# FL33T — Claude Design prompt

**Authored:** 2026-05-16 PM by Cipher (CZA) for XZA
**Sibling:** FL33T (working title: **IHP VAULT Exec**) — Everplay-Tech AiMANAC family
**Tier:** Paramount-tier (data classification: team policies + audit ledger + capability tokens — all highly sensitive) + Customer-deployed backend (FL33T-rs runs alongside aimanac-rs in the same `fleet_default` Docker network)
**Tagline (working — Claude Design may refine):** *"Bring the fleet aboard."* OR *"Roles. Tokens. Audit. All hands."*

## What FL33T IS (function)

FL33T is the **team-collaboration sibling** of the AiMANAC family. Where AiMANAC's base is single-operator, FL33T extends it into a **multi-member orchestration surface** with role-bound capabilities, append-only audit, and per-member trust.

**Family-charter purpose (rule #14):** FL33T extends AiMANAC's reach by being **the multi-operator half of HELM** — when an AiMANAC HELM tool invocation needs team-policy enforcement (who can call this tool? what's the role? what's the audit obligation?), FL33T's 6 `helm_fl33t_*` tools handle it. FL33T is the "team gate" — the carve-out of AiMANAC's single-user assumption into a real team-of-operators model.

**Core technical reality (port from `FL33T-rs/README.md`):**
- **Separate backend container** (FL33T-rs) — NOT embedded in aimanac-rs. Runs alongside aimanac-rs in the same `fleet_default` Docker network. Customer runs both.
- **Shared `JWT_SECRET`** — LLMGMT tokens minted by aimanac-rs verify on FL33T-rs byte-identically. Trust flows from anchor to FL33T.
- **Crate architecture:**
  - `api-server` — fl33t-server binary (axum + sqlx); JWT verifier; routes
  - `helm-core` — MCP tool registry (`helm_fl33t_*` — 6 tools registered; awaiting v1.1 impl)
  - `ihp-vault-exec` — load-bearing IHP Vault advanced primitive (`VaultExecRotator`, `CapabilityTokenDeriver`, `AuditLedgerWrapper`)
- **iOS-side:** standalone FL33T-iOS app — speaks to FL33T-rs via IHP-WS; presents LLMGMT token from shared keychain; receives capability tokens; syncs audit ledger via CloudKit.
- **Original working title: IHP VAULT Exec** — preserved in `crates/ihp-vault-exec/` directory. "FL33T" is the customer-facing brand; "IHP VAULT Exec" is the working-internal name. Design should embrace FL33T.

**Data model (from `migrations/20260509000000_init.sql`):**
- `users` — per-member Apple-ID-anchored identity
- `team_policies` — who can do what
- `team_members` — fleet roster
- `audit_ledger` — append-only ship's log
- `capability_tokens` — role-bound mission briefs

**Trust + deployment:**
- App Group: `group.net.llmtech.aimanac` (trust mesh with AiMANAC) + likely a dedicated `group.net.llmtech.fl33t-fleet` for team artifacts
- URL scheme: `fl33t://open` (BRIG-launched from AiMANAC; `LSApplicationQueriesSchemes` entry per family convention)
- Auth: **Apple Sign-In per member** (each team member uses their own Apple ID); owner runs FL33T-rs and bootstraps via `BOOTSTRAP_SETUP_CODE`; new members join via invite + their own Apple Sign-In flow
- Q15 contract applies (companion-tier sibling with own backend) — see `~/.claude/skills/appfamily/locked_specifics.md §-Q15`
- Bundle ID: `net.llmtech.fl33t` (post-CCW-0)
- Data: paramount classification per IHP-WS; audit ledger is append-only with cryptographic chain (`AuditLedgerWrapper` primitive)

## Visual design direction — NAVAL FLEET COMMAND

**The metaphor (Cipher proposal; XZA + Claude Design refine):** FL33T evokes a **naval/submarine fleet command center.** Owner = admiral; team members = vessel commanders; the FL33T-iOS app on each member's phone = that vessel's bridge; FL33T-rs running on customer infrastructure = the flagship; audit ledger = fleet log; capability tokens = mission briefs; team policies = standing orders.

