Architecture

Isolated products: one repository, one CDK app (or family of stacks) per box. They talk over HTTPS / SQS only — no shared process.

Legacy: igentify/helix-cdk — deprecated monolith (HelixStack). HEE and processors now live in their own repos; Surface Apps live in helix-apps.

Terms: Glossary (HEE vs helix-ee, SA vs hee-plugin, RV vs RA).

Related repositories

Role	Repository	CDK	GitHub
Desktop shell	Helix Platform	HelixPlatformStack	igentify/helix-platform — owns shared SSM /helix/github-app/*
Surface Apps	Helix Apps (Patch, Intake, …)	HelixAppsStack	igentify/helix-apps
Orchestration	Integration Orchestrator	IO stacks	igentify/orchestrator-platform
Execution engine	helix-ee	HelixEeStack	igentify/helix-ee
Wizard processors	helix-job-processors	6× *ProcessorStack	igentify/helix-job-processors

Diagram

Isolation

Layer	Knows	Must not know
Platform	Catalog, iframe host, logs/push	HEE internals, IO graph, product policy
Surface App	Product UX, domain verifiers, start jobs	HEE plugin registry, IO node ids
IO	Entrypoint, adapters, await-async	Caller business rules in adapter TS
helix-ee / HEE	Job description, workspace, baked plugins	IO, Package Center, SA APIs by name
Job processors	Wizard step job contract	HEE plugins, Platform apps
HEE hooks / shared verifiers	Task/job + workspace	IO, customers, entrypoints

Trigger starts work (Package Center, Surface App action, IO entrypoint/backfill). Hook runs inside an already-running HEE process.

Domain verifiers live in the Surface App (HTTP). Shared verifiers live in the helix-ee image, not on the IO canvas.

Helix Intake (com.helix.intake) replaces legacy repo-prep from helix-cdk. Pipeline: helix-flowgraph CLI → .helix/flowgraph/ → Helix GitHub App PR → graph UI.

See also Isolation.