09 · Integration

Three products, one operating system.

Brokher.com and Proassistly already communicate. This page defines the spine that turns them plus Zettlein into a single OS — with clear roles, one write path, and a rollout that never freezes what already works.

A · Role division

Decide once, enforce everywhere.

role/01

Proassistly

system of record

Owns identity, data, state, money, contracts, audit. The only place writes happen.

role/02

Zettlein

interface + intelligence

Owns no rows. Reads a projection, mutates via the RPC surface, logs every action.

role/03

Brokher.com

distribution surface

Owns no state. Renders the read-model, embeds Zettlein, drives SEO and trust.

The rule: all writes go through Proassistly RPC. Zettlein and Brokher have zero direct database access. Break this rule and the OS becomes three apps again.

B · Integration spine

One diagram, one write path.

                 ┌─────────── Brokher.com (SSR) ───────────┐
                 │  read-model API   +   Zettlein <script> │
                 └───────▲───────────────────▲─────────────┘
                         │                   │
                 read    │                   │ chat + tool-calls
                         │                   │
                 ┌───────┴────── Zettlein ───┴─────────────┐
                 │  agent-orchestrator · RAG · guardrails  │
                 └───────────────────▲─────────────────────┘
                                     │ authenticated RPC (mTLS + JWT)
                                     ▼
                 ┌─────────────── Proassistly ─────────────┐
                 │ Identity · Property · CRM · Contracts · │
                 │ Payments · Media · Workflows · Events   │
                 └────────────────────┬────────────────────┘
                                      │ domain events (EventBridge / SQS)
                                      ▼
                    read-model projector  ·  search index  ·  RAG index

C · Four concrete couplings

What you actually need to build.

link/01

Identity federation

one user, one id

One Proassistly user id per person. Brokher login and Zettlein session request scoped access tokens signed by Proassistly. Zettlein inherits the visitor's auth state; anonymous visitors get a session token bound to a device fingerprint.

link/02

Zettlein embed on Brokher

one script tag

<script src="zettlein.js"> + data-listing-id. Widget opens a WSS session against session-svc, inherits locale and auth, and is scoped to the current listing. Same widget mounts inside Proassistly panels.

link/03

Tool RPC contract

/rpc/v1/*

One versioned RPC surface in Proassistly. Zettlein calls only this. Every tool has a schema, an idempotency key, dry-run mode, and rate limits. No SQL from outside, no service-hopping from Zettlein.

link/04

Event bus + projections

one truth, three views

Proassistly emits listing.published, offer.submitted, contract.signed, etc. A projector fans out to (a) Brokher read-model, (b) Zettlein vector index, (c) OpenSearch. Eventually consistent, replayable.

D · Migration

From “3 apps” to “1 OS” without a freeze.

Phase	Focus	What ships	What we don't touch	Rollback
0	Contracts	Define /rpc/v1 surface + domain event schema in Proassistly. Publish OpenAPI + AsyncAPI docs.	Brokher keeps reading Proassistly the way it does today.	Docs only — no runtime change.
1	Embed	Ship Zettlein read-only widget on Brokher PDPs. RAG over listings + Cambodia legal pack. AiAction log live.	No mutations. Existing Brokher UX unchanged.	Feature flag off = widget disappears.
2	Structured tools	Enable book_tour, submit_offer, create_reservation_agreement via RPC. Confirm cards for every write.	Underlying contracts / payments flow in Proassistly stays as-is.	Per-tool feature flag, per-tenant override.
3	Capture	Zettlein capture app publishes listings via publish_listing RPC. Media pipeline live.	Brokher rendering pipeline unchanged; still consumes read-model.	Fall back to manual listing form in Proassistly admin.
4	Full agent	Escrow, e-sign, payout, cross-border FX, ZH market via tool-use.	—	Each rail behind its own flag; escrow can revert to manual ops.

E · What this changes on day one

The smallest useful step.

now/01

Freeze the contract

week 1

Lock /rpc/v1 and the event schema. Nothing else in the plan works until this is signed off.

now/02

Ship the embed

week 2–4

Read-only Zettlein on Brokher PDPs, Cambodia only, KH/EN. Measure resolution, latency, deflection.

now/03

Turn on the first write

week 5–6

book_tour — lowest risk mutation, highest signal on trust in the confirm-card pattern.