| Orchestrator | Orchestrator | Delegates work to five specialized agents and halts on any sensitive action. | CI/CD agent, Deploy agent, Security & IAM agent, Backup agent, QA agent |
|---|
| CI/CD agent | Agent | Owns pipeline definitions and the automated quality gate. | GitLab pipelines, OpenAPI lint, 36 contract tests |
|---|
| Deploy agent | Agent | Ships to four environments; production requires a human. | Dev, QA, Hotfix, Terraform IaC, 4-service Docker Compose, Human approval gate |
|---|
| Security & IAM agent | Agent | Proposes secret, role and branch-protection changes. Executes none of them alone. | Human approval gate |
|---|
| Backup agent | Agent | Snapshots and schema migration integrity. | Snapshots, 27 migrations |
|---|
| QA agent | Agent | Runs the contract and assertion suites before any merge. | 36 contract tests, 58 requests, 251 assertions, 6 SQL contract tests |
|---|
| Human approval gate | Approval gate | Every sensitive action stops here. 100% of production deploys are manually gated. | Production, Secrets, IAM roles, Protected branches |
|---|
| GitLab pipelines | Surface | Pipeline definitions and runners. | — |
|---|
| OpenAPI lint | Surface | Spec conformance on every change. | — |
|---|
| 36 contract tests | Surface | Service contract assertions. | — |
|---|
| 58 requests, 251 assertions | Surface | Postman-Newman regression collection. | — |
|---|
| 6 SQL contract tests | Surface | Row-level security and RBAC invariants. | — |
|---|
| Dev | Surface | Environment 1 of 4. | — |
|---|
| QA | Surface | Environment 2 of 4. | — |
|---|
| Hotfix | Surface | Environment 3 of 4. | — |
|---|
| Production | Surface | Environment 4 of 4. Reachable only through the gate. | — |
|---|
| Terraform IaC | Surface | VPC, subnets, security groups, DNS. | — |
|---|
| 4-service Docker Compose | Surface | Postgres, API, Nginx reverse proxy, worker. | — |
|---|
| Secrets | Surface | Gated. No agent holds a write path. | — |
|---|
| IAM roles | Surface | Gated. Permission changes need a human. | — |
|---|
| Protected branches | Surface | Gated. Direct pushes are refused. | — |
|---|
| Snapshots | Surface | Point-in-time recovery set. | — |
|---|
| 27 migrations | Surface | Versioned Firestore to PostgreSQL star schema. | — |
|---|
