# SATCHELI — Claude Design prompt

**Authored:** 2026-05-16 PM by Cipher (CZA) for XZA
**Sibling:** Satcheli — Everplay-Tech AiMANAC family
**Tier:** Supportive-tier (deployment) + Paramount-tier (data classification — holds cross-app MCP grants the customer minted)
**Tagline (working — Claude Design may refine):** *"Curate your access."* / alt: *"Policies, pocketed."* / alt: *"Your portable consent ledger."*

**Reference repo (private; XZA can link in Claude Design):**
- `https://github.com/Everplay-Tech/satchel-ios` (iOS — currently `main` @ `64b76197`)
- Rust half lives **embedded** in `aimanac-rs/crates/satchel/` (per family rule #10 — both halves required; Satcheli is one of the *embedded-Rust-half* siblings)

## What Satcheli IS (function)

Satcheli is the **MCP-policy enforcement** sibling. It's where the customer **curates which AI tools can access which siblings, on what surfaces, with what credentials, under what conditions.** Where MailSloth carves out *email* and BROILR carves out *hardened chat*, Satcheli carves out **the cross-app consent graph itself** — the policy ledger that other family members consult when an AI call wants to do something on the customer's behalf.

The customer's mental model: "I have a satchel. Inside it are pockets — each pocket holds an authorization for one tool, one sibling, one use case. I can add, remove, re-stitch, seal, or burn any pocket. When AiMANAC (or any sibling) asks 'can I do this?', it's asking my satchel."

**Family-charter purpose (rule #14):** Satcheli extends AiMANAC's reach by exposing `helm_satchel_*` MCP-policy tools (companion-tier participation shape — own customer-facing surface, but no separate deployable backend; rides the aimanac-rs embedded crate). HelmMCPClient (canonical primitive doc'd via P24, **Satcheli is the donor**) routes MCP `tools/call` invocations through Satcheli's policy gate before any provider is touched. Bypass Satcheli, bypass the customer's consent — that's the load-bearing line.

## Architecture refresher (locked from family discovery 2026-05-14)

- **Embedded Rust half**: `aimanac-rs/crates/satchel/` (NOT its own `satchel-rs` repo; family rule #10 honored via embedded variant)
- **iOS half**: `/Users/magus/satchel-ios/` — Build 11; 55 tests; SwiftUI
- **App Group**: `group.net.llmtech.mcp` (entitled in Satcheli; ALSO entitled by family siblings that need to read the MCP grant ledger). **NOTE from discovery**: Satcheli currently entitles `group.net.llmtech.mcp` but the AiMANAC-side SQLite mirror through this group is NOT yet wired — pure architecture-lock at the moment; Cipher will close in a follow-on chip. Design freely against the *intended* contract; the wiring lands soon.
- **Trust mesh participant**: shares `group.net.llmtech.aimanac` with AiMANAC for identity inheritance (`SatchelEnvironment` is the donor of P25 canonical `TrustMeshInheritedEnvironment`).
- **Bundle ID**: `net.llmtech.satcheli` (post-CCW-0; note display name `Satcheli` ↔ folder `satchel-ios` ↔ legacy bundle `satchel`)
- **No own auth surface**: Satcheli rides on AiMANAC's identity. First boot WITHOUT AiMANAC installed → `AiMANACMissingGate` (Satcheli is the canonical donor of this supportive-tier pattern; rule #11 lock).
- **Shared keychain**: reauth-proof primitive (per family rule #9). Donor for `EverplayTrustMeshKit` SPM (queued; rank-#10).

## The load-bearing UX surface: the FOUR-AXIS POLICY EDITOR

Per family-discovery 2026-05-14 (Satcheli walkthrough), Satcheli's central screen is a **four-axis policy editor** for each MCP grant. Every grant the customer holds is a tuple of four orthogonal selections:

1. **Where** — which app/surface is this grant valid on? (AiMANAC anchor; specific sibling; family-wide; system-level)
2. **By whom** — which actor can use it? (the customer themselves; AiMANAC's HELM dispatcher; an `agentskills.io` Skill ID; an MCP server instance)
3. **Load** — what model/provider is allowed to consume it? (specific provider + model; provider-family; tier-restricted: e.g. local-only / cloud-only / customer-BYOK)
4. **Grants** — what specific capabilities are permitted? (read X; write Y; mint sub-token; call sibling Z; expire at T)

The visual design of this four-axis editor IS Satcheli's marquee surface. It's where the design decision lands — does it look like four labeled dials? Four pocket flaps on a leather portfolio? Four colored bookmark tabs? Four wax-sealed envelopes laid out? **Designer's call** — but it's the screen people will recognize.

