Production Verified v1.4-LTS

HOMI Architectural E-Commerce Engine

"Turnkey Scandinavian Showroom & Catalog Architecture with Bespoke Quote Engine"

A production-grade, zero-dependency e-commerce and furniture showroom engine. Designed for bespoke boutique brands, interior studios, and physical craft manufacturers requiring custom dimensional quoting, atomic cart states, and relational catalog structures.

$149 USD

Full Source Code · Lifetime Commercial License

Purchase & License FAQ ↓

Live Demo Buy

PostgreSQL 16 3NF·Fowler Money (bcmath)·Monotonic Saga DAG·11-Gate DevSecOps Runner·Filament v3 Admin

System OverviewCore Architecture Scope

Hybrid Retail Showroom & Bespoke Quote Engine

HOMI bridges the gap between conventional mass-market shopping carts and luxury bespoke studios. Customers can either buy ready-made inventory with real-time stock validation or submit structured, dimensioned bespoke quote inquiries directly into the admin triage pipeline.

Target Profiles:Boutique furniture ateliers & artisan craft manufacturers·Interior design firms selling curated room collections·High-ticket physical goods with bespoke sizing/materials·Agencies delivering high-margin client storefronts in under 48 hours

Architectural Rationale

Industry Challenge vs. HOMI Architecture

Domain / Focus

Conventional Trap

HOMI Architecture

The Plugin Bloat Trap

Conventional Trap:Standard CMS platforms require 15+ fragile plugins for custom fields, quote builders, and cart drawers, causing 4s load times and continuous security breakages.

HOMI Architecture:A unified, production-ready Laravel 13 architecture with native Tailwind CSS v4, Filament v3 admin, and typed Value Objects. Zero plugin churn, <0.6s First Contentful Paint.

The SaaS Revenue Tax

Conventional Trap:Cloud commerce platforms deduct 2-3% transaction taxes on top of $300/mo app fees that drain high-ticket furniture profits year after year.

HOMI Architecture:Perpetual commercial license with complete source code ownership. Host on any $5/mo VPS or cloud server with zero platform cuts and zero subscriptions.

The Lost Quote Abyss

Conventional Trap:Bespoke commissions get buried in unstructured contact emails where dimensions, material preferences, and project budgets get lost.

HOMI Architecture:Customers submit structured dimensions (W × D × H) and material selections directly into a status-tracked back-office triage board.

System Topology & Container Mesh

Isolated 3-tier local network

1. Client Tier

Native Browser & Modals

──(AJAX / Fetch)──►

2. Application Core

PHP 8.4-FPM / Nginx 1.25

──(PDO Prepared)──►

3. Relational Persistence

PostgreSQL 16 (Strict 3NF)

1. Client Tier

Native Browser & Modals

↓AJAX / Fetch↓

2. Application Core

PHP 8.4-FPM / Nginx 1.25

↓PDO Prepared↓

3. Relational Persistence

PostgreSQL 16 (Strict 3NF)

homi-web8080:80

nginx:alpine (read-only root)

Nginx reverse proxy with security headers, FastCGI hop-by-hop framing defense, and static asset delivery.

homi-appinternal:9000

homi-app:latest (PHP 8.4-FPM)

PHP 8.4-FPM application core with read-only root, 64MB tmpfs runtime, Fowler Money VO, and Filament v3.

homi-workerbackground (redis)

homi-app:latest (PHP 8.4-FPM)

Default queue worker handling asynchronous transactional outbox relay and domain events.

homi-worker-financialbackground (redis-financial)

homi-app:latest (PHP 8.4-FPM)

Isolated financial queue worker dedicated to payment saga executions and ledger notarization.

homi-schedulerbackground (cron)

homi-app:latest (PHP 8.4-FPM)

Automated schedule worker executing maintenance jobs, expired quote triage, and security health checks.

homi-db127.0.0.1:5432:5432

postgres:16-alpine

PostgreSQL 16 relational database with row-level locks, PL/pgSQL immutability triggers, and strict 3NF schema.

homi-redis127.0.0.1:6379:6379

redis:alpine

Redis 7 in-memory cache, session store, rate limiting, and dual-queue message broker.

Dual Operational Workflows

End-to-end customer and administrative journeys

Customer Experience Journey

Storefront

Step 01Curated Space Discovery
Buyers explore tagged gallery spaces (Living Room, Dining, Bedroom, Workspace) rather than generic category lists.
Step 02Debounced Instant Search
Instant asynchronous modal searching across SKU, dimensions, materials, and titles with 300ms server debounce.
Step 03Dimension & Material Inspection
Inspect multi-angle high-res imagery, technical spec dimensions, and real-time inventory availability.
Step 04Dual Conversion: Cart or Bespoke Quote
Buyers can add standard stock directly to the AJAX slide-out cart or submit custom dimensions via the Quote Engine.

Admin & Triage Workflow

Back-Office

Step 01RBAC Back-Office Authentication
Dedicated `/admin` suite strictly guarded by role-based session middleware and automatic timeout guards.
Step 02Catalog & Space Management
CRUD operations on products, categories, and curated room spaces with multi-image gallery binding.
Step 03Bespoke Quote Triage
Review incoming customer dimension specs, budget ranges, and project scopes with one-click status updates.
Step 04Media Asset Pipeline
MIME-validated, extension-checked media upload manager with randomized file generation to prevent traversal.

Deliverables & Deployment Speed

Instant digital delivery

What's in the Download Package

Complete Source Code (.zip & Git)Storefront, client runtime, API handlers, admin suite, and asset pipeline.

Automated Docker MeshProduction-configured multi-container docker-compose.yml with healthchecks.

Relational PostgreSQL Schema & Seed Pack24+ versioned migrations with PL/pgSQL guards, pre-seeded architectural catalogs, and admin auth.

Interactive Architectural ERDStandalone Crow's Foot draw.io diagram file with visual relation mappings.

Commercial Developer LicenseFull modification and deployment rights for your store or client project. Redistribution or resale of the source code is strictly prohibited.

1-Command Boot~28s Ready

Clone or unzip the codebase, then execute the standard compose boot. PostgreSQL schemas, seed data, and web routing configure automatically.

git clone <repo> && cd homi && docker compose up -d

Storefront: http://localhost:8080

Admin Workspace: http://localhost:8080/admin

Auto-Seeded Database: homi

Application CorePHP 8.4 Execution & Runtime Directives

Hexagonal Domain Core & Asynchronous Outbox

A decoupled, hexagonal domain-driven architecture separating HTTP controller adapters, domain services (OrderService, LedgerService, PaymentSagaService), Fowler Money value objects, and asynchronous queue workers without framework lock-in.

Language:PHP 8.4 (FPM / Strict Types)·Server:Nginx 1.25 (FastCGI Hardened)·Persistence:PDO PostgreSQL 16 (Strict 3NF)·Memory:< 8MB Idle

Memory Ceiling

128 MB

< 8MB request cycle

Payload Ceiling

20 MB

High-res photography batch

Media Upload Cap

15 MB

Binary MIME validation

Session Inactivity

7,200s (2h)

Auto-purge dormant state

Hardened Security Matrix

8 Verified Defense Layers

Threat Vector & Domain

Enforced Mechanism

Implementation Details & Guarantees

Threat Vector

SQL Injection (SQLi)

Enforced Mechanism

100% Prepared Statements (Zero Emulated Prepares)

Implementation

All database queries use Eloquent ORM and PDO prepared statements with strict parameter binding (PDO::ATTR_EMULATE_PREPARES => false). Raw SQL interpolation is strictly prohibited.

