# LayerBrick

> LayerBrick is a seven-brand platform (LayerBrick core, Comphive, TLDName, NetDNS, DakRelay, Web-Ons, Evallot) sharing one identity/SSO/billing hub. Core owns users, sessions, organizations, wallets, KYC, and ALBOS (the ecosystem agent). Brands never touch Core's database directly — they forward the caller's bearer token to Core's `GET /v1/auth/me` and authorize locally from the identity it returns.

This file follows the llms.txt convention (https://llmstxt.org/) so language-model agents can discover LayerBrick's real, implemented API surface without scraping HTML. Everything linked below is live today on the playground (`albos.tr`) — nothing here is aspirational. Where a feature is intentionally partial (e.g. ALBOS's intent matching, or outbound email), that is stated plainly in the linked documents, not hidden.

## Core API

- [OpenAPI 3.1 spec](https://albos.tr/openapi.json): Full machine-readable schema for every implemented Core endpoint — auth, organizations, wallet, tokens, API keys, profile, agent memory, KYC, ALBOS, admin.
- [Human-readable API reference](https://albos.tr/developers.html): Authentication model, quick start (cURL + Node), resource paths, per-brand documentation links, and the role/authorization policy (Any/Technical/Financial/Admin/Owner/Staff tiers; 404 for non-members, 403 for insufficient role).

## Authentication

LayerBrick uses passwordless magic-link auth, not passwords. `POST /v1/auth/request-link` with an email, then `POST /v1/auth/verify` with the returned token to get a bearer session token (30-day TTL). Org-scoped API keys (`lb_live_...` prefix, from `POST /v1/organizations/{id}/api-keys`) work identically to session tokens on every endpoint and are the recommended credential for agents and integrations — they're capped below owner authority and revocable independently of any human session.

## ALBOS — the ecosystem agent

`POST /v1/albos` is a chat-style endpoint that answers questions and takes real actions over a caller's own account data, gated by a three-tier autonomy model: read-only queries answer immediately; reversible low-risk changes (profile fields, project creation) execute immediately and are audited; financial, destructive, or identity-sensitive actions (creating an organization, crediting a wallet, granting tokens, revoking a session) are staged and require a separate `POST /v1/albos/confirm` call before anything real happens. It holds short-term conversation memory (the current open conversation is replayed as message history; closing a chat archives+summarizes it) and can see the caller's data on EVERY brand — Comphive servers, TLDName domains, NetDNS zones, DakRelay mail, Web-Ons licenses, Evallot sites — via server-to-server calls that forward the caller's own token, so it never sees more than that user's own consoles would show. Understanding is LLM-backed (NVIDIA NIM by default, Gemini as an alternate; staff pick the model), with an automatic fall back to a fixed rule-based matcher if no provider is reachable.

## Projects — the cross-brand workspace concept

Organizations own PROJECTS (`GET/POST /v1/organizations/{id}/projects`, `GET/PATCH/DELETE /v1/projects/{id}`). A project groups resources across brands: Comphive servers, TLDName domains, NetDNS zones, DakRelay mail domains, Web-Ons licenses, and Evallot sites all carry an optional `project_id` that each brand validates against Core's `GET /v1/projects/{id}` server-side. A project is never an organization — it has no wallet or members of its own.

## Billing

Charges debit the org wallet in real time; invoices (LB- numbers) roll them into documents issued by the org's distributor entity; proformas (PF- numbers) are preliminary estimates. Payments are first-class records; customers can self-report a bank transfer via `POST /v1/organizations/{id}/payment-claims` (staff review before anything credits). The rendered invoice HTML is a preview — the externally-issued legal PDF attaches per invoice when available.

## Brands (subdomains of albos.tr) — all seven live

Every brand has its own console (`/console.html`), developer docs (`/developers.html`), `llms.txt`, and `openapi.json`; one SSO session or `lb_live_` API key works on all of them, and every subdomain proxies Core same-origin at `/core-api/*`.

- Comphive (comphive.albos.tr) — compute broker; real Hetzner Cloud provisioning is live.
- TLDName (tldname.albos.tr) — registrar: Contact Book, formula-priced registration, manual fulfillment until provider adapters land; active domains auto-attach a NetDNS zone with the parked template.
- NetDNS (netdns.albos.tr) — authoritative DNS control plane: zones/records, managed record sets (sibling brands claim protected groups), templates, BIND export, DDNS.
- DakRelay (dakrelay.albos.tr) — sovereign email: domains/mailboxes/aliases (pending_infra until Stalwart); one-click MX/SPF/DKIM/DMARC provisioning into NetDNS works today.
- Web-Ons (webons.albos.tr) — licensing: race-safe activation limits and a license-gated update server; revoked licenses stop updating immediately.
- Evallot (evallot.albos.tr) — hosting control plane: sites (traditional/git), plans, TR/EU regions, DNS attach into NetDNS; pending_infra until nodes provision through Comphive.

## Notes for agents

- Every brand's identity check funnels through Core's `/v1/auth/me` — if you're integrating one brand, the same credential works across all of them.
- Cross-brand server-to-server calls always forward the CALLER's bearer token — no brand has ambient authority another brand's user wouldn't have.
- Rate limits apply to unauthenticated auth endpoints (5/hr/email and 20/hr/IP on link requests, 15/min/IP on verification) — back off on 429 rather than retrying immediately.
- Write operations are audited; a user's own audit trail is readable at `GET /v1/audit/me`.