Behind the site

Cloud and agent architecture

Visitors reach this site through Route 53 DNS and a CloudFront distribution that terminates HTTPS with an ACM certificate. The files live in a private S3 bucket that only this CloudFront distribution can read.

Diagram: browser to Route 53 to CloudFront with ACM certificate to private S3 bucket through Origin Access Control

Request path

Service	Role in this site
Amazon Route 53	Hosts the DNS zone; A/AAAA alias records point the domain at CloudFront.
AWS Certificate Manager	Issues the TLS certificate for the domain (DNS validated, us-east-1).
Amazon CloudFront	Serves content over HTTPS, redirects HTTP to HTTPS, caches at the edge, and returns the custom 404 page.
Amazon S3	Stores the files. Block Public Access is on; only CloudFront (via Origin Access Control) may read objects.

The agents that deployed it

Planner

Plans, never executes

Turns the organization's requirement into ordered tasks for the other agents.

Site Builder

Audits the website

Checks pages, navigation, links, and the 404 page, and repairs problems inside site/ only.

Deployer

Runs approved AWS steps

Calls idempotent reconcile tools; anything that changes infrastructure needs human approval.

Verifier

Trusts evidence only

Probes the live site like an anonymous visitor and records status codes and certificate data.

Diagnoser

Explains failures

Reads failed checks and configuration, names a root cause, and proposes a fix from a fixed catalog.

Human

Approves changes

Consequential infrastructure changes are applied only after a person approves them.