# The Board — Devin Execution Brief

## Mission
Merge every Earth 1 Coalescent system into one body: one private code home, one identity, one AI gateway (Da Vinci), one deploy pipeline, and three apps (earth1.co, e1-4, Hive) that all run through them.

**Done means:** a single push to the code home builds, tests and deploys any app; every app signs people in the same way; every AI call from any app goes through the Da Vinci gateway; all money flows into the core and is paid out from it; and nothing runs from a repo, server or key that isn't listed in this brief.

**Order matters.** Consolidate what exists first (phases 0–2), then move it onto our own servers (phase 3), then add Spyder (phases 4–5). Do not start a later phase until the previous phase's acceptance checks pass.

## The tightened map
Seven systems, one job each. Use these names in repos, services and docs.

| System | Role | Status | Its one job |
|---|---|---|---|
| Core | Heart | Built, own server next | Holds all code, builds it, deploys every app, holds the ledger for all money; reachable only over our VPN |
| Da Vinci | Brain | Built | The one AI gateway every app calls: think, hear, speak, read, remember, know who's talking |
| Spyder · Crawler | Eyes | Next | Reads approved open sources and feeds the earth1 library and Da Vinci's memory |
| Spyder · Agent | Claws | Next | Da Vinci's hands on tools: writes code, opens pull requests in the core, runs tests |
| earth1.co | Mind · Knowledge | Live | The library: science, maths, philosophy, simulations, research archive |
| e1-4 | Voice | Live | e1-4.com: Voice Stream plus 1D–5D. No text anywhere |
| Hive (code name e1-5) | Community | Built | e1-4.com/hive: rooms, text chat, video calls, self-hosted media |

The body underneath (database, file storage, mail, DNS, VPN, servers) runs on Azure, Cloudflare, Hetzner and Google today and moves onto our own servers one piece at a time.

## Ground rules
1. Every repo is private. No public repos, forks or gists, ever.
2. No Vercel. Apps run as dynamic apps on Azure (not Azure Static Web Apps) until our own servers take over; voice workloads stay on Hetzner. DNS stays on Cloudflare.
3. Spread vendors on purpose. Don't put everything with one provider, and don't deepen dependence on Microsoft-owned GitHub: it is a mirror during migration, not the destination.
4. No secrets in code. Keys live in the secret store (Azure Key Vault now, our own store later). Rotate any key found in history.
5. Small pull requests. One change per PR, each with a test and a one-line description of how to check it. Never push straight to main.
6. Staging first. Every app has a staging copy; production deploys only from a green staging build.
7. Never delete user data or a live service without Zach's written yes in the PR. Migrations are copy, verify, then switch.
8. e1-4 shows no text. Nothing built for e1-4 may add visible text, typed input or a text login.
9. Design must feel human-made. No stock gradients, template layouts or generic AI look; follow the existing logos and the board's visual language.
10. Ask, don't guess, on anything listed under Decisions below.

## Target architecture
Everything converges on the core: code, identity, AI calls and money all pass through it. The defaults below are recommendations; propose alternatives in a PR with a one-paragraph reason.

**Core (heart)**
- Code: self-hosted Forgejo with Forgejo Actions for build and deploy. GitHub stays a private read-only mirror until phase 3 ends.
- Network: WireGuard VPN. The core's admin, git and CI are reachable only over it.
- Identity: one sign-in service for staff tools (passkeys). App users sign in the way each app decides (e1-4 by voice, see Decisions).
- Secrets: one secret store; apps receive keys at deploy time only.

**Core Treasury (money)**
- All money in arrives in one regulated account owned by the core: one business bank account plus one payment processor account (e.g. Stripe), never per-app accounts. That covers all money from every source: subscriptions and in-app payments, ad and sponsorship income, investor funding, grants, and anything Zach pays in himself. No other company account may receive money.
- Every app sends payments through a single core payments service; no app talks to the processor directly.
- The core keeps a double-entry ledger of every pound in and out, tagged by app and source.
- Payouts (suppliers, salaries, server bills, app budgets) run from allocation rules Zach sets.
- The core never holds funds itself; it instructs the bank and processor through their APIs.
- Autopay: every vendor that keeps the system running (Azure, Hetzner, Cloudflare, Google Workspace, Devin, ad platforms, domains) is billed to its own virtual card issued from the core bank account. core pulls each vendor's bills and usage by API, sets a monthly budget per card, alerts Zach on overspend and can freeze a card.
- Recurring bills under budget pay with no approval. New vendors, one-offs over the threshold and payroll wait for Zach's yes.

