Universe Admin

Control Tower

Operational readiness

WaitingSign in to resolve operational readiness.

IssuesNo readiness issues loaded yet.

This control tower rolls package, domain, email, service, automation, identity, and usage health into one operator view.

Usage And Audit

Recent pressure and operator activity

UsageNo usage data loaded yet.

AuditNo recent audit activity loaded yet.

Resilience

Auth throttles and recovery freshness

WaitingSign in to inspect resilience coverage.

Rate limitsNo recent throttle events loaded yet.

Recovery Drills

Operator runbook evidence

RecoveryNo recovery drills loaded yet.

Target System Drill Type

Status Next Review

Started At Completed At

Notes Metadata JSON

Record drills here so recovery freshness stops living only in operator memory.

Module Lineage

What the extraction already knows

Plan Packaging

Commercial baseline

Package Offers

Sellable bundles and add-ons

Usage Meters

AI and automation pricing units

Workspace Package

Current entitlement driver

WaitingSign in to inspect the active workspace package.

AccessModule gating state appears after package data loads.

Applying a package syncs the current workspace package subscription and grants plan-backed entitlements on the neutral Universe layer.

Package Builder

Upsert a sellable offer

Package key Name Type Linked plan Billing mode Billing interval Base price Compare-at price Audience Status Public

Description Modules JSON Meters JSON

Package offers can anchor a plan, include extra modules, and attach usage meters for AI or automation-heavy surfaces.

Wizer Routes

Workers AI orchestration map

Verified Access

Session and workspace resolution

SessionNo active verified session.

WorkspaceResolving runtime context.

AccessRole-boundary access appears after runtime resolution.

Request a verification code first. In development, the code is also returned in the response.

Access scopeVerified operators only.

Tenant contextChoose the tenant and workspace before signing in.

Protected surfaceOperational data stays hidden until the session is verified.

Tenant Provisioning

Create a sellable workspace

Tenant name Tenant slug Workspace slug Workspace name Owner email Owner display name Starter package Theme Default locale Supported locales Primary hostname Support email

Master-admin only. This creates tenant, workspace, owner membership, default package entitlements, branding, locale, domain, and email policy in one pass.

Provisioning Result

Default stack attached

WaitingProvision a tenant workspace to see the generated defaults.

Identity Providers

Email-code, OIDC, Cloudflare Access, and enterprise SAML

WaitingLogin to inspect SSO providers.

EventsSSO login audit appears here.

Enterprise SSO

Provider governance for bigger customers

Provider Status Surface Login policy

Display name Allowed domains Issuer URL Authorization URL Token URL JWKS URL Client ID Cloudflare Access team Cloudflare Access AUD

Enterprise SSO provider records can be prepared now. Redirect login activation returns after the Ory bridge is wired.

Branding Control

Platform, tenant, and workspace white-label setup

Target Theme key Theme mode Brand name Short name Support email Logo URL Logo mark URL Favicon URL Hero eyebrow Hero headline Powered by Universe Source lineage

Brand tagline Hero copy Theme tokens JSON

Platform branding stays on Universe-owned hosts; tenant and workspace branding takes over on white-labeled runtime hosts.

Resolved Branding

Active theme, host behavior, and profile chain

WaitingRuntime branding will appear after the first context refresh.

ProfilesSign in to inspect platform, tenant, and workspace overrides.

Locale Control

Platform, tenant, and workspace language defaults

Locale defaults resolve through the same platform, tenant, and workspace chain used by branding and Wizer.

Resolved Locale

Active language chain and runtime fallback

Preview locale

WaitingResolved locale will appear after the first context refresh.

ProfilesSign in to inspect platform, tenant, and workspace locale overrides.

Wizer Personality

Platform, tenant, and workspace AI behavior

Target Profile key Role label Tone Audience Source lineage Welcome headline

Mission Response style Guardrails Welcome copy System prompt Task instructions JSON

This writes platform, tenant, or workspace prompt guidance into the shared Wizer layer without changing route selection.

