app.web-founder-suite-monolith

Pactena Founder Intelligence web

Standalone Next.js web boundary for www.pactena.run and app.pactena.run.

The authenticated /meetings surface projects the shared OPA meeting workspace with adaptive profile rationale, confidence, and founder override visibility. Private guidance remains separate from shared artifacts, and AI output stays advisory: humans retain approval, publication, link, and dispatch authority. An opaque route-selected meetingRef loads live OPA state with the current Pactena session, and context refresh requires fresh origin and session evidence.

The same deployment uses host-based rewrites:

• pactena.run redirects to www.pactena.run
• www.pactena.run serves the marketing and verified-waitlist surface (the AuthOS WaitlistJoinForm from @lssm-tech/module.auth-os: consent is an explicit required checkbox, never implied; the Pactena adapter fixes the product scope, consent-text version and source)
• app.pactena.run serves the invite-only product workspace

A Railway recovery canary treats only the exact injected RAILWAY_PUBLIC_DOMAIN as a marketing host. It does not widen trust to the provider suffix, activate the product host, or change production canonicals.

The approved one-page homepage remains the canonical / experience. Additive EN/FR/ES acquisition routes cover feature, founder-persona, and decision-use intent under /features/*, /personas/*, and /solutions/*; each publishes a canonical URL, hreflang alternates, direct-answer content, JSON-LD, and an explicit privacy/evidence boundary. Canonical product topics include cockpit, portfolio, operating domains, weekly review, conversations and meetings, executive collaboration, talent, forms and intake, and purpose-bound sharing. The invited-founder persona and /trust boundary explain that one LSSM account still requires a Pactena entitlement, membership, and product-local session. sitemap.xml, robots.txt, and llms.txt are generated from the same typed registry.

The app host does not render the private workspace until the Pactena API confirms a Better Auth session. Reviewed LSSM OIDC uses the browser callback at /auth/callback/lssm; invited-email magic links remain available for existing local identities. The central provider must confirm an active app_pactena entitlement before it emits an authorization code.

The access threshold and session seal negotiate EN/FR/ES from the app request. Signing out in Pactena closes only the product-local session; it does not imply that the LSSM Passport session was closed. The seal links to the separate Passport account controls so both boundaries remain visible and independently operable.

The protected production replay is fail-closed. bun run test:production-oidc-canary skips unless PACTENA_LSSM_PRODUCTION_CANARY_AUTHORIZED=1, the exact E2E_PRODUCTION_BASE_URL=https://app.pactena.run, and secret-managed E2E_TEST_EMAIL / E2E_TEST_PASSWORD values are all present. It exercises central sign-in and optional consent, Pactena callback and local session, protected cockpit routes, product-local sign-out, denied post-sign-out session resolution, and independent Passport sign-out. Credentials are read only from process environment variables and are never written to evidence output.

Until the API database is configured, the UI presents an honest activation-pending state and does not emulate persistence or identity.

The Executive room consumes the live CompanyOS metrics projection through the Pactena API peer boundary. Missing, stale, degraded, and denied values remain explicit; the web app does not copy canonical metric state or access the founder-private vault.

Environment

NEXT_PUBLIC_PACTENA_API_URL=https://api.pactena.run
NEXT_PUBLIC_LSSM_IDENTITY_ORIGIN=https://id.lssm.co
NEXT_PUBLIC_PACTENA_LSSM_RP_ENABLED=0

Setting NEXT_PUBLIC_PACTENA_LSSM_RP_ENABLED=1 renders only the reviewed LSSM Passport handoff. The invited-email form is rendered only when the central RP is disabled for an explicit local rollback; the API must use the matching authority mode so a deployment never presents two sign-in authorities.

Better Auth 1.7 callback forwarding

The existing public LSSM callback alias forwards only its bounded authorization response to the fixed API owner's /auth/callback/ endpoint, replacing the removed /auth/oauth2/callback/ path. Existing issuer and parameter checks remain in force. API token exchange, provider registrations, cookies and account-identity migration still require live qualification before cutover.