03 · Target

Where we’re going — mostly already here

Same business logic, now hosted on managed AWS primitives instead of a single VPS. The cutover ran 2026-06-08: sales task generation moved off the VPS/n8n onto a Lambda producer/consumer writing a DynamoDB single-table, and the loop generate → review → send is LIVE. The goal was never a rewrite — it was removing the SPOF, centralizing secrets and making queue state observable. The VPS has since been decommissioned too (#152), so the SPOF is gone; the one remaining hardening item is consolidating to a single sender (retiring the legacy n8n send worker).

HV Hub v2 on AWS
Animated · interactive — the AWS-native end-state drawn as the infrastructure that runs it: ECS Fargate, API Gateway, the Maestro Lambdas, SQS+DLQ, DynamoDB and Bedrock AgentCore, all in us-east-2. Open interactive ↗
Migration deltas

What changes vs today

ConcernOld (VPS era)Now (AWS-native)Status
Generation computeSingle VPS 187.77.29.73 (generate-only)Lambda producer + consumer · auto-scale✅ Done
Schedulingn8n scheduleTrigger × 16 → VPSSame n8n crons re-pointed to /generate✅ Done
AuthURL-embedded BasicSecrets Manager + IAM✅ Done
TransportHTTP plaintextHTTPS · API GW + ALB✅ Done
Task store / auditAirtable task_queue_salesDynamoDB single-table + Audit_Log✅ Done
RetriesNone · cron just re-firesSQS + DLQ (maxReceive 5)✅ Done
ObservabilitySSH + tail -fCloudWatch → SNS → #hv-alerts + Sentinel V2✅ Done
Sendn8n Gmail cron (Airtable-fed)message-dispatcher Lambda (SQS outbound)⚠️ Live, dual-worker
VPS decommissionVPS still up (Deprecated/InCharged crons)Shut down + leaked credential rotated✅ Done (#152)

What moved vs what stayed

The task store moved: the review queue is now DynamoDB, and the human review surface moved from the old Airtable/Netlify queue to Hub v2 /queue. What stayed in Airtable is the config/brain SSOT — the Workflows & Automations kill-switch, Agent Settings, guardrails, suppression and templates. Playbook logic and prompts are unchanged (per ADR 0001) — only the infrastructure and the task store changed.

Scheduler choice — settled

What actually shipped: n8n crons → /generate

The cutover did NOT replace the schedulers. The existing n8n cron triggers were simply re-pointed to POST /generate (the producer Lambda behind API GW), which acks in under a second and enqueues to SQS. That kept the schedule definitions where the team already manages them while moving all the compute and retries onto AWS. The two alternatives below were evaluated but not built — kept on the shelf as roadmap.

Roadmap A

Hub v2 NestJS @Cron

Move schedules into apps/api alongside Hub v2's existing modules. Auth via Secrets Manager (already wired). Logs/metrics via CloudWatch (already wired).

Pros: retires n8n as the scheduler, git-versioned schedules, one deploy pipeline.

Cons: couples scheduler uptime to Hub v2 API; not needed for the cutover.

Roadmap B

EventBridge rules

EventBridge rules target the producer via SQS, decoupling the schedule from n8n entirely.

Pros: native retry, cross-account ready, no n8n dependency.

Cons: extra surface to monitor, Terraform churn per schedule edit. Keep on the shelf for the day cross-service triggers matter.

Sequencing — where we landed

The migration order, as executed

01
✅ Secrets + Observability
URL-embedded password retired into Secrets Manager (gabrielle-tokens). CloudWatch + SNS → #hv-alerts (~10 alarms) + the Sentinel V2 n8n poller landed first, so the cutover was measurable.
done · #246 #251
02
✅ Compute + Transport + Store
Generation re-built as a Lambda producer + consumer (not a containerized worker) writing the DynamoDB single-table over HTTPS. Ran in shadow against the VPS until parity was proven, then re-pointed the crons.
done · #136 #137 ADR 0001
03
✅ Scheduling + Retries + Send
n8n crons re-pointed to /generate (2026-06-08); SQS + DLQ between producer and consumer. Hub v2 Approve & Send un-gated; the message-dispatcher Lambda is the send path (SQS outbound-messages; email live to real clients — Governor sendDevelopmentMode=false, flip it to redirect to test inboxes).
done · #132 #222
04
✅ VPS shutdown · ◻ single-sender hardening
Done: the 5 remaining VPS POST nodes were dropped, the ClawBot VPS decommissioned and the leaked Basic credential rotated — the SPOF is gone. Still open: retire the legacy n8n "AWS Send Worker" so only the message-dispatcher polls the approved queue (dual-worker risk).
VPS done · #152 · sender consolidation open