# BOMBADIL — Claude Design prompt

**Authored:** 2026-05-16 PM by Cipher (CZA) for XZA
**Sibling:** Bombadil — Everplay-Tech AiMANAC family
**Tier:** Paramount-tier (data classification) + Standalone-deployment-tier (Q11 LOCKED 2026-05-16 PM — no own server; UniFFI XCFramework consumed in-app; HELM relay via aimanac-rs only)
**Tagline (working — Claude Design may refine):** *"Your on-device companion. Welcome in."*

## What Bombadil IS (function)

Bombadil is a **personal on-device AI agent** SKU. Hermes-derived (Nous Research `hermes-agent` MIT lineage; pinned SHA `674fad1...` per `bombadil-rs/README.md`). It carves out **"personal AI agent that lives on your phone"** as a family domain — extending AiMANAC's reach into a private always-with-you companion that runs entirely on the owner's device until they explicitly relay to AiMANAC's backend.

**Family-charter purpose (rule #14):** Bombadil extends AiMANAC's reach by being **the on-device half of HELM** — when an AiMANAC HELM tool invocation matches `helm_bombadil_*`, the work routes to Bombadil-on-device via IHP-WS relay envelope, executes locally (no phone-home), and returns the result up the relay. Bombadil is the "private compute" sibling — anything sensitive, anything you don't want crossing the wire, runs in Bombadil's burrow.

**Crate architecture (port from `bombadil-rs/README.md`):**
- `bombadil-core` — session DB, capabilities, agent loop orchestration
- `bombadil-profile` — SQLite user profile graph (Honcho replacement; persistent memory of the human)
- `bombadil-skills` — agentskills.io interchange + proposals (user-installable behaviors)
- `bombadil-tools` — iOS-safe tool adapters
- `bombadil-providers` — OpenAI / Anthropic / OpenRouter-compatible streaming
- `bombadil-istari` — attendant scheduler + manifests + audit (background routine watcher)
- `bombadil-mcp` — JSON-RPC MCP `tools/call` handler (in-process + stdio)
- `bombadil-ffi` — UniFFI scaffolding for Swift consumption

**Trust + deployment:**
- App Groups: `group.net.llmtech.aimanac` (trust mesh), `group.net.llmtech.mcp` (MCP registry read), `group.net.llmtech.bombadil-agent` (private agent DB)
- URL scheme: `bombadil://open` (BRIG-launched from AiMANAC; future: Universal Links)
- HELM relay envelope: `bombadilRelay` + `status: awaiting_device` (frozen in `bombadil-rs/docs/RELAY_ENVELOPE_V1.md`)
- Bundle ID: `net.llmtech.bombadil` (post-CCW-0)
- Auth: rides on AiMANAC's identity via shared App Group (rule #14 standalone-tier; no separate Apple-Sign-In surface)
- Data: paramount classification per IHP-WS; sensitive prompts + profile graph stay local

## Visual design direction — HOBBIT HOLE

**The metaphor (XZA-locked 2026-05-16 PM):** opening Bombadil should feel like **being welcomed as a guest into a hobbit's underground home.** Bag-End-style circular front door swings inward; soft amber lamplight; the host is glad you came. Bombadil is your host. You are safe here.

**This contrasts intentionally with other sibling aesthetics:**
- BROILR = MECHA industrial (cold trust-aware steel)
- MailSloth = Victorian writing-desk (formal correspondence)
- HELMPC = synth sequencer (modular knobs/jacks)
- DeepDive = nautical/dive log (deep-water exploration)
- AiMANAC = modular synthesizer faceplate (the anchor; rack of instruments)
- Bombadil = **cozy underground burrow** (private domestic warmth)

The contrast IS the message — Bombadil's privacy/safety/companionship feel is felt visually before any words are read.

