---
title: "Repo Inventory"
slug: repo-inventory
section: Developer Onboarding
status: stable
description: "What repos exist under `Alliance-Strategies`, what each one does, and how you actually work in it — the map that's normally missing before a new contributor's first PR."
last-updated: 2026-10-07
---

# Repo Inventory

What repos exist under `Alliance-Strategies`, what each one does, and how you actually work in it — the map that's normally missing before a new contributor's first PR.

## Overview

The Alliance Abroad codebase is split across roughly 50 repos in the `Alliance-Strategies` GitHub org. Most of what a new contributor touches day-to-day falls into four groups: the portals (applicant, host, partner), a small number of shared packages consumed by more than one portal, the platform infrastructure that runs and documents everything, and a long tail of MCP server repos that back the Alliance MCP Gateway. This page inventories all of them as of 2026-08-14. Repos with a null or missing GitHub description are marked as such — their purpose below is a best-effort inference from naming, related docs, and skills, not a confirmed fact; verify with the repo's own README before relying on it.

## Portals & Applicant-Facing Apps

| Repo | What it does | How you work in it |
| --- | --- | --- |
| **BackOfficePrototype** (BOP) | Staff-facing back-office portal (Globus BackOffice) | Deploys via **GitHub Actions**, not Cloud Build (some older docs incorrectly say Cloud Build). All BOP work MUST happen in a dedicated `wt-bop-*` git worktree — never a shared/default clone, since a shared clone's branch got switched underneath concurrent agents before and wiped in-progress work. The "Quality Gate" CI check has quirks: the blob-reporter can hide real failures, and bot-authored commits get zero CI checks run, so a human must verify CI actually ran rather than trusting the absence of a red X. PRs land via sha-pinned squash-merge, then the branch is deleted. |
| **PPPToo** (`ParticipantPortalPrototype2`) | The live, current applicant-facing portal v2 — a full greenfield rebuild | Consumes `globus-sdk-src` as its Globus API facade and `form-engine-portable` for dynamic form rendering. Known bug class: a "client-only" PR that only touches frontend code often actually needs a paired backend-for-frontend (BFF) route change — always grep the BFF routes before approving a client-only-looking PR. |
| **HostPortalPrototype** | Host Portal — the host-organization-facing app (org creation, offers, camp/activity sites, arrivals, user invitations) | GitHub description is null on this repo; purpose inferred from the nexus-docs "Host Portal" doc group and the `host-portal-provisioning` skill. Provisioning, ingress, and CI/CD issues are covered by that skill. Production runs on Cloud Run (not GKE) as of 2026-09-18 — see the Repo-Specific note below on the drift incident this cutover caused. |
| **WildPacksApplicationForm** | Public Camp Counselor and Wild Packs SWT application form on `apply.wildpacks.com` and its small Express API. Stateless: writes a HubSpot Contact and Application, no database, no Globus calls | Standalone pnpm monorepo, not part of Globus or PPPToo. Branches are `development`, `qa` and `master` (production deploys from `master`); production runs on GKE, dev and QA on Cloud Run. See [WildPacks Application Form](/docs/wildpacks-application-form). Note: the legacy `wildpacks.com` Azure app is a separate, unrelated domain — never touch it from this repo's context. |
| **PartnerPortal** | Likely the partner-organization-facing app backing the nexus-docs "Partner Portal" doc group (Partner Portal Governance, Partner Organizations) | *Unconfirmed — description unverified, confirm with repo README.* |
| `ParticipantPortalPrototype` (no "2") | — | **Archived and deleted.** This is the *old* participant portal, superseded by PPPToo. Do not reference it as live — see Archived section below. |

## Shared Packages

Consumed by more than one portal — a change here needs an explicit publish step before consumers see it.

### globus-sdk-src (repo: `Globus-SDK`)

Shared Globus API SDK facade package, consumed by PPPToo (server) and HostPortalPrototype (server). BackOfficePrototype is the Hub itself and does not depend on it.

- **Release process:** bump the package version, then tag `v*` and push that tag — this triggers the GitHub Actions publish workflow. Consumers do not get the new version until that tag is pushed.
- Note: the GitHub repo itself is named `Globus-SDK` (its description still references an older Replit app, "Globus-Sync-Manager") — `globus-sdk-src` is the package/consumer-facing name. If you can't find a repo literally named `globus-sdk-src`, this is why.

### form-engine-portable

Shared dynamic form-rendering engine package, published to GitHub Packages, consumed by BackOfficePrototype and PPPToo.

