Public web apps, operator tooling and AI agent infrastructure on Cloudflare's edge.
Every deploy goes through CI. Every gate refuses to guess.

LCV Ideas & Software is an independent vibe-coding studio. It builds AI-assisted public-facing web applications, editorial tooling, infrastructure services, sponsor infrastructure, and developer utilities — primarily on a Cloudflare edge stack (Pages + Workers + D1) integrated with leading AI providers (Claude, Codex, Gemini, DeepSeek, Grok, Perplexity). Public homepage: www.lcv.dev.

studio: LCV Ideas & Software
homepage: https://www.lcv.dev
location: Brazil
model: single-operator studio, multi-agent engineering
surface:
  public_repositories: 1
  live_products: 4 web apps + 2 Android apps in production + 3 operator services + 3 developer tools
  android_portfolio: 2 apps published in Google Play production, 1 app in internal testing
stack:
  languages: [TypeScript, JavaScript, Kotlin, Rust, Python, SQL]
  frontend: [React 19, Vite 8, TipTap, PWA/Workbox, DOMPurify]
  edge: [Cloudflare Pages, Workers, Hono, D1, R2, Secrets Store, Cron Triggers]
  desktop: [Tauri 2 (Rust)]
  mobile: [Kotlin, Jetpack Compose, Material 3, Hilt, Room, Retrofit/OkHttp, Gradle]
  ai: [MCP servers, Claude, Codex, Gemini, DeepSeek, Grok, Perplexity]
  payments: [Mercado Pago Checkout Transparente (Orders API + 3DS)]
  quality: [Vitest, Zod, Biome, CodeQL, Code Quality, Zizmor, OpenSSF Scorecard]
  ops: [GitHub Actions, Wrangler, Dependabot, Linear]
discipline: "Fail closed, test first, ship through pull requests."

Status. Active organization profile. Current release: not versioned — it publishes a surface rather than a numbered artifact.

Changes to this profile are recorded, from 11/08/2026 onward, in the CHANGELOG.md of the .github repository that hosts it. Earlier work is not summarized there; the commit history remains its record.

A small, opinionated portfolio organized in four layers, with its web services centered on Cloudflare's edge:

1. Public products — consumer-facing web apps with AI assistance, deployed on Cloudflare Pages with Worker backends.
2. Operator infrastructure — the single-tenant control plane and supporting services that govern the public products.
3. Developer tooling — open-source MCP servers and editorial workbenches built around multi-agent AI convergence.
4. Android portfolio — native Android editions of the products, written in Kotlin with Jetpack Compose. As of 12 October 2026, Calculadora v1.0.8 and Maestro v1.0.5 are published in Google Play production; Astrólogo v0.2.0 is published only in internal testing.

The organization maintains 1 active public repository, including its institutional .github repository. Product and tooling repositories expose public project surfaces or operational endpoints over HTTPS on custom domains. Engineering work follows strict multi-peer cross-review discipline with caller self-review prohibited, version-pinned baselines, CodeQL default setup on every repository, Secret Scanning push protection, and SHA-pinned external GitHub Actions.

Languages

TypeScript

JavaScript

Rust

Python

SQL / SQLite

Frontend & Desktop

React 19

Vite 8

Tauri 2

PWA / Workbox

DOMPurify

Edge & Data

Pages

Workers

D1

R2

Hono

Mobile (Android)

Kotlin

Android

Jetpack Compose

Material 3

Gradle

AI & Quality gates

MCP servers

Review panel

Vitest

CodeQL

Scorecard

By the operator decision of 11/10/2026 (11 October 2026), only .github is public; .github-private and github-operations are internal. All other organization repositories are private and require authorized access. Web applications, Play distribution, published packages and license obligations are separate.

The source repositories for these three services are private. Access to the deployed services follows their own controls; public service availability does not make the source repository public.

Native Android editions of the products — Kotlin and Jetpack Compose, not web wrappers. As of 12 October 2026, Calculadora and Maestro are published in Google Play production. Astrólogo has a working native natal-chart and PDF-export foundation in internal testing; it has no public production release yet.

Four private repositories have been created for future iOS development. The native inventory on 12 October 2026 confirms that all four are empty: no application code or LICENSE file is present. Platform-specific implementation and validation remain future work; repository creation is not an application release. Their GitHub Pages configuration is public, which does not establish that a site has been deployed.

Frontend     React 19 + Vite 8 + TypeScript
Runtime      Cloudflare Pages (static + SSR) + Cloudflare Workers (Hono)
Database     Cloudflare D1 (`bigdata_db` shared; `maestro_db` for optional Maestro configuration)
Storage      Cloudflare R2 (`mainsite-media`, shared by MainSite and Admin)
Auth         Cloudflare Access (Zero Trust JWT) — operator surfaces
AI           Claude Code · ChatGPT Codex · Gemini CLI · DeepSeek · Grok · Perplexity
Email        Resend
Sponsorship  sponsor-motor + Mercado Pago Checkout Transparente Orders API
Anti-abuse   Cloudflare Turnstile + GCP Natural Language
Desktop      Tauri 2 (Maestro)

• D1 separation. Consumer products, the operator control plane and the Workers (mtasts-motor, sponsor-motor, tlsrpt-motor) share bigdata_db; optional Maestro remote configuration uses maestro_db; internal operational systems keep their own dedicated database. Cross-app reads use Cloudflare bindings in-place, never public URLs between sibling apps.
• One media bucket. mainsite-media is shared by mainsite-app and admin-app. Upload handling uses magic-byte sniffing, allowlisted MIME types, a 10 MiB cap, and a sandboxed legacy SVG fallback.
• Defense in depth. Cloudflare Access gates who enters admin surfaces; CSP gates what the browser can execute on public surfaces; Turnstile gates form anti-abuse; GCP Natural Language scores comment moderation.