### Color palette (suggested; Claude Design refines)

| Token | Hex (suggested) | Use |
|---|---|---|
| `hearthGlow` | `#E8A864` (warm amber) | Primary accent; lamplight; CTA glow |
| `mossPath` | `#5C7A4D` (forest moss) | Secondary accent; doorframe trim; path indicators |
| `darkOak` | `#3D2817` (deep brown wood) | Primary background; wall panels |
| `lampLight` | `#F4D3A0` (candle warm) | Soft highlights; text on dark surfaces |
| `pipeSmoke` | `#9CA3AF` (soft grey-blue) | Inactive states; muted text |
| `clayHearth` | `#A86B3D` (reddish-brown clay) | Brick / chimney / fireplace surfaces |
| `parchment` | `#E8DCC0` (aged paper) | Light surfaces; secondary cards |
| `inkBlack` | `#1A1310` (warm near-black) | Deep shadows; text on light surfaces |

(All optional starting points — feel free to refine within the hobbit-hole vibe.)

### Compositional motifs

1. **Circular doors** — Bag-End-style round door is the iconic IA element. First-launch screen IS the door, swinging inward to reveal the interior. Subsequent screens can have circular portal transitions between major surfaces.
2. **Underground / burrow framing** — the chrome around content suggests "you're underground" — rounded ceiling arch tops, wood-beam edges, no sharp 90° corners on major containers. Soft, dug-out, organic feel.
3. **Lamplight glow** — primary CTA + active state radiates a soft amber halo (mimic an oil lamp or warm bulb). NOT harsh / neon / digital glow.
4. **Warm material textures** — subtle wood grain on panels, parchment grain on cards, brushed clay on hearth elements. Restrained — NOT photorealistic; suggested via subtle noise/texture overlays.
5. **Generous round-corner radii** — minimum 16pt, often 24pt+ on major containers. NOTHING is rectangular with sharp corners.
6. **Hospitality copy register** — "Make yourself at home", "The kettle's on", "Take off your boots", "What can I get you?", "Long way to come" (greeting), "Stay as long as you like." Bombadil-as-narrator speaks like a kind host, not a robot assistant.

### Surfaces to design (sketch list)

Claude Design should propose visual treatment for at minimum:

1. **First-boot welcome** — the circular door swinging open; "Welcome to my burrow" framing; consent to inherit AiMANAC identity via trust mesh (rule #14 standalone affordance — no separate auth flow)
2. **Home / hearth** — the main view when Bombadil is "in residence." Visualize current session, profile graph snapshot (if any), pending istari attendants, recent skill activity. Soft, lived-in. Should NOT feel like a dashboard.
3. **Conversation surface** — where the agent loop runs. Owner's typed input + Bombadil's streaming response. Tool calls visualized as Bombadil "going to the kitchen / pantry / library" — anthropomorphized but tasteful, not cartoonish.
4. **Profile graph viewer** — the SQLite profile of "what Bombadil knows about you." Visualize as a memory book / journal pages / hand-written index cards. Editable; explicit "forget this" affordance.
5. **Skills shelf** — `agentskills.io` interchange. Installed skills as little tools/objects on a shelf (book = reading skill, magnifying glass = research, mortar + pestle = analysis, etc.). Tap to inspect/configure.
6. **Istari attendants** — background routines on a schedule. Visualize as wizards/attendants doing chores. List + status + audit log.
7. **Provider settings** — which LLM provider drives the loop (OpenAI / Anthropic / OpenRouter-compatible). Discreet; not advertised; settings nook.
8. **HELM relay status** — when an AiMANAC HELM tool routes here via `helm_bombadil_*`, visualize the relay arriving + executing + returning. "A message came down the path" framing. Per RELAY_ENVELOPE_V1.md, this is NOT local execution authorization — Bombadil is told to act on AiMANAC's behalf for a specific request.
9. **App icon** — the iconic circular door rendered as a 1024×1024 squircle (Apple HIG max). Round door on round canvas — meta. Background suggests "you're standing on the path to the burrow."
10. **iOS home screen context** — show how Bombadil's icon looks alongside AiMANAC + sibling apps on a home screen. Should harmonize with family palette (each sibling distinct but family-coherent).

