Platform Architecture & Multi-Tenant Stack

Cora is engineered as an enterprise-grade autonomous operating system for Indian creative studios and agencies. It operates on a hybrid decoupled architecture where a high-performance Next.js marketing and documentation layer is paired with a resilient, single-plugin WordPress/PHP 8.2 backend runtime.

1. System Overview

The Cora platform consists of four primary decoupled layers:

1. Next.js Static/SSG Front-End (`heycora.in`):

- Built on Next.js 16 (App Router) with Turbopack.

- Deployed on LiteSpeed Web Server as pre-rendered static HTML/CSS/JS.

- Sub-50ms Time-To-First-Byte (TTFB) globally with zero server compute overhead.

- Houses the public website, interactive comparison benchmarks, calculator tools, and Developer Documentation Hub (/docs).

1. WordPress Core Application Engine (`app.heycora.in` & `cora.local`):

- Single, consolidated core plugin (cora-workspace) containing all 20+ operational modules.

- Custom Single Page Application (SPA) shell rendered at /workspace/dashboard.

- Zero dependency on external bloated third-party plugins.

1. Autonomous AI & RAG Engine:

- Google Gemini 3.5 Flash and Claude 3.5 Sonnet integrations.

- Vector-less SQLite/MySQL keyword-dense semantic chunking database.

- Bidirectional Model Context Protocol (MCP) JSON-RPC 2.0 gateway.

1. PWA Mobile Shell & Push Layer (v3.2.46):

- Dynamic cora-manifest.json generated with agency white-label assets.

- Root-scoped Service Worker (cora-service-worker.js) with Network-First navigation and Cache-First static asset caching.

- VAPID ES256 self-signed Web Push protocol without external messaging servers.

┌─────────────────────────────────────────────────────────────┐
│                    EDGE LAYER (CLOUDFLARE)                  │
└──────────────┬──────────────────────────────┬───────────────┘
               │                              │
        [heycora.in/*]                 [app.heycora.in/*]
               ▼                              ▼
┌─────────────────────────────┐ ┌─────────────────────────────┐
│  Next.js 16 SSG Frontend    │ │  WordPress / LiteSpeed PHP  │
│  - Marketing Site           │ │  - Single 'cora-workspace'  │
│  - Interactive Benchmarks   │ │  - 20+ Modular Views (SPA)  │
│  - Developer Docs (/docs)   │ │  - REST API & VAPID Push    │
└─────────────────────────────┘ └──────────────┬──────────────┘
                                               │
                                       [Agency-Scoped SQL]
                                               ▼
                                ┌─────────────────────────────┐
                                │   MySQL Database (cora_*)   │
                                └─────────────────────────────┘

2. Hybrid Routing & Subdomains

Inbound requests are handled via strict virtual host separation:

3. Multi-Tenant Database Isolation

All business data is strictly isolated by agency_id (Tenant Workspace Identifier). Every query executed by the workspace engine explicitly enforces:

SELECT * FROM wp_cora_leads 
WHERE agency_id = %d AND status = 'active' 
ORDER BY created_at DESC;

Cross-tenant leakage is prevented at both the database abstraction layer and the REST authentication middleware.

4. LiteSpeed & PWA Caching

• Static Cache: CSS and JS bundles are stamped with dynamic version parameters (?v=CORA_WORKSPACE_VERSION) to guarantee immediate browser updates without stale cache collisions.
• Cache Invalidation: On deployment (python3 scripts/deploy_frontend.py), LiteSpeed cache tags are flushed instantly.
• Service Worker Lifecycle: On new version release, cora-service-worker.js automatically calls self.skipWaiting() and purges outdated cache buckets within 300ms.

5. Zero-Trust Security Model

• No Browser Defaults: The system uses monochromatic custom toast banners (window.coraShowToast) and sliding drawers instead of native popup overlays.
• Role Capability Checks: Every AJAX and REST handler verifies current_user_can() against a granular 30-point security matrix.
• SHA-256 Hashes: Document vault agreements and audit log records include cryptographically verifiable integrity checksums.

6. Marketing Reform & Discovery Layer

Cora bridges client-facing website generation and private agency management into a seamless experience:

• Homepage Positioning: *"Build websites. Run your business, with an AI co-founder."*
• Dual Conversion Engine: Primary "Sign in with Google" OAuth for rapid workspace creation, and secondary "Explore free templates" routing directly into the 16+ turnkey pre-seeded schemas at /use-cases.
• Tools & Templates Architecture: The marketing navigation elevates free business calculators (18% GST calculator, retainer margin tool, proposal generator) alongside production website and workspace templates with instant lead capture bridge into wp_cora_leads.

7. Sticky AI SDR Sales Assistant

Mounted via React Portal (createPortal) directly into the document root:

• True Viewport Docking: Floats centered at the bottom viewport edge with zero backdrop overlay, avoiding parent container clipping or scroll interference.
• Objection Handling Vectors: Addresses platform switching concerns (e.g. HoneyBook/Notion vs Cora, free white-glove site migrations, annual discount codes, and multi-plugin elimination).
• Dynamic Conversion Coupons: Automatically generates actionable coupon cards (MIGRATEFREE, CORA10) with direct checkout links pre-populating discount parameters into /pricing.

8. 4-Tier Template & Asset Ecosystem

The /templates directory provides 16+ production-grade frontend assets across 4 distinct formats:

1. Native Landing Pages (`native_page`): Pure Tailwind CSS and Next.js 15 pages featuring sub-50ms paint times and accessible components.
2. AI Section Prompts (`section_prompts`): Token-engineered prompts for Claude 3.5 Sonnet and Cursor Composer.
3. Elementor Template Kits (`elementor_kit`): Standardized Elementor JSON blueprints for instant page builder import.
4. Lovable & React Projects (`lovable_project`): Rapid full-stack scaffolding configurations for Lovable.dev and v0.dev.