Current architecture vs target architecture

At a glance

Current Production architecture

Verified against live prod (chat.think2earn.com, EC2 i-076d244b62ec4d8e8, account 995772916887, us-east-1). One long-lived control-plane host fronts the entire web product.

flowchart TB
  subgraph users [Users]
    Browser[Browser]
  end

  subgraph edge [Cloudflare]
    CF_DNS[DNS]
    CF_Tunnel[Tunnel to origin]
  end

  subgraph ec2 [Control plane EC2]
    Cloudflared[cloudflared daemon]
    NodeApp[Node Express API plus Vite SPA]
    TurnMem[In-memory turn journal]
    LocalTerm[local_terminal shell on host]
    IAMHost[Think2earnHostRole]
  end

  subgraph aws_data [AWS data]
    DDB[(DynamoDB 16 tables)]
    S3[(S3 artifact bucket)]
    SSM[SSM secrets]
  end

  subgraph bedrock [Bedrock and AgentCore]
    Converse[Bedrock ConverseStream]
    CI[Code Interpreter]
    BrowserAC[Browser CDP]
    Memory[AgentCore Memory]
    Gateway[Gateway Exa MCP]
    Runtime[AgentCore Runtime microVM jobs only]
  end

  subgraph external [External]
    Cognito[Cognito]
    Stripe[Stripe]
  end

  Browser --> CF_DNS --> CF_Tunnel --> Cloudflared --> NodeApp
  NodeApp --> TurnMem
  NodeApp --> DDB
  NodeApp --> S3
  NodeApp --> SSM
  NodeApp --> IAMHost
  IAMHost --> Converse
  IAMHost --> CI
  IAMHost --> BrowserAC
  IAMHost --> Memory
  IAMHost --> Gateway
  IAMHost --> Runtime
  NodeApp --> LocalTerm
  NodeApp --> Cognito
  NodeApp --> Stripe
      

Request paths (today)

Characteristics

• Single point of compute — API, SSE, billing, and tool orchestration share one EC2 process.
• Ephemeral turn state — reconnect mid-turn uses in-memory journal; server restart drops in-flight UI state.
• Shared IAM — all tenants use Think2earnHostRole; isolation is app-layer (org / user / conversation ids).
• AgentCore Runtime underused for chat — live for dispatched jobs, not the default chat SSE path.
• Workspace — local_terminal runs shell on the control-plane host (not an isolated sandbox per user).
• UI — production redesign shell (DevLabChatTab); artifacts-only right pane.

Target North-star architecture

AWS-first: burn credits on Bedrock and AgentCore, keep Cloudflare for DNS and transactional email, eliminate the always-on EC2 API host, and externalize every piece of session state the UI depends on.

flowchart TB
  subgraph users [Users]
    Browser[Browser]
  end

  subgraph edge [Cloudflare]
    CF_DNS[DNS]
    CF_Email[Transactional email]
  end

  subgraph static [Static delivery]
    CF_CDN[CloudFront or Pages]
    SPA[Vite SPA bundle]
  end

  subgraph api [Serverless API]
    Lambda[Lambda API]
    DDB_Journal[(DynamoDB turn journal)]
    DDB_Core[(DynamoDB core tables)]
    SSE_Turn[POST chats messages SSE]
    SSE_Global[GET events stream or poll]
  end

  subgraph storage [Object storage]
    S3_Art[S3 artifacts and workspaces]
    S3_Sess[S3 SessionStore transcripts]
    PubCDN[pub.think2earn.com published HTML]
  end

  subgraph agent_compute [Isolated agent compute]
    Runtime[AgentCore Runtime microVM]
    AgentSDK[Claude Agent SDK Bedrock IAM]
    Sweep[Post-turn workspace sweep to S3]
  end

  subgraph bedrock [Bedrock and AgentCore services]
    Converse[Bedrock ConverseStream simple chat]
    CI[Code Interpreter]
    BrowserAC[Browser]
    Memory[Memory]
    Gateway[Gateway Exa]
  end

  subgraph external [External unchanged]
    Cognito[Cognito]
    Stripe[Stripe]
  end

  Browser --> CF_DNS
  Browser --> CF_CDN --> SPA
  Browser --> SSE_Turn
  Browser --> SSE_Global
  CF_DNS --> Lambda
  SSE_Turn --> Lambda
  SSE_Global --> Lambda
  Lambda --> DDB_Journal
  Lambda --> DDB_Core
  Lambda --> S3_Art
  Lambda --> Converse
  Lambda --> CI
  Lambda --> BrowserAC
  Lambda --> Memory
  Lambda --> Gateway
  Lambda --> Runtime
  Runtime --> AgentSDK
  AgentSDK --> Converse
  AgentSDK --> Sweep --> S3_Art
  AgentSDK --> S3_Sess
  S3_Art --> PubCDN
  Lambda --> Cognito
  Lambda --> Stripe
  CF_Email -.-> Lambda
      

Request paths (target)

Product surfaces (target UI)

• Thread session continuity — agentSessionId on conversation; durable turn journal.
• Right pane — Context doc tab + Artifacts (single / grid / filmstrip); HTML iframe + publish.
• Plan mode — Plan / Execute pill, Context checklist, Approve gate, sidebar waiting states.
• Inline artifacts — placeholder chips in messages + fallback map on conversation.
• Global awareness — artifact-published and cost-updated on a shared event channel.

Characteristics

• No always-on API EC2 — control plane scales with request volume; long compute stays on AgentCore Runtime.
• Durable streaming state — turn journal and context doc survive deploys and Lambda cold starts.
• Agent isolation — Bash / Write / Read run inside Runtime microVM, not on the API host.
• Bedrock billing throughout — simple chat and Agent SDK both use IAM to Bedrock (no third-party API keys in sandboxes).
• Publish tier — static HTML artifacts served from pub.think2earn.com via CloudFront.

What changes (current → target)

What stays the same

• Cognito auth and app JWT session model
• Stripe subscriptions and credit ledger
• DynamoDB entity model (conversations, messages, jobs, library)
• S3 artifact bucket and AgentCore resource IDs (Browser, CI, Memory, Gateway, Runtime)
• Default chatMode: simple + Bedrock ConverseStream as the fast path
• Shared Think2earnHostRole calling AgentCore (per-user IAM deferred)

Explicitly out of scope (for now)

• Per-user dedicated EC2 + DCV desktop (premium tier later)
• Standalone CLI binary
• Full integrations OAuth marketplace
• Replacing Exa Gateway with a native search API

Compute paths compared

Data & state

Edge & clients

flowchart LR
  subgraph today [Current edge]
    U1[User] --> CF1[Cloudflare Tunnel]
    CF1 --> EC2[EC2 serves API and SPA]
  end

  subgraph future [Target edge]
    U2[User] --> CF2[Cloudflare DNS]
    U2 --> CDN[CloudFront or Pages SPA]
    U2 --> API2[Lambda API URL]
    CF2 --> API2
  end
      

• Browser client — single-page app; SSE for turns; optional global event stream for sidebar and dock.
• Auth — Cognito hosted + native email/password + Google/GitHub; httpOnly app JWT.
• Email — moving transactional sends to Cloudflare (welcome@think2earn.com).
• CLI — not in either architecture yet; same API surface reserved for a future client.