- Publishing does **not** happen automatically on merge to `main` — it only triggers on a `v*` git tag push. Skipping the tag means consumers silently keep running the old bundle even though the code looks merged.
- Full process: (1) build the bundle on a feature branch with `vite build --config vite.portable.config.ts`, commit; (2) PR → merge to `main`; (3) bump `package.json` version; (4) push a `v*` tag (`git tag v2.6.5 && git push origin v2.6.5`) — the step people forget; (5) wait ~3–5 min for the publish workflow; (6) bump the consumer's `package.json` and redeploy; (7) verify the consumer actually restarted (e.g. `/api/health` uptime reset) before calling it done.

## Platform Infrastructure & Docs

| Repo | What it does | How you work in it |
| --- | --- | --- |
| **alliance-gcp-infra** | Terraform IaC repo — all GCP infrastructure changes (Cloud Run services, IAM bindings, secrets, DNS records) across every environment | Everything GCP-related is supposed to land here as Terraform. Manual `gcloud`/console changes cause drift that has repeatedly caused real incidents — dev, QA, **and now prod** have all needed drift-remediation campaigns. Prod's own incident (2026-09-18, Host Portal's GKE→Cloud Run cutover): live IAM grants, a GKE namespace teardown, and a static IP deletion were all done directly via `gcloud`/`kubectl` and had to be reconciled back into this repo's Terraform afterward, including a near-miss where an already-present-but-unapplied Terraform change (a Certificate Manager cert-map switch) would have destroyed the two classic SSL certs actually serving live production HTTPS on the very next `terraform apply` — caught only by reading that PR's own `terraform-plan-pr.yml` output before merging. Replaces the archived `00000_iac_*` repo family. |
| **alliance-mcp-gateway** | Go service — the MCP Gateway aggregating ~330 tools with per-user OAuth, RBAC, and audit logging. This is the very service brokering the tool calls used to write this page. | Actively maintained, private repo. |
| **n8n-workflows** | Canonical source-of-truth repo for n8n workflow JSON definitions across dev/QA/prod (`workflows/{id}__{slug}.json`) | **Corrected 2026-09-10 — the previous "live instance first, backfill git after" process below was backwards and is the exact anti-pattern that caused a real multi-day QA outage and a `development`/`qa`/`main` drift incident; do not follow it.** The correct, git-forward flow: (1) iterate in the Dev n8n UI (GKE instance, namespace `n8n-dev` on `globus-cluster-development`, no public DNS — reach it via `kubectl port-forward svc/n8n 8080:80 -n n8n-dev` after WIF auth); (2) `export-dev.yml` fires on push to `development` and opens a PR with the exported JSON (never commits directly — `development` requires PRs); (3) PR `development` → `qa` merges and `deploy-qa.yml` **pushes git's committed state onto the live QA instance** via `deploy_workflows.py` (id-map-resolved PUT/POST) — QA is a deploy *target*, not a source to copy from; (4) PR `qa` → `main` merges and `deploy-prod.yml` does the same against Production. Git is authoritative for QA and Prod; only Dev is meant to be hand-edited live and then captured back into git via the export PR. See the n8n Automation Layer doc's Workflow Version Control section for full detail, corrected the same day after this entry was found. |
| **n8n-infra** (renamed from `n8n-migration` 2026-09-14 — the old name no longer matched its ongoing role) | n8n cluster infra — K8s manifests, workflow export/remap tooling, and credential migration for the self-hosted n8n deployment | Ops/infra tooling, not a day-to-day app repo. Its manifest still describes the pre-migration instance (namespace `n8n`, image `n8n:latest`) — the live instance moved to namespace `n8n-dev`/image `n8nio/n8n:2.30.4` around 2026-09-02/03 and was never fully reconciled here (only a memory-limit fix landed, PR #34, 2026-09-14); confirm against live GKE state before relying on this repo's manifest. |
| **n8n** | Public fork/vendor copy of the open-source n8n automation platform itself | This is the upstream OSS project, not Alliance application code — you generally don't "work in" this repo directly; it exists to support self-hosting. |
| **nexus-docs** | This documentation/ecosystem-governance hub — the repo this very page lives in. Node/TypeScript + Drizzle ORM + Vite/React, originally a Replit app ("Ecosystem-Governance-Hub") | Doc pages normally publish through `ecosystem_update_doc` (auto-merging edit flow). When that backend is down, or you're adding a *new* page (not editing an existing one), go through a normal PR against `content/manifest.json` + the matching `client/src/pages/<slug>.mdx` file instead — see the `nexus-hub-docs` skill for the AI/MCP markdown-extraction surface this repo also serves. |
| **platform-hub** | Platform operations dashboards at platform.allianceabroad.com, extracted out of nexus-docs' old "Platform" section into its own repo. Migrated to the `alliance-mcp-services` GCP project | **Status: broken, needs attention** — this service has had a production outage since 2026-07-17 (a prod database wipe was never rebuilt). Still an active repo, but don't treat it as healthy. |
| **globus-config** | Config-as-code for the Globus platform — reviewable per-entity config files, env manifests, and CI that validates and builds import envelopes with `@alliance-strategies/globus-config-schemas` | Enforces the exact contract BackOfficePrototype expects; CI validation is the gate, not manual review alone. |

