PointSav architecture 2030 — an overview

@@ -49,35 +49,35 @@ The central thesis: a platform whose model fits entirely in plain text on one VM

Fifty-two claims constitute this structural commitment. The sovereign-SMB architectural commitment includes:

**Single-Boundary Compute Discipline.** Every AI inference call in every Foundry deployment passes through a single service boundary — the {{gli|Doorman}}. Bearer tokens and compute endpoints for all inference tiers live exclusively in the {{gli|Doorman}}'s configuration. The audit ledger is complete and cryptographic because the boundary is exclusive, not preferred.
**Single-Boundary Compute Discipline.** Every AI inference call in every Foundry deployment passes through a single service boundary — the Doorman. Bearer tokens and compute endpoints for all inference tiers live exclusively in the Doorman's configuration. The audit ledger is complete and cryptographic because the boundary is exclusive, not preferred.

**Knowledge-Graph-Grounded Apprenticeship.** The inference service consults the per-tenant knowledge graph before every substantive request. Training tuples include the graph context alongside the query and response. Adapters trained on graph-grounded tuples generate graph-coherent responses, and accepted responses update the graph — a co-evolution loop.

**TUI-as-Corpus-Producer.** Every terminal interaction with the inference service through the system administrator TUI is a curated training contribution. Operator feedback in the form of `/feedback [good|bad]` produces DPO triples. The IT-support adapter is intended to reach production quality with 200–500 high-quality interaction triples because the domain is narrow and ground truth is unambiguous.

**MCP-as-Substrate-Protocol.** Every Ring 1 and Ring 2 service exposes a Model Context Protocol server interface as its primary external contract. The {{gli|Doorman}} is the {{gli|MCP}} gateway. Customer-specific extensions plug in as additional {{gli|MCP}} servers without modifying core services. {{gli|MCP}} is the substrate-level wire contract for service composition.
**MCP-as-Substrate-Protocol.** Every Ring 1 and Ring 2 service exposes a Model Context Protocol server interface as its primary external contract. The Doorman is the MCP gateway. Customer-specific extensions plug in as additional MCP servers without modifying core services. MCP is the substrate-level wire contract for service composition.

**Seed Taxonomy as SMB Bootstrap.** Every tenant deployment is provisioned with a four-part seed taxonomy as the bootstrap of its knowledge graph: Archetypes (institutional role personas), Chart of Accounts, Domains, and Themes. The taxonomy is compact, explainable, and customer-tunable from day one. Industry-specific seed packs provide starter taxonomies for first-day operation.

**Customer-Owned Graph IP.** The per-tenant knowledge graph is the customer's intellectual property. PointSav has no claim to aggregate or resell tenant graph data without explicit per-tenant opt-in. The graph exports in open format. Per-tenant {{gli|LoRA}} weights are also the customer's property.
**Customer-Owned Graph IP.** The per-tenant knowledge graph is the customer's intellectual property. PointSav has no claim to aggregate or resell tenant graph data without explicit per-tenant opt-in. The graph exports in open format. Per-tenant LoRA weights are also the customer's property.

**Tier 0 Customer-Side Sovereign Specialist.** The reference Tier 0 deployment is a small-form-factor appliance running the full deterministic substrate plus a 1B sysadmin specialist model — no GPU required. A $7/month shared-core VM demonstrates the full substrate running at this size before dedicated hardware is procured.

**Vertical Seed Packs Marketplace.** Industry-specific seed packs are distributed as starter taxonomies for new tenant deployments: restaurant SMB shape, law firm shape, regional hospital shape, real estate shape, and others. Customers customize from the pack and may contribute refinements back to the marketplace.

**Code-for-Machines First.** Every inter-service contract, audit record, configuration, and ontology is machine-readable as a primary surface. Human-facing surfaces are skins on machine-first APIs — they consume the same {{gli|MCP}} servers any other client would.
**Code-for-Machines First.** Every inter-service contract, audit record, configuration, and ontology is machine-readable as a primary surface. Human-facing surfaces are skins on machine-first APIs — they consume the same MCP servers any other client would.

**Reverse-Flow Substrate.** The same {{gli|Doorman}} gateway and audit ledger that enforce inbound discipline also enforce outbound commercial flows: a data marketplace for customer data assets and an ad exchange for first-party audience inventory. Both flows are opt-in per tenant, disabled by default, and require per-record cryptographic provenance.
**Reverse-Flow Substrate.** The same Doorman gateway and audit ledger that enforce inbound discipline also enforce outbound commercial flows: a data marketplace for customer data assets and an ad exchange for first-party audience inventory. Both flows are opt-in per tenant, disabled by default, and require per-record cryptographic provenance.

**Service-Wallet Settlement.** Marketplace and ad-exchange revenue accrues to a per-tenant internal accounting ledger. PointSav's transaction fee is an accounting deduction at the time of incoming credit. The customer withdraws to their bank or cryptocurrency address on their own schedule. PointSav is never a custodial intermediary.

**Substrate-Without-Inference Base Case.** The Totebox Archive remains fully operational and freely transferable even when no inference tier is available. The deterministic substrate — {{gli|WORM}} ledger, knowledge graph, ingest pipeline, TUI in deterministic-only mode — provides complete data sovereignty operations without any AI dependency.
**Substrate-Without-Inference Base Case.** The Totebox Archive remains fully operational and freely transferable even when no inference tier is available. The deterministic substrate — WORM ledger, knowledge graph, ingest pipeline, TUI in deterministic-only mode — provides complete data sovereignty operations without any AI dependency.

