Credits

JSCAD (OpenJSCAD.org) is an open-source library for making 3D models in JavaScript, with code rather than a mouse. It is released under the MIT licence and kept by its community of contributors; its package lists Rene K. Mueller, z3dev and Mark Moissette among them.

• The starting point. Locus began as the JSCAD repository, imported with its full history and its MIT licence. Its packages live on unchanged in packages/, and JSCAD's own test suite still runs in every Locus pipeline.
• Every plate is JSCAD geometry. The curve, the axes, the ticks, the point domes and every braille dot are solids made with @jscad/modeling, joined into one plate and written out as the STL file you print.
• The same code makes the same plate. Because JSCAD builds geometry from code, a graph can be rebuilt exactly from its request, which is how Locus re-checks every shipped graph whenever the code changes.

Thank you to everyone who has built and maintained JSCAD. github.com/jscad/OpenJSCAD.org

Locus lives in a GitLab project. GitLab is where requests arrive, where the agents work, and where every graph is checked and released.

Duo Agent Platform

Two custom flows run the agents. locus-request reads a teacher's email, writes the request files, opens a merge request and fixes its own layout until the touch checks pass. locus-ops reviews a developer's change and explains on the merge request, before it is merged, which shipped graphs it would break.

Flow triggers

A request starts the agent when it is assigned to the flow's service account (the request email's last line does it); a failed pipeline starts the reviewer. Each flow works as its own service account.

Issues by email

A teacher's email becomes an issue through the project's "Email a new issue" address, and every note on it is emailed back to the teacher.

CI/CD pipelines

The pipeline renders each plate, runs the five touch checks, the guards that keep the agent inside its files and its maths, and then packages, releases and deploys.

Merge requests

Each request is a merge request: the first attempt fails, the agent's fix passes, and the pipeline merges it on its own. "Pipelines must succeed" makes GitLab refuse anything red.

Security scanning

Secret Detection and SAST run on every pipeline on the main branch, and a licence check keeps every dependency permissive.

Package Registry

Every released plate's files (STL, preview, description, manifest) are kept as a generic package, so their links never expire.

Releases

Each graph is tagged and released as graph-<request>-v<version>, with links to its files and the checks it passed.

ID tokens

GitLab's signed ID token lets the pipeline sign in to Google Cloud without any stored key.

This site, and every graph page on it, is served from Google Cloud.

Cloud Run

Runs the site. Each release becomes a new revision that is first served on a staging address and checked like a visitor would (every page loads, every file matches its fingerprint) before it gets production traffic. It scales to zero when nobody is visiting.

Cloud Build

Builds the site's container from the pipeline's files on every release.

Artifact Registry

Keeps the site's container images, with a cleanup rule that keeps only the five newest.

Workload Identity Federation

Trusts GitLab's ID token from our project's protected main branch only, so no Google key exists anywhere.

IAM and billing

One deploy service account with only the roles it needs, and a 5 USD monthly budget alert.