Runtime and API reference

Verified 13 September 2026 from executable route registration, manifests, lockfiles, deployment workflows, and production probes. Secret values are never part of this reference. This documentation release changes no API schema or TypeScript interface.

Runtime map

Surface	Source root	Package/runtime contract	Main locked versions	Deployment
AI Lab browser	repository root	pnpm 9.15.4; Node 20+ for tooling; Vite static build; Rust compiled to WASM	Vite 6.4.2, TypeScript 5.9.3, Three.js 0.170.0, React 18.2.0, Phaser 3.90.0, brain_sim 0.1.0	Vercel exepert at app.exepert.com
API, identity, and CMS	api/	Hono on Vercel Node; region hnd1; 60-second configured function ceiling	Hono 4.13.5, Better Auth 1.7.2, OAuth Provider 1.7.2, pg 8.23.0, Jose 6.2.11, Resend 6.26.0, Sharp 0.35.4	Same Vercel exepert artifact
Documentation	docs-site/	Separate pnpm lockfile; Node 20+; static Docusaurus build copied into root dist	Docusaurus 3.10.1, Mermaid theme 3.10.1, React 18.3.1, local search 0.45.0	https://app.exepert.com/docs
Website and blog	apps/landing/	Bun 1.3.14; Vercel Node 24.x; isolated Bun lockfile and root directory	Next.js 15.5.24, React 19.2.8, TypeScript 5.9.3, Tailwind CSS 4.2.4, TipTap 3.31.3, Motion 12.38.0, Three.js 0.170.0	Vercel exepert-landing at www.exepert.com
Brain Learning Lab	apps/brain-learning/	Bun 1.3.14; Vite static app; Cloudflare Pages Functions; browser Web Worker; compatibility date 2026-09-10	React 18.2.0, Vite 6.4.1, TypeScript 5.9.3, Three.js 0.170.0, Playwright 1.60.0	Cloudflare exepert-brain-learning at learn.exepert.com
Learning www redirect	apps/brain-learning/www-redirect/	Cloudflare Worker-compatible JavaScript; same reviewed release workflow	No application dependency graph	Cloudflare exepert-brain-learning-www
Identity gateway	apps/auth-gateway/	Bun 1.3.14 checks; Cloudflare Pages Functions; compatibility date 2026-09-12	TypeScript 5.9.3; Wrangler 4.130.0 in deployment workflows	Cloudflare exepert-auth-gateway at auth.exepert.com
Portable identity runtime	services/identity-runtime/ and supabase/functions/brain-identity/	Shared identity modules bundled to pinned npm imports; Supabase Deno 2; one database connection	Same Better Auth/Hono/pg identity composition as the Vercel API	Supabase Edge Function behind the gateway
Shared data plane	supabase/	PostgreSQL 17, Data API, Storage, RLS, Realtime, Deno 2 Edge Functions	Supabase JS 2.106.2; repository CLI 2.102.0; identity workflows pin CLI 2.104.0	Supabase managed project

The root browser remains useful without Supabase or Typesense. The Learning Lab remains useful without sign-in, WebGL, or inference. Optional service failure must not block those public shells.

Repository modules

Module	Responsibility
api/index.ts	Vercel Web Request entry point; normalizes rewrites and exports the supported HTTP methods.
api/_lib/identity-app-factory.ts	Registers explicit identity, discovery, principal-token, and merge routes, then delegates /api/auth/* to Better Auth.
api/_lib/auth-factory.ts	Composes email/password, Google, anonymous identities, CAPTCHA, JWT/JWKS, and OAuth Provider behavior.
api/_lib/cms-routes.ts and cms-service.ts	Registers and implements member-only editorial workflows, revisions, media, publication, and scheduled jobs.
apps/landing/app	Next.js website, public blog projection, admin UI, auth/CMS proxy use, RSS, sitemap, and revalidation endpoint.
apps/brain-learning/src	Six lessons, three depth tracks, anatomy/MRI viewers, local progress, deterministic simulation, and release metadata.
apps/brain-learning/functions	Learning session, logout, progress, and tutor Pages API.
apps/auth-gateway/src/handler.ts	Method/path allowlist, 64 KiB body bound, request/response header filtering, gateway authentication, and 12-second upstream timeout.
services/identity-runtime/edge-entry.ts	Instantiates the portable identity composition, validates the gateway secret, and enforces the cutover gate.
supabase/migrations	Cumulative schema, grants, RLS, stable principals, CMS, learning progress, tutor quotas, and OAuth resource registration.

app.exepert.com identity API

All explicit identity responses disable caching. Non-GET cookie mutations must come from a trusted EXEPERT origin; bearer-authenticated native/API requests are validated by their own token path.