## MCP Servers & Integrations

Repos backing the self-hosted Cloud Run MCP servers behind the Alliance MCP Gateway (see the MCP Gateway page and CLAUDE.md's Cloud Run hosting rule — one instance per server in `alliance-mcp-services`, never environment-specific).

| Repo | What it does |
| --- | --- |
| **gcp-connector** | Custom GCP connector for Manus agents — gcloud + kubectl wrapper, replacing the old google-cloud-gke/iam/logging MCP connectors |
| **asana-integration** | Resilient Asana REST API integration — PAT auth, keep-alive connection pool, retry/backoff, task creation & tracking, n8n workflow |
| **TeamsMCP** | Microsoft Teams MCP server (Microsoft Graph API integration) |
| **openstatus-mcp** | MCP server for the Alliance Abroad self-hosted OpenStatus instance. Flag: `status.*` is live from prod with known env-var landmines — see prior openstatus exposure notes before touching config. |
| **1password-mcp** | Secure multi-tenant 1Password MCP server — two-layer auth (server API key + per-tenant service account token) |
| **auth0-mcp-server** | Secure MCP server for the Auth0 Management API |
| **GoogleWorkspaceMCP** | Google Workspace Admin SDK MCP server — replaces AzureMCP for user directory, group management, and OIDC |
| **AzureMCP** | MCP server for Microsoft Entra ID / Azure AD admin operations. Per its successor's own description this is being replaced by GoogleWorkspaceMCP — confirm current usage before building on it. |
| **godaddy-connector** | GoDaddy MCP connector (DNS/domain management). *Description unverified — confirm with repo README.* |
| **ReplitMCP** | Likely the MCP server for Replit integration (per-user repl access). *Description unverified — confirm with repo README.* |
| **vertex-agents** | Alliance Abroad Vertex AI Agent Engine agents — PR review, QA, and future agents. Caution: several agents that historically lived in this fleet (the standalone `pr-review-agent`, `overseer`/`observer-agent-v2`) have since been decommissioned/deleted per platform history — confirm which agents in this repo are actually still deployed before assuming a given agent is live. |
| **manus-platform-agent** | Alliance Abroad Manus agent configuration export — skills, connector config, and project context. This is the source repo the Claude Code global instructions (this very agent's `CLAUDE.md`) were ported from. Sync process: push skill/config changes here, then trigger the admin-portal skill sync — see the `manus-agent-sync`/`gateway-skill-source-sync` process. |

## Other Repos (Unconfirmed / Lower Confidence)

Found active (non-archived, recently pushed) in the org but with no GitHub description and no clear cross-reference in existing docs/skills. Listed for completeness — treat the "what it does" column as a guess, not a fact, until confirmed against the repo's own README.

| Repo | Best-effort guess |
| --- | --- |
| **app-portal-server-keycloak-flows** | Applicant Portal Keycloak backend/BFF flows service (referenced by the `applicant-portal-cicd` skill) |
| **VirtualInterviews** | Possibly supports the "Interviews & Screening" / "Interview Result Capture" Globus Core capability — unconfirmed |
| **SevisSDK** | Possibly a SEVIS government-reporting integration SDK — unconfirmed |
| **Doc2web** | Possibly the "DocToWeb" PRD-to-website tooling referenced elsewhere in platform memory — unconfirmed |
| **AsanaReporter** | Possibly Asana reporting/timesheet automation — unconfirmed, may overlap with `asana-integration` |
| **AsanaTools** | Possibly additional Asana utilities — unconfirmed, may overlap or be legacy relative to `asana-integration` |
| **itrequestportal** | Possibly an internal IT request-ticketing portal — unconfirmed |
| **itp-dashboard** ("itp funnel dashboard") | Possibly an Intern/Trainee Program funnel dashboard, tying to the "Intern/Trainee Scope" Globus doc — unconfirmed |
| **StepWestWP** | Purpose unclear from name alone; may not even be an internal platform app (possibly a WordPress marketing/brand site) — unconfirmed |
| **globus-ocr-infra** | Infrastructure-as-code for the private `globus-ocr` GCP project (Document AI OCR processing) — description present and fairly clear, listed here only because it wasn't in the seed fact list |
| **globus-translation-infra** | Private GCP Cloud Translation v3 microservice for Globus — criminal background & reference letter translation — same note as above |

