Recruiter access
Technical Design · v1.7

How Agent Bob & Agent Cipher work

A governed, four-tier multi-agent platform — Agent Bob delivering methodology-backed virtual PMO across 8 domains and 14 regulatory frameworks, and Agent Cipher providing RAG-powered cybersecurity intelligence across threat, incident, and governance modes, grounded in 817 curated skills mapped to MITRE ATT&CK v19.1 and NIST CSF 2.0. Every conversation is auditable, access is gated to authorised sessions, and the GAELIX Command Centre — protected by TOTP MFA — gives operators full visibility over platform health, cost, security, and AI-driven remediation.

Next.js · TypeScript Claude AI · Model Mesh Supabase · PostgreSQL · pgvector Vercel · Serverless ITIL v4 · PMBOK · Compliance Row Level Security MITRE ATT&CK · NIST CSF Proactive Security Scanner TOTP MFA · Command Centre
System Overview
Four-tier architecture

Two separate deployments, one governed intelligence layer, one persistent data layer — connected by authenticated API calls with CORS enforcement. A scheduled job drives the proactive security pipeline independently of user traffic.

Presentation Layer
gaelix.online — Static Web App + Command Centre
Deployed on Vercel · Static HTML / CSS / Vanilla JS · Public chat UI + MFA-protected operator platform
Chat UI PMO / Governed Mode Selector Access Code Gate Decision Passport Panel Quick Prompts MFA-Gated Admin Platform Security Scanner UI Scan Scheduler Cost Dashboard TOTP MFA Login Command Centre
HTTPS · CORS · Authenticated sessions
API / Orchestration Layer
agent-bob.vercel.app — Serverless API
Next.js · TypeScript · Vercel Serverless Functions · CORS-enforced · Secret management via environment variables
Conversation API Decision Passport API Access Verification Profile API CORS Origin Validation Mode Routing Scheduled Security Pipeline Vulnerability Scanner AI Remediation Agent Admin Authentication TOTP MFA Verification
Claude AI · streaming
Supabase · service role
Intelligence Layer
Claude AI
Provider-independent via Model Mesh adapter. System prompt selected by mode at request time — never hard-coded in the client.
Claude AI Model Mesh adapter PMO system prompt Governed system prompt 8 PMO domains
Data Layer
Supabase
Postgres with pgvector, Realtime, Auth, and Storage. All tenant tables have ENABLE + FORCE RLS. Service-role client used server-side only.
PostgreSQL pgvector Row Level Security Custom JWT hook Supabase Auth Realtime Audit records Token usage
Components
What each tier does

Each tier has a single responsibility and communicates only through defined interfaces.