Method and route	Authentication	Handler and data	Success and failure behavior	Availability
GET /api/auth/config	Public	identity-app-factory; runtime mode, public Turnstile site key, desktop client ID, issuer, and resource	200 JSON; server configuration failure becomes 500	Live
GET /api/auth/health	Public	Identity app plus PostgreSQL select 1	200 {ok:true}; database/configuration failure becomes 500	Live
GET /api/.well-known/oauth-authorization-server/api/auth	Public	Generated authorization-server metadata	200 JSON with permissive read CORS	Live
GET /api/.well-known/oauth-protected-resource	Public	Better Auth OAuth resource metadata	200 JSON with permissive read CORS; provider failure becomes 500	Live
POST /api/supabase/token	Better Auth session or valid bearer; trusted origin for cookie requests	Stable principal lookup plus ES256 bridge signer	200 five-minute token and normalized user; unauthenticated 401; policy/origin failure 403	Live
POST /api/identity/merge-intent	Authenticated principal; trusted origin for cookie requests	Private merge-ticket state	201 intent; invalid identity/origin denied	Live
POST /api/identity/merge	Authenticated member; trusted origin for cookie requests	Consumes bounded JSON merge ticket and merges principal ownership	200 {principalId}; invalid body 400; policy/conflict status is preserved	Live
POST /api/identity/claim-legacy	Authenticated Better Auth identity; trusted origin for cookie requests	Validates a legacy Supabase access token and adopts its principal	200 {principalId}; invalid body 400; unauthorized/conflicting claims are denied	Live
`GET	POST /api/auth/*`	Endpoint-specific	Better Auth handler with versioned-session overlap	Better Auth status/body; prior valid session secrets are re-signed with the current secret when appropriate

Vercel also exposes the two standards paths /.well-known/oauth-authorization-server/api/auth and /.well-known/oauth-protected-resource/api; vercel.json rewrites them to the explicit handlers above.

Better Auth-generated capability groups

Better Auth 1.7.2 owns the catch-all routes rather than local Hono registration. Treat the installed version and factory as the route authority.

Capability	Route family and behavior
Session	Session inspection, sign-out, session revocation, and account/session management under /api/auth/*; HttpOnly secure cookies in production; 30-day session lifetime and daily update age.
Email and password	Email sign-up/sign-in, email verification, password-reset request and completion; verification is required and password reset revokes sessions.
Anonymous identity	Sparse anonymous sign-in for metered features; anonymous deletion is disabled and creation is rate-limited.
Google	Social sign-in initiation and callback on the configured Better Auth base URL; account linking trusts only Google.
CAPTCHA and rate limits	Cloudflare Turnstile on email sign-up, email sign-in, and password-reset request; database-backed global/custom limits.
JWT and JWKS	ES256 JWT/JWKS endpoints with five-minute token expiry and 30-day key rotation/grace behavior.
OAuth Provider	Authorization, token, refresh, introspection, revocation, user-info, consent, end-session, and JWKS capabilities for the registered public desktop client. Dynamic client registration is disabled.

app.exepert.com CMS API

The landing /admin UI calls these routes through its same-origin proxy. Except for the scheduled job, non-GET requests require a trusted origin. CMS membership and role checks are server-side. Request JSON is capped at 1 MiB. Private draft, revision, asset, and job tables are inaccessible to anon and authenticated Data API roles.

