Architecture

One core, three surfaces

lib/queries.ts      ← Supabase reads (RLS via user JWT)
lib/agent-ops.ts    ← FastAPI writes (Bearer token)
lib/headless.ts     ← token + Supabase client factory
        ↑
  Next.js app   scripts/cli.ts   scripts/mcp.ts

The dashboard UI uses @supabase/ssr in server components. The CLI and MCP server use createClient from @supabase/supabase-js with CIITED_ACCESS_TOKEN — same RLS boundaries.

Writes (prompt edits, topics, alert acks) must go through lib/api.ts → FastAPI so plan limits and audit events stay enforced. Do not write benchmark orchestration from the frontend repo.

Out of scope (v1 headless)

• Triggering benchmark runs
• Workspace creation / onboarding
• Competitor CRUD

Backend: authority-signal-backend.