🖥️
Presentation — gaelix.online
Zero-dependency static site. All server communication goes through the AgentBob API — no direct LLM calls, no secrets in the browser.
  • Two-card mode selector: Standard PMO and Governed PMO
  • Access code gate — verified server-side before any session starts
  • Chat window with streaming response rendering
  • Decision Passport panel — displays structured governance output
  • XSS-safe rendering: all user input HTML-escaped, API responses rendered through a controlled sanitising renderer
  • Quick prompts per mode; UUID session identifier per conversation
  • GAELIX Command Centre — TOTP MFA gated operator dashboard (password → signed pre-token → 6-digit TOTP) with recovery code escape hatch; panels: Dashboard, Access Codes, Experience, Knowledge Base, Security, Cost, Portfolio, Operations
Static HTMLVanilla JSVercelNo framework
⚡
API Layer — Serverless Functions
Stateless serverless API routes handling routing, prompt selection, access validation, and data persistence. All secrets held in environment variables — never in client code.
  • Conversation handler — receives message, mode, and session; selects system prompt server-side; calls Claude; writes session record
  • Decision Passport generator — produces structured governance artefact from conversation context
  • Access verification — validates access codes server-side via privileged backend client; zero anon access to the code store
  • Admin authentication — two-step flow: password → cryptographically signed short-lived pre-token → TOTP validation → admin session
  • Security pipeline — scheduled vulnerability scanning with AI-assisted remediation; deduplication guard prevents concurrent runs
  • CORS enforced via a server-side origin allowlist validated on every request
Next.jsTypeScriptApp RouterServerless
🧠
Intelligence — Claude AI
Provider-independent LLM access via a Model Mesh adapter. System prompts live server-side only — never exposed to the browser. Two AI agents share one governed runtime.
  • Claude AI model — configurable via the Model Mesh adapter; swap providers by changing one config value
  • Agent Bob — Three system prompts: Standard PMO (practitioner advice), Governed PMO (mandatory 4-section structure), and Project Planner (multi-turn structured intake)
  • Governed mode enforces: Assessment · Risk Flags · Recommendations · Governance Notes in every response; 8 PMO domains; 14 regulatory frameworks with article-level citations
  • Agent Cipher — Three cybersecurity personas: Threat (vCSO adversary intelligence), Incident (IR Commander containment & recovery), and Governed (formal security governance & compliance)
  • Cipher RAG pipeline — 817 curated skills ingested from the Anthropic Cybersecurity Skills library, indexed with pgvector HNSW; top-8 retrieval with mode-aware query prefixes; MITRE ATT&CK v19.1 and NIST CSF 2.0 framework citations enforced in every response
  • Agent isolation — each agent queries only its own knowledge partition; Cipher and Bob RAG pools are separated by an agent-type filter at retrieval time
Claude AIModel MeshServer-side promptsMITRE ATT&CKNIST CSF 2.0pgvector RAG
🗄️
Data — Supabase
Managed Postgres with pgvector, Auth, Storage, and Realtime. All tenant tables are fully locked down with row-level security.
  • Every tenant table has row-level security enabled and forced — deny-by-default for all non-service roles
  • Policies keyed on the authenticated tenant JWT claim via a custom Supabase hook
  • Access code store has zero anon or authenticated RLS policies — service-role client only
  • pgvector ready for semantic search over programme documents and decisions
  • Supabase Realtime available for live dashboard updates
PostgreSQLpgvectorRLSAuthStorageRealtime
Admin Platform
GAELIX Command Centre

A TOTP MFA gated operator dashboard — the single control surface for provisioning, monitoring, security, and cost management of the platform.

Authentication flow
Step 1
Password
Credential check — server-side only
→
Server
Pre-token issued
Cryptographically signed · short-lived
→
Step 2
TOTP Code
6-digit from authenticator app · or single-use recovery code
→
Authenticated
Admin Session
Token stored · Command Centre loads
Command Centre panels
📊
Dashboard
Platform health overview — active sessions, token usage, access code activity, recent security scans, and credit metrics.
🔑
Access Codes
Create, list, and manage access codes. Set credit limits; monitor credits used per code.
🎓
Experience
Manage CV and experience data surfaced in the profile and recruiter engagement flow.
📚
Knowledge Base
Manage Agent Bob's knowledge context — ingested documents and domain content for the intelligence layer.
🔍
Security
Manual scan trigger, scan history with Scheduled / Manual trigger badges, scan scheduler with auto-fix toggle, and IP rate-limit telemetry.
💰
Cost
Token spend breakdown by day, model, access code, and session — sourced from the audit records table.
🗂️
Portfolio
Portfolio and project showcase management for the recruiter-facing gaelix.online profile.
⚙️
Operations
Ariel AI Troubleshooter — estate sweep, Tier 1 auto-fix, Tier 2 AI-generated proposals, operator approve/reject, and Decision Passports.
Automation
Proactive security pipeline

A scheduled job fires every morning at 03:00 Ireland time. It runs a full vulnerability scan and, if auto-remediation is enabled, passes findings to an AI security agent that diagnoses and fixes issues automatically — before the working day begins.

Automated daily flow
1
Scheduled trigger fires — 02:00 UTC / 03:00 Ireland BST
The scheduler invokes the security pipeline. The endpoint immediately validates a secret authorisation token; any mismatch is rejected before any processing occurs.
2
Schedule guard checks
Reads scan schedule config: if scanning is disabled or a scan already ran today, exits immediately. A deduplication guard prevents concurrent invocations.
3
Vulnerability scan runs
Full vulnerability scan executes. Findings are written to the audit records store with status, severity, and trigger source — scheduled or manual.
4
Auto-remediation (if enabled)
If auto-fix is enabled in the scheduler config, the AI remediation agent is invoked with the scan results. Claude AI analyses each finding and applies targeted, minimal fixes.
5
Results recorded & surfaced
Scan record updated. Results appear in the Admin Security tab with a Scheduled badge alongside any manual runs (Manual). Admin can review remediations, compare runs, and toggle the schedule at any time.
Scheduler config
Fires at03:00–03:59 Ireland / 02:00 UTC
Enabled flagAdmin UI toggle
Auto-fix flagAdmin UI toggle
Double-run guardsame-day deduplication
Trigger badges in history
⏰ Scheduled Automatically triggered by the daily schedule
⚓ Manual Operator-triggered from the Security tab
Manual override always available
Admin can trigger a scan immediately from the Security tab, independent of the schedule. Both trigger types appear in the same history list, distinguished by badge.
Data Flow
Request lifecycle

