VARO Command Centre

Bronze/Silver/Gold layers with automated promotion work well even at personal scale. Key insight: Bronze ingestion should be append-only with SHA256 dedup.

SerpAPI returns $0 for Korean LCCs. Solution: detect $0 prices and trigger Amadeus/Duffel/FlightAPI.io fallback chain. Real prices recovered in 85% of cases.

AI trust boundary rule: validate enums against allowed sets, parse JSON defensively, cap content-driven AI calls, escape query strings in ALL query languages.

next/headers dynamic requires edge runtime annotation. getServerSideProps does not work. Use route handlers for API calls. Cookie domain must be .varo.au for cross-subdomain auth.

Instrument Serif for display headings, Instrument Sans for body. JetBrains Mono for code/metrics. This combination balances authority with readability.

D1 has high per-query latency. Batch all lookups with IN clauses. Never loop individual SELECTs. Use COALESCE for optional joins.

Break complex features into independent streams with mission files. Each stream gets its own worktree. Wave driver orchestrates and merges. Maximum 5 parallel streams.

Every deal entity (issue, decision, document, comment) must be cross-linked via pushDealEntityToBrain(). Without this, the brain cannot surface connections during advisory sessions.

Combining SSH for device list, MongoDB for DPI stats, and ARP for MAC-to-IP mapping provides 95% device identification. Remaining 5% are IoT devices with no useful hostname.

Usage data lives in two file types: session-meta (timing, model, messages) and facets (tool usage, code changes). Join on session_id field for complete picture.