## Visual design direction — LEATHER SATCHEL / CURATOR'S PORTFOLIO

**The metaphor (proposed; XZA may redirect):** opening Satcheli should feel like **unrolling a well-worn travel satchel onto a map table.** Hand-stitched leather. Brass buckles. Parchment cards with inked labels. Wax seals on the active grants. Travel stickers earned over miles. The customer is a curator-courier — they CARRY their policies with them; the satchel is their portable consent ledger.

**This contrasts intentionally with other sibling aesthetics:**
- AiMANAC = modular synthesizer faceplate (the anchor)
- BROILR = MECHA industrial (cold trust-aware steel)
- HELMPC = synth sequencer (modular knobs/jacks)
- Archimedes = synth chrome operational
- DeepDive = dive computer / nautical log
- MailSloth = Victorian writing desk (stationary furniture)
- Bombadil = cozy underground burrow (domestic warmth)
- FL33T = naval bridge / fleet command (admiral aesthetic)
- ARACHNID = browser/web sanitizer (acid-bath chrome)
- PSL = personal stash (collection)
- **Satcheli = portable leather curator's satchel** (the courier's bag laid open on a map table)

Where MailSloth is stationary (a desk you sit at), Satcheli is **portable** (a satchel you carry between apps). Where Bombadil is interior (you go in), Satcheli is **exterior** (you open onto a table). The materials register is close to MailSloth (warm + crafted) but the *form* is different — bag vs furniture; open-flat-on-table vs upright-at-station.

### Color palette (suggested; Claude Design refines)

| Token | Hex (suggested) | Use |
|---|---|---|
| `cognacLeather` | `#8B5A2B` (cognac brown) | Primary background; satchel body |
| `oxbloodSeal` | `#722F37` (deep oxblood) | Active grant seal; primary CTA accent |
| `agedBrass` | `#B5A03C` (warm aged brass) | Hardware accents; buckles; latches; rivets |
| `parchmentCard` | `#E8DCC0` (aged parchment) | Index cards; labels; inscribed surfaces |
| `inkBrown` | `#2A1A0E` (sepia ink) | Primary text on parchment |
| `forestLining` | `#3D5430` (deep forest green) | Interior lining; secondary surfaces |
| `dustyEdge` | `#A8957A` (worn leather edge) | Borders; inactive states; muted text |
| `waxRed` | `#9B2C2C` (sealed wax red) | Sealed/active grant indicator |
| `compassGold` | `#D4A04F` (compass face) | Highlight; cardinal axis indicators |

(All optional starting points — refine within the leather-satchel vibe.)

### Compositional motifs

1. **Satchel-open-on-table framing** — primary IA shape suggests a satchel UNFOLDED, contents organized for the curator's view. Major sections feel like pocket flaps, sleeve dividers, or bound inserts.
2. **Hand-stitched seams** — visible stitching at panel/card edges. Decorative + functional. Soft + crafted — NOT corporate vector neatness.
3. **Brass hardware** — buckles, snap closures, D-rings, rivets as functional UI affordances. A "lock policy" gesture might be a brass-buckle closing animation. Pulled tabs reveal pockets.
4. **Wax seals on active grants** — currently-active grants visually show a wax-red seal. Revoking a grant breaks the seal (subtle crack animation; the act has gravitas).
5. **Parchment cards** — each grant inscribed on a parchment-textured card; ink-brown handwriting register for legibility. Cards can be flipped (front = identity; back = audit log).
6. **Compass / cardinal markers** — the four axes of the policy editor visualized as compass points OR as four labeled tabs around a central card. North/South/East/West feels right for "four orthogonal dimensions."
7. **Travel stickers / patches** — earned states (used N times; granted for M days; valid across X siblings) shown as faded leather patches or hand-applied sticker stamps. Restrained — sparse, not Tumblr-collage.
8. **Generous round-corner radii** — minimum 16pt on cards; satchel flaps and pocket edges are CURVED organically, not rectangular.
9. **Curator copy register** — "Pocket this", "Stitch in", "Seal", "Break the seal" (revoke), "Tuck away" (archive), "Unbuckle" (open settings), "Pack for travel" (sync to other sibling). Tone: a knowledgeable curator-courier explaining their satchel to a peer. NOT a robot assistant; NOT a butler.