Verified against tested first- and second-order SQL injection vectors via zero emulated prepares.

Threat Vector

Cross-Site Scripting (XSS)

Enforced Mechanism

Context-Aware Escaping & Unicode Canonicalization

Implementation

Every user variable rendered in Blade templates passes through {{ $var }} (htmlspecialchars ENT_QUOTES). Form inputs are normalized via Normalizer::normalize() to prevent homoglyph attacks.

Context-aware escaping and Unicode canonicalization mitigate stored and reflected XSS vectors.

Threat Vector

Cross-Site Request Forgery (CSRF)

Enforced Mechanism

Cryptographic Synchronizer Session Tokens

Implementation

All state-mutating HTTP POST routes enforce Laravel VerifyCsrfToken middleware verifying 40-character cryptographic tokens. Webhooks bypass CSRF only via mandatory HMAC-SHA256 headers.

Mitigates unauthorized cross-origin state mutations.

Threat Vector

BOLA / IDOR Horizontal Isolation

Enforced Mechanism

Session Token & Signed URL Authorization

Implementation

Gate 2 verified; order confirmation receipts strictly enforce ownership isolation. Guests require high-entropy access tokens stored in session or HMAC signed recovery URLs.

Enforces strict authorization boundaries against horizontal order enumeration and PII access.

Threat Vector

Reverse Proxy IP Spoofing

Enforced Mechanism

RFC 1918 CIDR Validation & TrustProxies

Implementation

Gate 1 verified; RestrictAdminAccess middleware validates $request->ip() against corporate CIDRs and TrustProxies only trusts the immediate Nginx upstream reverse proxy.

Restricts administrative access to corporate CIDRs and validates upstream reverse proxy trust.

Threat Vector

FastCGI Hop-by-Hop Smuggling

Enforced Mechanism

Reverse Proxy Header Stripping & Framing Invariant

Implementation

Gate 8 verified; Nginx configuration explicitly strips Transfer-Encoding and Proxy hop-by-hop headers before delivering requests to PHP-FPM FastCGI backend.

Mitigates HTTP/2 downgrade desynchronization and request smuggling; verified by Gate 8.

Threat Vector

Web Cache Deception (WCD)

Enforced Mechanism

Dynamic Anti-Cache Headers & Extension Guards

Implementation

Gate 7 verified; stateful customer order and cart endpoints emit Cache-Control: private, no-store, no-cache, must-revalidate and reject trailing static asset confusion.

Prevents edge CDN and proxy caches from storing private customer data under static keys.

Threat Vector

Payment Webhook Race & Replay

Enforced Mechanism

HMAC-SHA256 Authentication & DAG Monotonicity

Implementation

Gate 10 verified; PaymentWebhookController verifies shared secret HMAC signature and PaymentSagaService enforces a directed acyclic graph (DAG) preventing state resurrection.

HMAC verification and monotonic state transitions mitigate forged, replayed, and out-of-order webhook transitions; verified by Gate 10.

Dual Operational Pipelines

Storefront Commerce vs. Atelier Custom & DAM

Pipeline 01 · Commerce & ACID Boundary

Storefront Transaction & ACID Checkout Pipeline

Deterministic Row-Level Locking to Cryptographic Ledger Attestation

End-to-end commerce lifecycle executing inside an isolated PostgreSQL transaction with pessimistic row-level locking and arbitrary-precision financial arithmetic.

STEP 01Deterministic Lock Ordering
Sorts cart items by product ID ascending before acquiring row locks, eliminating PostgreSQL deadlock cycles (SQLSTATE 40P01) under high concurrency.
STEP 02Pessimistic Row Locking (lockForUpdate)
Acquires exclusive SELECT ... FOR UPDATE locks on target product rows with a 200ms timeout, serializing inventory mutations to prevent overselling.
STEP 03Fowler Money Arbitrary Precision
Computes subtotals and grand totals using App\ValueObjects\Money backed by bcmath scale 4 arithmetic, preventing IEEE 754 float drift.
STEP 04Stock Ceiling & Underflow Protection
Validates available stock under lock and decrements inventory atomically, ensuring stock balances can never drop below zero.
STEP 05Order Entity & Frozen Price Persistence
Generates high-entropy order reference HOMI-XXXXXXXX, inserts master record into orders, and freezes point-in-time price snapshots into order_items.
STEP 06Cryptographic Ledger & Outbox Dispatch
Hashes order payload into append-only audit_ledgers with SHA-256 block chaining, signs with Ed25519, and writes to outbox_messages for Redis relay.

Pipeline 02 · Atelier Ingestion & Defense

Atelier Bespoke & Digital Asset Pipeline

Parametric Dimension Ingestion & Magic-Byte MIME Defense

Handles structured bespoke commission triage, parametric dimension parsing, and hardened showroom asset ingestion.

STEP 01Parametric Dimension Decomposition
Parses independent Width, Depth, and Height inputs in inches, validates positive numeric proportions, and formats standardized notation (e.g. 84"W x 38"D x 30"H).
STEP 02Material Matrix & Budget Tier Ingestion
Maps customer selections across material presets (Solid White Oak, Smoked Walnut, Brushed Brass, Natural Bouclé) and captures project timeline brackets.
STEP 03Relational Quote Ticket Creation
Saves structured ticket into quote_requests with foreign key binding to authenticated user_id or guest email, initialized with status 'pending'.
STEP 04Multipart Stream Interception
Admin upload handler enforces 15MB ceiling and verifies zero upload stream errors (UPLOAD_ERR_OK) before disk writes.
STEP 05Binary Magic-Byte MIME Sniffing
Uses finfo_file() to inspect real binary headers on disk, strictly enforcing image/jpeg, image/png, and image/webp while rejecting spoofed file extensions.
STEP 06Cryptographic Collision-Proof Renaming
Generates 16-byte random hexadecimal filename bin2hex(random_bytes(16)) . '.' . $ext, preventing path traversal (../) and namespace collisions.

