Cornerstone device — Phase 0: dependency inventory + reference build
Status: PLANNING (2026-07-31). The groundwork CORNERSTONE_HARDWARE.md names as the first concrete step — the thing that turns "we should build a box" into "here's exactly what runs on it, and here's the one we bought." Companion to that doc.
The finding up front: only one dependency swap is actually load-bearing (self-hosted Supabase). Everything else is additive, droppable, or not a box concern at all. That's what makes a reference build realistic this quarter.
The dependency inventory
Each cloud dependency the app has today → what it does → the local substitute on the box
→ how hard the swap is. Grounded in the actual env surface (SUPABASE_*, OPENAI_API_KEY
ANTHROPIC_API_KEYinllm.ts,ELEVENLABS_API_KEY,REPLICATE_API_TOKEN,STRIPE_*,SLACK_BOT_TOKEN).
| Dependency | What it does | Local substitute | Swap effort |
|---|---|---|---|
| Supabase (Postgres + Auth/GoTrue + Storage + Realtime) | The whole data backbone — DB, JWT auth, the vault's blob storage, realtime | Self-hosted Supabase (Docker: Postgres + GoTrue + PostgREST + Storage + Realtime) | HIGH — the critical path |
| OpenAI / Anthropic (LLM) | Generative AI; llm.ts provider: 'openai' | 'anthropic' | Local model (Ollama / llama.cpp) for decide-locally + Cicero deterministic NLU (licensed); escalate hard asks to cloud | MEDIUM |
| ElevenLabs (TTS) | Cloned/character voices, page-audio, JQ voice | Piper (local neural TTS) or Cicero speech-core; high-fidelity clone stays an opt-in cloud call | MEDIUM |
| Cloud STT (spoken input) | Speech → text | whisper.cpp (local) | MEDIUM |
| OpenAI images / Replicate | Painterly backdrops, comic art, generated imagery | Local Stable-Diffusion, or defer | LOW (non-core for the box) |
| Railway (backend host) | Runs the Express backend | The box runs it (Node process/container) | LOW |
| Vercel (frontend host) | Serves the Next app | The box serves it (Next standalone), or the Family Wall reaches it over the LAN | LOW–MEDIUM |
| Stripe (billing) | Subscriptions | N/A on the box — a box is a purchase, not a subscription surface | N/A |
| Slack (ops alerts) | Internal notifications | Skip / local log | LOW |
| B2 / Glacier (off-site backup) | The encrypted second copy | Keep — it's a feature, not a dependency to remove (ciphertext, fire/theft insurance) | — |
| Remote access | Reaching the box from outside the home | Tailscale (or self-hosted Headscale); off by default | MEDIUM (the named tension) |
The critical path
Exactly one swap is load-bearing: self-hosted Supabase. The app talks to Supabase's
APIs (PostgREST, GoTrue, Storage) — not a raw Postgres — so the substitute is the
self-hosted Supabase stack, which is documented but ops-heavy, not a drop-in. Every other
row is either additive (a 'local' provider added alongside the cloud one in
llm.ts — nothing to remove), droppable (images, Slack), already-a-feature (B2
backup), or not a box concern (Stripe). So Phase 1's real engineering is: get the
app running against self-hosted Supabase on the mini-PC. Land that and the rest is
capability and packaging.
The pinned reference build (BOM)
Illustrative — the class is the spec; exact models drift, and these are ranges, not quotes. A commodity mini-PC, buyable today, nothing to manufacture.
| Part | Spec | Notes |
|---|---|---|
| Mini-PC | Ryzen 7/9 mobile (8c/16t) with an integrated NPU (Ryzen AI / XDNA class), or Intel Core Ultra; 2.5 GbE | The NPU raises how much of the model runs locally; not required for v1 |
| RAM | 32 GB DDR5 | Local model + Postgres + services headroom |
| Storage | 1–2 TB NVMe (primary) | Vault + models; expandable |
| Backup drive | optional external SSD | Off-site-push staging; the mesh also adds redundancy |
| Power | ~15–45 W | Always-on running cost / thermals |
| Total | ~$600–800 | One commodity unit |
Explicitly NOT needed for v1: a discrete GPU, a display, a custom board, ECC memory, a redundant PSU. The device mesh + off-site backup provide the durability a single box lacks, so the box itself doesn't need enterprise-grade redundancy.
The "hello box" milestone (the smallest proof)
The smallest thing that proves the entire thesis:
On the mini-PC, with the internet physically unplugged, seal a note in the vault and open it back — running against self-hosted Supabase, the packaged app, and local key custody. No cloud in the loop.
That one offline round-trip is the proof that Cornerstone can live in a home. Everything after it — the local model, local STT/TTS, remote access, the productized appliance — is capability and packaging on top of a thing that already runs.
Open questions to resolve in Phase 1
- Self-hosted Supabase's real footprint on a mini-PC — RAM/CPU headroom alongside a local model.
- Which local model is "good enough" for decide-locally at box scale, and what escalation rate is acceptable to the family.
- Frontend delivery: serve Next on the box, or treat the Family Wall as the client over the LAN.
- Update/patching model for an appliance: immutable image vs. managed updates.
- The remote-access default (off) and the exact tunnel (Tailscale vs. self-hosted Headscale) — so "nothing leaves" stays honest.
Next after Phase 0
Buy the reference unit, stand up self-hosted Supabase on it, run the packaged app, and hit the hello-box milestone in a real home (ours) — Phase 1 in CORNERSTONE_HARDWARE.md.