Resolved Personality

Live profile chain reaching the worker

WaitingRuntime Wizer personality will appear after the first context refresh.

ProfilesSign in to inspect platform, tenant, and workspace Wizer overrides.

Domain Ownership

Neutral hostname inventory

WaitingSign in to inspect owned domains.

DNS Governance

Protected and editable records

WaitingSign in to inspect DNS records.

WaitingSign in to inspect DNS change logs.

Domain Control

Claim and assign routable domains

Ownership scope Hostname Label DNS mode Verification mode Status Source lineage

Claim the hostname first, then attach it to a tenant root, workspace root, or CMS domain.

Owned domain Target type CMS domain Assignment role Status

Use `cms_primary` to project the claimed hostname into the current workspace CMS routing layer.

DNS Record Control

Manage only safe records

Owned domain Name Type Content TTL Priority Proxied Status

The backend blocks protected root and `www` routing records so platform hostnames stay hidden.

CMS Domains

First extracted Info Global slice

WaitingLogin to inspect CMS domains.

CMS Pages

Published and draft route inventory

WaitingLogin to inspect CMS pages.

WaitingLogin to inspect launch readiness.

ChecklistLaunch readiness checks will appear after the first authenticated load.

This turns the imported CMS, publication, funnel, and domain data into an operator-facing launch checklist.

Launch Blockers

What still blocks public traffic

WaitingBlockers and warnings will appear after the first authenticated load.

Public routesRecent launchable page and funnel routes will appear here.

Preserved Builders

Open the battle-tested runtimes

The current Universe builder path preserves the proven Info Global runtimes instead of rewriting the page and funnel editing experience during the blend.

Builder Rule

Preserve first, adapt second

Page Builder Literal preserved runtime mounted on the neutral Universe CMS contract.

Funnel Builder Literal preserved runtime mounted on the new funnel graph and simulation bridge.

Rule Do not rewrite the builder UX while battle-tested legacy behavior is still the stronger asset.

CMS Domain Control

Create or update routed brands

Domain key Label Hostname Domain type Status Source lineage Primary

Use this to manage CMS labels and primary brand routing after the hostname is claimed in Domain Control.

CMS Page Control

Publish the current route shell

Domain Path Title Status Page type Page kind Content type SEO title Canonical path Featured image URL Builder template Source lineage Variant label

Excerpt SEO description

Content JSON Builder sections JSON Content HTML

This writes the live route payload and normalizes landing-builder sections into the public CMS contract.

Localization inventorySave the base page first, then add translated variants here.

Locale Translation state Localized path Source lineage Localized title Localized SEO title Localized featured image URL

Localized excerpt Localized SEO description

Localized Content JSON Localized Builder Sections JSON Localized Content HTML

Localized CMS variants keep the same route and publish state while overriding user-facing copy for the selected locale.

CMS Redirects

Legacy and campaign path routing

WaitingLogin to inspect redirects.

Redirect Control

Route old URLs without touching published pages

Use redirects for preserved campaigns, renamed pages, and launch aliases.

Glossary Inventory

Resolved translation terms by locale

WaitingLogin to inspect glossary entries.

Wizer and future translation tooling will honor the active glossary chain once entries are saved.

Glossary Control

Platform, tenant, and workspace terminology rules

Target Locale Status Source lineage Source term Preferred term

Notes

Use glossary entries to keep Wizer, translations, and future localized slugs aligned on the same terminology.

Translation Memory

Exact-match translation reuse by locale and context

WaitingLogin to inspect translation memory entries.

Page and funnel localization writes will backfill exact-match translation memory here.

Translation Memory Control

Save reusable source-to-target text mappings

Target Locale Status Context type Source lineage

Source text Translated text

Notes

Context types let the same source phrase resolve differently for page copy, funnels, and future editor-side translation tooling.

CMS Assets

Media registry for the neutral builder layer

WaitingLogin to inspect CMS assets.

