Architecture brief · for external review

The PINAVOX Stack

One founder, a small team, and a client base of $10–50M machine manufacturers — served by a fleet of isolated AI brains, one self-hosted agent, and a client product that seeds a platform. This brief consolidates every architecture decision, the economics, and the failure history they were derived from.

Author Stefan Badertscher, PINAVOX Date 5 Sep 2026 Status Decisions locked; build sequenced Ask Section 10 — reviewer questions

0 · Executive summary

The whole system in six lines

Separate state from compute from surface — then never let a credential cross a boundary.

State lives in per-tenant brains: git + Cloudflare Worker + D1 + R2, physically isolated per tenant (no shared DB, no namespace filters).
Compute is three-tier: an always-on self-hosted agent (browser hands, multi-account email), Anthropic cloud routines (scheduled jobs), and interactive Claude sessions — all billed to existing subscriptions, not per-token API.
Surfaces are thin: Slack for capture, claude.ai Projects for conversation, a web Board per client, Obsidian for files. Brain routing is enforced by credential scoping, not by prompt discipline.
Client product: each client gets a cloned brain stack (RAG included) + a Board web app at ~$0–2/mo marginal COGS; AI tokens ride on the client's own Claude subscription in phase 1, metered API in phase 2.
The predecessor system failed (7 weeks silent, $50–95/day API burn); seven invariants derived from that post-mortem govern every component here.
New capital required: ≈ $0. The always-on hardware is an owned laptop; everything else is existing subscriptions plus low single-digit dollars of Cloudflare usage.

1 · System map

Three brain tiers · three compute tiers · hard walls

Fig. 1 — The stack. Surfaces are thin and interchangeable; state is per-tenant and physically isolated; compute is split between one owned always-on agent (private + company work), managed cloud routines (scheduled work), and Cloudflare's edge (everything client-facing).

2 · Brain routing — the guarantee

Why a task can't pull from the wrong brain

Three surfaces, three deterministic routers. The critical design choice: routing is enforced by credential scoping, not by model obedience. A mis-phrased prompt cannot cross a wall, because the execution environment for a company task contains no key for the private brain — and vice versa.

Fig. 2 — Credential-scoped routing. Each surface resolves deterministically to a credential bundle; the bundle defines the reachable world. This also restores the multi-account email capability the previous system had (personal + company Gmail simultaneously) that single-connector chat products cannot offer.

3 · The agent layer

APEX — a self-hosted Manus-class agent on owned infrastructure

APEX is ~100 lines of glue, deliberately: a Slack Socket-Mode listener that shells into claude -p with per-thread session resumption, on an always-on ThinkPad X1 (Ubuntu) in the founder's home. No agent framework. The intelligence is stock Claude Code; the scheduler is systemd; the state is git.

Capability	Manus-class SaaS agent	APEX (self-hosted)
Multi-step live web research	Yes	Yes — real Chrome, headed, watchable via remote desktop
Logged-in sessions (groceries, Marketplace, airline)	Ephemeral, per-run logins	Persistent dedicated Chrome profiles — log in once, stays live across reboots
IP reputation	Datacenter IPs → bot walls	Residential IP (the founder's home line)
Multiple Gmail / calendar accounts	One account per connector	N × OAuth token files, selected per credential bundle
Multiple brains with hard walls	No concept	Credential-scoped routing (Fig. 2)
Marginal cost per task	Per-credit pricing	$0 — existing Claude Team seat
Purchase completion	Attempts full checkout	Deliberate stop-line: fills carts / prepares bookings; human clicks buy. Server-side carts make the handoff seamless (cart appears in the owner's own app)

Reliability posture (the boring parts that matter)

Zero inbound ports. Slack Socket Mode and Tailscale are both outbound-only; UFW denies all inbound. The machine is invisible from the internet.
Encrypted and unattended. LUKS full-disk encryption with TPM auto-unlock — survives power loss and reboots headless (the macOS FileVault equivalent requires a human or a KVM; Linux does not).
Battery = built-in UPS, charge-capped at 80% for longevity; systemd restarts the listener on any exit; a silent dead-man's switch pings the founder's phone only if the box vanishes.
Sync is part of the work, not a daemon. Every session starts with git pull; a task is not "done" until its commit is pushed. The predecessor's fatal background sync loop (below) is structurally impossible.
Client isolation: the X1 holds no client credentials and serves no client traffic. A dead laptop inconveniences one founder, never a customer.

