CTO AIPA

CTO AIPA — Production AI Code Review & Agent Orchestration System

Web Data UNLOCKED hackathon submission (May 2026): Track 1 — GTM Intelligence. Four Bright Data products in production (Web Unlocker, SERP API, Scraping Browser, MCP Server) + autonomous Claude tool-use loop exposing them as /research_company, /research_employer, /research_competitor Telegram commands. See Live Web Data Layer below.

Single TypeScript service that:

• Automatically reviews every PR and push
• Routes between LLMs based on criticality
• Persists technical memory in Oracle Autonomous DB
• Exposes technical Q&A via API and Telegram

Deployed on Oracle Cloud. PM2-managed. <$1/month operational cost.

Elena Revicheva · AIdeazz · LinkedIn

Screenshots

1. Architecture or health — System overview or GET / response	2. PR review — GitHub PR or commit with CTO review comment
3. Telegram — CTO bot menu or /ask / /daily response	4. Atuona — /create or /visualize output

Add images to docs/assets/ (see docs/assets/README.md).
PR and commit reviews are triggered by the GitHub webhook to CTO AIPA.

Architecture (high level)

flowchart LR
  subgraph Triggers
    GH[GitHub PR/Push]
    TG[Telegram]
    API[HTTP /ask-cto]
  end
  subgraph Service["Node + Express"]
    R[Rules: security, complexity]
    M[Model router]
    L[LLM: Claude / Groq]
  end
  subgraph Persistence
    DB[(Oracle)]
    FS[atuona-state.json]
  end
  GH --> R --> M --> L --> DB
  TG --> M --> L --> DB
  API --> M --> L --> DB
  L --> FS

• Triggers: GitHub webhook, Telegram (Grammy), HTTP POST /ask-cto.
• Service: Single process. Deterministic rules run first; then model router; then LLM. Results persisted to Oracle (and file for Atuona).
• Persistence: Oracle Autonomous DB (mTLS) for CTO memory, tech debt, context; JSON file for Atuona creative state.

Orchestration flow (bullet pipeline)

Code review (PR or push):

1. GitHub sends webhook → Express receives.
2. Fetch diff; run deterministic checks (security, complexity, architecture patterns).
3. Route: If critical (security/payment/keywords) or explicit override → Claude Opus 4; else → Groq Llama 3.3 70B.
4. Build prompt with diff + rule results + last N memories from Oracle.
5. LLM returns review text → post comment on PR/commit.
6. Save to aipa_memory (Oracle); notify CMO webhook (non-blocking).

Ask CTO (API or Telegram):

1. Request (JSON or message) → load conversation context from Oracle.
2. Route: Always Claude Opus 4 for strategic Q&A.
3. LLM returns answer → save to aipa_memory and conversation context; respond to client.

Atuona (Telegram):

1. Message/voice → Whisper for transcription if voice.
2. Load atuona-state.json (mood, creative memory); select mood; inject knowledge + anti-repetition lists.
3. Claude Opus 4 generates → extractAndTrackFromResponse() updates creative memory → save state; reply.

Model routing logic

Configurable via env: CRITICAL_MODEL, STRATEGIC_MODEL, STANDARD_MODEL.

Why deterministic + LLM split

• Deterministic rules handle everything that must be consistent and cheap: regex/pattern checks for SQL injection, hardcoded secrets, XSS, eval, debug code; line-count and nesting for complexity; detection of patterns (async/await, try-catch, types). No token cost, no flakiness, instant. The LLM then gets a structured summary (e.g. “3 high, 2 low”) and the diff, and focuses on synthesis and advice.
• LLM is used only where reasoning or language is needed: review narrative, answer to “How should I structure auth?”, dialogue, creative text. We avoid using the model for things that can be computed.
• Result: Lower cost (Groq for most reviews), predictable security/complexity signals, and a single place to tune “when to use Claude” (critical path and config).

Data lifecycle (how memory tables are used)

All Oracle writes are best-effort (errors logged, no throw to client). Reads fall back to empty/default so the app stays up if DB is temporarily unavailable.

