JBNX stack architecture review — growth, security, affordability

JBNX stack architecture review — 2026-08-03

Audience: CEO · Slugs: full-stack, projects-portal · Directive: v28

BLUF

The stack is already a coherent AI-operated portfolio OS: Postgres truth + thin SPA frame + LiteLLM gateway + claim leases. Strengths are cost control, collision avoidance, and a clear ship path. Risks are single-service blast radius (hi + portal together), ungated public write APIs (rate-limited only), DNS still on Squarespace, and spend truth split across Cursor / Claude / gateway / vendor receipts. Grow by deepening producers + enforcement, not by adding platforms.

Configuration map (what runs what)

Layer	Live components	Config / SoT
Edge / DNS	Squarespace Domains (jbnx.io, projects, hi, llm)	Planned: Cloudflare WAF/cache
Host	Railway project ai.jbnx.io — services: projects, web (ai.jbnx.io), litellm, langfuse, Redis, LiteLLM Postgres, Langfuse Postgres	rootDirectory=projects-portal for projects
Public surfaces	projects.jbnx.io (SPA+API), hi.jbnx.io (directive), llm.jbnx.io (gateway), product apps / landings	deploy-targets API
Data	Supabase jbnx — portfolio. + agent_ops.; curated public.pf_* views + RLS	handovers, claims, facts, stack_nodes, documents
Agent plane	Cursor Cloud / IDE · agent.sh · /api/1099/* · Compiled Brief ≤2k · memory_facts	ai_os_v1, ai_context_v1, ai_architecture
Models	LiteLLM cheap→standard→frontier, Redis cache, Langfuse traces	virtual keys; IDE paths still record_usage
Ship	GitHub Actions quality-gates (gitleaks/semgrep/OSV) · main→test · chat approve→prod	releases registry + Railway redeploy rollback
Products	CipherDeck, FedM8 (+scan), NodeDough, Tensuite, landings — own repos / Supabase projects	one claim per slug

Pros

• Truth in DB — handovers versioned; SPA is a shell; agents update via API.
• Cheap-by-default AI — brief/facts/cache/clerk cut token reuse; frontier only after failures.
• Collision control — one live lease per slug; board + next work.
• Observability exists — site_checks, guard_runs, Langfuse, usage_events (even when cost_usd is thin).
• Rollback path — app versions list + Railway redeploy; DB migrations separate (honest).
• Lean host surface — one Railway project for company AI + portal; few moving parts.

Cons / risks

• hi.jbnx.io and portal share one process — bad deploy takes down every agent’s boot doc.
• Public /api/1099 writes are ungated — intentional for contractors, but abuse/spam is a real threat model; rate limits are the only front door.
• DNS on Squarespace — no WAF/CDN/bot fight; Cloudflare still “planned.”
• Spend SoT fragmented — IDE chat hard to meter; gateway vs vendor receipts disagree; silent $0 still possible if agents skip usage.
• Activity / realtime gaps — producers were historically dead; SPA still poll-heavy; push incomplete.
• Claim slug hygiene — free-text refs historically drifted; project_id not always enforced.
• Single replica — simple and cheap; no HA for portal/directive.

Recommendations (growth · security · affordability)

Affordability (keep service, cut waste)

1. Keep brief ≤2k + facts top-k + prompt cache as non-negotiable — this is the main cost lever.
2. Finish portal spend ← LiteLLM import so one Spend page is honest USD.
3. Stay on Langfuse v2 until trace volume hurts; do not buy ClickHouse early.
4. Cap max 2 parallel cloud agents; serial bake-offs only.
5. Enforce token-health cycle in practice (close chat >20:1 in:out).

Security (raise floor without killing speed)

1. Move DNS/edge to Cloudflare (WAF, bot fight, cache static) — highest ROI next step.
2. Add abuse controls on /api/1099/*: tighter per-IP/actor budgets, anomaly alerts, optional signed actor cookies for write bursts.
3. Split or harden directive availability: either a tiny read-only hi failover, or deploy canaries so a bad portal build cannot blank hi for long.
4. Keep CI gates green before frontier spend; continue gitleaks/semgrep/OSV.
5. Prefer document API + RLS views over new static HTML under public/framework/.

Growth (scale products, not ceremony)

1. Complete Phase 0–2 from the realtime review: activity producers → SSE/push → panel drill-down.
2. Wire visit-beacon on FedM8 / CipherDeck / landings so #/map becomes a real signal.
3. Treat full-stack, automation, ceo-desk, fedm8-llc as either active lanes with owners or park them — stop letting open-task counts look like delivery.
4. Keep product apps in own repos + own Supabase; portal remains the OS, not the monolith.
5. Promote test → prod only after live verify on test.projects.jbnx.io + chat approve.

Way forward (ordered)

1. Ship directive v28 (this change) so every agent boots knowing how the project site works.
2. Cloudflare cutover for jbnx.io zones (projects, hi, llm) — security + cache without rewriting apps.
3. Activity producers + spend import — make the board and Spend page trustworthy.
4. Write-API abuse budget + optional hi read replica/canary — protect the boot surface.
5. Product beacons + document library fill — growth telemetry and readiness without new static pages.

Verify

• curl -sS https://hi.jbnx.io/json | jq .version → 28 after prod deploy
• curl -sS https://hi.jbnx.io/md | grep -F 'How the project site works'
• curl -sS https://projects.jbnx.io/healthz → ok
• Open #/stack, #/ai, #/ RAD board