4 · Why these rules exist — the predecessor's post-mortem

"Vox" — OpenClaw daemon on a rented VPS, Jan–Aug 2026

Failure (observed, logged)	Invariant derived
Claimed actions it hadn't completed	R1 — No claim without an artifact. Every action returns a link/path/row-ID or reports failure.
24 sync-failure alerts over 7 weeks into a channel the founder had stopped reading; nobody noticed	R2 — The output is the heartbeat. No ops channel; the absence of expected work product is the alarm.
Status file claimed jobs ran on the VPS that actually ran elsewhere	R3 — Status is derived from artifact timestamps, never declared.
Scheduled daily briefs lost the founder's trust ("not up to date, not at a good level of trust") and were all disabled	R4 — Reactive first. Proactive jobs added one at a time, each with a stated success condition.
$50–95/day per-token API burn; one $22 scrape produced zero usable rows	R5 — Spend reported daily, ceiling enforced in code. Personal/company compute rides subscriptions; API is reserved for revenue-attached product COGS, capped per tenant.
Bespoke agent framework only the founder could repair	R6 — Thin glue over stock tooling. Losing the glue loses a script, not a system.
A "vacation-week" review routine ran 40 days past its scope, committing daily requests to be cancelled	R7 — Everything scheduled carries an expiry and a three-strikes auto-disable.

5 · The client product

A brain + a Board per client — the deliberate seed of the PVOS platform

Every PINAVOX client (industrial machine manufacturers running the Production Visibility OS™ content system) gets a cloned stack: Worker + D1 + R2 + managed RAG (Cloudflare AI Search, multilingual embeddings) + an Access-gated Board. The client's team connects their own Claude to their brain via MCP and works conversationally; the Board is the shared operational view.

Division of labor — deliberately LLM-free Board

Activity	Surface	AI cost bearer
Drafting, discussing, "what's missing on piece S-012?"	Client's own Claude (Project + MCP connector) — full-window chat, artifacts, long texts	Client's subscription phase 1 / metered API phase 2
Weekly content meeting: add ideas live, move stages	Board grid — type, Enter, next numbered row (IDs brain-assigned; human-typed IDs corrupted the pilot client's sheet)	None — no LLM in the Board
Reading a full article, reviewing files	Board full-page view / file manager (R2)	None

Data model — hard-capped against feature creep

Two levels, forever: Piece (idea, TAYA category, priority, sales-use) → Assets (channel × language, stage, date, link). No tasks, no dependencies, no automation builder. The grid stays dumb; anything intelligent — summaries, charts, "what changed since last week" — is asked in chat and answered by the brain. UI is English-only; per-language columns (DE/EN) are content-tracking data, not localization.

Unit economics

Item	Phase 1 (now)	Phase 2 (product)
Infra per client brain	~$0–2 / mo	~$0–2 / mo
AI tokens	$0 — client's own Claude via MCP	metered API, hard-capped per tenant in code
Build effort	≈ 3 days (first), then template-clone in hours	—
Pricing	bundled in PVOS engagement	monthly tool fee ≥ 10× capped COGS (cap guarantees margin floor)
Trigger to move	3+ client brains live · MCP-side token telemetry from phase 1 sets the phase-2 price — measure, then price; never guess

Position

Phase 1 is not a compromise — it is instrumentation. Client-side Claude usage through the Worker produces exact per-tenant token telemetry. The embedded-API chat ships only when that data exists, with a per-tenant spend ceiling enforced in the Worker (the same class of runaway that produced $95 days structurally cannot recur, because the cap is code, not policy).

6 · Security model

Summarized — each item enforced, not aspirational

Tenant isolation is physical: separate Worker + D1 + R2 + Access app per client. A cross-tenant leak requires a Cloudflare platform failure, not a WHERE-clause bug. Adversarial isolation test is a phase-C gate before any client handoff.
Private tier is graded: the personal brain is online (single-email Access) but holds knowledge and pointers; raw sensitive artifacts (tax filings, contracts) exist only on the encrypted X1.
Credential bundles (Fig. 2) scope every agent task; write audit log on every brain mutation; per-tenant kill switch (one command disables one client, touching nothing else).
Backups: truth in git (versioned by construction); nightly D1 export + R2 versioning; disaster recovery = clone + import. The X1 is disposable by design — reinstall + re-auth ≈ one morning.
Platform risk, named honestly: heavy dependence on Anthropic (subscriptions + API) and Cloudflare. Mitigants: state is portable (git + SQLite-compatible D1 exports + standard MCP), the Board is vanilla web, and the agent glue is ~100 lines. Vendor exit is measured in days, not quarters.

7 · Cost picture

Before vs after

Line	Predecessor era	This architecture
Agent model usage (founder ops)	$50–95 / day (API, peaks)	$0 marginal — existing Team seats
Hosting	$25 / mo VPS	$0 — owned X1 (+ ~$2/mo power)
LinkedIn proxy plan	$20–25 / mo (planned)	$0 — Tailscale free tier, residential exit
Cloudflare (all brains + Boards)	—	$5 / mo Workers Paid + ~$0–2 / mo per tenant
Client-facing AI	n/a	$0 (phase 1) → capped COGS priced into fee (phase 2)
New hardware	—	$0 — repurposed owned laptop

The structural fix is not frugality — it is moving founder-side compute onto flat-rate subscriptions and reserving metered API strictly for revenue-attached, ceiling-capped product COGS. The binding constraint becomes Claude seat capacity (shared with the founder's own usage), managed by model-routing routine jobs to cheaper tiers.

