VinMin Portal

• portal.vinmin.gg — live application.
• vinmin.gg — planned public launch.
• docs.tlte.cloud — this documentation hub (legal, charter, architecture).
• notify.security.vinmin.gg — outbound email infrastructure.
• Forest World — separate cloud project, bridged via signed partner-api + shared Google identity only. No shared database.

The Charter replaces the prior five-element role picker. Every member accepts it before entering the Sanctuary; acceptance is recorded server-side via the accept_vinmin_charter RPC and revisitable at /sanctuary/charter?revisit=1.

1. One Earth — ஒரே பூமி. We gather as one diaspora on one sacred ground.
2. Listen first — முதலில் கேள். Hear before you speak. Witness before you judge.
3. Honour every name — ஒவ்வொரு பெயரையும் மதி. Names, places, memory carry weight.
4. Carry your village with pride — உன் கிராமத்தை பெருமையாய் சுமக்க.
5. Disrupt nothing sacred — புனிதமானதை உடைக்காதே. Memorials and ceremonies are not for noise.
6. Earn your rank — உன் நிலையை சம்பாதி. Honour and titles are earned, never bought.
7. What is shared inside, stays inside — உள்ளே பகிர்ந்தது உள்ளேயே.

A Visit Charter sub-contract applies when entering another member's sanctuary: listen first, honour the element, three visits / fifteen minutes, the host may ask you to leave (24h cooldown), carry nothing back uninvited.

The original five-element vision (Earth · Fire · Water · Air · Storm) is deprecated. A code-level SanctuaryElementGuard redirects every non-Earth route to /sanctuary/earth. The platform now has three layers:

• Dashboard (/home) — civic surface: music, world chat, transparency.
• Sanctuary (/sanctuary/earth) — voice-first: Kindred, Whispers, Village Hall, personal & village honour.
• Arena — events, tournaments, dual-side voting, champion ceremonies. Turn-based voice via LiveKit.

Pattarai is the long-term answer to "who builds VinMin?" Members earn their place through skill trials, not credentials, and are paid in Min through the Bounty Board.

Padikalam (படிகலம்) trials: Frontend · Backend · AI/Intelligence · Voice/Realtime. Each track has a verifiable rubric reviewed by existing Sirpis.

Bounty Board (Phase 2, live): atomic claim_bounty · submit_bounty · pay_bounty RPCs auto-credit Min on approval. The Eelam Homeland Lock reserves homeland-priority bounties to Eelam/diaspora developers for an initial window before opening to the wider guild — structural, not promotional.

Min is a digital identity token bound to XP and Level. Spendable balance is what you can use; honour balance is non-spendable status. Min is utility-only today — not redeemable for cash. A regulated Min ↔ fiat exchange leg is planned but not built.

Top-up: Stripe checkout via min-topup-checkout; min-topup-webhook credits Min on success. 10% of every top-up is recycled to the public treasury (visible on /transparency within the app).

30-day auto-renew from wallet. Failed renewal: 3 retries spaced 1 day apart, then drop to Witness. Cancelling preserves tier until current_period_end. Cron via renew-min-subscriptions.

Marketplace caps: 100 Min/day, 500 Min/week per user. Cosmetic categories only (Profile Frames, Glow Themes, Card Skins, Wallpapers). World Drop: daily reward; first 20 claimers get bonus Min, server-side CURRENT_DATE enforced.

Roles are stored in admin_user_roles (service-role only — never client-mutable). Hierarchy: Root → Steward → Guardian → Guide → Member. Eleven symbolic Tamil roles (e.g. Guardian of Voice குரல் காவலர், Archivist of Time கால சேகரர்) sit within Steward/Guardian.

A 5-stage Era system gates which admin actions are unlocked as the community matures. Every admin action writes to admin_audit_log with actor, role, action, target, IP, metadata. Scheduled actions run through admin_scheduled_actions.

• Frontend: React 18, Vite 5, Tailwind v3 (HSL semantic tokens only), TypeScript 5, framer-motion.
• Backend: managed cloud platform — Postgres, Auth, Storage, Edge Functions (Deno).
• Realtime: Supabase Realtime + Presence with useId() channels; 20s heartbeat.
• Voice: LiveKit (token issued by livekit-token edge function).
• Maps: Mapbox GL — Northern/Eastern Sri Lanka focus, 3D extrusion.
• Storage: AWS S3 via s3-upload; 3D models served from /public.
• AI: managed AI gateway (Gemini 2.5 + GPT-5 families). No user-supplied API keys.
• Email: hardened queue via auth-email-hook → process-email-queue on notify.security.vinmin.gg.
• Phone (creators only): Twilio UK +44 verification.

• All Pl/pgSQL functions SET search_path = public to prevent search-path hijacking.
• RLS on every user-scoped table via get_my_username() strictly bound to auth.uid().
• Master vinmin admin requires both standard auth session AND a master token to bypass RLS.
• OTP / auth emails routed through hooked queue, never direct.
• Privilege-escalation attempts logged in admin_audit_log.

VinMin Portal is live and in the Aarambam (founding) era. Surfaces, recommendations, and tools may continue to evolve. See Era Status.