PayCargo · AI-Sandbox

System Documentation

Build doctrine + deployment record

Documents (TLDR;)

  • P0The Playground (overview)●
  • P1The Foundation (safety features)●
  • P1.5The Locks (KMS keys, three safes)●
  • P2The Console (installation hub)●
  • P3The Cartridges (the rides)●
  • P4The Anvil (design before build)●
  • P5The Forge (how rides get built)●
  • P6Playground Diagram (animation)●

Doctrine

  • DForge Doctrine (canonical rules)●

Substrate (Steps 0–5)

  • 0Pre-bootstrap◐
  • 1Bootstrap◐
  • 2Identity (KMS / IAM)◐
  • 3Network◐
  • 3aCI wiring (OIDC)◐
  • 4Substrate complete◐
  • 5NFW enforcement flip○

Console Doctrine

  • 6Console (parent doctrine)●
  • 6.dRepo structure●
  • 6.gConsole v0 build walkthrough◐
  • 6.hConsole v0 implementation reference◐
  • 6.iCartridge extended metadata●
  • 6.jChatbot cartridge — build walkthrough◐
  • 6.kScheduled-jobs substrate (Scheduler + DLQ + watchdog + UI)●
  • 6.mTiered inference: model router substrate●
  • 6.nOAuth abstraction in the Console (Salesforce first)●
  • 6.oForge SDK: versioning, manifest, distribution●
  • 6.pSSO layer (Azure SAML, in-platform group assignment)●
  • 6.qBuild a cartridge with just the SDK (walkthrough)●
  • 6.rSDK-distribution MCP (specced; ≠ Console MCP)●
  • 6.sContent CMS — grounding docs (CLAUDE.md/skills.md)●
  • 6.vConsole MCP — machine tokens for scheduled evaluators●
  • 6.tSetup cartridge: operator wizard for foundation config○

Memos

  • M1PayCargo's AI infrastructure moat (Lewis / CEO)●

SDK

  • 6.fCSS / design system●
  • 6.bWebSockets●
  • 6.cAsync / queue / batch●
  • 6.eSDK Capability Roadmap●

Cartridges (the rides)

  • P3All cartridges — overview●
  • 4.5Observability (obs) — operator surface◐
  • 6.aChatbot — Claude via Bedrock◐
  • 6.lSquadFlow (squad-assess) — SDLC assist◐
  • 6.uDoc Vault — versioned HTML documents●
  • 6.wFoundation Audit — scheduled AI audits + console●
  • 6.xAI Automation — freight document intelligence (external product)●

Also live (no dedicated doc yet)

  • Mock TMS · Mock Email · Backlog●

Obs spec detail

  • 4.5.aData governance CMKs◐
  • 4.5.b3-layer defense◐
  • 4.5Click-through demo◐

Platform Services

  • 6.sContent CMS — grounding docs●
  • 6.vConsole MCP — machine tokens●
  • 6.kScheduled-jobs substrate●
  • TTenants — one customer per tenant●

Security Diagrams

  • S1How the Console MCP is secure●
  • S2How the AI agent layer is secure●
  • S3How the Content CMS is secure●
  • S4Third-party code, and how it gets here●
  • S5How tenants keep customer data apart●

Planned (next)

  • S4SDLC flow (SquadFlow → /spec → …)○
  • S5MCP service architecture○
  • S6CMS → skills.md / claude.md grounding○

Reference

  • 3.xDB access boundaries◐
  • 3.xRouting tables◐
  • —Out of scope●
  • H.1DNS setup — app/obs.paycargo.ai + no-reply@○
  • H.2Azure Entra SAML SSO — customer IT handoff○
  • H.3Azure Power BI app registration○

Cartridge Author

  • KNew cartridge starter kit●
  • K.1CLAUDE.md (project rules)●
  • K.2DESIGN.md (visual reference)●
  • K.3SKILL.md (on-demand skill)●

Diagrams

  • 1Bootstrap diagram◐
  • 2Identity diagram◐
  • 3Network diagram◐
  • 4Substrate diagram◐
Legend
● Shipped — applied to AWS
● Doctrine in flight
○ Planned
◐ History — built in the retired account 959228203854; live today is 753974371195