Method and route	Authentication	Primary store/action	Response or notable failure	Availability
GET /api/cms/me	Better Auth member	Principal and app_private.cms_member	Member profile; 401/403 when absent or unauthorized	Live
GET /api/cms/featured	CMS member	Featured slot plus private post summary	Ordered configuration; CMS-disabled/unavailable 503	Live
PUT /api/cms/featured	Authorized editor	Replaces validated featured ordering	Updated ordering; validation 400/422, conflict/policy status preserved	Live
GET /api/cms/posts	CMS member	Filtered/cursor list from private posts	Paginated JSON; unauthorized 401/403	Live
POST /api/cms/posts	Authorized author/editor	Creates private draft and initial state	201 post; invalid body or policy denied	Live
GET /api/cms/posts/:id	CMS member	Private post detail and editorial metadata	Post JSON; missing 404	Live
PATCH /api/cms/posts/:id	Authorized owner/editor	Version-checked draft update and revision	Updated post; stale version 409; invalid input 400/422	Live
POST /api/cms/posts/:id/publish	Authorized editor	Publishes immutable public article/asset projection and requests revalidation	Published post; conflict/policy/revalidation details surfaced	Live
POST /api/cms/posts/:id/schedule	Authorized editor	Schedules private publication job	Scheduled post/job; invalid schedule denied	Live
POST /api/cms/posts/:id/unpublish	Authorized editor	Removes public projection while retaining private editorial record	Updated post; missing/conflict/policy errors preserved	Live
POST /api/cms/posts/:id/archive	Authorized editor	Archives editorial post and removes public projection	Updated post; missing/conflict/policy errors preserved	Live
GET /api/cms/posts/:id/revisions	CMS member	Private revision history	Revision list; missing/unauthorized denied	Live
POST /api/cms/posts/:id/revisions/:revisionId/restore	Authorized owner/editor	Restores revision through versioned update	Restored post; stale version 409; missing 404	Live
POST /api/cms/posts/:id/assets	Authorized owner/editor	Creates validated media upload intent	Signed upload data/asset record; size/type/policy denied	Live
POST /api/cms/assets/:id/complete	Authorized owner/editor	Verifies upload, processes image with Sharp, writes immutable public object	Completed asset; invalid/missing upload denied	Live
GET /api/cms/assets/:id/content	CMS member	Reads private editorial asset through server authorization	Media response; missing/unauthorized denied	Live
DELETE /api/cms/assets/:id	Authorized owner/editor	Deletes an unused private asset and storage objects	Completion JSON; in-use/conflict/policy denied	Live
POST /api/cms/jobs/publish-due	Bearer CMS_CRON_SECRET	Claims due jobs, publishes projections, and revalidates landing paths	Job summary; invalid bearer 401/403; service failure 503	Live

Unknown API routes return 404. Known Hono/Better Auth/CMS statuses are preserved. Unexpected CMS failures use 503 cms_unavailable; other unexpected identity failures use a generic 500 without secret-bearing detail.

www.exepert.com routes and proxies

Method and route	Authentication	Handler/data	Behavior	Availability
`GET	POST /api/auth/:path*`	Endpoint-specific	Next.js rewrite to app.exepert.com/api/auth/:path*	Preserves the public website origin while Better Auth remains centralized
Supported CMS methods on /api/cms/:path*	CMS member or job credential	Next.js rewrite to app.exepert.com/api/cms/:path*	CMS response is returned through the website origin	Live
POST /api/internal/blog-revalidate	Bearer BLOG_REVALIDATION_SECRET	Next.js revalidation handler	Revalidates allowlisted article/index/feed paths; invalid bearer denied	Live
GET /rss.xml	Public	Next.js route using public article projections	RSS XML; safe empty/failure handling in the public data layer	Live
GET /sitemap.xml	Public	Next.js metadata route	Canonical website and published-article URLs	Live
GET /robots.txt	Public	Next.js metadata route	Crawler directives and sitemap location	Live

The public blog reads public.blog_article, public.blog_article_asset, public.blog_slug_redirect, and public.blog_featured_slot through the publishable Supabase key. It never receives the service-role key or private CMS tables.

Supabase Edge Function API

These fixed endpoints use https://<project>.supabase.co/functions/v1/<function-name>. A read-only publication-day probe reached every deployed handler: public health returned 200, protected handlers returned their expected 401 or 405, and direct brain-identity traffic returned its deliberate 404. Those probes verify the deployed boundary, not a successful authenticated model invocation or data mutation.

