Chain · Owner-first — the external brain before the audience

Parent: requirements-to-design

L0 · Vision

introduction — "the first user is you — an external brain over your own thinking; others querying is a second surface". boundaries — "not a job-seeking tool; the owner's own use comes first". founder-product-fit — the founder IS the target user; lived friction surfaces what can't be faked: ingestion ergonomics, retrieval shape, voice fidelity.

L1 · Promise

The system must be worth running for the owner alone: their own retrieval, drafting, curation, and review — before any visitor exists.

L2 · Requirements (journeys & features)

The owner journeys broadly; specifically setup/auth (/setup 4-step wizard — identity / credentials / ai provider / verify, app/src/components/auth/SetupForm.tsx:27 —, /login, /account/reset), curation, conversations review, admin Dashboard/Drafts/Preview/Conversations (28 admin sections at 36789537d, app/src/components/admin/sections/); the "self" role of the four.

L3 · Design decisions

Setup-token first-run claim (boot-printed, sha256, consumed once — see owner-keypair-auth disambiguation); admin plane rides owner session cookie (distinct from visitor path); display-error-surfacing (owner-facing errors are actionable: 401→login, 409→inline); conversations as review loop (chat_reports, conversation_ghosts tables).

L4 · Engineering artifacts

backend/internal/infra/session (setup_token/owner_session/password), backend/internal/infra/middleware (auth.go, csrf.go, code_guard.go, credential_guard.go, client_ip.go), admin routes + NAV_GROUPS sidebar (app/src/components/admin/AdminSidebar.tsx), instance_settings singleton + one-time claim (schema.sql:152). Owner session hygiene landed 2026-09-05: sign-out actually revokes the server session (ec40ecdab), an active-sessions panel lists and revokes every owner login (d6d3f54bc), and each owner-MCP keypair shows where it was last used (169a51d79).

L5 · Verification

E2e setup/login/admin suites; features-and-journeys ranks its uncovered specs by priority.

Status & gaps

The owner-first stance is structurally true (admin plane is the largest feature surface) but the external brain promise is thin: owner-side retrieval = the same visitor-grade search (corpus.search goes straight to Postgres, confusables §10); the only owner-specific drafting surface beyond Writings is the résumé composer (Puck, 756c0eb1d, 2026-09-07), which is job-scoped; the "first user is you" promise currently rests more on curation surfaces than on retrieval power.