Production Code Reality

Direct extracts from production codebase

app/Services/OrderService.php·Lines 63–99

Prevents PostgreSQL 40P01 deadlocks via deterministic ascending ID sorting, sets 200ms lock timeout, and locks rows for update.

return DB::transaction(function () use ($customerDto, $normalizedCart, $currency) {
    if (DB::getDriverName() === 'pgsql') {
        DB::statement("SET LOCAL lock_timeout = '200ms'");
        DB::statement("SET LOCAL statement_timeout = '1000ms'");
    }

    $orderNumber = 'HOMI-' . strtoupper(substr(bin2hex(random_bytes(4)), 0, 8));

    // Deterministic lock ordering: sort by product ID ascending to prevent deadlocks (40P01)
    $sortedCart = collect($normalizedCart)->sortBy('id')->values()->all();

    $calculatedTotalMoney = Money::zero($currency);
    $lockedItems = [];

    foreach ($sortedCart as $item) {
        $product = Product::where('id', $item['id'])->lockForUpdate()->firstOrFail();

        if ($product->stock_quantity < $item['quantity']) {
            throw new InsufficientStockException("Insufficient stock for '{$product->name}'.");
        }

        $productPriceMoney = Money::fromString(sprintf('%.4f', (float) $product->price), $currency);
        $lineSubtotalMoney = $productPriceMoney->multiply((int) $item['quantity']);
        $calculatedTotalMoney = $calculatedTotalMoney->add($lineSubtotalMoney);

        $lockedItems[] = ['product' => $product, 'quantity' => $item['quantity'], 'subtotal' => $lineSubtotalMoney];
    }
    // Persist order, freeze order_items snapshot, record audit ledger...
});

app/ValueObjects/Money.php·Lines 17–65

Prevents IEEE 754 floating-point drift and micro-cent rounding errors using bcmath scale 4 arithmetic.

final readonly class Money implements JsonSerializable, Stringable
{
    private const INTERNAL_SCALE = 4;
    private const DISPLAY_SCALE = 2;

    public string $amount;
    public string $currency;

    private function __construct(string $amount, string $currency = 'USD')
    {
        $cleanAmount = trim($amount);
        if (!preg_match('/^-?\d+(\.\d+)?$/', $cleanAmount)) {
            throw new InvalidArgumentException("Invalid monetary amount: '{$amount}'.");
        }
        // Normalize strictly to INTERNAL_SCALE (4 decimal places)
        $this->amount = bcadd($cleanAmount, '0', self::INTERNAL_SCALE);
        $this->currency = strtoupper(trim($currency));
    }

    public static function fromString(string $amount, string $currency = 'USD'): self
    {
        return new self($amount, $currency);
    }

    public function add(self $other): self
    {
        $this->assertSameCurrency($other);
        return new self(bcadd($this->amount, $other->amount, self::INTERNAL_SCALE), $this->currency);
    }

    public function multiply(int|string $factor): self
    {
        return new self(bcmul($this->amount, (string)$factor, self::INTERNAL_SCALE), $this->currency);
    }
}

app/Services/Ledger/LedgerService.php·Lines 42–85

Cryptographic tamper-evidence via SHA-256 block hash chaining and Ed25519 digital signature envelopes; verified by Gate 11.

public function record(string $eventType, ?Model $auditable, array $payload, string $ip, string $ua, ?User $actor): AuditLedger
{
    return DB::transaction(function () use ($eventType, $auditable, $payload, $ip, $ua, $actor) {
        $lastEntry = AuditLedger::query()->lockForUpdate()->latest('id')->first();
        $prevHash = $lastEntry ? $lastEntry->record_hash : AuditLedger::genesisHash();
        $seq = $lastEntry ? $lastEntry->sequence_number + 1 : 1;

        $recordHash = $this->hashingService->computeHash(
            sequence: $seq,
            prevHash: $prevHash,
            eventType: $eventType,
            payload: $payload,
            timestamp: now()->toIso8601String()
        );

        $signature = $this->signingService->sign($recordHash);

        return AuditLedger::create([
            'sequence_number' => $seq,
            'prev_hash'        => $prevHash,
            'record_hash'      => $recordHash,
            'signature'        => $signature,
            'event_type'       => $eventType,
            'auditable_type'   => $auditable ? get_class($auditable) : null,
            'auditable_id'     => $auditable?->getKey(),
            'payload'          => $payload,
            'ip_address'       => $ip,
            'user_agent'       => $ua,
        ]);
    });
}

REST API Contract Directory

5 Structured Endpoints

Method & Endpoint

Authentication Guard

I/O Contract (Payload ➔ Response)

POST/cart/actions

Handles atomic shopping cart mutations with stock ceiling validation and Fowler Money totals.

Security Guard:

CSRF Verified / Session Token

Input:{ action: 'add'|'update'|'remove'|'clear', product_id: int, quantity: int }

Returns:{ success: true, message: string, cart_count: int, subtotal: string }

POST/quote

Captures parametric bespoke furniture dimensions and ingests inquiry into back-office triage queue.

Security Guard:

CSRF Verified (Throttle: 10/min)

Input:{ product_id: int, dim_width: float, dim_depth: float, dim_height: float, material: string, notes: string }

Returns:{ success: true, message: string, quote_id: int }

GET/search

Performs real-time indexed search across titles, descriptions, and categories, returning lightweight JSON results.

Security Guard:

Public (Debounced 300ms, Throttle: 60/min)

Input:Query Parameter: ?q={search_term}

Returns:{ success: true, count: int, products: [{ id, name, price, image_url, category_name }] }

POST/checkout

Executes atomic checkout transaction with pessimistic row locking and Fowler Money computation.

Security Guard:

CSRF Verified (Throttle: 5/min)

Input:{ customer_name, customer_email, customer_phone, shipping_address }

Returns:302 Redirect to /order/{orderNumber} with session access token

POST/api/webhooks/payment

Secure webhook receiver enforcing monotonic DAG payment saga transitions.

Security Guard:

HMAC-SHA256 Signature Header

Input:{ event: 'payment.captured'|'payment.refunded', order_id: string, amount: string }

Returns:{ success: true, status: 'processed' }

Backend Source Tree & Separation of Concerns

Categorized by architectural tier

1. Core Domain Entities & Value Objects

Immutable value objects, domain aggregates, and cryptographic ledger models with zero framework entanglement.

app/ValueObjects/Money.php

Fowler Money Arbitrary-Precision VO

bcmath scale 4 arithmetic eliminating IEEE 754 floating-point drift across pricing and taxation.

app/Services/OrderService.php

Transactional Order Aggregate Service

Owns pessimistic lock ordering, stock conservation verification, and atomic checkout transactions.

app/Models/AuditLedger.php

Cryptographic Audit Ledger Aggregate

SHA-256 chained append-only ledger entries notarized with Ed25519 digital signatures.

2. Asynchronous REST & Storefront Adapters

Thin HTTP controllers with strict FormRequest validation, Redis rate-limiting throttles, and JSON serialization.

app/Http/Controllers/CartController.php

Cart State & Drawer Adapter

Processes asynchronous item addition, quantity updates, and cart tab switches with Fowler Money totals.

app/Http/Controllers/CheckoutController.php

Checkout Transaction Adapter

Validates customer shipping details, invokes OrderService, and manages guest access tokens in session.

app/Http/Controllers/PaymentWebhookController.php

Monotonic Payment Webhook Adapter

Validates HMAC-SHA256 signatures and executes monotonic state transitions preventing order resurrection.

app/Http/Controllers/QuoteRequestController.php

Bespoke Dimension Quote Adapter

Validates parametric dimensions and ingests inquiry tickets into back-office triage queue.

3. Asynchronous Outbox & Back-Office Suite

Transactional outbox relay daemon, Redis queue workers, and Filament v3 administration suite.

app/Services/OutboxService.php

Transactional Outbox Publisher

Writes domain events to outbox_messages inside the primary business transaction.

app/Console/Commands/OutboxRelayCommand.php

Outbox Relay Daemon

Continuously polls outbox messages and dispatches them to Redis queues with at-least-once delivery.

app/Filament/Resources/OrderResource.php

Filament v3 Admin Order Suite

Protected back-office interface for order management, quote triage, and cryptographic audit log inspection.