Method and function route	Authentication	Handler and data	Response or notable failure	Availability
`GET	POST /chat-models`	Valid EXEPERT principal token	Reads the 9Router model catalogue; POST can request a refresh	Model and combo catalogue; missing/invalid token 401; provider/configuration failure 500/503
`GET	POST /chat-saved-prompts`	Non-anonymous principal	Owner-scoped chat_saved_prompts; POST actions are list, lookup, create, update, and delete	List or record JSON; invalid body/action 400; missing record 404; idempotent delete
GET /run-chat?models=1	Valid EXEPERT principal token	Alternate model-catalogue path retained by the chat gateway	Catalogue JSON; other GET requests 404; invalid token denied	Live endpoint
POST /run-chat	Valid EXEPERT principal token and owned project	Bounded text/image request, 9Router model call, quota RPC, and trace/span persistence	Structured research JSON or SSE token stream; validation 400/413; ownership 403; quota 429; provider failure 502/503	Live endpoint; provider availability is independent
POST /run-playground	Valid EXEPERT principal token	Renders a prompt template and streams an OpenAI- or Anthropic-compatible provider response	SSE output; invalid request 400; quota 429; provider/configuration errors are streamed	Live endpoint; configured provider required
GET /run-world-agent	Public	World gateway readiness and protocol versions	200 when configured; safe 503 when the gateway is unavailable	Live; readiness probe passed
POST /run-world-agent	Non-anonymous principal plus quota	Validates bounded world observations, selected text/vision capability, and returns a deterministic action contract around the model response	JSON or SSE decision; sign-in 401; invalid observation 400/413; unavailable model 404; capability 422; quota 429; upstream 502/504	Live endpoint; configured provider required
POST /chat-affect	Valid principal and owned project	Writes owner-checked affective_state span annotations; optional 9Router refinement degrades to local analysis	Analysis JSON; invalid input 400/413; ownership 403; quota 429; write/configuration 500	Live endpoint
POST /chat-feedback	Valid principal and owned project	Upserts owner-checked positive/negative human span annotation	200 annotation ID; invalid input 400; ownership 403; missing span 404; quota 429	Live endpoint
POST /ingest-arcade-trajectory	Valid principal and owned project	Validates a body up to 512 KiB and calls the owner-bound trajectory ingest RPC	Acknowledged episode/chunks; invalid 400/413; ownership 403; conflict 409	Live endpoint
POST /delete-arcade-trajectories	Valid principal	Calls the internal delete RPC for that principal only	Deleted episode/chunk counts; invalid token 401; server failure 500	Live endpoint
POST /otlp-receiver	Constant-time checked X-EXEPERT-INGEST-KEY	Upserts OTLP traces/spans; optional Typesense indexing is best-effort	Ingest counts; unauthorized 401; rate 429; invalid/large payload 400/413; write failure 500	Live endpoint
POST /run-eval	Constant-time checked X-EXEPERT-INGEST-KEY	Runs configured or heuristic span evaluation and upserts annotations	Evaluation count; invalid target 400; missing spans 404; write/provider failure 500	Live endpoint
/brain-identity/*	Cloudflare-held gateway secret	Portable Better Auth candidate and PostgreSQL identity data	Requests without the exact gateway header return 404; public access is only through auth.exepert.com	Live behind gateway; cutover gated

All function handlers answer CORS preflight with OPTIONS; it is omitted from the table for readability. The browser must never receive service keys, router keys, ingest keys, or provider credentials.

learn.exepert.com API

The Pages Function accepts only the five routes below and rejects non-EXEPERT mutation origins. In current production, identity and tutor flags are false.

Method and route	Authentication	Handler/data	Response or failure	Availability
GET /api/session	Public	Feature-state response; identity bridge only when enabled	Current production returns 200 with enabled:false	Live; identity disabled
POST /api/logout	Session when identity is enabled	Proxies Better Auth sign-out to auth.exepert.com	Current production fails closed as identity-disabled; no cross-account local data transfer	Disabled
GET /api/progress	Non-anonymous member	Identity principal token, then owner-scoped Supabase select	200 progress list; current unauthenticated request 401; backend error 503	Disabled for account sync
PUT /api/progress	Non-anonymous member	save_brain_progress RPC with expected version	Saved record; optimistic conflict 409; invalid body 400; backend error 503	Disabled for account sync
POST /api/tutor	Non-anonymous member plus valid lesson/question; Turnstile only for AI mode	Deterministic corpus filter, private quota RPC, optional Workers AI	Once identity is enabled, returns an authored answer when AI prerequisites, quota, citations, or provider fail; invalid input 400	Disabled; authored lesson explanations remain in the static UI

The account bridge, progress table, and quota code exist, but their production availability is controlled independently. Do not describe a successful static learning session as proof of cloud synchronization or AI inference.

auth.exepert.com gateway contract

The gateway accepts GET/OPTIONS for configuration, health, and discovery; GET/POST/OPTIONS for /api/auth/*; and POST/OPTIONS for the principal token and /api/identity/* routes. It strips unapproved request headers and hop-by-hop response headers, preserves cookies, rejects bodies over 64 KiB, times out slow body reads after 5 seconds, and times out the upstream after 12 seconds.

