-envelope validation.
+- Add transactional outbox tables and dispatchers.
+- Operate one internal queue and event gateway.
+- Build Fixars.ai read-only projections.
+
+### Phase C: inbound and outbound webhooks
+
+- Add provider-specific inbound endpoints only when a provider is selected.
+- Add signed internal webhook delivery for consumers that cannot use the queue directly.
+- Add delivery monitoring, replay tooling, and contract tests.
+
+### Phase D: regulated VestDen integration
+
+- Complete legal and provider review.
+- Implement server-verified financial state and reconciliation.
+- Test failure, duplication, replay, reordering, and rollback cases before enabling consequence-bearing workflows.
+
+## 10. Go-live gates
+
+- DNS zone exports and rollback values captured.
+- Exactly one redirect layer selected.
+- All canonical and connector hostnames have valid certificates.
+- Canonical redirects preserve deep paths and never loop.
+- Four product builds pass desktop and 390px checks.
+- Event catalogue validation passes.
+- Webhook endpoints reject bad signatures, expired timestamps, duplicates, invalid schemas, and oversized payloads.
+- Queue, retry, dead-letter, replay, and audit behaviour are tested.
+- No client-side code can produce authoritative cross-product scores or financial success states.
+- Live URLs, status codes, certificates, canonical tags, and product identity are verified after deployment.
+
+## 11. Immediate next work
+
+1. Complete a read-only cPanel/edge inventory.
+2. Use the four deterministic outputs generated by `npm run build:products`.
+3. Prepare redirect configuration without applying it.
+4. Review the event catalogue and approve the initial event names and consumers.
+5. Implement only the static-domain deployment first.
+6. Start the event runtime when the first authoritative product backend exists.

subapps/README.md

@@ -0,0 +1,19 @@
+# Fixars independent product sites
+
+This package produces four independently deployable static artifacts for
+SkillsCanvas, ConceptsNexus, CollaBoard, and VestDen.
+
+```bash
+npm install
+npm run architecture:validate
+npm run build:products
+```
+
+`dist-products/` contains the exact canonical-domain artifacts. The standalone
+`.co` domains are the only indexable product origins. The `*.fixars.ai`
+connectors are permanent redirects and must not be configured as duplicate app
+origins.
+
+The repository-root `.cpanel.yml` copies only these validated artifacts into
+their isolated document roots. It does not alter Fixars.ai, its waitlist, or
+FixarsGroup.com.

subapps/contracts/events/catalog.v1.json

@@ -0,0 +1,77 @@
+{
+  "catalog_version": "1.0.0",
+  "envelope_schema": "./event-envelope.schema.json",
+  "products": [
+    "fixars-hub",
+    "concepts-nexus",
+    "skills-canvas",
+    "colla-board",
+    "vest-den",
+    "vest-den-verification"
+  ],
+  "events": [
+    {
+      "type": "ai.fixars.concepts.concept.certified.v1",
+      "producer": "concepts-nexus",
+      "consumers": ["fixars-hub", "skills-canvas", "colla-board"],
+      "classification": "internal",
+      "description": "A concept completed the authoritative certification workflow."
+    },
+    {
+      "type": "ai.fixars.concepts.skills.required.v1",
+      "producer": "concepts-nexus",
+      "consumers": ["skills-canvas", "colla-board"],
+      "classification": "internal",
+      "description": "A certified concept published a versioned capability requirement."
+    },
+    {
+      "type": "ai.fixars.skills.skill.verified.v1",
+      "producer": "skills-canvas",
+      "consumers": ["fixars-hub", "colla-board"],
+      "classification": "restricted",
+      "description": "An authoritative assessment changed a verified skill record."
+    },
+    {
+      "type": "ai.fixars.skills.passport.updated.v1",
+      "producer": "skills-canvas",
+      "consumers": ["colla-board", "vest-den"],
+      "classification": "restricted",
+      "description": "A versioned passport projection is available for authorised consumers."
+    },
+    {
+      "type": "ai.fixars.collab.capsule.created.v1",
+      "producer": "colla-board",
+      "consumers": ["fixars-hub", "concepts-nexus"],
+      "classification": "internal",
+      "description": "A project capsule was created from approved source context."
+    },
+    {
+      "type": "ai.fixars.collab.artifact.approved.v1",
+      "producer": "colla-board",
+      "consumers": ["skills-canvas", "vest-den"],
+      "classification": "restricted",
+      "description": "A versioned project artifact was approved and recorded as evidence."
+    },
+    {
+      "type": "ai.fixars.collab.milestone.approved.v1",
+      "producer": "colla-board",
+      "consumers": ["fixars-hub", "vest-den-verification"],
+      "classification": "restricted",
+      "description": "A milestone entered verification; this event cannot release escrow."
+    },
+    {
+      "type": "ai.fixars.vest.diligence.updated.v1",
+      "producer": "vest-den",
+      "consumers": ["fixars-hub"],
+      "classification": "restricted",
+      "description": "A non-financial diligence projection changed."
+    },
+    {
+      "type": "ai.fixars.vest.escrow.release.requested.v1",
+      "producer": "vest-den",
+      "consumers": ["vest-den-verification"],
+      "classification": "highly-restricted",
+      "description": "A request entered the restricted verification workflow; no release has occurred."
+    }
+  ]
+}

subapps/contracts/events/event-envelope.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://fixars.ai/schemas/events/envelope.v1.json",
+  "title": "Fixars ecosystem event envelope v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "specversion",
+    "id",
+    "type",
+    "source",
+    "subject",
+    "time",
+    "datacontenttype",
+    "dataschema",
+    "correlationid",
+    "data"
+  ],
+  "properties": {
+    "specversion": { "const": "1.0" },
+    "id": { "type": "string", "minLength": 16, "maxLength": 128 },
+    "type": {
+      "type": "string",
+      "pattern": "^ai\\.fixars\\.[a-z0-9.]+\\.v[1-9][0-9]*$"
+    },
+    "source": { "type": "string", "format": "uri-reference" },
+    "subject": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "time": { "type": "string", "format": "date-time" },
+    "datacontenttype": { "const": "application/json" },
+    "dataschema": { "type": "string", "format": "uri" },
+    "correlationid": { "type": "string", "minLength": 8, "maxLength": 128 },
+    "traceparent": { "type": "string", "maxLength": 256 },
+    "tenantid": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "data": { "type": "object" }
+  }
+}