### Anti-scope (what NOT to design in this pass)

- **No phone-home posture badges or marketing-style "private by design!" callouts.** The cozy-burrow visual IS the message; don't shout it.
- **No subscription / paywall / IAP affordances.** Family rule #2 — one-time purchase, no subscriptions. $1 sibling.
- **No surveillance-aesthetic dark-mode "data dashboards."** Bombadil is companion, not security suite. Profile graph shows what's known LOVINGLY, not as forensic data.
- **No fantasy cliches** — no actual hobbits, no Gandalf, no obvious LotR characters. The metaphor is the SPACE (burrow), not the IP. Tonal inheritance, not visual quotation.
- **No "AI assistant" robot/circuit-board iconography.** Bombadil is folk-magic warm, not silicon cold.
- **No bright neon accents.** Lamplight only.

## Family-design discipline (apply per family rule #13)

- Output expected: `BOMBADIL_BRIEF.md` (text BRIEF) + `Bombadil.html` (single-page visual canvas with all surfaces) + `bombadil-app.jsx` / `bombadil-components.jsx` / `bombadil-screens-a.jsx` etc. JSX fragments + `bombadil.css` theme tokens + `design-canvas.jsx` harness + `screenshots/` PNG renders for the key surfaces (~8-10 screenshots minimum)
- Match the file structure of existing handoffs at `~/.claude/plans/broilr-design-handoff/` (BROILR), `~/.claude/plans/mailsloth-design-handoff/` (MailSloth), `~/.claude/plans/archimedes-design-handoff/` (Archimedes) — those are the precedents
- The HTML render MUST be self-contained (inline React + Babel via unpkg OR pure SVG; do NOT depend on missing companion files like the BROILR mascot v2 did before P31)
- Theme tokens in CSS variables so Claude Code can wire `BombadilTheme.swift` consuming the same palette
- Include a "trust register" / app-context table similar to BROILR's 4-trust-state chip if Bombadil has natural state variants (e.g., idle / working / relaying / awaiting-permission)

## Family-rule constraints (apply during design)

- **Rule #1 no phone home** — visualize Bombadil's "stays local" posture in compositional choices (the burrow is buried; no antennas, no satellite dishes); don't over-explain via text
- **Rule #4 no catalogue** — Bombadil's purpose is specific (private on-device AI agent); the design should make ONE thing crystal clear, not be a do-everything hub
- **Rule #8 trust mesh via App Groups** — first-boot inherits AiMANAC identity automatically (no auth wizard); design the "I see AiMANAC is here too" recognition moment warmly
- **Rule #9 FaceID + IHP + shared keychain** — Secure Reset trigger ("burn the burrow / start fresh") needs a visual home in Settings; design with appropriate gravitas (irreversible)
- **Rule #14 every sibling participates in HELM** — Bombadil is standalone tier; HELM participation is affordance-side (relay envelope received from aimanac-rs; no Bombadil-side tool registry exposed to other apps). Design the "I got an envelope from AiMANAC" arrival moment as a warm "letter arrived under the door" notification

## What this prompt does NOT lock

Claude Design has discretion on:
- Exact color hex values (palette suggestion is a starting point; refine)
- Typography (suggest: a warm humanist serif for headings + readable sans for body; explore)
- Whether Bombadil is anthropomorphized as a character or stays as a space-host (designer's call; both work)
- Exact tab/IA structure (5 surfaces vs 3 vs different decomposition — designer can propose)
- Sound design / haptics suggestions are welcome but not required

## When this design lands

The design return enables:
- **P41 Bombadil canonical adoption wide cycle** (per Part 2.5 Wave J / line 113) — vendor P14 SecureReset + P15 AdaptiveGlass + P24 HelmMCPClient + P25 TrustMeshInheritedEnvironment per BROILR P31 precedent; build 12-step BRIEF-driven impl walking
- **`bombadil.llmtech.net`** marketing page (Wave O / P71 per Part 2.5)
- **App icon vendoring chip** (similar to BROILR app-icon chip 2026-05-16) once mascot/icon HTML is in this handoff

XZA flags this design for return when Claude Design has time. No deadline; queues with BROILR / MailSloth / Archimedes / ARACHNID handoff cadence.