Failure handling & monitoring

🎯 What CTO AIPA does

• 🔍 Reviews every code change (PRs AND direct pushes to main)
• 💬 Answers technical questions anytime via API or Telegram
• 🧠 Knows your entire ecosystem (11 AIdeazz repositories)
• 🔐 Detects security vulnerabilities before production
• 📊 Analyzes architecture and suggests improvements
• 🤝 Coordinates with CMO AIPA for LinkedIn announcements
• ☀️ Daily briefings - Start each day informed
• 🔔 Proactive alerts - CTO watches your ecosystem 24/7
• 🎤 Voice messages - Talk naturally via Telegram
• ⚡ Runs 24/7 on Oracle Cloud (PM2, health checks, cron)

No code review bottlenecks; strategic technical guidance on demand.

What's in v4.0

• Oracle Cloud deployment (PM2, startup credits)
• Atuona: persistent creative memory, anti-repetition, multi-modal (text + image + video via Replicate/Runway/Luma)
• Repository cleanup: docs in docs/, strengthened .gitignore

What's new since v4.0 (May 2026 hackathon week)

Six commits this week that turn CTO AIPA into a live-web-powered GTM intelligence system, not just a code-review bot:

• Autonomous research agent (src/research-agent.ts): Claude tool-use loop exposing Bright Data primitives as agent tools. Three modes — client / employer / competitor — surfaced as /research_company, /research_employer, /research_competitor Telegram commands.
• Bright Data 4-product integration (src/brightdata-enrich.ts, src/serpapi-prospects.ts, .mcp.json): Web Unlocker for enrichment + SERP API for prospect discovery + Scraping Browser for JS-heavy pages + MCP Server for IDE-side use, all sharing one credential set.
• HubSpot Lead Brief with freshness buckets (src/lead-triage.ts): daily 8 AM Panama brief in Telegram, grouped 🆕 NEW (≤24h) / 🔥 ACTIVE (1-7d) / ⏰ AGING (>7d). Silent skip on quiet days (zero noise).
• Daily blog publisher hardening (src/daily-blog-publisher.ts): sliding-window mutex prevents accidental double-publishes; always-fire Telegram notify on every outcome (success / skip / failure).
• dragontrade-main crashloop fix (separate dragontrade-agent repo + Oracle check_oracle_health.sh): jq-based pm2 status check replaces a brittle grep that wrongly restarted the bot every 5 minutes for weeks. Engagement loop now runs autonomously, replying to and following real users on @reviceva.
• Outreach hardening: bogus-email retry loop fixed in src/outreach.ts + markOutreachDraftStatus + auto-mark-invalid on Resend 422.

See HACKATHON_SUBMISSION.md in the private docs repo (aideazz-private-docs/docs/01-career-applications/Accelerator-Applications/BrightData-WebDataUnlocked-2026/) for the full submission kit.

What's new (late May – June 2026)

The engine grew four durable capabilities — each one earned by a real production incident, not a roadmap:

• Voice Growth Engine + "Building in Public" Podcast (src/voice-growth-engine.ts, src/podcast-*.ts): one voice note → Speechmatics transcription → bilingual blog + LinkedIn/IG atoms (Buffer drip) + a published podcast episode, all UTM-attributed into HubSpot. Auto-publishing RSS + branded site (podcast.aideazz.xyz) — live on Spotify, YouTube, Listen Notes, and Podcast Index. Episodes from real voice (/podcast) or AI-narrated (/podcast_ai).
• Credit-exhaustion resilience, engine-wide (src/llm-resilience.ts + call-site hardening): every agent falls back Anthropic → Groq on credit exhaustion. When Anthropic credits actually ran out, the daily blog still failed — twice — exposing two deeper gaps that are now fixed: a tolerant article parser (Groq drops the XML envelope Claude obeys) and a TPM-aware retry (all agents share Groq's 12K tokens/min, so the big blog call retries through congestion). Proof: a full article was generated, parsed, quality-gated, and cross-posted to Dev.to + aideazz.xyz entirely on the free fallback.
• Buying-intent lead gate + Bright Data-first discovery (src/serpapi-prospects.ts): a Google result is a page, not a prospect. An LLM intent classifier now admits only people actively seeking technical/AI/build help — articles, news, job-seekers, and freelancers-for-hire are dropped, and deals are named by intent ("Non-technical founder seeking technical co-founder for music infrastructure startup"), not by headline. When the paid SERP API quota died (429, no top-up), discovery migrated to Bright Data organic SERP the same day — the legacy serpapi-* names remain, but Bright Data runs inside.
• HubSpot as a revenue surface, not a data dump (src/hubspot-client.ts, scripts/): enriched writes (company domain/website/description, dealtype, clean contact names, placeholder-domain guard), a quality gate that keeps personal-Gmail prospects out of the "I Act TODAY" view, plus two idempotent operator tools — carve-revenue-pipeline.cjs (demote non-contactable deals out of action stages, reversible log) and cleanup-junk-crm.cjs (archive headline-era junk: 198 deals + 145 companies + 63 contacts in the June 10 pass). Every record left is a real job lead or a real prospect.

