Framework partner workflow

Downstream repo contribution and update workflow

How partner-specific registrar repos connect to the Partner API while keeping secrets, billing, and registry backend controls protected.

Repo Model

headlessdomains-partnersControl plane, Partner API, agreements, modules, Gems ledger, and registry backend state.

headlessdomains-whitelabelUpstream frontend framework/template for registrar storefronts.

Partner downstream repoPartner-specific branding, theme, copy, feature flags, deployment config, and allowed custom pages.

Access Levels

Hosted Starter partners request changes through support. Framework Partner and Custom/Enterprise partners may receive repo access under agreement.

Access can be read-only, contribution-based pull requests, or maintain access when contract and support terms allow.

Secrets Rule

Do not put Partner API keys, GFAVIP wallet keys, SkyInclude credentials, database credentials, admin secrets, or customer exports in GitHub.

Server-side env vars belong in Railway or the partner's hosting environment.

Contribution Flow

1. ScopePartner opens a support/module request in the Partners Portal.

2. BranchPartner, developer, or AI agent opens a downstream repo branch or pull request.

3. ReviewHeadlessDomains checks API safety, payment handoff, secret handling, module scope, and screenshots/test steps.

4. DeployApproved frontend-only changes merge to staging or production according to the partner Railway workflow.

5. RecordThe support request gets the PR, preview, deploy link, reviewer notes, and final status.

AI Agent Rules

Partner AI agents can work in downstream frontend repos only when repo permissions allow. They should open pull requests, keep API secrets server-side, preserve payment-success callback patterns, and avoid changing billing or Gems ledger behavior.

Upstream Updates

When the upstream white-label framework improves, HeadlessDomains opens downstream PRs, keeps partner overrides intact, checks env var changes, runs tests/previews, and merges only after branding and checkout still work.

Merge Checklist

SecurityNo secrets, private customer data, or browser-exposed secret API calls.

CommerceCheckout still verifies payment before registration and keeps retail/wholesale boundaries clear.

ScopeEnabled namespaces, modules, terms/support links, screenshots, and preview URL are reviewed.