From the moment a user submits a message to a streamed, methodology-backed response recorded in the audit store.

1
Access code verification
User enters an access code on gaelix.online. The platform verifies the code server-side via a privileged backend client — the code store has zero anon access and is never reachable from the browser directly. On success, the UI unlocks and a UUID session identifier is generated client-side.
Presentation layer → API layer · server-side verification
2
Mode selection
User selects Standard PMO or Governed PMO via the two-card selector. The selected mode is stored in a client-side variable and sent with every subsequent message — it determines which system prompt is applied server-side.
Client-side state · mode: standard or governed
3
Message sent to API layer
User submits a message. The frontend sends the message, session identifier, mode, and conversation history to the API layer. CORS is validated against the server-configured origin allowlist before the request is processed.
API layer · CORS validated · authenticated session
4
System prompt selection
Based on the mode field, the API selects either the practitioner (conversational) or governed (formal, 4-section mandatory structure) system prompt. Both prompts live server-side only — never sent to the browser or exposed in client code.
Server-side prompts only · never client-exposed
5
Claude AI processes the request
The API calls Claude AI via the Model Mesh adapter with the selected system prompt, conversation history, and the user's message. The model reasons across 8 PMO domains to produce a methodology-backed response.
Intelligence layer · Claude AI · Model Mesh
6
Response streamed to UI
The API streams tokens back to the frontend. The chat UI renders each token progressively using a controlled sanitising renderer — which sanitises markdown and applies safe HTML rendering without exposing raw API output to XSS risk.
Streaming response · XSS-safe rendering
7
Session recorded in the audit store
On completion, the API writes the session record (session identifier, message, response, mode, timestamp) to the data layer using the server-side client. Row Level Security ensures tenant isolation.
Data layer · service-role write · RLS enforced
8
Decision Passport (optional)
After a governed conversation, the user can request a Decision Passport. The frontend requests the governance document from the API layer, which uses Claude AI to produce a structured record (decision ID, risk flags, recommendations, audit trail) and returns it for display and download.
API layer → Structured governance output
Intelligence
Three operating modes

Mode is selected per conversation and determines the system prompt, response structure, and governance posture. Project Planner mode (v1.1) adds structured intake and artefact generation.

Standard PMO
Practitioner advice mode

Conversational, evidence-backed PMO guidance across 8 domains. Suitable for general programme delivery questions, methodology advice, and stakeholder planning.

  • Free-form conversational responses
  • Draws on PMBOK, ITIL v4, DORA, Agile/Hybrid frameworks
  • Covers all 8 PMO domains in any order
  • Practical, actionable language — no mandatory structure
  • Suitable for day-to-day programme management questions
Governed PMO
Formal governance mode

Audit-ready, structured responses enforcing a mandatory 4-section format. Every response is a governance record suitable for steering committees and compliance reviews.

  • Assessment — situation analysis against PMO standards
  • Risk Flags — identified risks with severity ratings
  • Recommendations — prioritised, evidenced actions
  • Governance Notes — compliance, audit, and escalation guidance
  • Outputs suitable for Decision Passport generation
Project Planner ✦
Structured intake mode v1.1

Multi-turn intake flow that asks structured questions, identifies gaps, and produces a milestone plan, risk register, and action log for any project brief.

  • Structured intake — objective, timeline, team, risks, constraints
  • Gap-detection: asks follow-up questions where information is missing
  • Milestone plan — high-level phases with dates
  • Risk register — identified risks with severity & mitigations
  • Action log — prioritised immediate next steps
Feature
Decision Passport

A structured governance artefact generated from a Governed PMO conversation — immutable, auditable, and fit for board-level review.

