Skip to main content

Web Platform overview

Verified 13 September 2026. This page describes the deployed EXEPERT web platform. It separates working production behavior from code that is present but still gated.

Status vocabulary​

LabelMeaning
LiveThe hostname and described behavior are available in production.
Live but gatedThe deployment responds, but a release flag deliberately blocks the candidate capability.
DisabledCode may exist, but production configuration prevents its use.
DeferredThe capability is outside the current production release.

Canonical domains and owners​

Public addressHosting ownerProduction responsibilityStatus
https://www.exepert.comVercel project exepert-landingPublic website, product pages, blog, RSS, sitemap, sign-in and CMS user interfacesLive
https://exepert.comVercel domain redirectPermanent redirect to the www websiteLive
https://app.exepert.comVercel project exepertAI Lab, Hono API, Better Auth authority, CMS service, Supabase principal-token bridge, and current documentationLive
https://app.exepert.com/docsBundled into the exepert Vercel artifactThis maintained Docusaurus documentationLive
https://learn.exepert.comCloudflare Pages project exepert-brain-learningPublic Human Brain Learning Lab with local progress, 3D anatomy, MRI comparisons, quizzes, and deterministic simulationLive
https://www.learn.exepert.comCloudflare Pages project exepert-brain-learning-wwwPath- and query-preserving 308 redirect to learn.exepert.comLive
https://auth.exepert.comCloudflare Pages/Functions in front of the Supabase Edge Function brain-identityPortable identity candidate; health, configuration, and OAuth discovery are available while sign-in/session cutover is blockedLive but gated

The website, AI Lab, and Learning Lab are separate deployable applications. A failure or rollback in one does not require moving either of the other two.

System context​

Application responsibilities​

Public website and blog​

apps/landing owns www.exepert.com. It renders the marketing website and the public blog with Next.js. Public articles are read from publish-safe Supabase tables. The sign-in and editorial interfaces stay on this hostname, while /api/auth/* and /api/cms/* are proxied to the API at app.exepert.com.

The apex hostname has one job: redirect to www.exepert.com. Do not attach an application with separate content or identity behavior to the apex.

AI Lab, API, and documentation​

The repository root owns app.exepert.com. Its browser application combines a Vite/TypeScript shell, Three.js rendering, and Rust/WASM simulation. Its Vercel Node function mounts the Hono API. That API is the active Better Auth authority, issues short-lived Supabase principal tokens, and runs the private editorial CMS service.

The Docusaurus application under docs-site builds separately and is copied into the root production artifact. Its canonical origin is https://app.exepert.com, and its current documentation routes begin with /docs.

Human Brain Learning Lab​

apps/brain-learning owns learn.exepert.com. It pre-renders the lesson shell and loads Three.js geometry only when a learner opens the interactive viewer. Six chapters each provide beginner, neuroscience, and AI/ML material. Guest progress remains partitioned in device storage. WebGL failure leaves a readable lesson and comparison fallback.

For repository layout, local commands, Vite behavior, and Cloudflare Pages emulation, see Human Brain Learning Lab development.

The public Open Brain Kit is downloaded from Hugging Face rather than stored in Supabase or Vercel. It contains approved educational geometry, labels, lessons, example outputs, and authored simulation parameters. It does not contain trained biological weights, a human-brain checkpoint, clinical diagnostic software, credentials, or private repository source.

Portable identity candidate​

apps/auth-gateway and services/identity-runtime form the candidate identity path. Cloudflare admits only an allowlisted identity surface, adds a private gateway header, and forwards to the brain-identity Supabase Edge Function. The Edge Function rejects direct requests that lack that header.

Production keeps IDENTITY_CUTOVER_ENABLED=false. Public configuration, health, and OAuth discovery work; sign-in, sessions, token issuance, and identity mutation remain on app.exepert.com. The candidate must not become authoritative until the session-overlap and client regression gates pass.

How the applications are stitched together​

The website links users to the AI Lab and the Brain Learning Lab. The docs navbar links back to all three public products. Each application owns its own canonical URL, assets, deployment, and rollback.

Identity and data flow​

  1. A browser or native client authenticates against Better Auth at app.exepert.com/api/auth.
  2. Better Auth stores users, accounts, sessions, verification records, OAuth state, and rate-limit state in the shared PostgreSQL database.
  3. POST /api/supabase/token maps the authenticated Better Auth user to a stable EXEPERT principal and returns a five-minute ES256 token.
  4. Supabase RLS uses that principal as auth.uid() for owner-scoped data.
  5. auth.exepert.com mirrors this composition for a future cutover, but its mutating and session routes currently fail closed.

CMS publication flow​

  1. Editors use /admin on www.exepert.com.
  2. The landing application forwards authenticated CMS requests to app.exepert.com/api/cms/* with the shared HttpOnly session cookie.
  3. The Node CMS verifies membership, writes private drafts and revisions, and processes media with server-only storage credentials.
  4. Publishing creates immutable public article and asset projections in Supabase.
  5. A signed internal request revalidates affected Next.js blog paths.
  6. Public readers query only the public projection; private draft tables remain unavailable to browser roles.

Learning flow​

The current release reads lesson and asset manifests from the static Pages bundle, runs the regional simulator in a browser worker, and stores progress on the device. The implemented /api/progress and /api/tutor routes remain closed until their independent identity and tutor flags pass. If optional inference is later unavailable or exhausted, the tutor contract returns authored lesson guidance; it never sends the request to a paid fallback.

Deployment flow​

Pull requests run repository checks before normal merge to main. Vercel builds the root AI Lab and bundled docs as project exepert; the isolated landing project deploys only when apps/landing changes. Brain Learning and the identity candidate use manual GitHub Actions workflows that require an exact reviewed commit and explicit environment gates before Cloudflare or Supabase deployment.

Current feature status​

CapabilityStatusOperational meaning
Website, blog, RSS, sitemapLiveServed by exepert-landing.
AI Lab and APILiveServed by exepert; optional hosted integrations can degrade independently.
Better Auth on app.exepert.comLiveCurrent session and OAuth authority.
Editorial CMSLiveMember-only API with public read projections.
Brain Learning static experienceLiveLessons, comparison viewer, quizzes, simulation, local progress, and downloads work.
Brain Learning cloud progressDisabled/api/progress requires account identity; production learning configuration does not enable it.
Brain Learning AI tutorDisabledNo Workers AI request is made; authored learning content remains available.
auth.exepert.com health and discoveryLiveSafe probes are routed through Cloudflare to the portable Edge runtime.
Identity cutover to auth.exepert.comLive but gatedNon-probe traffic receives the cutover-disabled response.
Trained “human brain weights”DeferredThe public kit is an educational asset and simulation release, not a trained biological model.

Engineering entry points​