Relational EnginePostgreSQL 16.2 ACID Transaction Core

PostgreSQL Relational Architecture & ACID Isolation

The HOMI persistence tier is engineered exclusively on pure relational principles using PostgreSQL 16.2. All transactions execute under READ COMMITTED + Pessimistic Row Locks isolation with deterministic row-level locking. Relational integrity, referential cascade constraints, and full UTF-8 collation are enforced strictly at the database engine level, enforcing zero orphan rows via engine-level referential integrity and immutable append-only audit permanence.

Database Engine:PostgreSQL 16.2·Storage Engine:PostgreSQL Heap Engine + WAL·Character Collation:en_US.UTF-8·Transaction Isolation:READ COMMITTED + Pessimistic Row Locks

Relational Schema

12 Tables

Strict 3NF domain partitioning

Normalization

Third Normal (3NF)

Zero duplicated inventory state

Concurrency Control

Row-Level Locks

SELECT FOR UPDATE + 200ms timeout

Storage Invariants

PL/pgSQL Triggers

Immutable state & reserved deletion guards

Entity Relationship Diagram (ERD)

homi-erd.drawio·Read-Only Vector Canvas

Open in diagrams.net .drawio

Loading Crow's Foot Vector Canvas...Rendering 11 entities & relational cascade edges

InnoDB EntityPKPrimary KeyFKForeign Key|| = Mandatory 1·>• = Many (N)

Scroll to zoom · Click & drag to pan canvas

Ledger Architecture & Immutability

Zero Blast Radius Relational Guarantees

Append-Only Transaction Ledger & Immutability Standard

Financial transactions, inventory reservations, and state transitions in HOMI are architected as an immutable, write-once ledger. Past order history cannot be altered, overwritten, or corrupted by subsequent catalog mutations.

Historical Price & Product SnapshotWrite-Once Snapshot

The order_items entity freezes product_name, price, and subtotal at the exact millisecond of sale, decoupling historical receipts from future catalog price edits.

Zero Blast Radius on Account DeletionAudit Permanence

Orders bind to users via ON DELETE SET NULL. If a customer exercises privacy rights and deletes their account, historical financial receipts remain intact for tax auditing.

Catalog Retirement IsolationIsolated Blast Radius

The foreign key from order_items to products uses ON DELETE SET NULL. Deleting or archiving a discontinued sofa never corrupts past invoices.

Cryptographic Block Hash ChainingTamper Resistance

AuditLedger links every mutation to the previous record hash (prev_hash) with SHA-256 Merkle chaining and signs the payload with Ed25519 digital signatures.

Foreign Key Topology & Cascade Matrix

7 Relational Constraints

Constraint Identifier

Parent ➔ Child Entity

Cascade Policy

Integrity Guarantee & Blast Radius Defense

Constraintfk_orders_user

Relationshipusers (id)➔orders (user_id)

PolicyON DELETE SET NULL

GuaranteePreserves immutable financial ledger even if customer profile is deleted.

Constraintfk_order_items_product

Relationshipproducts (id)➔order_items (product_id)

PolicyON DELETE SET NULL

GuaranteeProtects historical line item price and name records when catalog products are retired.

Constraintfk_order_items_order

Relationshiporders (id)➔order_items (order_id)

PolicyON DELETE CASCADE

GuaranteeEnsures atomic cascading removal of line items only when parent order is explicitly purged.

Constraintfk_products_category

Relationshipcategories (id)➔products (category_id)

PolicyON DELETE RESTRICT

GuaranteePrevents accidental deletion of categories containing live catalog items.

Constraintfk_product_images_product

Relationshipproducts (id)➔product_images (product_id)

PolicyON DELETE CASCADE

GuaranteeUnlinks secondary showroom gallery views when product entity is removed.

Constraintfk_payments_order

Relationshiporders (id)➔payments (order_id)

PolicyON DELETE RESTRICT

GuaranteePrevents deletion of orders with confirmed or disputed payment transaction records.

Constraintfk_order_discounts_order

Relationshiporders (id)➔order_discounts (order_id)

PolicyON DELETE CASCADE

GuaranteeCascades discount records if order master is purged.

Relational Schema Directory

12 Production Tables · 4 Domains

1. Identity & Role-Based Access

System authentication accounts, customer contact records, and administrative role designations.

1 Table

usersPK: id (BIGSERIAL)

7 columns

System authentication accounts, customer contact records, and administrative role designations.

Foreign Keys:None (Root domain entity)

2. Showroom Catalog & Taxonomy

Hierarchical product categorization, multi-angle visual assets, and spatial gallery layouts.

5 Tables

categoriesPK: id (BIGSERIAL)

6 columns

Hierarchical product categorization taxonomy with SEO slugs and display ordering.

Foreign Keys:None (Root domain entity)

productsPK: id (BIGSERIAL)

12 columns

Core catalog entities containing pricing, dimension specifications, material notes, and inventory levels.

Foreign Keys:category_id → categories.id (ON DELETE RESTRICT)

product_imagesPK: id (BIGSERIAL)

5 columns

Multi-angle visual gallery assets bound to catalog products with primary flag sequencing.

Foreign Keys:product_id → products.id (ON DELETE CASCADE)

gallery_spacesPK: id (BIGSERIAL)

6 columns

Curated architectural room showcases (e.g. Living Room, Bedroom, Workspace) for spatial browsing.

Foreign Keys:category_id → categories.id (ON DELETE CASCADE)

storefront_bannersPK: id (BIGSERIAL)

7 columns

Promotional hero banners, seasonal campaign announcements, and headline links.

Foreign Keys:category_id → categories.id (ON DELETE SET NULL)

3. Immutable Transaction Ledger & Payments

Write-once order records, frozen historical price line items, payment intents, and discount vouchers.

5 Tables

ordersPK: id (BIGSERIAL)

12 columns

Confirmed customer purchase orders with generated order numbers, status tracking, currency, and guest access tokens.

Foreign Keys:user_id → users.id (ON DELETE SET NULL)

order_itemsPK: id (BIGSERIAL)

7 columns

Historical purchase snapshots preserving historical unit prices, quantities, and subtotal lines.

Foreign Keys:order_id → orders.id (ON DELETE CASCADE)product_id → products.id (ON DELETE SET NULL)

paymentsPK: id (BIGSERIAL)

9 columns

Payment transaction ledger records with provider references, idempotency keys, and HMAC verification.

Foreign Keys:order_id → orders.id (ON DELETE RESTRICT)

order_discountsPK: id (BIGSERIAL)

5 columns

Applied coupon discounts and monetary deductions tied to orders.

Foreign Keys:order_id → orders.id (ON DELETE CASCADE)coupon_id → coupons.id (ON DELETE SET NULL)

couponsPK: id (BIGSERIAL)

8 columns

Discount vouchers with predicate rules, usage limits, and expiration controls.

Foreign Keys:None (Root domain entity)

4. Bespoke Atelier & Customer Proof

Structured parametric custom dimension inquiries and moderated customer commentary.