Asset Control

Register reusable media without tenant lock-in

Asset key Label Type Status Public URL Mime type Alt text Width Height Storage provider Storage ref Source lineage

This is the neutral asset inventory that future builder blocks and tenant themes can reuse.

CMS Publications

Recent publish history across the workspace

WaitingLogin to inspect CMS publication history.

Publishing Ops

Promote drafts and keep route history durable

Publish creates a durable snapshot and keeps the route path locked even if the page later returns to draft.

CMS Funnels

Route sequencing on top of the neutral CMS pages

WaitingLogin to inspect funnel inventory.

Funnel Control

Bind page paths into a sequenced offer journey

Funnel key Name Primary product code Status Domain Source lineage

Description Step config JSON

Steps can reference page IDs directly or page paths on the selected domain.

Localized Funnels

Locale-aware funnel overlays and step ordering

WaitingSave or load a base funnel, then inspect localized overlays here.

Funnel Localization

Override funnel copy and per-step routing metadata by locale

Locale Translation state Source lineage Localized name

Localized description Step localization JSON

Use step localization JSON to reorder offers, localize offer keys, or attach locale-specific step metadata without cloning the base funnel.

CMS Quizzes

Funnel-adjacent quiz inventory

WaitingLogin to inspect quizzes.

Quiz Control

Define quiz questions and results

Quiz key Title Status Require email Funnel Source lineage

Description Questions JSON Results JSON

Questions and results are optional but should be updated before publishing a quiz.

Quiz Submissions

Latest quiz responses

WaitingLogin to inspect submissions.

Quiz Notes

What the public API will store

CaptureQuestion answers, score totals, and matched results.

RouteResults can link to CMS pages for funnel routing.

ConsentEmail is optional unless the quiz requires gated results.

Behavior Events

Live engagement telemetry

WaitingLogin to inspect behavior events.

Behavior Notes

Baseline tracking contract

EventTrack key events like lead capture, quiz starts, and checkouts.

ContextSession/visitor IDs stay optional for now.

MetadataFreeform JSON holds page and campaign attributes.

Automation Rules

Behavior-triggered sequences

WaitingLogin to inspect automation rules.

Automation Control

Define triggers and steps

Rule key Name Status Trigger type Trigger event Source lineage

Description Trigger metadata JSON Steps JSON

Steps can reference template IDs or use webhook targets.

Email Governance

Managed providers, routing, and professional mail

WaitingLogin to inspect email providers.

Master Delivery Control

Configure managed providers and backup routing

Provider Status From name From email Reply-to email Secret key / API key Source lineage

Provider metadata JSON

Purpose Provider Role Priority Status Source lineage

Professional email mode Provider Dashboard webmail DNS control Source lineage

Provider governance is master-admin only. Tenants do not choose or see the backend provider chain.

Professional Domains

Managed professional mail domain inventory

WaitingLogin to inspect professional mail domains.

Professional Domain Control

Attach managed mail to a governed domain

Platform-managed domains will lock Qbox MX/SPF and optional DMARC. Tenant-external mode leaves MX and sender policy under the customer.

Professional Mailboxes

Mailbox inventory for dashboard-native mail

WaitingLogin to inspect managed mailboxes.

Mailbox Control

Store mailbox inventory and optional vendor sync

Managed domain Local part Display name First name Last name Quota bytes Status API enabled POP disabled IMAP disabled SMTP disabled Vendor webmail disabled Provision vendor mailbox now Vendor password Source lineage

Mailbox metadata JSON

Mailboxes default to API-enabled with vendor webmail disabled. Immediate vendor creation is optional and does not store the password in Universe.

Native Inbox

Dashboard-native professional inbox

WaitingLogin to inspect professional inbox counts.

WaitingMailbox messages will appear after a managed mailbox is selected.

This inbox stays inside Universe. Vendor webmail remains disabled and hidden.

Message Detail

Selected mailbox thread

WaitingSelect a professional mailbox message to inspect the detail view.

Email Templates

Automation messaging inventory

WaitingLogin to inspect email templates.

