Confidential
RRI GitHub Audit
rri-dev organization — 27 active repositories across 5 domains
169
Total Repos
27
Active Repos
5
Internal Devs
8
Critical Findings
16
Days to UPW
~4K
Total Commits
1 — Executive Summary
RRI's codebase is held together by 5 developers, extensive technical debt, and zero organizational standards. The most critical systems — checkout, order processing, event registration, member portal — run on outdated infrastructure with single points of failure. The infrastructure team is literally one person. There are hardcoded secrets in repos,
The good news: The talent that's here is real. Johnny, Zach, and Nick are strong engineers doing modern work where they can. The new infrastructure (K8s, GitOps, AWS SAM) is well-designed. There's a path forward — it just needs leadership, prioritization, and resources.
.env files committed to git, and production systems running on Node.js versions EOL for 7 years.
The good news: The talent that's here is real. Johnny, Zach, and Nick are strong engineers doing modern work where they can. The new infrastructure (K8s, GitOps, AWS SAM) is well-designed. There's a path forward — it just needs leadership, prioritization, and resources.
2 — The Team
Who actually builds things at RRI. 5 internal developers + 4 contractors maintaining 27+ active repos, 2 datacenters, and 11 data source integrations.
Johnny Yarlott
@alphonso77
Core Backend • Auth • Payments
1,100+
Commits
5
Repos
97%
Core-API
core-api-v3 (567)
order-ingestion (368)
event-api (115)
Keystone engineer. Highest code quality on the team. Modernizing core-api to K8s. Only person who understands auth, payments, and Salesforce integration end-to-end. CRITICAL bus factor risk.
Michael "Spork" Evans
@HeySporky
Events • Operations • Fire-fighting
850+
Commits
4
Repos
event-api (500)
order-ingestion (285)
android-kiosk (49)
Director of Engineering but still coding. Dominant on event infrastructure. Operational/fire-fighting style. Uses Pokemon-themed alt accounts (Kingler, Rotom) to push directly to master.
Nick Jensen
@ncklrs
Principal Architect • Web Platform
1,230+
Commits
4
Repos
44%
TR.com
sanity-project (1,182)
experience-api (22)
rpm-knowledge (23)
Owns the crown jewel — TonyRobbins.com. Most modern tech choices (Next.js 16, React 19, Bun, Fastify). Building next-gen Experience API. Single point of failure on the highest-traffic property.
Zachary Hardesty
@suigintoulain
THE Entire Infrastructure Team
370+
Commits
9
Repos
gitops-k3s (291)
gitops-platform (14)
zendesk-stripe (7)
lakehouse (6)
Sole person managing K8s clusters, GitOps, observability, CI/CD, and the data lake. Best documentation. Heavy Claude Code user. If he leaves, nobody knows how the infrastructure works.
Josh Fuller
@joshfuller8
Backend Support • Experimental
320+
Commits
5
Repos
order-ingestion (104)
omi (131)
event-api (66)
Backend developer spread across 3 core repos + experimental (Omi). Works on Salesforce data, RFID, schema fixes. Pushes directly to master without PRs.
External Contractors & Agencies (5 active)
Federico Del Rio
UruIT / Nearsure
Sole maintainer of the Members Portal (374 commits) and Member Service (72 commits). External contractor. Single point of failure on a critical customer-facing system.
Jonathan Perez
DualBoot Partners
Sole maintainer of RPM Planner (web + backend + mobile). Low velocity. External contractor.
Freddy Garcia
Nearsure
Built AI tools rapidly (9 days). Chargeback AI (33 commits) and Performance Follow-up (29 commits).
awilmort
Nearsure
Primary Salesforce developer. 420 commits on salesforce-deploy.
OnBuild / Nortal
Agency
Contributing to TonyRobbins.com (sanity-project) alongside Nick.
3 — Bus Factor Risk
How many people need to leave before a system becomes unmaintainable. Almost every critical system is at 1.
All Infrastructure
1
Extreme
Core API
1
Critical
TonyRobbins.com
1
Critical
Members Portal
1
Critical
Data Lake
1
Critical
RPM Planner
1
High
Event API
2
High
Order Ingestion
3
Moderate
4 — Critical Findings
Members Portal Running on Node 11 (EOL June 2019)
Extreme
The customer-facing Members Portal (
members-portal) requires Node.js >=8.6 <12. Node 11 reached end-of-life nearly 7 years ago. Known security vulnerabilities. Can't use modern npm packages. Failed upgrade attempts visible in abandoned branches (feature/node-upgrade-18-16). Pure JavaScript (no TypeScript). 102MB repo. Maintained by a single external contractor. No CI/CD. .env was committed to git.
Auth System Cannot Handle UPW-Scale Load
Critical
The
rri-stress-test repo contains actual load test results showing massive degradation under concurrent load. The auth system (AWS Cognito token generation) becomes a bottleneck at scale. The current workaround is pre-warming cached tokens before events.