Selected earlier claims of structural significance:

- **Continued-pretraining path** to customer-owned base model. The substrate compounds without vendor lock at the model layer.
- **The Compounding Substrate.** Every interaction improves the substrate for subsequent interactions, within the customer's infrastructure.
- **Adapter Composition Algebra.** The {{gli|Doorman}} is a kernel; adapters are processes; `service-content` is the filesystem. Composable intelligence.
- **Adapter Composition Algebra.** The Doorman is a kernel; adapters are processes; `service-content` is the filesystem. Composable intelligence.
- **Knowledge Commons / Service Commerce.** Knowledge artifacts are public and CC-licensed. The commercial threshold is multi-Totebox aggregation.
- **Designed-for-Breakout Tenancy.** Customer exit is the designed endgame, not a support exception.
- **Constrained-Constitutional Authoring.** The substrate's document schema is compiled into a context-free grammar and enforced at AI decode time. The AI cannot emit content that fails the schema.
@@ -88,11 +88,11 @@ Selected earlier claims of structural significance:

The platform organises services into three rings. Rings 1 and 2 are deterministic and function fully without Ring 3.

**Ring 1 — Boundary Ingest (per-tenant, MCP servers).** Services handle document ingestion, people data, email, and direct input. Each Ring 1 service implements an {{gli|MCP}} server interface. Customer extensions plug in as additional {{gli|MCP}} servers.
**Ring 1 — Boundary Ingest (per-tenant, MCP servers).** Services handle document ingestion, people data, email, and direct input. Each Ring 1 service implements an MCP server interface. Customer extensions plug in as additional MCP servers.

**Ring 2 — Knowledge and Processing (multi-tenant via moduleId).** Services handle extraction, content graph, search, and egress. The deterministic core of the platform. Functionally complete without AI.

**Ring 3 — Optional Intelligence (single instance, multi-tenant).** The {{gli|Doorman}} (`service-slm`) is the entirety of Ring 3. It routes among three compute tiers: Tier A local (OLMo 1B on customer hardware, zero marginal cost), Tier B GPU burst (OLMo 32B Think on a short-lived GPU instance, customer-controlled), and Tier C external API (external vendor API with explicit per-request allowlist, audit-logged at the customer's ledger). Ring 3 is structurally optional — the platform's sovereign posture is the default, not an opt-in.
**Ring 3 — Optional Intelligence (single instance, multi-tenant).** The Doorman (`service-slm`) is the entirety of Ring 3. It routes among three compute tiers: Tier A local (OLMo 1B on customer hardware, zero marginal cost), Tier B GPU burst (OLMo 32B Think on a short-lived GPU instance, customer-controlled), and Tier C external API (external vendor API with explicit per-request allowlist, audit-logged at the customer's ledger). Ring 3 is structurally optional — the platform's sovereign posture is the default, not an opt-in.

## Cross-Domain Operational Patterns

@@ -104,7 +104,7 @@ The architecture draws operational patterns from eight domains outside software:
4. **Bill of Lading** (maritime shipping) — cross-realm handoffs produce append-only log entries.
5. **Time-Vested Operation** (banking/fiduciary) — destructive operations post to a queue with a vesting date and cannot execute until the date passes.
6. **Apprentice Mode** (aviation type-rating / medical residency) — new model versions run in apprentice mode; actions land in a shadow outbox; the senior reviews before promoting.
7. **Integrity Anchor** (notarization / public timestamping) — monthly and per-MINOR-bump, the workspace state hash is posted to Sigstore {{gli|Rekor}} public transparency log. Externally verifiable; anyone can prove this state existed at this time under this identity.
7. **Integrity Anchor** (notarization / public timestamping) — monthly and per-MINOR-bump, the workspace state hash is posted to Sigstore Rekor public transparency log. Externally verifiable; anyone can prove this state existed at this time under this identity.
8. **Constitutional Convention** (IETF RFC 2026 Last Call / constitutional amendment) — MAJOR bumps require a 30-day public comment period in the `factory-release-engineering` repository.

## Open Commons Economic Structure
@@ -141,15 +141,3 @@ The BCSC Continuous Disclosure Posture applies to all claims, conventions, and p
7. OpenTimestamps — Bitcoin-anchored timestamping.
8. RFC 3161 — Internet X.509 PKI Time-Stamp Protocol.
9. ESEF Regulation — European Single Electronic Format, iXBRL.

---

## Provenance

Source material: v0.1.0 ALPHA (ratified 2026-04-30). Summary covers: Six Pillars, selected Architectural Claims (full treatment of #43–#54 plus selected earlier claims), Eight Cross-Industry Inventions, Three-Ring Architecture, economic model. Stripped: full action matrix table specifics, mailbox file paths, cluster manifest YAML schemas, commit-flow mechanics, personal contributor identity details. BCSC forward-looking framing applied to all planned capabilities. No body H1. Structural positioning throughout.

---

*Copyright © 2026 Woodfine Capital Projects Inc. Licensed under [Creative Commons Attribution 4.0 International](https://creativecommons.org/licenses/by/4.0/).*

*Woodfine Capital Projects™, Woodfine Management Corp™, PointSav Digital Systems™, Totebox Orchestration™, and Totebox Archive™ are trademarks of Woodfine Capital Projects Inc., used in Canada, the United States, Latin America, and Europe. All other trademarks are the property of their respective owners.*