2 Tables

quote_requestsPK: id (BIGSERIAL)

8 columns

Bespoke architectural inquiries capturing custom dimensions, materials, and budget brackets.

Foreign Keys:user_id → users.id (ON DELETE SET NULL)

reviewsPK: id (BIGSERIAL)

8 columns

Customer feedback ratings (1-5 stars) and moderated commentary linked to catalog items.

Foreign Keys:product_id → products.id (ON DELETE SET NULL)user_id → users.id (ON DELETE SET NULL)

5. Cryptographic Audit & Asynchronous Outbox

Append-only SHA-256 chained audit logs and transactional outbox message relay table.

3 Tables

audit_ledgersPK: id (BIGSERIAL)

13 columns

Cryptographic append-only ledger entries linked via prev_hash and signed with Ed25519.

Foreign Keys:None (Root domain entity)

audit_ledger_headsPK: id (BIGSERIAL)

6 columns

Tracks latest ledger sequence heads and signature policies.

Foreign Keys:None (Root domain entity)

outbox_messagesPK: id (BIGSERIAL)

8 columns

Transactional outbox events written inside business transactions for at-least-once Redis relay.

Foreign Keys:None (Root domain entity)

DDL Schema Bootstrapper

01-schema.sql · Core Tables & Foreign Key Setup

docker/db-init/01-schema.sql·11 InnoDB Tables

Auto-mounted to /docker-entrypoint-initdb.d

-- 1. Orders Master Table (Immutable Transaction Ledger)
CREATE TABLE IF NOT EXISTS orders (
  id BIGSERIAL PRIMARY KEY,
  user_id BIGINT REFERENCES users(id) ON DELETE SET NULL,
  order_number VARCHAR(32) NOT NULL UNIQUE,
  customer_name VARCHAR(120) NOT NULL,
  customer_email VARCHAR(150) NOT NULL,
  customer_phone VARCHAR(30) NOT NULL,
  shipping_address TEXT NOT NULL,
  total_amount NUMERIC(10, 2) NOT NULL,
  currency CHAR(3) NOT NULL DEFAULT 'USD',
  status VARCHAR(32) NOT NULL DEFAULT 'pending',
  guest_access_token_hash CHAR(64) DEFAULT NULL,
  inventory_reserved_at TIMESTAMPTZ DEFAULT NULL,
  inventory_released_at TIMESTAMPTZ DEFAULT NULL,
  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
);

-- 2. PL/pgSQL Immutability Trigger: Order Transition Guard
CREATE OR REPLACE FUNCTION homi_guard_order_status_update() RETURNS trigger AS $$
BEGIN
  IF OLD.status IS DISTINCT FROM NEW.status
     AND current_setting('homi.order_transition', true) IS DISTINCT FROM 'authorized' THEN
    RAISE EXCEPTION 'Order status changes must use Order::transitionTo().'
      USING ERRCODE = '23514';
  END IF;
  RETURN NEW;
END;
$$ LANGUAGE plpgsql;

DROP TRIGGER IF EXISTS homi_guard_order_status_update ON orders;
CREATE TRIGGER homi_guard_order_status_update
  BEFORE UPDATE OF status ON orders
  FOR EACH ROW EXECUTE FUNCTION homi_guard_order_status_update();

-- 3. PL/pgSQL Immutability Trigger: Currency Immutability Guard
CREATE OR REPLACE FUNCTION homi_guard_order_currency_update() RETURNS trigger AS $$
BEGIN
  IF OLD.currency IS DISTINCT FROM NEW.currency THEN
    RAISE EXCEPTION 'Order currency is immutable after creation.'
      USING ERRCODE = '23514';
  END IF;
  RETURN NEW;
END;
$$ LANGUAGE plpgsql;

DROP TRIGGER IF EXISTS homi_guard_order_currency_update ON orders;
CREATE TRIGGER homi_guard_order_currency_update
  BEFORE UPDATE OF currency ON orders
  FOR EACH ROW EXECUTE FUNCTION homi_guard_order_currency_update();

-- 4. PL/pgSQL Reserved Product Deletion Guard
CREATE OR REPLACE FUNCTION homi_guard_reserved_product_delete() RETURNS trigger AS $$
BEGIN
  IF EXISTS (
    SELECT 1 FROM order_items AS item
    JOIN orders AS parent_order ON parent_order.id = item.order_id
    WHERE item.product_id = OLD.id
      AND parent_order.inventory_reserved_at IS NOT NULL
      AND parent_order.inventory_released_at IS NULL
  ) THEN
    RAISE EXCEPTION 'A product with reserved order inventory cannot be deleted.'
      USING ERRCODE = '23514';
  END IF;
  RETURN OLD;
END;
$$ LANGUAGE plpgsql;

DROP TRIGGER IF EXISTS homi_guard_reserved_product_delete ON products;
CREATE TRIGGER homi_guard_reserved_product_delete
  BEFORE DELETE ON products
  FOR EACH ROW EXECUTE FUNCTION homi_guard_reserved_product_delete();

Automated Provisioning:Docker compose automatically creates database, users, and seeds fixtures on first up

Download complete 01-schema.sql (152 lines) ↓

DevSecOps Self-Attack PipelineContinuous Adversarial Verification & SBOM Attestation

DevSecOps Continuous Self-Attack & Security Verification Pipeline

◆Core Engineering Thesis

"HOMI doesn't only run tests against expected behavior. Its CI deliberately attempts to violate the application's security and business invariants before a build is accepted."

Standard CI: "Does code compile, do tests pass, and are dependencies vulnerable?"

HOMI CI: "Can I deliberately violate this system's business invariants?"

HOMI bifurcates CI into commodity verification (OSV-Scanner, Aqua Trivy, Pint, PHPUnit, Nuclei) and an application-specific adversarial layer (Go attack harness, concurrency bursts, TOCTOU inventory conservation, FastCGI framing, Fowler Money fuzzing, and payment DAG monotonicity). Instead of relying on a generic pass/fail badge, the pipeline produces auditable machine-readable evidence artifacts on every push.

Adversarial Invariant Gates

11 / 11 invariant gates passed

25 concurrent checkout workers → 0 oversells, 0 negative inventory, 0 deadlocks

Supply Chain & Container Audit

0 known Critical/High vulnerabilities detected

Trivy SBOM & OSV-Scanner · Continuous sync

Cryptographic Fault Injection

1,000 / 1,000 injected ledger mutations detected

1,000 randomized ledger corruptions → 1,000 detected

Payment Saga Monotonicity

State Monotonicity Preserved

Concurrent capture/refund + out-of-order webhook delivery

Architectural Separation

Two-Layer Verification Model

Generic Scanners Cannot Test Domain Invariants

Layer 01 · BaselineIndustry Commodity

Commodity Verification Layer

Standard Baseline & Vulnerability Hygiene

Executes industry-standard vulnerability scanning, CVE matching, dependency hygiene, and application unit/integration test suites to establish baseline security.