The leet-speak "33" in FL33T fits — each commissioned vessel has a callsign / pennant number / unit designation. "FL33T-7" = team member 7's commissioned identity. Hacker-tinted naval = the FL33T flavor.

**This pairs intentionally with DeepDive** (single submarine) — DeepDive is one operator one sub; FL33T is the entire fleet command. Family-coherent nautical pairing.

**Contrasts with other sibling aesthetics:**
- AiMANAC = modular synthesizer faceplate (anchor)
- BROILR = MECHA industrial (hardened marketplace chat)
- MailSloth = Victorian writing desk (formal correspondence)
- HELMPC = synth sequencer (routine orchestration)
- Bombadil = cozy underground burrow (private on-device companion)
- DeepDive = single submarine / dive log (deep exploration)
- **FL33T = naval command center / fleet of submarines** (multi-operator coordination)
- Archimedes = governance bridge (capability-token ops)
- ARACHNID = 8-eyed sentinel (web crawling)
- Satcheli = MCP-policy enforcement
- PSL = BYOK private stash

### Color palette (suggested; Claude Design refines)

| Token | Hex (suggested) | Use |
|---|---|---|
| `fleetNavy` | `#0E1B2C` (deep ocean navy) | Primary background; command-deck canvas |
| `signalBrass` | `#C8A26B` (warm brass) | Primary accent; CTA; rank insignia |
| `sonarGreen` | `#15B88A` (sonar phosphor) | Active members; "online" presence; sonar ping radiance |
| `commsAmber` | `#E8A864` (signal lamp amber) | Incoming signal; notification; capability-token issuance |
| `redFlag` | `#E4458F` (red-pink alert) | Critical alerts; revoked capability; audit-anomaly |
| `paperLog` | `#F2EFE6` (aged paper) | Audit ledger pages; printed reports; light surfaces |
| `chartGrid` | `#3A5374` (navigation chart blue-grey) | Grid lines; secondary structure; chart overlays |
| `inkDark` | `#0A0F18` (near-black ink) | Text on light surfaces; deep shadows |

(Starting points — refine within the command-center vibe.)

### Compositional motifs

1. **Charts / sonar / sea-grids** — chrome backgrounds suggest navigation charts; subtle grid lines; sonar ping circles emanating from active members; depth contours.
2. **Pennants / signal flags** — team members have callsigns + pennant-flag identities; status changes ripple through visual flag-signals (raised flag = "available", struck flag = "off-duty", red flag = "alerted").
3. **Portholes / spyglass / radar** — circular framing for "viewing into another vessel" (per-member detail view = looking through a porthole at their station).
4. **Ship's log / audit ledger as printed paper** — audit entries render as paper log pages with handwritten timestamps + officer signatures. Append-only is visually obvious — pages stack but never erase.
5. **Brass + steel finishes** — control surfaces feel like submarine-bridge instruments. Brass valves for capability-token issuance, steel switches for policy toggles, gauges for fleet-wide status.
6. **Rank insignia** — roles render as naval-rank-style insignia (chevrons, stripes, stars) tasteful + unique-per-role. NOT literal naval rank but inspired-by.
7. **Tone: command register** — "All hands accounted for," "Vessel #7 reporting in," "Sound the alarm," "Permission to come aboard," "Captain's log," "Stand down." NOT casual; orderly + signal-clear + slightly formal.

### Surfaces to design (sketch list)

Claude Design should propose visual treatment for at minimum:

1. **Owner's bridge / admiral dashboard** — the main FL33T-iOS view for the team owner. Fleet at a glance: how many members, who's active (sonar ping), pending invites, audit-ledger tail, active capability tokens. Should feel like a command deck.
2. **Fleet roster** — list of all team members. Each row: callsign (e.g., "FL33T-3"), Apple-ID-anchored name + photo, role (rank insignia), current status (signal flag), last-active timestamp. Tap row → per-member detail.
3. **Per-member detail (porthole view)** — looking into a single member's vessel. Their role + assigned policies + active capability tokens + their slice of the audit ledger. Owner can adjust role; revoke tokens; eject from fleet.
4. **Invite flow (commissioning)** — owner generates an invite (one-time code + role assignment). Visually: writing a commission letter / sealing it with the FL33T pennant. Sent to a member's email or shared link. Member uses code in their FL33T-iOS first-boot.
5. **Team-member first-boot (joining the fleet)** — non-owner perspective. "Welcome aboard" sequence. Apple Sign-In + invite code entry. The member's vessel is commissioned; their callsign is assigned; they receive their first capability token.
6. **Workspace / mission list** — active "missions" the fleet is running. Each mission is a project/workspace; shows assigned crew + status + audit tail. Tap → mission detail.
7. **Policy editor (standing orders)** — owner edits team policies. Who can call which `helm_*` tool? What roles see which workspaces? What's the audit obligation for tool X? Should feel weighty — these are the rules of engagement.
8. **Capability token tray** — visualize tokens-currently-in-circulation. Each token = mission brief envelope. Shows: bearer (which member), scope (which capabilities), expiry, audit anchor. Revocable.
9. **Audit ledger viewer** — append-only log of everything the fleet did. Reading view should feel like reading a paper logbook — pages, dates, officer signatures, no edit affordance (it's literally append-only). Filter by member, by mission, by capability.
10. **Settings (admiral's quarters)** — owner-only governance. SecureReset trigger ("scuttle the fleet — irreversible"). BOOTSTRAP_SETUP_CODE display (since this is the recovery surface). Auto-lock policy. JWT_SECRET rotation (advanced).
11. **App icon** — FL33T fleet emblem rendered as 1024×1024 squircle. Suggested: submarine silhouette + pennant, OR naval crest with crossed signal flags + "33" callsign, OR a stylized fleet-in-formation. Designer's choice within the naval-command vibe.
12. **iOS home screen context** — show FL33T's icon alongside AiMANAC + sibling apps. Should harmonize with family palette; instantly readable as "fleet/team."

### Anti-scope (what NOT to design in this pass)

- **No literal military / weaponry visuals** — the metaphor is naval **administration + signals**, NOT combat. No guns, no torpedoes, no battle imagery. Submarines as workspaces, not weapons.
- **No "happy team using laptops" stock-photo aesthetic** — wrong register. Real product UI only.
- **No subscription / per-seat-tier pricing comparison** — $1/Apple-account is the model. No tiered "Team / Pro / Enterprise" pricing surface. One price, one feature set.
- **No fake "live activity" social-network feed** — audit ledger is the only activity surface, and it's deliberately archival (not engagement-bait).
- **No "AI is doing things for you" assistant chatter** — FL33T is infrastructure for team operators; HELM tool calls show up as audit-ledger entries, not chatbot dialog.
- **No surveillance-aesthetic dashboards** — owner views the fleet to coordinate, not to surveil. Tone: respectful command + clear accountability, NOT panopticon.
- **No fantasy / sci-fi exaggeration** — submarine command is grounded + technical. Avoid neon-lit cyberpunk-bridge or Star-Trek-fictional surfaces. Looks like a real working command deck.

## Family-design discipline (apply per family rule #13)

- Output expected: `FL33T_BRIEF.md` + `FL33T.html` (single-page visual canvas) + JSX/CSS fragments + `screenshots/` PNGs + `design-canvas.jsx` harness
- Match the file structure of existing handoffs at `~/.claude/plans/broilr-design-handoff/`, `~/.claude/plans/mailsloth-design-handoff/`, `~/.claude/plans/archimedes-design-handoff/`
- The HTML render MUST be self-contained (inline React + Babel via unpkg OR pure SVG)
- Theme tokens in CSS variables for `FL33TTheme.swift` consumption
- Include a "fleet trust-state" / signal-flag legend with the 4-5 member-status states (e.g., available / on-duty / standby / off-duty / alerted)