Concurrent login success rate — UPW typically has thousands of attendees
No CI/CD on Most Critical Repos
High
Of the most critical repos: members-portal, event-api, order-ingestion, member-service — none have CI/CD pipelines. Even where CI/CD exists (core-api-v3), tests are often not run in the pipeline. Changes go to production without automated testing.
Has CI/CD (11)
core-api-v3, sanity-project, rpm-planner-web, rpm-planner-backend, salesforce-deploy, rpm-knowledge, zoom-transcription, zendesk-stripe, zendesk-sf, sms-consent, dwd-backend
No CI/CD (15)
members-portal, event-api, order-ingestion, member-service, chargeback-ai, performance-followup, omi, decision-maker, stress-test, ted-api, rri-cli, android-kiosk, rpm-planner-mobile, wealth-mastery, freshservice
Hardcoded Secrets in Source Code
Critical
- rri-stress-testAPI secret (st-secret header value) and Cognito client IDs committed
- members-portal.env was committed to git (removed but remains in git history)
- member-service.env committed then removed; SALESFORCE_PASSWORD in .env.example
- rri-lakehouseFacebook Ads and LinkedIn Ads account IDs hardcoded in job scripts
- rri-ted-apiPostman collection with credentials committed then removed
- order-ingestion.env.preview committed to repository
Heroku Lock-In (Migration Half-Done)
High
Only 3 repos are on Kubernetes. The rest are on Heroku with no migration path. Core-api-v3 is split between K8s staging and Heroku production.
| Repo | Current | Target | Status |
|---|---|---|---|
core-api-v3 | K8s (staging) + Heroku (prod) | Full K8s | Migrating |
sanity-project | Kubernetes (multi-DC) | Done | Complete |
event-api | Heroku | K8s | PR open |
order-ingestion | Heroku | Unknown | No plan |
members-portal | Heroku | Unknown | No plan |
member-service | Heroku | Unknown | No plan |
wealth-mastery | Heroku | No plan | Legacy |
Private NPM Package on Personal Account
High
@alphonso77/rri-lifeforce is a private npm package used by rri-order-ingestion. It's published under Johnny's personal npm account. If his account becomes inaccessible, production builds break.
5 — Architecture Overview
Core revenue path — the systems that matter for UPW and daily operations.
Entry Point
TonyRobbins.com
rri-sanity-project • Nick Jensen (44% of commits) • Sanity CMS
Kubernetes (multi-DC)
Next.js 16
React 19
Bun
payments & orders
Payments
Stripe Checkout
Webhooks, ClickFunnels, Shopify, Copecart
Stripe 8.x-9.x
6 versions behind
Order Processing
Order Ingestion
rri-order-ingestion • Johnny + Spork + Josh
Heroku
TypeScript
BullMQ 1.x
auth & events
Auth & SSO
Core API v3
rri-core-api-v3 • Johnny (97% of commits)
K8s (staging)
Heroku (prod)
AWS Cognito
Event Registration
Event API
rri-event-api • Spork + Josh • POS, check-in, RFID
Heroku
TypeScript
Node 18 (EOL Apr 2025)
post-purchase
Customer Portal — CRITICAL RISK
Members Portal
members-portal • Federico (contractor, sole maintainer) • Billing, event details, member experience
Heroku
Node 11 (EOL 2019)
Pure JavaScript
102MB repo
No CI/CD
Infrastructure Details (2 Datacenters)
Two Datacenters: san1 (San Jose, fully operational) and fmt2 (Fremont, partially operational, no DR capability yet).
