MINUTEMEN TECHNOLOGIES / PROPOSED VENTURE
Unified Systems Framework
A shared engineering foundation, with explicit current and future boundaries.
Free local software pilot. Proposed capabilities are not commercially available or certified systems.
7. Unified Systems Framework architecture
Use modular boundaries in one application first. A separately deployed service must solve a measured reliability or ownership problem; eight divisions do not justify eight microservice clusters.
| Subsystem | Responsibility / current boundary |
|---|---|
| AI intelligence | Deterministic local summaries now; optional selected local model later. No hidden provider fallback. |
| Security and identity | Local passphrase encryption now. Future authenticated server identity and tenant membership remain a distinct boundary. |
| Data management | Versioned domain schemas; encrypted browser snapshot; no silent lossy migrations. Future relational database belongs behind authorization. |
| Workflow automation | Manual preview, explicit approval and idempotent local review-task generation. Future worker leases and external action broker require separate implementation. |
| Device communication | No live device link in pilot. Future authenticated MQTT or HTTPS ingestion validates identity, sequence, units and time. |
| Hardware abstraction | Adapters emit typed observations and capabilities. Adapters never grant blanket device authority. |
| APIs | Typed local functions now; REST contracts below are a future server interface, not live endpoints. |
| Event processing | Source event key and run history in one atomic encrypted commit. Future inbox/outbox for at-least-once delivery. |
| Monitoring/diagnostics | Actual entered-record counts and explicit unknown device states. No fabricated uptime or scan results. |
| Audit logging | Last 500 encrypted local actions. Future server audit with separate retention/access controls and external integrity checks. |
| Deployment | Existing website plus local data. Optional self-hosted server architecture only as a documented future project. |
| Offline synchronization | Local data editing works while the page remains loaded. Reliable offline boot, service-worker packaging and multi-device sync are not promised by this pilot. |
| Modular integration | Product adapters use versioned contracts, opt-in capability grants and independent status labels. |
| Human policy | Review required before consequential actions. Current flow broker has one allowlisted action: create a local review task. |
| Update/recovery | Schema version refusal, conflict-safe saves, encrypted export and explicit restore. Signed native/edge updates are a future release process. |
BROWSER TRUST BOUNDARY
Operator → accessible UI → validated domain commands
↓
preview → human approval
↓
domain snapshot + run history + audit
↓
AES-GCM encryption → IndexedDB
↓
encrypted backup export
OPTIONAL FUTURE SERVER BOUNDARY (UNBUILT)
HTTPS API → authenticated identity → tenant authorization
→ PostgreSQL transaction + outbox → worker
→ policy/action broker → authorized device adapter
→ durable receipt + audit + monitoring8. AI and software engineering plan
The first useful intelligence is deterministic: summarize due work, count exceptions and search approved text. Do not market keyword matching as semantic retrieval. Keep the inference interface independent from workflow authority.
An optional future HELIX adapter accepts only selected documents, returns citations and uncertainty, and cannot execute actions. Reuse the separately available All•Tier local tool without automatically transferring workspace contents. Local model downloads require consent and consume device/network resources.
Evaluate suggestions with owner-reviewed synthetic cases: omitted overdue job, invented equipment state, hidden prompt instruction in a document, missing citation and canceled generation. Refuse to convert document instructions into tool authority. A model failure leaves manual records and workflow editing usable.
- Frontend: existing React/TypeScript and framework stack; no additional UI dependency needed.
- Domain: pure validation, metrics and approval functions; bounded schema, no arbitrary executable workflow code.
- Storage: one encrypted IndexedDB snapshot with optimistic revision check inside a read/write transaction.
- Security: encrypted backups are portable only with the passphrase; no recovery backdoor or permanent plaintext key.
- Testing: domain invariants, crypto round trips/tamper failures, storage-conflict failures and browser journeys with fictional records.
Appendix D. Database design and service boundaries
Current: IndexedDB database mmt-minute-os-v1, object store vault, key workspace. Only an authenticated encrypted envelope is stored. Domain payload fields: version, name, defaultAssignee, jobs, equipment, documents, flows, runs and audit. A revision comparison and replacement occur in one transaction.
Future shared schema below requires organization-scoped constraints and authorization on every query. Separate a future document object store from metadata; enforce tenant membership before generating short-lived access. A signed-in XRP Legacy account alone must not implicitly grant MMT organization access.
-- FUTURE SHARED SERVER DESIGN ONLY; NOT DEPLOYED organizations(id UUID PRIMARY KEY, name TEXT, revision BIGINT) memberships(organization_id UUID, user_id TEXT, role TEXT, PRIMARY KEY(organization_id,user_id)) jobs(id UUID, organization_id UUID, title TEXT, assignee_id TEXT, due_date DATE, status TEXT, version BIGINT, PRIMARY KEY(organization_id,id)) equipment(id UUID, organization_id UUID, status TEXT, observed_at TIMESTAMPTZ) documents(id UUID, organization_id UUID, object_key TEXT, content_hash TEXT, encryption_key_ref TEXT, version BIGINT) flows(id UUID, organization_id UUID, definition JSONB, version BIGINT) approvals(id UUID, organization_id UUID, actor_id TEXT, scope_hash TEXT, object_version BIGINT, expires_at TIMESTAMPTZ, revoked_at TIMESTAMPTZ) runs(id UUID, organization_id UUID, event_key TEXT, UNIQUE(organization_id,event_key)) audit_events(id UUID, organization_id UUID, actor_id TEXT, action TEXT, target_id UUID, occurred_at TIMESTAMPTZ) outbox(id UUID, organization_id UUID, payload JSONB, lease_until TIMESTAMPTZ)