Commodity Verification Toolchain

Google OSV-Scanner·Scans Composer lockfiles for known CVEs and malicious supply-chain packages

Supply Chain Audit

Aqua Security Trivy·Generates CycloneDX SBOM and audits base OS container CVEs

SBOM & Container Audit

Composer Audit & Laravel Pint·Enforces PSR-12 strict typing and checks package advisories

Code Quality & Advisories

Adversarial PHPUnit Suite·257 tests / 849 assertions verifying domain model contracts

Application Contract Tests

ProjectDiscovery Nuclei·Runs DAST vulnerability templates and protocol desync checks

Dynamic Edge Probes

Layer 02 · Adversarial CoreCustom Go Attack Harness

Application-Specific Adversarial Layer

Custom Go Harness Violating Domain Invariants

Generic scanners don't know that furniture inventory must obey conservation under 25 simultaneous checkouts, or that a refunded charge must never resurrect. Our compiled Go harness deliberately fires real-world attacks to break HOMI's business invariants before a build is accepted.

Domain Invariants Tested Under Real FireFail-Closed Oracle

High-Concurrency TOCTOU BurstEnforced

25 concurrent checkout workers → 0 oversells, 0 negative inventory, 0 deadlocks

BOLA / IDOR Horizontal IsolationEnforced

Cross-account order receipt lookup denied without session token

Reverse Proxy IP SpoofingEnforced

RFC 1918 internal header spoofing rejected with HTTP 403

Web Cache Deception (WCD)Enforced

Dynamic stateful routes reject static extension cache pollution

Continuous Pipeline Flow

Sequential Execution Lifecycle (Git Commit → Attestation)

Fail-Closed on Any Violation

01→

Source Commit & Signature

Git HEAD Attestation

02→

Dependency & Supply-Chain Scan

osv-report.json

03→

Static Quality & Style Checks

pint-summary.txt

04→

Application Contract Tests

test-results.xml

05→

Cryptographic Fault Injection

security-invariants.json

06→

Release-Container Scanning

release-image-trivy.json

07→

Custom Go Adversarial Harness

security-attack-report.json

08→

Dynamic Edge & Protocol Probes

nuclei-report.json

Machine-Readable Evidence Artifacts

CycloneDX SBOM + Audit JSON

Execution Lifecycle

8-Phase DevSecOps Verification Stages

Executed on Every Commit & PR in GitHub Actions

Stage 01Google OSV-Scanner v2.6.0

Dependency Vulnerability Scan

Scans Composer lockfiles and container components for known CVEs and malicious supply-chain packages against open vulnerability databases.

osv-scanner --recursive ./

Artifacts:osv-report.json

Stage 02Aqua Security Trivy 0.35.0

Filesystem SBOM & Supply-Chain Audit

Audits repository filesystem dependencies and generates a machine-readable CycloneDX Software Bill of Materials (SBOM).

trivy fs --scanners vuln --format cyclonedx -o reports/homi-sbom.cyclonedx.json ./

Artifacts:homi-sbom.cyclonedx.json

Stage 03Laravel Pint & Composer Audit

Code Style & Quality Invariant Scan

Enforces PSR-12 strict typing standards, code style invariants, and validates installed package security advisories.

./vendor/bin/pint --test && composer audit

Artifacts:pint-summary.txt

Stage 04PHPUnit 12.5 (257 Tests / 849 Assertions)

Adversarial PHPUnit Contract Suite

Executes unit, integration, and negative-path feature tests covering domain invariants, Fowler Money arithmetic, and order state machines.

php artisan test

Artifacts:test-results.xml

Stage 05Ed25519 & Sodium Fuzzer

Cryptographic Ledger & Bit-Flip Fault Injection

Validates SHA-256 block hash chaining integrity across all audit records and executes 1,000 randomized bit-flip corruptions to prove tamper detection.

php artisan audit:verify && php artisan audit:fuzz --iterations=1000

Artifacts:security-invariants.json

Stage 06Trivy Container Scanner

Release Candidate Container CVE Scan

Builds a production-shaped release candidate Docker image and performs deep CVE scans on base OS packages, PHP extensions, and Nginx binaries.

trivy image --severity CRITICAL,HIGH -f json -o reports/release-image-trivy.json homi-release-candidate:security

Artifacts:release-image-trivy.json

Stage 07Go Attack Engine v4.1.0

Adversarial Go Attack Harness (DAST)

Launches an adversarial Go test harness attacking the live Nginx/PHP-FPM stack across 11 security gates with concurrency depth 25.

./bin/homi-attack --target=http://127.0.0.1:8080 --concurrency=25 --report=reports/security-attack-report.json

Artifacts:security-attack-report.json

Stage 08ProjectDiscovery Nuclei v3.11

Dynamic Protocol & Edge Probing

Executes dynamic DAST vulnerability templates, header fuzzing, and protocol desynchronization checks against the live reverse proxy.

nuclei -u http://127.0.0.1:8080 -tags homi,security -o reports/nuclei-report.json

Artifacts:nuclei-report.json

Adversarial DAST Engine

The 11 Invariant Defense Gates

11 / 11 invariant gates passedView Verification Report→

Gate 0core.target_identity·Edge & Surface

Target Identity, Health Disclosure & CSRF Baseline

Security Invariant Rule

The harness must reach HOMI through the public edge, health output must be minimal, and session mutations must reject missing CSRF tokens with HTTP 419.

Experiment Verification Method

Edge handshake probe and non-CSRF state mutation fuzzing

Enforced

Target: GET /healthz, GET /, POST /cart/actions without CSRF

Gate 1access.proxy_spoofing·Network & Perimeter

Reverse Proxy IP Spoofing Probe

Security Invariant Rule

Administrative back-office MUST reject untrusted external client IPs and never leak authenticated dashboard access via spoofed forwarded headers.

Experiment Verification Method

Injected RFC 1918 internal IP headers against RestrictAdminAccess middleware

Enforced

Target: GET /admin & GET /admin/login (with spoofed X-Forwarded-For)

Gate 2access.order_isolation·Authorization

BOLA / IDOR Horizontal Order Isolation

Security Invariant Rule

Order confirmation receipts MUST enforce strict ownership isolation; guests must supply matching billing email or valid session access token. Attacker must not see victim PII.

Experiment Verification Method

Cross-account order lookup probes with mismatched credentials (HTTP 403)

Enforced

Target: GET /cart?tab=orders&lookup={order} & GET /order/{orderNumber}

Gate 3abuse.rate_limiting·Rate Limiting

Authentication & Quote Rate Limit Flooding

Security Invariant Rule

High-frequency submission endpoints MUST throttle abusive bursts and return HTTP 429 Too Many Requests.

Experiment Verification Method

Rapid-fire HTTP burst flooding exceeding configured throttle thresholds

Enforced

Target: POST /quote & POST /login

Gate 4inventory.checkout_conservation·Concurrency & Data

High-Concurrency TOCTOU Inventory Conservation Burst

Security Invariant Rule

Inventory decrement must happen atomically under pessimistic locking and must never oversell or go negative.

Experiment Verification Method

25 concurrent checkout workers → 0 oversells, 0 negative inventory, 0 deadlocks

Enforced

Target: POST /checkout (Pessimistic lock race)

Gate 5input.state_immutability·Data Integrity

Input Mutation & State Immutability Fuzzing

Security Invariant Rule

HTTP parameters must be strictly validated; mutated arrays, negative quantities, and Unicode homoglyphs rejected (HTTP 422) while application state remains completely immutable.

