Independent software studio building public web apps, operator tooling, and AI agent infrastructure on Cloudflare's edge.

LCV Ideas & Software is an independent vibe-coding studio. It builds AI-assisted public-facing web applications, editorial tooling, infrastructure services, sponsor infrastructure, and developer utilities — primarily on a Cloudflare edge stack (Pages + Workers + D1) integrated with leading AI providers (Claude, Codex, Gemini, DeepSeek, Grok, Perplexity). Public homepage: www.lcv.dev.

Status. Active organization profile. Current release: not versioned — it publishes a surface rather than a numbered artifact.

Changes to this profile are recorded, from 11/08/2026 onward, in the CHANGELOG.md of the .github repository that hosts it. Earlier work is not summarized there; the commit history remains its record.

A small, opinionated portfolio organized in three layers, with its web services centered on Cloudflare's edge:

1. Public products — consumer-facing web apps with AI assistance, deployed on Cloudflare Pages with Worker backends.
2. Operator infrastructure — the single-tenant control plane and supporting services that govern the public products.
3. Developer tooling — open-source MCP servers and editorial workbenches built around multi-agent AI convergence.

The organization maintains 11 active public repositories, including its institutional .github repository. Product and tooling repositories expose public project surfaces or operational endpoints over HTTPS on custom domains. Engineering work follows strict multi-peer cross-review discipline with caller self-review prohibited, version-pinned baselines, CodeQL Advanced Setup on public code repositories, Secret Scanning push protection, and SHA-pinned external GitHub Actions.

Frontend     React 19 + Vite 8 + TypeScript
Runtime      Cloudflare Pages (static + SSR) + Cloudflare Workers (Hono)
Database     Cloudflare D1 (`bigdata_db` for product services; dedicated infrastructure databases)
Storage      Cloudflare R2 (`mainsite-media`, shared by MainSite and Admin)
Auth         Cloudflare Access (Zero Trust JWT) — operator surfaces
AI           Claude Code · ChatGPT Codex · Gemini CLI · DeepSeek · Grok · Perplexity
Email        Resend
Sponsorship  sponsor-motor + Mercado Pago Checkout Transparente Orders API
Anti-abuse   Cloudflare Turnstile + GCP Natural Language
Desktop      Tauri 2  (Maestro)

• D1 separation. Consumer products and the operator control plane share bigdata_db; optional Maestro remote configuration uses maestro_db; the GitHub-to-Slack relay uses github-slack-alerts-db. Cross-app reads use Cloudflare bindings in-place, never public URLs between sibling apps.
• One media bucket. mainsite-media is shared by mainsite-app and admin-app. Upload handling uses magic-byte sniffing, allowlisted MIME types, a 10 MiB cap, and a sandboxed legacy SVG fallback.
• Defense in depth. Cloudflare Access gates who enters admin surfaces; CSP gates what the browser can execute on public surfaces; Turnstile gates form anti-abuse; GCP Natural Language scores comment moderation.

• Structured reasoning and independent review. Substantive operator-authored engineering changes use ultrabrain for structured reasoning and the cross-review MCP for independent review before they are declared complete. Caller/reviewer self-review is invalid. This is an operator-process control, not a required GitHub merge check.
• Repository-specific quality gates. Each change must pass the checks defined by the affected repository — formatting, linting, type checking, tests, builds, and security checks as applicable. Toolchains vary; there is no universal four-check chain.
• CodeQL Advanced Setup. Every active repository maintains an explicit .github/workflows/codeql.yml with the languages relevant to that repository. CodeQL is a required check on both pull request and merge_group revisions; its analyzer job enforces zero SARIF findings because native code-scanning merge protection does not cover merge-queue groups.
• GitHub-native PR governance. A pull request is required for every change to the default branch. Squash is the only merge method; an authorized human admits an eligible pull request to GitHub's native merge queue after all effective rulesets and required checks pass, and those checks run again on the synthetic revision before GitHub creates a signed, single-parent squash. Default branches cannot be deleted or force-pushed, review conversations that exist must be resolved, and no actor has a ruleset bypass. Repository-owned auto-merge and governance controllers are not part of this design.
• cross-review anti-drift checks. In the cross-review repository, push CI verifies package/runtime version consistency and the expected release markers in README.md, SECURITY.md, and CHANGELOG.md.
• Agent-instruction parity. Program-wide directives are mirrored across the active agent environments as an operator process; GitHub does not enforce this parity.
• Supply-chain baseline. External GitHub Actions are pinned by full commit SHA. Cloudflare deployment workflows use exact Wrangler versions from committed manifests and lockfiles, verify package signatures and audit results, and rely on daily Dependabot checks with automatic rebasing. GitHub Actions updates are evaluated immediately; ordinary version updates in every other ecosystem observe a seven-day stability cooldown. Security updates are not delayed by it.

The AGPL-3.0 network-service trigger applies to the AGPL repositories: running a modified fork as a public service obligates publication of the modifications under the same license. Public software repositories ship a THIRDPARTY.md inventory and a NOTICE (where applicable). Forks are welcome under the respective license terms.

• Security: Secret Scanning, push protection, and Dependabot security updates are enabled across every active repository. CodeQL Advanced Setup runs in every active repository; the internal .github-private enterprise governance repository analyzes its GitHub Actions source with the same zero-finding SARIF gate. Vulnerability disclosures follow each public repository's SECURITY.md.
• Contributing: Every public repository carries its own CONTRIBUTING.md. Every change to the default branch must arrive through a PR and pass the repository-specific checks; direct pushes to main are not permitted. Eligible PRs are squash-merged through GitHub's native merge queue after authorized human admission. Dependabot prepares and rebases its updates automatically, while required security and quality gates remain mandatory.
• Code of Conduct: Every public repository follows Contributor Covenant 3.0 through its own CODE_OF_CONDUCT.md.

• Homepage: www.lcv.dev
• GitHub: opening issues on the relevant repository is the canonical channel.
• Email: lcv@lcv.dev for general topics.
• Phones: +55 (21) 3955-0883 / +55 (21) 99152-4643
• Sponsorship: support the work through the secure sponsor page → www.lcv.dev/sponsor.

• License: AGPL-3.0-or-later. Network-service trigger applies: running a modified fork as a public service obligates you to publish modifications.
• Notices: see NOTICE and THIRDPARTY.
• Security disclosure: see SECURITY.md.
• Code of conduct: see CODE_OF_CONDUCT.md.
• Contributing: see CONTRIBUTING.md.
• Sponsorship: see the relevant repository's Sponsor button or central sponsor page.
• Action pinning: all external GitHub Actions are pinned by full commit SHA per supply-chain hardening baseline.
• Code owners: .github/CODEOWNERS.

• Site: https://www.lcv.dev
• GitHub organization: LCV-Ideas-Software
• Organization profile source: .github
• Sponsors: https://github.com/sponsors/LCV-Ideas-Software

AGPL-3.0-or-later. See LICENSE, NOTICE, and THIRDPARTY.

Copyright © 2026 LCV Ideas & Software
_{LEONARDO CARDOZO VARGAS TECNOLOGIA DA INFORMACAO LTDA
Rua Pais Leme, 215 Conj 1713 - Pinheiros
São Paulo - SP - CEP 05424-150
CNPJ: 66.584.678/0001-77 - IM: 3039854}