Current: K3s clusters on Proxmox VMs
Next-gen: Talos Linux + ArgoCD + Cilium (gitops-platform, in progress)
Observability: Loki + Tempo + Mimir + Alloy + Grafana
Secrets: AWS Secrets Manager + ExternalSecrets
CI/CD: GitHub Actions on self-hosted runners
Container Registry: GHCR
Data Lake: AWS Glue → S3 (Raw → Clean → Curated/Iceberg)
Current: K3s clusters on Proxmox VMs
Next-gen: Talos Linux + ArgoCD + Cilium (gitops-platform, in progress)
Observability: Loki + Tempo + Mimir + Alloy + Grafana
Secrets: AWS Secrets Manager + ExternalSecrets
CI/CD: GitHub Actions on self-hosted runners
Container Registry: GHCR
Data Lake: AWS Glue → S3 (Raw → Clean → Curated/Iceberg)
6 — Repo Health Scorecard
| Repo | Activity | Tests | CI/CD | Bus Factor | Health |
|---|---|---|---|---|---|
rri-sanity-projectTonyRobbins.com |
Daily | Yes | Yes | 1-2 | Good |
rri-core-api-v3Core API |
Daily | Yes (not in CI) | Yes | 1 | Moderate |
rri-order-ingestionOrder Processing |
Weekly | Yes (enforced) | No | 2-3 | Moderate |
rri-event-apiEvent Registration |
Weekly | Yes (~50%) | No | 2 | Moderate |
rri-salesforce-deploySalesforce |
Weekly | Partial | Yes | 2 | Moderate |
rri-lakehouseData Lake |
Weekly | No | Yes | 1 | Moderate |
gitops-k3sInfrastructure |
Monthly | No | Yes (9 workflows) | 1 | Moderate |
rri-rpm-planner-webRPM Planner |
Low | Yes (85% cov!) | Yes | 1 | Moderate |
rri-experience-apiNew Portal |
Active | Yes | No | 1 | Early |
members-portalCustomer Portal |
Low | Yes (not in CI) | No | 1 | Critical |
rri-member-serviceMember Service |
Low | Yes | No | 1-2 | Critical |
wealth-masteryWealth Mastery |
Dead | Yes (not in CI) | No | 0 | Critical |
rri-dwd-backendDWD |
Abandoned | Yes | Yes | 0 | Critical |
7 — Vendor History
A revolving door of agencies with inconsistent knowledge transfer.
2018 – 2023
UruIT
Built members-portal, member-service, wealth-mastery. Federico is the last holdover from this era.
Departed
2022 – 2024
Fueled
Built RPM Planner (web + backend) and DWD backend. No visible knowledge transfer when they left.
Departed
2024 – Present
DualBoot Partners
Maintaining RPM Planner. 1 developer. Low velocity.
Active
2024 – Present
Nearsure
Salesforce (awilmort), AI tools (Freddy Garcia), portal work (Federico). Multiple contributors.
Active
2024 – Present
OnBuild / Nortal
Contributing to TonyRobbins.com (sanity-project) alongside Nick.
Active
8 — Dependency Graveyard
EOL runtimes, deprecated libraries, and major version gaps across the stack.
| Dependency | Issue | Repos Affected |
|---|---|---|
Node 11 |
End-of-life since June 2019 (7 years) | members-portal |
Node 18 |
End-of-life April 2025 | event-api |
Python 3.7 |
End-of-life October 2023 | dwd-backend |
Django 4.1 |
End-of-life April 2024 | rpm-planner-backend |
PostgreSQL 11 |
End-of-life November 2023 | dwd-backend |
jsforce 1.11 |
Outdated Salesforce client (current is 2.x) | ALL backend repos |
Kue |
Deprecated job queue (abandoned 2017) | members-portal, event-api |
request |
Deprecated HTTP client (2020) | members-portal, member-service |
Stripe 8.x-9.x |
6+ major versions behind current | members-portal, event-api, order-ingestion |
TypeScript 4.x |
2 major versions behind | core-api, event-api, order-ingestion |
BullMQ 1.x |
4 major versions behind | order-ingestion |
9 — UPW March 12 Risks
16 DAYS UNTIL UPW — THESE RISKS ARE LIVE
1
Auth System Buckles Under Concurrent Load
Stress tests prove degradation at 600 concurrent users — 52% success rate. At 3,000 users it's near-total failure (1.5%). UPW has thousands of attendees. Need pre-warming strategy for Cognito tokens before March 12.
2
Order Ingestion Is Brittle
Just had a HubSpot rate limiting crisis (Jan 29) with 8 branches of emergency fixes. System handles Stripe, ClickFunnels, Shopify, and Copecart webhooks. No CI/CD. Any failure during UPW sales = lost revenue.
3
No Automated Testing on Critical Paths
Neither order-ingestion nor event-api have CI/CD. Changes go to production without automated testing. Any last-minute fix before UPW is deployed on faith.
4
Members Portal on Node 11
If anything goes wrong with the customer portal during UPW, debugging and fixing options are severely limited. Node 11 can't run modern tooling. Single contractor dependency.
10 — Recommendations
Immediate (Pre-UPW)
- Secure secrets — audit and rotate all hardcoded credentials
- Load testing plan — Cognito pre-warming strategy for March 12
- Get JIRA access — per-project permissions still blocked
- Evaluate contractors — Federico and Jonathan are single points of failure
- K8s migration timeline — only core-api-v3 partially migrated
Medium-Term (Post-UPW)
- Members Portal Node upgrade — rewrite vs. incremental upgrade
- CI/CD standardization — adopt gha-template across all repos
- Consolidate jsforce — single upgrade benefits all backends
- Address bus factor — cross-training, documentation, redundancy
- Retire dead repos — wealth-mastery, dwd-backend, ~69 legacy repos
- Standardize branching — main vs master vs develop — pick one
- Move NPM package — @alphonso77/rri-lifeforce to org scope
- Complete K8s migration — move remaining Heroku apps