## Family-rule constraints (apply during design)

- **Rule #1 no phone home** — FL33T-rs runs on customer infrastructure; the iOS app talks only to the customer's FL33T-rs deployment, not Everplay. Visualize this in chrome (e.g., the "flagship" label is the customer's deployment, not Everplay)
- **Rule #4 no catalogue** — FL33T's purpose is team-collaboration with audit + capability tokens; ONE thing crystal clear, not a do-everything team-suite
- **Rule #8 trust mesh via App Groups** — first-boot inherits AiMANAC identity automatically when AiMANAC is installed (rule #14 affordance), then Apple Sign-In layers on per-member identity for the team layer
- **Rule #9 FaceID + IHP + shared keychain** — Secure Reset trigger ("scuttle the fleet") for the OWNER; non-owner members can leave but can't scuttle; design with appropriate role-gated gravitas
- **Rule #14 every sibling participates in HELM** — FL33T is companion tier (own backend + App Group claim-flow); registers `helm_fl33t_*` tools (6 currently skeleton; v1.1 impl makes them real). Visualize policy-gated tool calls in the audit ledger
- **Q15 Apple Sign-In + BOOTSTRAP_SETUP_CODE recovery** — owner bootstraps FL33T-rs with setup code; members join via Apple Sign-In + invite code; lost-everything recovery = wipe-and-redo per Wave L runbook

## What this prompt does NOT lock

Claude Design has discretion on:
- Exact color hex values (palette suggestion is a starting point)
- Typography (suggest: a humanist sans with technical character — Inter, IBM Plex Sans, or similar; consider a slab serif for headings; explore)
- Whether to use literal naval/submarine imagery or abstract/stylized (designer's call within "fleet command center" vibe)
- Exact IA decomposition (12 surfaces vs different — designer can propose)
- Whether to embrace the "33" callsign motif heavily OR lightly (designer's call)
- Sound design / haptics suggestions are welcome but not required

## What this prompt DOES lock

- **Functional reality** — FL33T = team-collaboration; owner runs FL33T-rs alongside aimanac-rs; per-member Apple Sign-In; capability tokens; audit ledger; team policies; 6 `helm_fl33t_*` tools
- **Tier** — paramount data-class + companion deployment-tier
- **Auth model** — Q15 Apple-Sign-In + BOOTSTRAP_SETUP_CODE per family contract
- **Pricing** — $1/Apple-account
- **Metaphor floor** — naval/submarine fleet command (designer can refine within; can't drift to e.g. "office suite" or "messaging app")
- **Tone** — orderly, signal-clear, professional. Slightly nautical-formal. NOT chatty, NOT casual, NOT cyberpunk-cool

## When this design lands

The design return enables:
- **P42 FL33T first wide cycle** (per Part 2.5 Wave J / line 113) — v1.1 trait impl for `helm_fl33t_*` 6 tools + UI shell + first-boot + invite flow + audit ledger reader, walking BRIEF-driven 12-step pattern (mirror BROILR P31)
- **`fl33t.llmtech.net`** marketing page (Wave O / P72 per Part 2.5)
- **Wave L FL33T-rs deploy runbook** (P53 per Part 2.5) — customer-side deploy guide
- **App icon vendoring chip** once mascot/icon HTML is in this handoff

XZA flags this design for return when Claude Design has time. No deadline; queues with Bombadil / Satcheli / PSL / ARACHNID cadence.

## Cross-references

- `~/.claude/plans/bombadil-design-handoff/BOMBADIL_DESIGN_PROMPT.md` — companion prompt authored same session (hobbit-hole hospitality vibe for the on-device-companion sibling)
- `~/.claude/plans/aimanac-website-dadpitch-proposal01/WEBSITE_DESIGN_PROMPT.md` — companion prompt authored same session (dadpitch-register website that will have FL33T's page wired once this design returns)
- `~/.claude/plans/arachnid-design-handoff/ARACHNID_DESIGN_PROMPT.md` — earlier sibling design prompt (ARACHNID — 8-eyed sentinel)
- Existing handoffs (for pattern reference): broilr-design-handoff / mailsloth-design-handoff / archimedes-design-handoff / helmpc-design-handoff
- `~/FL33T-rs/README.md` — functional ground-truth source
- `~/FL33T-iOS/README.md` — iOS-side ground-truth source (Build 1 scaffold)
- `~/FL33T-rs/docs/DEPLOY.md` — customer-side deploy guide (already exists; pairs with future P53 chip)
- `~/FL33T-rs/docs/IHP_VAULT_EXEC.md` — Vault Exec architecture (original working title)
- `~/FL33T-rs/docs/INTEGRATION.md` — fleet integration contract with aimanac-rs