What ARIA OS does

A teamspace owns brands and holds the people who work on them. One teamspace per user, enforced by schema trigger as well as in the application, so the two cannot drift.

Operators with more than one brand switch the active context explicitly. Nobody sees every brand at once: visibility is a decision, never a side effect of a role name.

Analytics identifiers, domains, voice and publishing rules belong to the brand, stored against it. No per-brand value is read from an environment variable, because an environment variable is one global value and the second brand would render the first brand’s identity.

Attach a domain, verify it, and the platform resolves the hostname to the brand at the edge. SSL is provisioned and synced automatically.

Pages are composed from a governed component catalogue. The React registry, the canvas catalogue and the Postgres definition are kept in step, so what an editor drags is what the site renders.

Uploads land in Supabase Storage with dimensions and duration measured from the file itself. A filename is a label; the file is the fact.

Menus are projected from published pages, so an unpublished page cannot leave a dead link in the navigation.

Operational events become channel-appropriate drafts, written against the brand’s own context. Drafts enter review; they do not publish themselves.

Approved content dispatched to LinkedIn, X, Meta Ads and Google Ads on a schedule, with per-channel formatting.

Sitemaps, robots and structured data generated from the content model. Per-domain, per-brand, and regenerated when content changes rather than on a cron nobody checks.

Average position, impressions and clicks for your own property, read from Google Search Console. Each brand grants access to its own property.

GA4, PostHog and Vercel Web Analytics, each scoped to the brand that owns the property. Cookieless measurement where the provider offers it.

URLs submitted to IndexNow and the Google Indexing API on publish. The response is recorded for what it establishes (that the credential worked) and never as proof a page was indexed.

Visibility spans the teamspace; destruction is narrower. Roles may only invite strictly below themselves, so nobody can mint a peer.

Passkeys, TOTP and single-use backup codes. Every login path writes an attributable event with a real actor and address.

Emergency developer access needs an admin-issued consent code, expires on a hard maximum, and audits every read it performs.

Lifecycle and auth events appended to a chained log. Rows are never deleted; tampering breaks the chain rather than passing unnoticed.

A switch that refuses every non-superadmin request. It fails closed: if the lockdown state cannot be read, the platform refuses rather than carrying on.