When IDENTITY_CUTOVER_ENABLED=false, only these probes pass:

• GET /api/auth/config
• GET /api/auth/health
• GET /api/.well-known/oauth-authorization-server/api/auth
• GET /api/.well-known/oauth-protected-resource
• the two equivalent root /.well-known/* discovery paths

Every other allowlisted route returns 503 identity_cutover_disabled. Unknown paths or methods return 404. The Supabase Edge runtime independently requires X-EXEPERT-Identity-Gateway; direct public traffic without the matching secret returns 404.

Versioned public interfaces

Brain Learning and its download package share the following version-one types:

• BrainAssetManifest identifies source, species, representation, units, revision, license, limitations, and per-file hashes.
• LearningLesson binds one lesson version to approved sources, assets, three audience tracks, an activity, and authored quiz feedback.
• LearningProgress binds one principal, lesson, and track to answers, completion, optimistic version, and update time. The pending marker is device-only.
• SimulationConfig fixes the illustrative-regional-v2 model, seed, bounded coupling/damping/stimulus, 200 steps, and dt=0.05.

The simulator uses authored four-region connections and fixed-point arithmetic. Those connections are explicitly illustrative and are not measured human connectivity.

Data ownership and RLS boundaries

Data	Owner and access boundary
Better Auth identities and sessions	Private authn schema, accessed by the identity backend database role. Browser clients never query it directly.
Stable principals and merge tickets	app_private; identity services only. Principal IDs remain stable across supported merges.
CMS drafts, revisions, membership, assets, and jobs	app_private; Node CMS only. Data API roles have no table access.
Published blog	Public projection tables with read-only anon/authenticated grants and RLS; written by the backend role.
AI Lab user records	Owner-scoped public tables and explicit RLS/RPC boundaries; auth.uid() is the stable principal.
Brain progress	public.brain_learning_progress; non-anonymous owner can read; writes only through save_brain_progress optimistic RPC. Production app sync is disabled.
Tutor counters and gateway digest	app_private; no browser table access. Reservation requires the member principal and Cloudflare-held gateway secret. Tutor is disabled.
Learning release metadata	Public read-only release records; large archives remain on Hugging Face.
Device learning drafts	Browser local storage partitioned by principal or guest; pending progress from one account is never uploaded as another.

Configuration names

Values belong in provider secret/environment stores or local ignored files. Documentation and client bundles may contain names and public keys, never secret values.

Scope	Names
Root browser, public	VITE_SUPABASE_URL, VITE_SUPABASE_PUBLISHABLE_KEY or legacy VITE_SUPABASE_ANON_KEY, VITE_AUTH_RUNTIME_MODE, optional VITE_DOCS_URL, and optional search-only VITE_TYPESENSE_* values
Active identity server	BETTER_AUTH_URL, BETTER_AUTH_DATABASE_URL (or runtime SUPABASE_DB_URL), AUTH_RUNTIME_MODE, BETTER_AUTH_SECRET, BETTER_AUTH_SECRETS, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_CLIENT_SECRET_NEXT, GOOGLE_CLIENT_SECRET_VERSION
Principal-token bridge	SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY or SUPABASE_ANON_KEY, SUPABASE_JWT_PRIVATE_JWK, SUPABASE_JWT_KID, SUPABASE_JWT_PRIVATE_JWK_NEXT, SUPABASE_JWT_KID_NEXT, SUPABASE_JWT_SIGNER; the Edge runtime uses the corresponding EXEPERT_SUPABASE_JWT_* aliases
Identity policy/email	RESEND_API_KEY, RESEND_FROM, TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY, TURNSTILE_ALLOWED_HOSTNAMES, EXEPERT_DESKTOP_CLIENT_ID, EXEPERT_AUTH_RESOURCE, EXEPERT_SHARED_COOKIE_ENABLED
CMS	CMS_ENABLED, CMS_CRON_SECRET, SUPABASE_SERVICE_ROLE_KEY, BLOG_REVALIDATION_URL, BLOG_REVALIDATION_SECRET
Landing	EXEPERT_API_ORIGIN, NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY, BLOG_REVALIDATION_SECRET; NEXT_DIST_DIR and BLOG_TEST_PUBLIC_PORT are test/build controls
Learning Pages	IDENTITY_ENABLED, IDENTITY_ORIGIN, SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, TUTOR_ENABLED, TURNSTILE_SITE_KEY, TURNSTILE_SECRET, TUTOR_GATEWAY_SECRET, and optional AI binding
Identity gateway/Edge	IDENTITY_FUNCTION_ORIGIN, EXEPERT_IDENTITY_GATEWAY_SECRET, IDENTITY_CUTOVER_ENABLED; Edge diagnostics also recognize IDENTITY_DEBUG_ERRORS and must keep it false in production
AI Lab Edge Functions	SUPABASE_URL, SUPABASE_PUBLISHABLE_KEYS or legacy SUPABASE_ANON_KEY, SUPABASE_SECRET_KEYS or legacy SUPABASE_SERVICE_ROLE_KEY, ROUTER_BASE_URL, ROUTER_API_KEY, ROUTER_DEFAULT_MODEL, optional ROUTER_COMBO_MEMBERS, ROUTER_VISION_MODELS, ROUTER_AFFECT_MODEL, EXEPERT_INGEST_KEY, optional TYPESENSE_URL/TYPESENSE_ADMIN_KEY, and evaluator-only OPENAI_API_KEY/ANTHROPIC_API_KEY fallbacks
Release workflows	BRAIN_LEARNING_RELEASE_GATES, BRAIN_IDENTITY_CANDIDATE_GATES, BRAIN_IDENTITY_PRODUCTION_GATES, BRAIN_CLOUDFLARE_PAGES_TOKEN, AUTH_CLOUDFLARE_PAGES_TOKEN, BRAIN_SUPABASE_ACCESS_TOKEN

