Architecture & Auto-Detection

Most cloud deployment platforms force a nasty trade-off: either you move your entire backend onto their proprietary cloud wrapper, or you spend weeks rewriting your repo into a new Infrastructure-as-Code framework and handing root AWS IAM roles to their hosted dashboard.

NeoSpaxe flips that model inside out. The engine is a black box that comes to your CI runner; your code and AWS keys never come to us.

The Zero-Trust CI Execution Flow

Every time you trigger a deploy or remove job, your CI spins up ghcr.io/toolboxanonymous/neospaxe-engine:latest. Here is what happens step by step:

┌─────────────────────────────────────────────────────────────────────────┐
│ Your CI Runner (GitHub Actions / GitLab CI / Bitbucket Pipelines)       │
│                                                                         │
│  1. Inspect Workspace ──► Uses existing stack config if present         │
│                           OR auto-synthesizes AWS blueprint on the fly  │
│                                                                         │
│  2. Authorize Action  ──► POST https://neospaxe.com/functions/v1/...    │
│                           (Sends stage name + license key hash check)   │
│                                                                         │
│  3. Provision AWS     ──► Spins up isolated stage in YOUR AWS account   │
│     + 20s Heartbeat       using the IAM credentials in your CI runner   │
│                                                                         │
│  4. Report Completion ──► Records stack life open/close in ledger       │
└─────────────────────────────────────────────────────────────────────────┘

Why This Matters for Security

• No Inbound Listeners: The NeoSpaxe engine image has zero open ports and no background daemon. It runs one command and exits.
• No Cloud Credential Exfiltration: Your AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are consumed strictly inside your CI container to talk directly to AWS APIs.
• Locked Transactional Notifications: Status emails (like 24-hour or 72-hour open stack reminders) are only ever sent to the verified billing email on file with Dodo Payments—a CI workflow cannot spoof or redirect notifications to an external address.

Black-Box Workload Auto-Detection

Don’t want to maintain extra infrastructure files just to spin up branch previews? You don’t have to.

If your repository already defines a native stack blueprint, NeoSpaxe uses it untouched and charges $0 in synthesis fees. If your repository doesn’t have one, the NeoSpaxe engine automatically inspects your project root and synthesizes the right AWS architecture inside the container:

1. Container & .NET Workloads (ECS Fargate)

• Detected when: Your repository root contains a Dockerfile or any .csproj file.
• What NeoSpaxe provisions: An isolated AWS ECS Cluster and Fargate Service built straight from your repository context, complete with networking and load-balanced routing for that branch stage.

2. Frontend & Jamstack Apps (S3 + CloudFront)

• Detected when: Your package.json includes modern web frameworks (next, astro, or vite) and no Dockerfile is present.
• What NeoSpaxe provisions: A dedicated S3 bucket and CloudFront CDN distribution scoped to your preview stage.

3. Serverless APIs (Lambda + API Gateway)

• Detected when: Default profile for Node/TypeScript backend services (src/index.handler).
• What NeoSpaxe provisions: An AWS API Gateway (ANY /{proxy+}) wired to an isolated Lambda function with a live preview endpoint.

Heartbeats & Abandoned Build Protection

Cloud deployments aren’t instant—Fargate clusters and CloudFront distributions take a few minutes to spin up, and sometimes a developer cancels a CI job mid-flight.

• While a deploy or teardown runs, the NeoSpaxe container sends a lightweight heartbeat ping every 20 seconds.
• If a deploy fails cleanly and reports ok: false before going silent, the attempt is cleared and you are not charged the stack life fee.
• If a CI runner is forcefully killed and goes silent for 15 minutes mid-deploy—meaning AWS resources may already be provisioned in your account—NeoSpaxe marks the stack life open so you still have visibility and can run remove to clean up any partial AWS resources.