Web architecture

• web: Turborepo with the Next.js platform app and shared TypeScript and lint configuration. All React code and all API route handlers live here.
• engine: the Python analysis engine (ingestion, sandbox, features, training, reasoning, reporting, mitigation). It has no database access and calls the platform API through its API client.
• supabase: migrations, configuration, and seed data only. No application logic.
• shared: the API contract (OpenAPI now, JSON Schema for reports next). No runnable code.
• infra: Docker Compose for local Supabase and the sandbox base image build context.

The platform uses the Next.js App Router with React server components by default and client components only where interaction needs them (menus, search, maps, tables).

• Public routes (the (public) route group): research documentation, malware database, live map, IP blacklist, news, legal pages, and file reports.
• Workspace routes (/app): role-gated screens for samples, submissions, analysis, experiments, datasets, models, agents, evaluation, audit, and governance.
• API routes (/api): mock authentication today; the versioned /api/v1 surface returns with the backend.

Workspace screens read through a ResearchRepository interface rather than calling a database. Today that interface is backed by the DEMO repository; the Supabase-backed implementation will replace it without changing the screens.

Public pages that show data (database, map, blacklist) use deterministic seeded generators, so every visitor sees the same records and tests can assert exact values.

The interface uses the Astryx design system with an instrument-panel visual language shared across the site. Pages are built mobile first: the header collapses to a menu drawer at 1024px and below, wide data tables scroll horizontally on small screens, interactive controls have visible focus states, and header and menu controls meet the 44px touch-target minimum.

Every layer is built to these requirements; the backend stage is not released until each is met.

• Specimens are never served from public routes; public pages show hashes, metadata, and aggregates only.
• The engine authenticates to the platform with its own credential and cannot reach the database.
• Sandboxes run isolated, with networking disabled or simulated, and all analysis output is treated as untrusted input.
• Secrets live only in environment files excluded from version control, and are rotated if exposed.