A production agent platform, deployed on your AWS.
The Kubernetes-native substrate, the guardrails, and a first production app — stood up on your
account and explained end to end, not handed over as a repo to reverse-engineer.
Or run the whole factory yourself; it's all open source.
| THE FACTORY | |
| fab | The factory runner — orchestrates a roster of Claude agents through discovery → design → build → verify → ship, every deliverable gated by an evidence-backed merge review. |
| nanohype | Template catalog + @nanohype/sdk + the Platform Reference — the factory's vocabulary, served to agents over MCP. |
| THE SUBSTRATE · what it ships onto | |
| landing-zone | The AWS substrate — OpenTofu + Terragrunt monorepo, multi-account isolation, GitOps-ready clusters. |
| eks-fleet | The cluster vending machine — a Crossplane v2 composition that manufactures EKS clusters from a namespaced Cluster resource, wrapping the landing-zone modules. |
| eks-agent-platform | k8s-native control plane: the operator + CRDs that fence each Platform tenant — per-tenant IAM/KMS/S3, an Envoy AI Gateway egress path, KEDA autoscaling, a budget kill-switch, and an Argo eval pipeline on EKS + Bedrock. |
| eks-gitops | ArgoCD addon catalog for EKS — ApplicationSets, sync-wave ordering, per-env Helm values. |
| kx | Local kind cluster preloaded with the eks-gitops catalog — develop locally, deploy to EKS unchanged. |
| WHAT IT'S SHIPPED · live Platform tenants | |
| competitive-intelligence | Competitor-site change radar — crawls, semantic-diffs each page, alerts Slack on meaningful change. Durable pgvector. |
| incident-response | Ceremonial incident commander — Grafana OnCall → war-room → approval-gated Statuspage → Linear postmortem. |
| digest-pipeline | Weekly newsletter pipeline — aggregates GitHub/Linear/Notion/Slack, drafts with Bedrock Claude, human-gated SES send. |
| slack-knowledge-bot | Internal Slack knowledge bot — per-user ACL-filtered retrieval over Notion/Confluence/Drive via Bedrock Claude. |
| OPERATE | |
| portal | Self-hosted ops portal for OpenTofu workspaces, AWS accounts, EKS clusters, and EAP tenants — one UI, one audit trail. |
| cloudgov | AWS security & cost CLI — IAM least-privilege, cost anomalies, posture, drift, plus a Kubernetes RBAC scanner. |
| homebrew-tap | brew install for the nanohype CLIs. |
Colour means the same thing on every page · containment means ownership · an arrow is spent only where position cannot say it
Generated from the repos themselves — components from git ls-files, sync waves from the ApplicationSet annotations, cadences from the operator.
How to read this what each colour means, what containment means, and when an arrow is worth spending
1 · The factory every repo is what the factory consumes, what it produces, or the factory itself
2 · Cloud substrate landing-zone by layer — organization components run once, everything below them is per-environment
3 · Network one component, two modes — own a VPC, or build nothing and re-export someone else's
4 · Cluster addons one ApplicationSet per group, ordered by sync wave — a cluster opts in with a label
5 · Control plane ten CRDs, nine reconcilers, one binary — each zone is a reconciler, and what sits in it is what that reconciler keeps true
6 · Request path one invocation, app to model and back — the app holds no AWS credential and signs nothing
7 · Identity & isolation isolation is a spectrum, not a boolean — two orthogonal dials
8 · Observability one neutral OTLP waist — which backends exist behind it is a property of the cluster tier
9 · Governance loops budget, SLO and eval each close a loop that can stop a tenant — recovery from the budget one is human
10 · Lifecycle two vending lines, one layer apart — both write manifests to git, and the cluster always wins on read
How they are built, and the rules they follow → atlas/