Email Template Control

Store reusable email content

Template key Name Subject Status From name From email Source lineage

Markdown body HTML body

Templates stay tenant-owned, and delivery now resolves from workspace branding plus the active provider.

Automation Runs

Latest automation triggers

WaitingLogin to inspect automation runs.

Queue-first automation now runs through a recoverable execution layer before email delivery sweeps.

Email Outbox

Queued or sent email activity

WaitingLogin to inspect email outbox.

Use preview mode to validate branded sends before adding a live provider key.

Email Suppressions

Delivery blocks and recovery safety

WaitingLogin to inspect suppression rules.

Suppression Control

Block sends without deleting automation

Recipient email Delivery purpose Status Expires at Source lineage

Reason Metadata JSON

Suppressions turn matching outbox rows into skipped audit records instead of deleting queued automation history.

Member Documents

Protected delivery catalog

WaitingLogin to inspect member documents.

Member Document Control

Create delivery records before checkout automation

Product code Title File name Mime type Status Source lineage

Description Sanitized R2 key (optional)

This slice manages metadata and entitlements first. File upload automation can be added after the neutral pipeline settles.

Entitlements

Grant product and document access manually

Manual grants bridge the gap until checkout and member onboarding start issuing entitlements automatically.

Customer Snapshot

What one member can access right now

WaitingLoad a customer snapshot after login.

This matches the public member-content flow that a verified member session can read from the public worker.

Commerce Products

Neutral checkout catalog

WaitingLogin to inspect commerce products.

Product Control

Create products that issue member access

Product code Name Price cents Currency Status Checkout mode Grant product code Source lineage

Description Checkout label Metadata JSON

These products feed the live public checkout sandbox and automatically grant member product access after paid completion.

Commerce Orders

Live purchase records

WaitingOrders will appear after checkout completion.

Commerce Leads

Lead-first funnel inventory

WaitingLeads will appear after the public checkout flow captures them.

Billing Providers

Workspace-owned payment configuration

WaitingLogin to inspect billing providers.

Stripe Governance

Keep checkout behavior and move key ownership into the workspace

Provider Mode Status Source lineage

Publishable key Secret key Webhook secret

Keep the provider inactive until both Stripe keys are ready. Empty fields will clear the stored values.

Billing Rotation Audit

Credential changes without exposing stored secrets

WaitingLogin to inspect billing secret rotations.

Stripe Secret Rotation

Replace keys or re-seal existing secrets

Provider Mode Reason

New publishable key New secret key New webhook secret

Use this for key replacement or seal-key re-encryption. Blank fields preserve the current stored values.

Commerce Offers

One-click upsell and downsell inventory

WaitingOffers will appear after the one-click slice is configured.

Saved Payment Profiles

Reusable payment methods captured from paid Stripe orders

WaitingPayment profiles will appear after successful Stripe purchases.

Offer Control

Configure the one-click transition rules

Offer key Label Offer type Status Source product Target product Pricing model Discount % Fixed price cents Requires saved payment Source lineage

This defines the reusable offer contract that the public one-click routes will execute.

One-Click Flow

Off-session Stripe baseline

CaptureA normal Stripe checkout stores the reusable customer and payment method.

OfferA one-click offer links a paid source order to a target product.

ChargeIf the saved method supports it, Universe attempts an off-session payment intent.

FallbackIf Stripe requires action, the checkout stays open for customer confirmation.

Service Providers

Optional Veloxt service-pack operators

WaitingSwitch to the Veloxt workspace and login to inspect service providers.

Service Orders

Customer service timeline inventory

WaitingService orders will appear after the service pack is enabled on the active workspace.

Provider Control

Register dispatchable providers

Provider key Display name Email Phone Status Onboarding Source lineage

Coverage JSON Metadata JSON

Provider onboarding now uses the shared Universe flow; this form still supports direct operator edits.

Provider ID Review status Review onboarding

Application JSON Identity JSON Payout JSON

Use the provider ID from the list above to move an application into review, verify it, or reject it.

Scheduled reminder automation now runs every 5 minutes. Use this as a manual override for the current workspace.