8 · Current status

Honest inventory, 5 Sep 2026

Component	State
PINAVOX Brain (Worker + D1 + MCP OAuth, team access, nightly Librarian)	LIVE since Jul 2026
Cloud routines (CEO brief, post-ideas, night-shift)	LIVE — runaway review routine killed 5 Sep (R7 now enforced)
Brain Librarian (nightly curation: capture wide → curate → cite sources)	LIVE — verified from run logs 5 Sep: fired every night, ~3 min/run, zero misses; curated learnings land as cited Brain entries + Slack digest + push
LinkedIn post-performance ingest → brain (closes the content flywheel)	NEXT — prerequisite before the brain generates weekly posts; entry count is not the gate, the feedback loop is
Command Center (outreach: D1 + web UI + guarded send)	LIVE — pattern-proof for the Board
Sensora brain (first client clone: frameworks, planner, RAG, Board)	BUILDING — phase A/B/C sequenced; framework approval + Access app pending
APEX on X1 (wipe → Ubuntu → listener → browser hands)	BUILDING — hardware in hand, spec locked
Stefan Brain split (private stack + credential bundles + routing)	NEXT — after APEX phase 1
PINAVOX-internal Board (retires Notion content DBs)	NEXT — clone of Sensora Board once proven
Phase-2 embedded client chat (metered API)	GATED — on 3+ live brains + telemetry

9 · Positions taken

Where the advisor disagreed, and what stands

Physical isolation over multi-tenant namespaces — namespaces were proposed and rejected: a filter bug leaks, a separate database cannot. Ops cost of N stacks is the accepted price; revisit only past ~50 tenants (reviewer question 2).
The Board carries no LLM in v1 — chat lives in the client's Claude. Rebuilding a chat window inside the Board would duplicate a surface Anthropic builds full-time, and reintroduce uncapped COGS before telemetry exists.
Phase the monetized chat — against the instinct to price API chat now: measure phase-1 usage first. Caps before pricing, telemetry before caps.
The private brain went online after all — the initial "no endpoint" purism was reversed for usability (live brain access from any device), mitigated by graded sensitivity: knowledge online, raw artifacts local-only.
Repurposed laptop over new hardware — a Mac mini (and earlier a $3K MacBook Pro) was evaluated and rejected: the measured bottleneck was RAM on the calls machine caused by Chrome, solved by moving agents off it; and Linux is strictly better for this server role (TPM unlock, kernel exit-node, systemd, no forced reboots).
No second agent runtime — Grok/other agent bots rejected as runtimes (they'd double the maintenance surface); external AI tools remain welcome as data sources called by the one runtime.
Platform grows inside delivery until 10 clients — external reviewer concurrence (5 Sep): let the PVOS platform emerge from real client usage pain, not imagined requirements. Product/delivery split deferred until 10 tenants run the system.
Brain-generated LinkedIn posts are gated on the feedback loop, not an entry count — the brain drafts posts through the existing approval gate today, but the compounding flywheel starts only when post performance is ingested nightly and the Librarian curates market resonance, not just operational status.

10 · Questions for the reviewer

Where outside pattern-matching beats inside conviction

Round 1 outcome — 5 Sep

Reviewer confirmed: physical tenant isolation, vendor-risk posture, and the bus-factor bar ("Fatima restarts APEX without calling Stefan" — now a binary phase gate alongside the adversarial isolation test and handoff one-pager). Product-wedge question answered: stay inside delivery until 10 clients run the system — the platform emerges from real usage pain. Still open below: fleet ops at 50+, phase-2 pricing model, vendor de-risk timing.

Fleet ops: at 10 / 50 / 200 client brains, where does per-tenant physical isolation break as an operating model — and what would you instrument now so the migration moment is visible early?
Pricing: for the phase-2 embedded chat, per-seat flat with a hard usage ceiling vs. metered pass-through — which has survived better in your portfolio for non-technical SMB buyers?
Vendor concentration: Anthropic terms scope subscriptions to "ordinary individual usage," and the agent layer leans on one vendor's seat capacity. Would you de-risk now (second-model fallback, API budget line) or treat it as premature?
Product wedge: the client Board is deliberately the seed of the PVOS platform (belt tracking, training paths parked). Grow the platform out of delivery like this, or split product engineering from client delivery earlier?
The one-founder bus factor: template deploys, brain curation prompts, and the agent glue are all founder-maintained. What is the minimum documentation/automation bar before this counts as a sellable system rather than a founder's exoskeleton?