When a Governed PMO session reaches a decision point, the user can request a Decision Passport. The system generates a structured document capturing the full governance context of the decision.

Each passport is assigned a unique ID, records the risk and compliance posture at time of decision, and is stored in the audit store for retrieval.

  • Unique decision ID (UUID) per passport
  • Captures assessment, risk flags, and recommendations at point of decision
  • Governance notes section for escalation and compliance trail
  • Stored server-side — retrievable for audit
  • Printable / exportable as a formal governance record
  • Future: DORA compliance scoring, digital signature
Decision Passport · GP-2026-0147
Date19 Jul 2026
ModeGoverned PMO
Session IDa3f8…c12d
Risk Level⚠ Medium — 3 flags
Assessment
Programme governance gate review for Phase 3 mobilisation. Dependency on vendor onboarding creates schedule risk at milestone M4.
Risk Flags
R1 · Vendor SLA not confirmed — HIGH
R2 · Resource allocation gap wk 32 — MEDIUM
R3 · Stakeholder sign-off pending — LOW
Governance Notes
Escalate R1 to Steering Committee by EOW. No gate approval until vendor SLA signed.
Security
Security & governance controls

Built to enterprise standard — every boundary is enforced, every tenant is isolated, every action is logged.

🔒
Row Level Security
All tenant tables have row-level security enabled and forced. Policies are keyed on the tenant claim injected by a custom JWT hook. No data leaks between tenants by design.
🛡️
Access Code Gate
The access code store has zero anon or authenticated RLS policies — it is accessible only via the service-role client running server-side. No unauthenticated request can read or enumerate access codes.
🔐
Secret Management
API keys, database credentials, and CORS allowlist are held in server-side environment variables only. No secrets appear in client code, version control history, or build artefacts.
🌐
CORS Enforcement
The API validates the origin header on every request against a server-side allowlist. Requests from unlisted origins are rejected before any processing occurs.
🧹
XSS Prevention
All user input is HTML-escaped before DOM insertion. API responses are rendered through a controlled markdown-to-HTML renderer that never trusts raw output. No unescaped content is set on the DOM directly.
📋
Audit Trail
Every agent interaction writes an immutable session record to the data layer. Governed PMO sessions produce Decision Passports — structured artefacts timestamped, risk-rated, and stored for compliance retrieval. Designed to align with DORA audit requirements.
🔍
Proactive Vulnerability Scanner
A scheduled job fires daily at 03:00 Ireland time, runs a full vulnerability scan, and — if auto-fix is enabled — invokes the AI remediation agent to address findings automatically. Results are stored and surfaced in the Admin Security tab with trigger-type badges.
🚦
IP Rate Limiting
Failed access-code attempts are tracked via hashed IPs using a service-role-only store with zero anon access. Repeated failures within a rolling window trigger HTTP 429. Rate-limit state is logged for the Security telemetry dashboard.
🔐
TOTP Multi-Factor Authentication
Admin login requires a time-based one-time password as a mandatory second factor. The password step issues a short-lived cryptographically signed pre-token. The MFA step validates a 30-second TOTP code; a single-use recovery code provides an escape hatch. All MFA logic is server-side only.
Stack
Technology stack

Every technology choice is a fixed decision (see ADRs). Changes require a new Architecture Decision Record.

AI & Agents
Anthropic Claude AI Model Mesh adapter Server-side prompts Streaming responses
Frontend
Static HTML / CSS / JS Vercel (CDN) Space Grotesk · Inter No framework
Backend
Next.js TypeScript App Router Vercel Serverless Edge Functions Scheduled Jobs
Data
Supabase PostgreSQL pgvector Supabase Auth Supabase Storage Realtime
Security
Row Level Security (RLS) Custom JWT hook CORS allowlist Server-side env vars XSS-safe rendering IP rate limiting Hashed IP tracking Proactive scanner AI auto-remediation TOTP MFA Signed MFA pre-token
Governance & CI/CD
GitHub Actions DORA aligned ITIL v4 PMBOK ADR-driven decisions Feature branches only
Evolution
Platform evolution — what's coming

GAELIX is built to grow. Each release adds capabilities grounded in real use cases — programme management with Agent Bob, and cybersecurity intelligence with Agent Cipher.