Experiment Verification Method

Fuzzing mutated type payloads and Unicode homoglyph strings

Enforced

Target: POST /cart/actions, POST /register & GET /search

Gate 6protocol.threat_interception·Application Firewall

Blue-Team Active Threat Interception

Security Invariant Rule

Active exploit signatures (path traversal, SQL injection, shell command injection, null bytes) MUST be intercepted with HTTP 400 and security action header.

Experiment Verification Method

Firing OWASP Top 10 attack payloads against storefront and API routes

Enforced

Target: GET /collection, GET /search & POST /cart/actions

Gate 7protocol.cache_deception·Cache Security

Web Cache Deception (WCD) Defense

Security Invariant Rule

Stateful dynamic endpoints must never return public cacheable headers when requested with static file extensions.

Experiment Verification Method

Requesting private dynamic routes with trailing static CSS/JS extensions

Enforced

Target: GET /order/{victimOrder}/style.css & GET /cart/analytics.js

Gate 8protocol.fastcgi_framing·Protocol Boundary

FastCGI Hop-by-Hop Framing Invariant & Smuggling Defense

Security Invariant Rule

Reverse proxy must strip hop-by-hop framing headers (Transfer-Encoding, Proxy) before FastCGI delivery to PHP-FPM.

Experiment Verification Method

Injecting hop-by-hop framing headers through public Nginx edge

Enforced

Target: GET /api/diagnostic/headers (with injected Transfer-Encoding or Proxy)

Gate 9finance.decimal_precision·Financial Precision

Micro-Cent Accumulation & Arbitrage Fuzzing

Security Invariant Rule

Monetary arithmetic must eliminate IEEE 754 float drift and preserve arbitrary-precision scale 4 invariants.

Experiment Verification Method

10,000 fractional multiplications fuzzed → 0 floating-point micro-cent rounding errors

Enforced

Target: GET /api/diagnostic/financial & POST /cart/actions

Gate 10payments.saga_monotonicity·Payments & Saga

Payment Saga DAG Monotonicity & Webhook Race Gate

Security Invariant Rule

Payment webhooks must require valid HMAC-SHA256 signatures; state transitions must follow DAG monotonicity without resurrection of refunded orders.

Experiment Verification Method

Concurrent capture/refund + replayed/out-of-order webhook suite → state monotonicity preserved

Enforced

Target: POST /api/webhooks/payment (HMAC verification & monotonic state machine)

Defense Toolchain

Enterprise Security Stack

Zero Proprietary Lock-In

Go Attack Enginev4.1.0

Adversarial DAST

Custom compiled Go test harness launching fail-closed multi-threaded concurrency bursts and protocol probes.

Aqua Security Trivyv0.35.0

SBOM & Container Security

CycloneDX SBOM generation and release candidate container image vulnerability scanning.

Google OSV-Scannerv2.6.0

Supply Chain Defense

Automated lockfile dependency audit verifying zero known CVEs across Composer packages.

ProjectDiscovery Nucleiv3.11.1

Dynamic Protocol Fuzzing

Dynamic edge vulnerability templates and HTTP desynchronization scanning.

Libsodium / SodiumPHP 8.4 ext

Cryptographic Signing

Ed25519 digital signature generation and verification for append-only audit ledger blocks.

PostgreSQL 16 PL/pgSQLv16.2

Storage Immutability

Engine-level triggers enforcing order lifecycle immutability and reserved inventory deletion guards.

Redis 7 Alpinev7.2

Distributed Rate Limiter

High-speed in-memory rate limiting and transactional outbox queue message brokering.

Cryptographic Evidence

Self-Attack Execution Attestation

Live Log Output Format

================================================================
   HOMI ADVERSARIAL SELF-ATTACK HARNESS (FAIL-CLOSED ORACLE)    
================================================================
Target: http://127.0.0.1:8080 | Concurrency: 25 | Engine: Go v4.1.0

[PASS] Gate 0: Target Identity, Health Disclosure & CSRF Baseline (8.2ms)
       ✓ Target identity verified through public Nginx reverse proxy
       ✓ Minimal healthz disclosure: status=ok, 0 environment leak
       ✓ Missing CSRF token rejected with HTTP 419 on state mutation

[PASS] Gate 1: Reverse Proxy IP Spoofing Probe (11.4ms)
       ✓ Injected RFC 1918 X-Forwarded-For header rejected on /admin
       ✓ RestrictAdminAccess middleware blocked external client: HTTP 403

[PASS] Gate 2: BOLA / IDOR Horizontal Order Isolation (14.1ms)
       ✓ Cross-account order receipt lookup denied without session token
       ✓ Customer PII strictly isolated; guest access requires signed URL

[PASS] Gate 3: Authentication & Quote Rate Limit Flooding (22.8ms)
       ✓ Rapid burst of 20 quote requests throttled at request 11
       ✓ Distributed Redis rate limiter returned HTTP 429 Too Many Requests

[PASS] Gate 4: High-Concurrency TOCTOU Inventory Burst (48.3ms)
       ✓ 25 concurrent threads raced to purchase 1 available stock unit
       ✓ Pessimistic row locking (lockForUpdate) acquired in 12ms
       ✓ Result: Exactly 1 order placed, 24 requests safely rejected
       ✓ Stock balance: Exactly 0. Zero oversell. Zero deadlocks (40P01).

[PASS] Gate 5: Input Mutation & State Immutability Fuzzing (16.7ms)
       ✓ Negative quantities, array mutation, and homoglyphs rejected: HTTP 422
       ✓ Application state verified immutable across fuzzed parameters

[PASS] Gate 6: Blue-Team Active Threat Interception (19.2ms)
       ✓ Injected path traversal (../../etc/passwd) intercepted: HTTP 400
       ✓ SQLi payload (' UNION SELECT null--) blocked by Eloquent binding

[PASS] Gate 7: Web Cache Deception (WCD) Defense (9.5ms)
       ✓ Request /order/HOMI-8F3A29B1/style.css returned private anti-cache
       ✓ Cache-Control: private, no-store, no-cache, must-revalidate

[PASS] Gate 8: FastCGI Hop-by-Hop Framing & Smuggling Defense (7.8ms)
       ✓ Injected Transfer-Encoding header stripped before FastCGI delivery
       ✓ HTTP/2 downgrade smuggling desynchronization strictly mitigated

[PASS] Gate 9: Micro-Cent Accumulation & Arbitrage Fuzzing (13.6ms)
       ✓ Fractional penny multiplications verified across 10,000 iterations
       ✓ Fowler Money bcmath scale 4 arithmetic eliminated IEEE 754 float drift

[PASS] Gate 10: Payment Saga DAG Monotonicity & Webhook Race Gate (31.2ms)
       ✓ Concurrent capture vs refund webhook race resolved monotonically
       ✓ Invalid HMAC-SHA256 signature rejected with HTTP 401 Unauthorized
       ✓ Refunded charge cannot be resurrected to authorized state

================================================================
VERIFICATION SUMMARY: 11 / 11 GATES PASSED (0 INVARIANT VIOLATIONS)
TOTAL EXECUTION TIME: 202.8ms | DAST ATTESTATION: VERIFIED FAIL-CLOSED
================================================================

Audit Artifacts

Machine-Readable Evidence Artifacts

View Full Verification Report & Audit Proofs →

security-attack-report.jsonjson

Full machine-readable execution report of all 11 adversarial Go gates with pass/fail criteria and latency metrics.