Service Order Control

Create service orders manually or from a paid commerce order

Commerce order ID Customer email Customer name Customer phone Title Package code Package label Status Location label Source lineage

Location JSON Metadata JSON

If a commerce order is provided, customer and package fields can stay empty and Universe will bootstrap from the paid order.

Schedule + Assignment

Set windows and dispatch a provider

This controls the live shared service window, dispatch, reminders, and technician execution loop.

Evidence Control

Attach before/after evidence to the customer timeline

Evidence now supports governed delivery URLs and audience-specific download policy on the live shared service layer.

Evidence Policy

Control who can see and download service evidence

WaitingPolicy inventory will appear after the service worker deploy succeeds.

WaitingRetention inventory will appear after the lifecycle slice deploy succeeds.

Audience Evidence type Delivery mode Show in timeline Allow download Status

Metadata JSON

These rules decide whether evidence stays downloadable, metadata-only, or hidden for each audience.

Retention scope Lifecycle mode Retention days Status

Metadata JSON

Retention controls can retire evidence access and delete expired R2 objects while keeping the audit record.

Operator Routing

Route service milestones into the operator outbox

WaitingDashboard operator notifications will appear after the service worker deploy succeeds.

WaitingOperator notification routes will appear after the service worker deploy succeeds.

WaitingDispatch history will appear after the first routed service event.

Route key Event Recipient mode Status

Custom recipients JSON Metadata JSON

Routed events create dispatch rows and queued transactional outbox records for operator follow-up.

Secure operator access for the blended Universe platform.

Operational readiness

Recent pressure and operator activity

Auth throttles and recovery freshness

Operator runbook evidence

What the extraction already knows

Commercial baseline

Sellable bundles and add-ons

AI and automation pricing units

Current entitlement driver

Upsert a sellable offer

Workers AI orchestration map

Session and workspace resolution

Create a sellable workspace

Default stack attached

Email-code, OIDC, Cloudflare Access, and enterprise SAML

Provider governance for bigger customers

Platform, tenant, and workspace white-label setup

Active theme, host behavior, and profile chain

Platform, tenant, and workspace language defaults

Active language chain and runtime fallback

Platform, tenant, and workspace AI behavior

Live profile chain reaching the worker

Neutral hostname inventory

Protected and editable records

Claim and assign routable domains

Manage only safe records

First extracted Info Global slice

Published and draft route inventory

Customer-facing go-live checklist

What still blocks public traffic

Open the battle-tested runtimes

Preserve first, adapt second

Create or update routed brands

Publish the current route shell

Legacy and campaign path routing

Route old URLs without touching published pages

Resolved translation terms by locale

Platform, tenant, and workspace terminology rules

Exact-match translation reuse by locale and context

Save reusable source-to-target text mappings

Media registry for the neutral builder layer

Register reusable media without tenant lock-in

Recent publish history across the workspace

Promote drafts and keep route history durable

Route sequencing on top of the neutral CMS pages

Bind page paths into a sequenced offer journey

Locale-aware funnel overlays and step ordering

Override funnel copy and per-step routing metadata by locale

Funnel-adjacent quiz inventory

Define quiz questions and results

Latest quiz responses

What the public API will store

Live engagement telemetry

Baseline tracking contract

Behavior-triggered sequences

Define triggers and steps

Managed providers, routing, and professional mail

Configure managed providers and backup routing

Managed professional mail domain inventory

Attach managed mail to a governed domain

Mailbox inventory for dashboard-native mail

Store mailbox inventory and optional vendor sync

Dashboard-native professional inbox

Selected mailbox thread

Automation messaging inventory

Store reusable email content

Latest automation triggers

Queued or sent email activity

Delivery blocks and recovery safety

Block sends without deleting automation

Protected delivery catalog

Create delivery records before checkout automation

Grant product and document access manually

What one member can access right now

Neutral checkout catalog

Create products that issue member access

Live purchase records

Lead-first funnel inventory

Workspace-owned payment configuration