### Surfaces to design (sketch list)

Claude Design should propose visual treatment for at minimum:

1. **First-boot welcome** — the satchel UNROLLING onto a map table. "Welcome — let's organize your access." Consent to inherit AiMANAC identity via trust mesh (rule #14 supportive-tier; no separate auth wizard).
2. **AiMANACMissingGate** — Satcheli's CANONICAL contribution to the family pattern (rule #11 supportive-tier). When AiMANAC is not installed, ONE full-screen gate with calm explanation + App Store deeplink. Refresh-on-foreground when AiMANAC arrives. Design this gate carefully — it's the family's reference impl for the missing-anchor case.
3. **Home / satchel-open** — main view: satchel laid open. Pockets visible. Pinned grants up top. Recent activity. Quick-add affordance. "What's in your satchel today?"
4. **Four-axis policy editor (MARQUEE SURFACE)** — the four-dimensional grant editor described above. THIS IS THE SCREEN PEOPLE WILL RECOGNIZE. Designer's call on dial vs tab vs card-flip layout. Show one grant being edited with all four axes visible + the audit-log back-side accessible via flip.
5. **Grant list / index** — all grants. Filterable. Each row inscribed on a parchment card with wax seal (active) or no seal (revoked/expired). Activity sparkline + last-used + valid-until.
6. **Audit log / "the trail"** — every grant invocation logged. Show as a travel journal / log book: dated entries, where the grant was used, by whom, what it authorized. Read-only; tamper-evident framing visually.
7. **MCP server registry** — list of MCP servers the satchel knows about. Add new (paste manifest / scan QR). Connection states. Per-server policy defaults.
8. **HELM relay arrivals** — when AiMANAC HELM tool invokes `helm_satchel_*`, visualize the inbound relay as a sealed envelope arriving in a brass mail-slot on the satchel. Open + decide + return.
9. **Settings / unbuckling** — auto-lock policy (rule #12), SecureReset (rule #9; FaceID-gated; "burn the satchel"; irreversible), provider settings nook, locale, etc.
10. **App icon** — the iconic satchel rendered as a 1024×1024 squircle. Three-quarter view of a leather satchel with a single brass buckle prominent and a wax seal hanging from one strap. Background suggests a map-table corner (parchment + ink horizon).
11. **iOS home screen context** — show how Satcheli's icon looks alongside AiMANAC + sibling apps on a home screen. Should harmonize with family palette (each sibling distinct but family-coherent).

### Anti-scope (what NOT to design in this pass)

- **No marketing-style "privacy-first!" callouts.** The satchel-on-the-table visual IS the message; the customer's policies live in *their* satchel, *their* table. Show, don't shout.
- **No subscription / paywall / IAP affordances.** Family rule #2 — one-time purchase, no subscriptions. $1 sibling.
- **No social-app patterns** (likes, comments, followers, share-this). The satchel is private + curatorial.
- **No actual-world references** (no specific real-world bag brands, no recognizable leather goods designers, no "this looks like a Filson / Saddleback" cosplay). The metaphor is the FORM (worn leather satchel), not the IP.
- **No surveillance dashboard aesthetic** (no "data exhaust" charts, no "your AI usage this week!" gamification). Satcheli is curatorial, not analytical.
- **No vault / safe / military iconography.** Satcheli is curator's portfolio, not a security product. Leather, not steel.
- **No fantasy / wizard-as-character framing.** Hands-on craftsperson register. The curator-courier is the implied protagonist; never anthropomorphized as a character.

## Family-design discipline (apply per family rule #13)

- Output expected: `SATCHELI_BRIEF.md` (text BRIEF) + `Satcheli.html` (single-page visual canvas with all surfaces) + JSX fragments (`satcheli-app.jsx` / `satcheli-screens-*.jsx`) + `satcheli.css` theme tokens + `design-canvas.jsx` harness + `screenshots/` PNG renders for the key surfaces (~8-10 screenshots minimum)
- Match the file structure of existing handoffs at:
  - `~/.claude/plans/broilr-design-handoff/` (BROILR — MECHA industrial)
  - `~/.claude/plans/mailsloth-design-handoff/` (MailSloth — Victorian desk)
  - `~/.claude/plans/archimedes-design-handoff/` (Archimedes — synth chrome operational)
  - `~/.claude/plans/arachnid-design-handoff/` (ARACHNID — returned 2026-05-16)
  Those are the precedents.
- The HTML render MUST be **self-contained** (inline React + Babel via unpkg OR pure SVG; do NOT depend on missing companion files — BROILR mascot v2 broke this discipline pre-P31; don't repeat it).
- Theme tokens in CSS variables so Claude Code can wire `SatcheliTheme.swift` consuming the same palette.
- Include a **"grant state register"** (parallel to BROILR's 4-trust-state chip) showing the visual treatment for the natural grant states: **active-sealed**, **pending-acceptance**, **expired**, **revoked**, **audit-only** (witness without grant).