## Service Configuration Reference

Runtime settings for small services whose code is the only other source. Read from each repo's entry point.

### vertex-agents: `db-query-proxy`

Read-only SQL proxy. `GET /health` is open; `POST /query` requires a bearer token. The process exits at start-up if a required variable is missing.

| Variable | Required | Behaviour |
|---|---|---|
| `BEARER_TOKEN` | yes | Token callers must present on `POST /query`. |
| `DB_HOST` | yes | Cloud SQL socket path, for example `/cloudsql/PROJECT:REGION:INSTANCE`. |
| `DB_NAME` | yes | Database name. |
| `DB_PASSWORD` | yes | Password for `DB_USER`. |
| `DB_USER` | no | Defaults to `karin_readonly`. |
| `STATEMENT_TIMEOUT_MS` | no | Per-statement timeout. Defaults to 10000. |
| `MAX_ROWS` | no | Row cap per query. Defaults to 1000. |

### vertex-agents: `db-query-proxy-token-broker`

Mints short-lived identity tokens for the proxy using the runtime service account's ambient credentials. `GET /health` is open; `POST /mint-token` requires the app token.

| Variable | Required | Behaviour |
|---|---|---|
| `APP_TOKEN` | yes | Token callers must present on `POST /mint-token`. |
| `TARGET_SERVICE_ACCOUNT` | yes | Service account to impersonate. |
| `TARGET_AUDIENCE` | yes | Audience for the minted ID token. |
| `ID_TOKEN_LIFETIME_SECONDS` | no | Token lifetime. Defaults to 300. |

### globus-config: drift-check and sync-apply

| Variable | Used by | Behaviour |
|---|---|---|
| `CONFIG_EXPORT_API_KEY` | `scripts/drift-check.ts` | Required. The script exits with code 2 when it is unset. |
| `CONFIG_EXPORT_BASE_URL` | `scripts/drift-check.ts` | Optional override of the per-environment default base URL; required if the environment has no default. |
| `CONFIG_IMPORT_BASE_URL` | `scripts/sync-apply.ts` | Optional override of the per-environment default base URL used when applying a commit. |

## Archived — Do Not Use

Confirmed `archived: true` on GitHub as of 2026-08-14. Do not build on these, and don't be confused if you find stale references to them elsewhere.

| Repo | Why it's dead |
| --- | --- |
| **ParticipantPortalPrototype** (no "2") | Old participant portal, superseded by PPPToo. Do not treat as live. |
| **app-portal-front-keycloak-flows** | Legacy Applicant Portal frontend, superseded by PPPToo. |
| **manus-mcp-server** | Legacy Manus API MCP server, superseded by the current Alliance MCP Gateway architecture. |
| **azure-mcp** | Lowercase duplicate of `AzureMCP`, archived. |
| **alliance-build-dashboard** | Deprecated and disabled per platform convention (along with `alliance-build-health-dashboard`, which doesn't appear as a separate repo here). |
| `00000_iac_database_terraform_gcloud`, `00000_iac_platform_cloud_run_services`, `00000_iac_gke_clusters_gcloud`, `00000_iac_cloud_run_services`, `00000_iac_iam_serviceaccounts_gcloud`, `00000_iac_load_balancer_GCP`, `00000_iac_artifact_registry_repository_GCP`, `00000_iac_secret_manager_GCP`, `00000_iac_vpc_gcloud` | The old per-resource-type Terraform repo family. Explicitly replaced by the single consolidated **alliance-gcp-infra** repo — see that repo's own description. |

Also excluded here (by design, not because they were found and rejected): anything with "staging" in the name — there is no staging environment at Alliance Abroad, only `development`, `QA`, and `prod`.