Services & ports

browser
   │
   ▼
nginx (443) ─┐
             ├─ Supervisor (9000)  ─── static UI (dashboard, agents, teams, …)
             │                       └─ proxies /auth + /api → cores
             │
             ├─ Ambrose Core Py (8100)
             │     │
             │     ├─ Postgres (5432)
             │     ├─ Brain (8150) [federal/healthcare MCPs]
             │     ├─ PHI Gateway (8160)
             │     └─ Spoke subprocesses (per-tool)
             │
             └─ Ambrose Core Node (3300)
                   │
                   ├─ War Room (/api/warroom)
                   ├─ PHI Rail (scrub/hydrate, BAA gating)
                   ├─ Claude Agent SDK (heads + dispatch)
                   └─ Billing (Stripe)

Voice traffic goes through the SAA Voice Relay on Fly.io — Ambrose Core opens a persistent outbound WS; the relay dispatches Retell/VAPI tool invocations back. Real PHI never leaves the customer machine on voice paths.