{
  "schema": "cain42.review.system_map.v1",
  "conclusion": "THREE BRANDS, ONE SHARED BACKEND, NOT THREE INDEPENDENT SECURITY BOUNDARIES.",
  "domains": {
    "cainstudio.online": {
      "application": "CAIN Studio platform gateway (FastAPI, main.py)",
      "served_by": "traefik service 'cain-backend' -> 127.0.0.1:8088 (blue) and :8098 (green)",
      "authorization": "gateway /fabric stages (identity, authorization, policy, risk, consensus)",
      "execution": "gateway request path; /fabric/try and product API",
      "evidence_storage": "gateway SQLite evidence DB + /proof/bundle static evidence root",
      "verification": "/proof, /api/v1/proof/*, /api/v1/live-cluster/*, standalone verifiers",
      "public_routes": [
        "/",
        "/proof",
        "/evidence/",
        "/review/",
        "/fabric/status",
        "/.well-known/*",
        "/api/v1/live-cluster/*"
      ],
      "authenticated_routes": [
        "/fabric/* product API with API key",
        "/accounts/*",
        "/billing/*"
      ]
    },
    "mcpgate.online": {
      "application": "SAME cain-backend application as cainstudio (reverse-proxy alias by Host header)",
      "served_by": "traefik service 'cain-backend' -> 127.0.0.1:8088/8098",
      "note": "20+ subdomains (verifygate, analytics, ...) are host-based routes to the same backend"
    },
    "clawx.click": {
      "application": "clawx-site static server (port 8480) + API proxy to cain-backend (8088)",
      "served_by": "traefik: static assets -> :8480, /health|/.well-known/*|/fabric/*|/api/* -> :8088"
    }
  },
  "shared": {
    "backend_process": "cainstudio.online and mcpgate.online are the same FastAPI process behind one traefik service; they share code, keys, databases and failure domain.",
    "evidence_root": "the same /proof/bundle evidence tree is mirrored across all three sites.",
    "keys": "one operator-held publisher key and one evidence-root key sign all three sites' evidence.",
    "failure_domain": "one host, one operator, one control plane for all three brands."
  },
  "trust_boundaries": "The only real trust boundary is the gateway process and the MCPGate enforcement boundary; the three domains are marketing/branding surfaces over one runtime.",
  "redaction": "host IPs, overlay addresses, secrets and tenant data are not published."
}