• Structured reasoning and independent review. Substantive operator-authored engineering changes use ultrabrain for structured reasoning and the cross-review MCP for independent review before they are declared complete. Caller/reviewer self-review is invalid. This is an operator-process control, not a required GitHub merge check.
• Repository-specific quality gates. Each change must pass the checks defined by the affected repository — formatting, linting, type checking, tests, builds, and security checks as applicable. Toolchains vary; there is no universal four-check chain.
• CodeQL default setup. Every active repository runs GitHub's code scanning default setup with the extended query suite on a weekly schedule and on every pull request to the default branch. The Enterprise ruleset requires a CodeQL analysis before a revision reaches main, alongside GitHub Code Quality and license-compliance scanning; alerts are triaged in the repository's Security tab.
• GitHub-native PR governance. A pull request is required for every change to the default branch, and the active Enterprise branch and tag rulesets carry no bypass actor. Squash is the only permitted merge method and linear history is required, so GitHub creates a signed, single-parent squash; commits and tags must be signed. Dependabot pull requests receive GitHub's native auto-merge from a repository-local workflow; every other pull request is merged by the maintainer once the effective rules and required checks are satisfied. Review conversations that exist must be resolved, unattributed changes require an extra approval, and Copilot code review is requested on pull requests and on every push. Default branches cannot be deleted or force-pushed.
• cross-review anti-drift checks. In the cross-review repository, push CI verifies package/runtime version consistency and the expected release markers in SECURITY.md and CHANGELOG.md.
• Agent-instruction parity. Program-wide directives are mirrored across the active agent environments as an operator process; GitHub does not enforce this parity.
• Supply-chain baseline. External GitHub Actions are pinned by full commit SHA, and that pin is required by the enterprise and organization Actions policy rather than by per-repository allowlists. Cloudflare deployment workflows use exact Wrangler versions from committed manifests and lockfiles, several of them gate on npm audit results, the organization-site deploy additionally verifies package signatures, and all of them schedule Dependabot checks every day at 05h (UTC−03:00), including weekends with automatic rebasing. Official Actions under actions/* and github/* are evaluated immediately; third-party GitHub Actions and ordinary version updates in every other ecosystem observe a seven-day stability cooldown. Security updates are not delayed by it.

Repository visibility and license terms are separate. The private source repositories admin-app, mtasts-motor and sponsor-motor remain listed under their existing licenses; their GitHub contents require authorized access.

The AGPL-3.0 network-service trigger applies to the repositories in the AGPL row: if a modified version lets users interact with it remotely through a computer network, those users must be offered its Corresponding Source under AGPL-3.0. The institutional .github repository is public because GitHub requires public visibility for its platform role — the organization profile and the default community-health files — and that visibility grants no rights beyond those provided by the GitHub Terms of Service. The current Android releases use LicenseRef-LCV-Ideas-And-Software-Proprietary only for original code and materials owned by LCV Ideas & Software. This does not replace third-party licenses or revoke earlier grants, including copies previously received under AGPL. The respective LICENSE, NOTICE and THIRDPARTY.md retain those boundaries. Repository visibility does not grant or revoke license rights.

• Security: Secret Scanning, push protection, and Dependabot security updates are enabled across every active repository. CodeQL default setup runs in every active repository. Vulnerability disclosures follow each public repository's SECURITY.md.
• Contributing: Every public repository carries its own CONTRIBUTING.md. Every change to the default branch must arrive through a pull request and pass the repository-specific checks; direct pushes to main are not permitted.
• Code of Conduct: Every public repository follows Contributor Covenant 3.0 through its own CODE_OF_CONDUCT.md.

• Homepage: www.lcv.dev
• GitHub: opening issues on the relevant repository is the canonical channel.
• Email: contato@lcv.dev for general topics.
• Phones: +55 (11) 5229-0077 / +55 (21) 99152-4643
• Sponsorship: support the work through the secure sponsor page → www.lcv.dev/sponsor.

• License: this .github repository is proprietary — all rights reserved. See LICENSE.
• Notices: see NOTICE and THIRDPARTY.
• Security disclosure: see SECURITY.md.
• Code of conduct: see CODE_OF_CONDUCT.md.
• Contributing: see CONTRIBUTING.md.
• Inbound rights: see INBOUND.md.
• Sponsorship: see the relevant repository's Sponsor button or central sponsor page.
• Action pinning: all external GitHub Actions are pinned by full commit SHA; the enterprise and organization Actions policy requires that pin.
• Code owners: .github/CODEOWNERS.

• Site: https://www.lcv.dev
• GitHub organization: LCV-Ideas-Software
• Public organization profile source: .github
• Sponsors: https://github.com/sponsors/lcv-ideas-software

Copyright © 2026 LCV Ideas & Software. The original content of this repository owned by LCV Ideas & Software is proprietary and all rights are reserved. See LICENSE, NOTICE, and THIRDPARTY.

Copyright © 2026 LCV Ideas & Software
_{LEONARDO CARDOZO VARGAS TECNOLOGIA DA INFORMACAO LTDA
Rua Pais Leme, 215 Conj 1713 - Pinheiros
São Paulo - SP - CEP 05424-150
CNPJ: 66.584.678/0001-77 - IM: 3039854 - Número D‑U‑N‑S® 583149431}