Platform Architecture & Multi-Tenant Stack

Cora is engineered as an enterprise-grade autonomous operating system for Indian creative studios and agencies. It operates on a hybrid decoupled architecture where a high-performance Next.js marketing and documentation layer is paired with a resilient, single-plugin WordPress/PHP 8.2 backend runtime.

1. System Overview

The Cora platform consists of four primary decoupled layers:

1. Next.js Static/SSG Front-End (`heycora.in`):

- Built on Next.js 16 (App Router) with Turbopack.

- Deployed on LiteSpeed Web Server as pre-rendered static HTML/CSS/JS.

- Sub-50ms Time-To-First-Byte (TTFB) globally with zero server compute overhead.

- Houses the public website, interactive comparison benchmarks, calculator tools, and Developer Documentation Hub (/docs).

1. WordPress Core Application Engine (`app.heycora.in` & `cora.local`):

- Single, consolidated core plugin (cora-workspace) containing all 20+ operational modules.

- Custom Single Page Application (SPA) shell rendered at /workspace/dashboard.

- Zero dependency on external bloated third-party plugins.

1. Autonomous AI & RAG Engine:

- Google Gemini 3.5 Flash and Claude 3.5 Sonnet integrations.

- Vector-less SQLite/MySQL keyword-dense semantic chunking database.

- Bidirectional Model Context Protocol (MCP) JSON-RPC 2.0 gateway.

1. PWA Mobile Shell & Push Layer (v3.2.46):

- Dynamic cora-manifest.json generated with agency white-label assets.

- Root-scoped Service Worker (cora-service-worker.js) with Network-First navigation and Cache-First static asset caching.

- VAPID ES256 self-signed Web Push protocol without external messaging servers.

┌─────────────────────────────────────────────────────────────┐
│                    EDGE LAYER (CLOUDFLARE)                  │
└──────────────┬──────────────────────────────┬───────────────┘
               │                              │
        [heycora.in/*]                 [app.heycora.in/*]
               ▼                              ▼
┌─────────────────────────────┐ ┌─────────────────────────────┐
│  Next.js 16 SSG Frontend    │ │  WordPress / LiteSpeed PHP  │
│  - Marketing Site           │ │  - Single 'cora-workspace'  │
│  - Interactive Benchmarks   │ │  - 20+ Modular Views (SPA)  │
│  - Developer Docs (/docs)   │ │  - REST API & VAPID Push    │
└─────────────────────────────┘ └──────────────┬──────────────┘
                                               │
                                       [Agency-Scoped SQL]
                                               ▼
                                ┌─────────────────────────────┐
                                │   MySQL Database (cora_*)   │
                                └─────────────────────────────┘

2. Hybrid Routing & Subdomains

Inbound requests are handled via strict virtual host separation:

3. Multi-Tenant Database Isolation

All business data is strictly isolated by agency_id (Tenant Workspace Identifier). Every query executed by the workspace engine explicitly enforces:

SELECT * FROM wp_cora_leads 
WHERE agency_id = %d AND status = 'active' 
ORDER BY created_at DESC;

Cross-tenant leakage is prevented at both the database abstraction layer and the REST authentication middleware.

4. LiteSpeed & PWA Caching

• Static Cache: CSS and JS bundles are stamped with dynamic version parameters (?v=CORA_WORKSPACE_VERSION) to guarantee immediate browser updates without stale cache collisions.
• Cache Invalidation: On deployment (python3 scripts/deploy_frontend.py), LiteSpeed cache tags are flushed instantly.
• Service Worker Lifecycle: On new version release, cora-service-worker.js automatically calls self.skipWaiting() and purges outdated cache buckets within 300ms.

5. Zero-Trust Security Model

• No Browser Defaults: The system uses monochromatic custom toast banners (window.coraShowToast) and sliding drawers instead of native popup overlays.
• Role Capability Checks: Every AJAX and REST handler verifies current_user_can() against a granular 30-point security matrix.
• SHA-256 Hashes: Document vault agreements and audit log records include cryptographically verifiable integrity checksums.