v1.0 Live now
Governed PMO Intelligence
  • ✓PMO Advisor mode — 8-domain practitioner guidance
  • ✓Governed PMO mode — formal 4-section audit structure
  • ✓Project Planner mode UI & intake quick-starts
  • ✓Decision Passport — immutable governance record
  • ✓Confidence scoring (Verified · High · Indicative)
  • ✓In-app 👍/👎 response feedback
v1.1 Live now
Project Planner & Artefact Generation
  • ✓Structured intake — Bob asks the questions it needs
  • ✓Milestone plan — phased delivery with dates
  • ✓Risk register — risks, severity & mitigations
  • ✓Action log — prioritised immediate next steps
  • ✓Gap-detection — proactive follow-up on missing info
v1.2 Live now
Persistent Artefact Library & Export
  • ✓Named artefact library per user — retrieve across sessions
  • ✓Version history & diff on governance documents
  • ✓Export to PDF — board-ready formatted output with Print / Save PDF toolbar
  • ✓Formal title extraction — heading derived from artefact content, not raw prompt
  • ✓Copy All toolbar — full selectable text, paste into any document or tool
  • ✓Export Chat to PDF — full conversation export from the chat toolbar
v1.3 Live now
Document Upload & Visual Intelligence
  • ✓Upload PDF or image — advisory on your own portfolio, programme, project, or product
  • ✓Document-aware analysis — Bob reads your artefacts and applies the PMO lens
  • ✓Secure upload pipeline — MIME validation, size limits, execution-free processing
  • ✓Visual "How Agent Bob Works" guide with interactive step-by-step diagrams
v1.4 Live now
AI Estate Troubleshooter & Fixer — Ariel
  • ✓Automated estate sweep — Database RLS, HTTP headers, CI, worker jobs, npm CVEs
  • ✓Tier 1 auto-fix — RLS enforcement & stalled job reset applied immediately, no approval needed
  • ✓Tier 2 AI proposals — Claude AI generates exact header patches & upgrade commands
  • ✓Operations Command Centre — sidebar navigation consolidating Ariel, Feedback, Artefacts, Roadmap
v1.5 Live
Ariel Phase C — Governed Remediation & Decision Passports
  • ✓Tier 2 approve/reject workflow — operator reviews Claude's proposal before applying
  • ✓Decision Passport per approved action — immutable governance record with rationale & evidence
  • ✓Pending Actions panel — operator queue of AI proposals awaiting approval or rejection
  • ✓ADR-0020 compliant — governed remediation with full audit trail and constitution articles
v1.6 Live now
Ezra — Prompt Translator Agent
  • ✓Stateless prompt translation agent — transforms plain-language project descriptions into structured Agent Bob prompts
  • ✓POST /api/ezra — 10 RPM rate limit, access-code gated (Career & Beta), token usage logged
  • ✓Model Mesh via Haiku (provider: 'free') — low-latency, sub-5 s p95 target
  • ✓Homepage panel with access-gate overlay — one-click handoff injects translated prompt directly into Agent Bob chat
v1.7 Live now
Agent Cipher — Cybersecurity Intelligence
  • ✓Three personas — Threat vCSO (adversary intelligence), Incident IR Commander (containment & recovery), Governed (security governance & compliance)
  • ✓817-skill RAG library grounded in MITRE ATT&CK v19.1 and NIST CSF 2.0 — retrieved at inference time via pgvector HNSW
  • ✓Ireland healthcare knowledge base — HIQA, EHDS, HSE Cybersecurity Framework, DPC, eHealth Ireland ingested as 34 RAG chunks
  • ✓20 Cipher scenario briefs in the Playbook — threat intelligence, incident response, and security governance across 10 sectors
  • ✓NIS2, DORA, GDPR, ISO 27001:2022, HSE framework, DPC notification — all regulatory clocks and obligations built in
GAELIX governs itself

The product backlog, enhancement priorities, and continuous improvement loop are managed entirely within the GAELIX Command Centre — the same evidence-backed, audit-ready approach delivered to clients. GAELIX is its own first customer: every feature is validated against real PMO use before it ships.

Managed in Command Centre
✓Enhancement backlog & priorities
✓MVP feedback triage & resolution
✓Release milestone tracking
✓Artefact & document review
Loading repositories…
Access required

This page is invite-only. Enter your access code to view the GAELIX AI platform architecture.

← Back to home