**Da Vinci (brain)**
- One gateway service with endpoints for think, hear, speak, read, remember and who's-talking.
- Every app calls only the gateway, with its own app key. Models behind it can change without touching any app.
- Memory: Postgres with pgvector, partitioned by app and user, with per-user delete.

**Apps**
- earth1.co, e1-4 and Hive: one repo each, or one monorepo with an app folder each (Decision 1). Shared packages for the UI kit, the gateway client and the payments client.

**Body (organs)**
- Database: one Postgres cluster, one schema per app. Files: S3-compatible object storage. DNS: Cloudflare. Mail: Google Workspace for now.
- Hosting today: Azure dynamic apps plus Hetzner for voice. Target: our own Hetzner servers, moved one service at a time.

## Execution phases
Six phases, in order. Each ends with checks you must show passing before the next begins.

### Phase 0 — Inventory and lock-down
List every repo (the quantumleapsfusion-ops account, the Z-D-Fields monorepo, the earth1 repo, the e1-4 feature repos and umbrella repo), every hosting account (Azure, Hetzner, Cloudflare, Supabase, any Vercel leftovers, Red Hat OpenShift, IBM Cloud), every domain, every API key and every bill.
- [ ] Inventory doc in the umbrella repo: what exists, where, who pays, what depends on it
- [ ] Every repo private; leaked or old keys rotated
- [ ] Anything unused flagged for Zach (not deleted)

### Phase 1 — Consolidate the code
- [ ] Repo layout from Decision 1 in place; earth1.co, e1-4 and Hive each build from it
- [ ] Shared packages: UI kit, Da Vinci client, payments client
- [ ] Staging and production for each app, deploys automatic from main
- [ ] Vercel fully removed; Azure runs the apps as dynamic apps

### Phase 2 — One brain, one identity, one treasury
- [ ] Da Vinci gateway live; every AI call in every app goes through it (a code search finds no direct model calls)
- [ ] Staff sign-in by passkey across core tools; app sign-in per Decision 3
- [ ] Core payments service live; every app's payments route through it to the single core account
- [ ] Ledger records every transaction, tagged by app and source
- [ ] Autopay live: each vendor on its own virtual card, budgets set, overspend alerts tested, freeze tested
- [ ] Approval flow for new vendors, one-offs over the threshold and payroll
- [ ] Monthly money report to Zach: in, out, by app, by vendor, runway

### Phase 3 — Core on our own servers
- [ ] Forgejo and Forgejo Actions on our Hetzner servers, behind WireGuard
- [ ] All repos moved; GitHub becomes a read-only mirror, then is switched off on Zach's yes
- [ ] Database and file storage moved one at a time: copy, verify, switch, keep the old copy 30 days
- [ ] Backups nightly to a second provider; one restore rehearsed

### Phase 4 — Spyder Crawler
- [ ] Crawls only an approved source list (arXiv, Wikipedia, openly licensed sites), obeys robots.txt and rate limits, records each item's licence
- [ ] Feeds the earth1 library and Da Vinci's memory through the gateway

### Phase 5 — Spyder Agent
- [ ] Writes code and opens pull requests in the core only; never merges its own work
- [ ] Runs tests and deploys to staging; production still needs a human yes
- [ ] No access to Treasury payouts, ever

## Decisions for Zach
Stop and ask on each of these; do not guess.
1. Repo layout: one monorepo with an app folder each, or the current split of feature repos under an umbrella repo.
2. Da Vinci's models: the rule is "our own, no third-party AI", which means self-hosted open-weight models on our GPU servers. Is a third-party model allowed behind the gateway as a temporary stand-in? (An Anthropic key is already set up.)
3. e1-4 sign-in: voice alone can be faked with voice cloning. Allow a silent passkey on the person's own device alongside voice, with no visible text?
4. Legal company: the holding company that owns Earth 1 Coalescent and receives all money (likely a Delaware C-corp for US investors). To be confirmed with a startup lawyer and accountant before any bank is connected.
5. Bank and card provider for the core account and virtual cards (e.g. Mercury or Revolut Business).
6. Approval threshold: the amount above which any payout waits for Zach.
7. Hive moderation: UK online-safety law places duties on rooms, chat and video calls regardless of a free-speech policy. Get legal advice before Hive opens to the public.

## How Devin reports back
- Daily: three lines in the umbrella repo's log: done, next, blocked.
- Per phase: a short report listing each acceptance check with proof (link to the PR, test run or screenshot).
- Immediately: any blocker on a Decision, any found secret or security issue, any bill or budget surprise.
- Never: mark a check done without proof, or start the next phase early.