## Family-rule constraints (apply during design)

- **Rule #1 no phone home** — Satcheli's policy ledger lives on-device + in shared App Group (with AiMANAC). No Everplay-operated server. Visualize "stays local" through the satchel-on-table framing (private workspace; nothing leaves your table without your seal).
- **Rule #4 no catalogue** — Satcheli does ONE thing: curate MCP grants. Resist the urge to bolt on "AI marketplace browsing" or "policy recommendation feeds" — those would dilute the curatorial register.
- **Rule #8 trust mesh via App Groups** — first-boot inherits AiMANAC identity automatically (per Satcheli's own canonical `AiMANACMissingGate` pattern; no auth wizard).
- **Rule #9 FaceID + IHP + shared keychain** — SecureReset trigger ("burn the satchel / start fresh") needs a visual home in Settings; design with appropriate gravitas (irreversible; biometric-gated; wipes all grants + audit log + keychain reauth-proof).
- **Rule #11 apps = function; website = explanation** — Satcheli should not contain marketing copy explaining "what MCP is" or "why policies matter." Functional surfaces only; education lives at `satcheli.llmtech.net` (queued for Wave O).
- **Rule #12 auto-lock in Settings** — every sibling exposes a lock policy. Satcheli especially — the satchel should lock between sessions per user-chosen interval (never / on background / after N min / on terminate).
- **Rule #14 every sibling participates in HELM** — Satcheli is **companion-tier** participation (own customer-facing iOS surface; embedded Rust half exposes `helm_satchel_*` tools). Visualize HELM tool dispatch arrivals as **sealed envelopes arriving in a brass mail-slot** on the satchel exterior.

## Auth + identity (FYI for design context — no surface needed)

- Satcheli inherits AiMANAC identity via shared App Group `group.net.llmtech.aimanac` (P25 canonical `TrustMeshInheritedEnvironment` — Satcheli is the donor)
- Apple Sign-In flow lives at AiMANAC anchor; Satcheli has NO independent auth surface
- Identity-missing case → `AiMANACMissingGate` (Satcheli is canonical donor)
- Reauth proof minted from shared keychain when sibling-to-sibling RPC needs auth; design doesn't surface this — it's behind the curtain

## Engineering refs (for visual context — design needn't reproduce code)

For Claude Design's grounding (NOT for visual reproduction):

- `satchel-ios/Sources/.../SatchelEnvironment.swift` — identity inheritance pattern (P25 donor)
- `satchel-ios/Sources/.../HelmMCPClient.swift` — MCP `tools/call` client (P24 donor)
- `satchel-ios/Sources/.../AppGroupBackendLocator.swift` — App Group resolution
- `satchel-ios/Sources/.../ReauthProofMinter.swift` — keychain reauth proof
- Embedded Rust: `aimanac-rs/crates/satchel/` — server-side policy enforcement; `helm_satchel_*` tool registry

The four-axis policy editor doesn't have a code analog yet (this design is the lock). Discovery 2026-05-14 surfaced the four axes; the UI shape is what this design pass produces.

## What this prompt does NOT lock

Claude Design has discretion on:
- Exact color hex values (palette suggestion is a starting point; refine within leather + brass + parchment)
- Typography (suggest: a humanist serif with optional small-caps for headings — feels inscribed; clean sans for body if needed; explore)
- Whether the four-axis editor is presented as a single screen or a stepwise wizard (designer's call; one-screen feels more curatorial; wizard feels more onboarding-friendly — pick one)
- Exact tab/IA structure (5 sections vs 3 vs different decomposition — designer can propose; the satchel-open framing constrains naturally)
- Sound design / haptics suggestions are welcome but not required (brass-buckle click, parchment rustle, wax-seal break)
- Whether grants are inscribed by hand (faux-handwriting font) or typeset on parchment (more formal) — both work; pick one consistent register

## When this design lands

Once the design returns with `SATCHELI_BRIEF.md` + HTML canvas + JSX + screenshots, Cipher will:
1. Extract to `~/.claude/plans/satcheli-design-handoff/`
2. Update `~/.claude/skills/appfamily/appfamily.md` rule #13 precedents list with Satcheli
3. Author the **P26-equivalent SATCHELI canonical-adoption wide cycle** chip (analog of P31 BROILR + P43d ARACHNID) to land the visual surface on satchel-ios `main`
4. Update `locked_specifics.md §22` vendor SHA registry with Satcheli adoption SHAs

Satcheli is **already live as a v1 sibling** (Build 11; 55 tests passing; on App Store path). This design pass is a **visual refresh + four-axis-editor lock** — the engineering substrate is mature; what's missing is the curated visual identity that matches the family register.

## Family context refresher (quick reference)

- **Anchor**: AiMANAC (modular synth faceplate aesthetic)
- **Companion-tier siblings (own customer-deployable backend or own surface + tools)**: BROILR (hardened chat), Archimedes (operational), MailSloth (correspondence), HELMPC (sequencer), FL33T (fleet command), **Satcheli** (MCP-policy)
- **Standalone-tier siblings (on-device only; affordance + file-bridge per rule #14)**: DeepDive (dive log), PSL (stash), Bombadil (on-device agent), ARACHNID (browser sanitizer)
- Each sibling carves ONE domain out of AiMANAC's monolith. Satcheli's domain: **the consent graph itself.**