11 / 11 invariant gates passed (0 invariant violations)

homi-sbom.cyclonedx.jsoncyclonedx

CycloneDX Software Bill of Materials tracking 100% of runtime dependencies, licenses, and packages.

0 known Critical/High vulnerabilities detected in supply chain

release-image-trivy.jsonjson

Container CVE security attestation certifying the production Docker image is clean of high-severity vulnerabilities.

Hardened Container Baseline & Read-Only Root

security-invariants.jsonjson

Cryptographic ledger hash chain audit proof and 1,000-iteration bit-flip fault injection attestation.

1,000 / 1,000 injected ledger mutations detected

Commercial Clarity

Purchase, Licensing & Delivery FAQ

Zero ambiguity before checkout

Delivery & Access

What exactly happens immediately after I pay?

The moment your payment clears on LemonSqueezy, you are instantly redirected to your order confirmation receipt with a direct 1-click download link for the full production package (homi-production-v1.4.zip) containing complete source code, Docker configs, and database seeders. You also receive an automated email receipt with your permanent license token and a permanent re-download link. If you would also like direct collaborator access to the private GitHub repository, simply reply to your receipt email with your GitHub username and we'll grant access within 24 hours.

Updates

Are future HOMI versions and patches included?

Yes. All minor releases, security patches, and framework updates across the HOMI v1.x series (e.g. v1.5, v1.6, security updates) are included free forever. Whenever an update is released, you can re-download the latest release archive directly from your LemonSqueezy customer portal at any time, or pull updates via git if you've requested repository access.

Support Boundaries

What level of developer support is included?

Included: Direct email and GitHub issue support from the core maintainer (@frogdevops) for 30 days post-purchase, covering Docker Compose boots, environment configuration, database seeders, and verified bug fixes. Not included: Custom bespoke feature engineering, third-party ERP integrations, or client-specific design tweaks (available as separate consulting engagements upon inquiry).

Agency Usage

What does "unlimited client deployments" mean in practice?

It means exactly what it says: you pay $149 once and you can use HOMI as the foundational architecture for 1 client, 10 clients, or 100 clients. There are zero per-site licensing royalties, zero recurring developer seats, zero domain activation keys, and zero telemetry phone-home scripts. You charge your clients your standard agency rate and keep 100% of your earnings.

Client Ownership

Can our client's in-house engineering team modify the code?

Yes. Once you deliver a customized build to your client as part of your bespoke project, their internal engineering team has full rights to inspect, audit, host, refactor, and maintain that specific deployment in perpetuity.

Contractors & Teams

Can an agency share the repository with freelance contractors?

Yes. You may grant access to your internal agency developers, employees, and freelance contractors actively working on your client deployment, provided they are bound by standard commercial confidentiality.

Prohibited Resale

What precisely counts as prohibited redistribution?

The simple rule: do whatever you want with it—build client sites, run your own commercial stores, customize every single line of code, and make money. Just don't buy it, re-zip it, and resell it as your own starter kit or boilerplate. That's the only line. In legal terms: you cannot redistribute, resell, or open-source the raw codebase on marketplaces (ThemeForest, Envato, Gumroad, etc.). You can deploy it for unlimited commercial clients, retail showrooms, and stores where the deliverable is a real functioning business.

Refund Policy

What is your refund policy for digital source code?

Because HOMI delivers immediate, unencrypted, and irrevocable access to full production source code upon checkout, sales are generally final. However, if you discover a reproducible defect or architectural bug in the core stack that cannot be resolved by maintainers within 5 business days of reporting, a full 100% refund will be issued via LemonSqueezy.

HOMI Architectural E-Commerce Engine

Hybrid Retail Showroom & Bespoke Quote Engine

Architectural Rationale

System Topology & Container Mesh

Dual Operational Workflows

Deliverables & Deployment Speed

Warm Scandinavian Minimalism

Payload & Runtime Footprint

Color Tokens & Pigment System

Typography Architecture

Cinzel

Plus Jakarta Sans

Frameworks & Client Environment

Interactive UI Component Suite

Real-Time Debounced Search Modal

AJAX Slide-Out Cart Drawer

Bespoke Dimension & Quote Modal

Multi-Image Interactive Showroom Gallery

Frontend Asset Architecture

Client State & Event Bus Architecture

Hexagonal Domain Core & Asynchronous Outbox

Hardened Security Matrix

Dual Operational Pipelines

Storefront Transaction & ACID Checkout Pipeline

Atelier Bespoke & Digital Asset Pipeline

Production Code Reality

REST API Contract Directory

Backend Source Tree & Separation of Concerns

PostgreSQL Relational Architecture & ACID Isolation

Entity Relationship Diagram (ERD)

Ledger Architecture & Immutability

Append-Only Transaction Ledger & Immutability Standard

Foreign Key Topology & Cascade Matrix

Relational Schema Directory

1. Identity & Role-Based Access

2. Showroom Catalog & Taxonomy

3. Immutable Transaction Ledger & Payments

4. Bespoke Atelier & Customer Proof

5. Cryptographic Audit & Asynchronous Outbox

DDL Schema Bootstrapper

DevSecOps Continuous Self-Attack & Security Verification Pipeline

Two-Layer Verification Model

Commodity Verification Layer

Application-Specific Adversarial Layer

Sequential Execution Lifecycle (Git Commit → Attestation)

8-Phase DevSecOps Verification Stages

Dependency Vulnerability Scan

Filesystem SBOM & Supply-Chain Audit

Code Style & Quality Invariant Scan

Adversarial PHPUnit Contract Suite

Cryptographic Ledger & Bit-Flip Fault Injection

Release Candidate Container CVE Scan

Adversarial Go Attack Harness (DAST)

Dynamic Protocol & Edge Probing

The 11 Invariant Defense Gates

Target Identity, Health Disclosure & CSRF Baseline

Reverse Proxy IP Spoofing Probe

BOLA / IDOR Horizontal Order Isolation

Authentication & Quote Rate Limit Flooding

High-Concurrency TOCTOU Inventory Conservation Burst

Input Mutation & State Immutability Fuzzing

Blue-Team Active Threat Interception

Web Cache Deception (WCD) Defense

FastCGI Hop-by-Hop Framing Invariant & Smuggling Defense

Micro-Cent Accumulation & Arbitrage Fuzzing

Payment Saga DAG Monotonicity & Webhook Race Gate

Enterprise Security Stack

Self-Attack Execution Attestation

Machine-Readable Evidence Artifacts

Purchase, Licensing & Delivery FAQ

What exactly happens immediately after I pay?

Are future HOMI versions and patches included?

What level of developer support is included?

What does "unlimited client deployments" mean in practice?

Can our client's in-house engineering team modify the code?

Can an agency share the repository with freelance contractors?

What precisely counts as prohibited redistribution?

What is your refund policy for digital source code?