Internal apps

Apps we build and host for ourselves, as opposed to the vendor tools in Engineering System or the production consoles in Where to look.

App	URL	What it’s for	Where it runs	Repo
PR dashboard	triage.plasticlabs.ai	Who owes a code review, who owes the next reply	Cloudflare Worker + KV	pr-dashboard
Falinks	falinks.plasticlabs.ai	Data labeling for judge calibration	Fly Machine + Cloudflare Tunnel	falinks

Access

Both sit behind Cloudflare Access, which admits @plasticlabs.ai Google accounts. No VPN, no client setup — open the URL and sign in with Google.

Neither app authenticates anyone itself. Access is the whole access-control layer, so any hostname that reaches these apps without transiting Cloudflare’s edge is an unauthenticated hole. Both repos guard against this in different ways, and both guards are load-bearing:

• PR dashboard — workers_dev = false and preview_urls = false in wrangler.toml. *.workers.dev is outside our zone and cannot be gated; per-version preview URLs serve the same Worker with the same KV and secrets.
• Falinks — no [http_service], no [[services]], no public IP. The app binds 127.0.0.1 and a cloudflared sidecar dials out, so the Machine has no reachable origin. Adding a service block would leave falinks.fly.dev answering directly.

PR dashboard

Boards over every open PR and issue in the org. A cron pulls GitHub into KV every 15 minutes and page loads read KV, so nothing waits on GitHub.

Route	What
/	Review load — who owes a review, per person
/triage	Response triage — who owes the next reply
/integrations	Open PRs/issues on each Honcho adapter
/api/status	Last run: ok, duration, row counts, warnings
POST /api/refresh	Refresh now; ?repos=a/b,c/d scopes it

Repos scanned are the REPOS and INTEGRATION_REPOS vars in wrangler.toml — add one there and redeploy.

Falinks

Labeling app for judge calibration: imports scored datasets, samples them, routes blind adjudication, and produces the calibration export Excadrill consumes — one export per batch.

Stdlib Python, SQLite, and vanilla JS with no dependencies. SQLite is single-writer, so it runs as exactly one Machine and must never be scaled out.

The roster identity a labeler picks in the browser is attribution, not authentication — Access is what actually gates entry. Binding labeler_id to the Access-verified email is still outstanding.

Operational detail for both apps lives in their repos: README.md and RUNBOOK.md in falinks, README.md in pr-dashboard.