BETTER_AUTH_SECRETS uses versioned version:secret entries. The legacy BETTER_AUTH_SECRET remains during the defined session overlap. Credential selectors must retain both current and standby material until rollback is no longer required.

Build, test, and deployment commands

Target	Reproducible commands	Deployment behavior
Root AI Lab	pnpm.cmd install --frozen-lockfile; pnpm.cmd typecheck; pnpm.cmd test; pnpm.cmd build	scripts/vercel-build.sh builds WASM/Vite and docs, then merges docs into dist.
Docs only	pnpm.cmd --dir docs-site typecheck; pnpm.cmd --dir docs-site exec docusaurus build	Direct Docusaurus command avoids rewriting the activity calendar.
Landing	bun install --frozen-lockfile; bun run test; bun run topology:check; bun run lint; bun run typecheck; bun run build from apps/landing	Vercel project root is apps/landing; unchanged app files use its ignored-build check to skip deployment.
Brain Learning	Local development; bun install --frozen-lockfile; bun test; bun run build; bun run package:kit	brain-learning-deploy.yml requires main, a passed static release gate, and the exact reviewed commit; deploys both Pages projects.
Identity candidate	Root pnpm identity:bundle and pnpm auth-gateway:build; gateway bun run check and bun test	Candidate and promotion workflows require separate gates and exact reviewed commits before Supabase/Cloudflare deployment.

The root CI runs DCO, TypeScript, Vitest, Vite/WASM, landing browser checks, and research/docs checks according to changed scope. Pull-request commits require a Signed-off-by trailer.

Rollback paths

• AI Lab/API/docs: promote the preceding known-good exepert Vercel deployment. Keep both session secrets and signing keys during credential overlap.
• Website/blog: promote the preceding exepert-landing deployment. Public projections remain immutable until a later authorized editorial action.
• Brain Learning: restore the preceding verified Cloudflare Pages deployment or use the stable pages.dev endpoint while diagnosing the custom hostname. Keep identity and tutor flags false.
• Identity candidate: set the cutover flag false, retain the active Vercel authority, and leave the gateway probes available. Direct Edge traffic stays blocked.
• Database: migrations are additive. Disable dependent application flags on failure; do not destroy progress, CMS, or identity records as an application rollback.

Open Brain Kit boundary

The public dataset is AkmalAlif69/exepert-open-brain-kit, and the demonstration is AkmalAlif69/exepert-brain-learning. Release 0.1.2 is pinned by revision and SHA-256 in apps/brain-learning/src/release.ts.

Each third-party source retains its own license and attribution. Restricted BraTS files, HCP participant files, generated-model checkpoints, private EXEPERT code, and credentials are excluded. “Weights” in product discussion must not be used to describe this release: it is a learning asset and deterministic simulation package, not a trained biological or clinical model.