Cross-repo, same period: VibeJobHunter's two dead hiring paths were restored (missing-ID drop fix + SerpAPI→Bright Data jobs migration) — see that repo's README for the engineering highlights.

🚀 How To Use Your CTO

Quick connect: See docs/CONNECT_TO_CTO_AIPA.md for all ways to reach your CTO (Telegram, terminal, API, GitHub).

📍 Endpoints

💬 Ask CTO - Get Technical Advice Anytime

From any terminal:

curl -X POST http://<your-server-ip>:3000/ask-cto \
  -H "Content-Type: application/json" \
  -d '{"question":"Should I use MongoDB or PostgreSQL for my project?"}'

With context:

curl -X POST http://<your-server-ip>:3000/ask-cto \
  -H "Content-Type: application/json" \
  -d '{
    "question": "How should I structure the authentication?",
    "repo": "MyProject",
    "context": "Currently using JWT tokens"
  }'

🔍 Automatic Code Reviews

For Pull Requests:

1. Create a PR in any connected repo
2. CTO AIPA automatically reviews within 30 seconds
3. Review comment appears on the PR

For Direct Pushes:

1. Push to main or master branch
2. CTO AIPA reviews the commits
3. Review comment appears on the commit

🤖 AI Models

CTO AIPA uses the best AI models for each task:

Configuration

Edit .env on your server:

CRITICAL_MODEL=claude-opus-4-8
STRATEGIC_MODEL=claude-opus-4-8
STANDARD_MODEL=llama-3.3-70b-versatile
MAX_TOKENS=8192

(Orchestration, model routing, and data lifecycle are described in the sections at the top.)

🌐 Live Web Data Layer (May 2026)

Every agent in this stack that touches the open web does it through Bright Data — one shared BRIGHTDATA_API_TOKEN + one zone, four products in production:

Autonomous research agent (src/research-agent.ts)

Three Telegram commands wrap a Claude tool-use loop that exposes the Bright Data primitives as agent tools (bd_serp_search, bd_unlock_url, bd_scrape_browser). Claude itself decides how many calls to make, which URLs to fetch, when to stop. Budget: max 8 tool calls or 120s per command.

Live proof (decircle.io, client mode): 86 seconds, 7 Bright Data tool calls, returned a sendable LinkedIn DM pitch angle the operator could copy-paste.

Signal flow (end-to-end)

External web → Bright Data (Web Unlocker / SERP / Scraping Browser)
            → Claude (Sonnet 4.5 tool-use loop in research-agent.ts, or Opus 4 in code-review path)
            → /api/crm-event (unified Bearer-auth hub)
            → HubSpot deal ([CLIENT-*] / [HIRING-VJH-*] / [CLIENT-ALGOM] prefixes)
            → HubSpot → Trello current-month "Kira {Mes} 2026" board (urgent stages)
            → Lead Brief Telegram (8 AM Panama, 🆕 / 🔥 / ⏰ freshness buckets, silent on quiet days)

🧠 AIdeazz Ecosystem

CTO AIPA knows and monitors 11 repositories:

📱 Telegram Bot

Chat with your CTO from your phone — now with voice messages!

Setup

1. Create a bot via @BotFather on Telegram
2. Add to .env on your server:

   TELEGRAM_BOT_TOKEN=<your-bot-token>
   TELEGRAM_AUTHORIZED_USERS=<your-telegram-user-id>
   

3. Restart: pm2 restart cto-aipa

Commands