YBA Empire — Development Plan v1

What this is: the detailed, step-by-step plan to take the YBA empire from today’s state (2026-05-02) to first paying YBA Med tenant (~Q1 2028). Designed by 5 specialists in parallel and synthesised into one document. Companion to the Empire Architecture v3.3 page (which is the WHAT and WHY). This page is the HOW and WHEN.

Top-line

Goal: First paying Med tenant by ~Q1 2028. Cashflow-funded. No outside capital. Captain works ~18 hrs/week at night.

Anchor numbers: - Total new code in Phase 0-2: ~3,500 lines (Flow Core + LLM Router + Brain Provisioner + Edge concierge dashboard) - LLM/voice cost at moderate use: ~R2,700/tenant/month - Concierge pricing: R45k setup + R18.5k/mo + LLM at-cost+15% - Q1 (Weeks 0-13) target: 3-5 paying concierge clients, R55-90k MRR, R250-350k cash banked - First-hire trigger: 5 paying concierge × 60 days + R150k MRR × 3 months. Realistic month 9-12. - 18 hrs/week is the contract. Anything in this plan that needs more is wrong and gets cut.

The Master Build Sequence (9 Phases tied to 7 Gates)

Phases align with the gates from Architecture v3.3. Each phase finishes when its gate fires (measurable triggers, NOT calendar dates).

Phase 0 — Pre-stage-1 (today → Edge S1 capable)

Goal: Captain can run his own brands on Flow Core. No paying clients yet.

Phase 0 capacity: ~3 weeks. Captain ~10h total, Niki ~32h, agents ~83h.

Phase 1 — Edge stage 1 (Captain runs his own 10 brands)

Goal: Hit Gate 1 — 5+ Captain brands fully on platform 30+ days, 0 P1 bugs, indemnity bound, onboarding <30 min.

Key deliverables: - Migrate CashCircuit + 4 more Captain brands onto Flow Core as multi-tenant test bed - Build Edge Layer 2 specialist agents (brand-voice, content-clipper, per-platform social, engagement-monitor, analytics) - Onboarding playbook: setting up brand #11 takes <30 min - Professional indemnity insurance bound (R8m cover, ~R8k/mo) — REQUIRED before paying client #1 - Synthetic Tenant B leak test running nightly, 30 nights green - Meta-Brain vault scaffolded at /opt/claude-workspace/projects/yba-meta-brain/

Phase 1 capacity: ~2-3 months. Captain ~17h/week. Mostly agent dispatch on the build, Captain on voice/judgement/insurance.

Phase 2 — Edge stage 2 launch (first paying concierge client)

Goal: R6k Flow concierge client onboards as Concierge tenant #1 at R45k setup + R18.5k/mo.

Key deliverables: - MSA + DPA drafted by SA lawyer (Michalsons or Webber Wentzel) - Client #1 onboarding — shadow mode first 2 weeks (agents observe but don’t act) - Onboarding interview ingested into Meta-Brain as first pattern - Progressive activation: 3 agents week 3-4, full 8 by week 8 - Stitch banking integration for Reconciliation agent - Captain-offline 7-day runbook + Niki-vs-Captain responder boundary tested

Done: Client #1 live, paying, fully onboarded, 30 consecutive days with Captain <2h/week intervention.

Phase 3 — Concierge scale (8+ paying clients, Gate 2)

Goal: Hit Gate 2 — 8+ clients × 3 months, churn <5% over 90 days, Captain <6 hrs/wk per client, Layer 1 stable 14 days.

Key deliverables: - Clients #2 + #3 in same agency-adjacent industry as #1 (de-risk concentration risk) - Recruit ONE practising doctor as concierge client #4 OR #5 — onto Layer 1 only, no Med Layer 2 yet. This GP becomes the Med design partner. (De-risk experiment #1) - Recruit 1 farmer + 1 estate agent the same way for Terra/Realty - Layer 1 stability hardening — fix every P2/P3 from clients 1-3 - Per-task LLM cost guard production-tested (synthetic runaway killed at R200) - Meta-Brain Pattern Extractor agent (weekly anonymised cross-tenant scrape) - Month 4 founder-transfer test — package one painful workflow, sell standalone (de-risk experiment #4)

Hard cap: 5 concierge clients in first 6 months (de-risk experiment #2).

Phase 4 — BYOK self-serve build (parallel to Phase 3)

Built quietly while concierge funds the work: - Self-serve signup + Stripe billing + 60-sec tenant provisioning - BYOK key vault — encrypted at rest, never logged - Onboarding wizard tested by 5 friendly betas (Gate 2 trigger) - Tutorial library + 4 brand templates (creator / consultant / e-commerce / agency) - flow-compliance-core add-on (BCEA, LRA, SARS, POPIA RAG)

Phase 5 — BYOK launch (public)

• Closed beta to existing Edge SaaS users (20-30)
• Public launch at flow.ybaedge.com with content marketing
• BYOK liability cap (R2k) baked into ToS
• Cross-sell: every concierge client offered BYOK for additional brands at R3.5k/mo

Phase 6 — Med planning (Gate 3)

Trigger: 15+ Edge clients OR 50+ BYOK + 3 unprompted “do you have something for doctors?” + Edge MRR R150k+ × 2 months + Healthbridge NDA + 1 SA GP design partner.

In parallel: - Healthbridge NDA + integration application (3-9 month lead time — start NOW in Phase 3) - GP design partner formalised (the doctor recruited in Phase 3 becomes Med pilot tenant #1) - Captain writes Terra vision document - POPIA Information Officer appointed + IR registered - Medical-grade DPA + MSA drafted - Indemnity scaled to medical level (~R20-30m cover, ~R20-25k/mo)

Phase 7 — Med Layer 2 build (42 specialist agents in 5 teams)

Per the [[yba-med-layer2-2026-05-02]] design:

Phase 7 capacity: ~4-6 months. Captain ~10h/week (clinical voice + safety review is non-delegable).

Phase 8 — Med launch (Gate 4 + first GP client)

Trigger: Healthbridge contract signed + all 10 safety rails wired + Practice B test passed + Rejection Auto-Fix shadow ≥85% × 30d + POPIA IO appointed + DPA/MSA signed + medical indemnity bound.

• GP design partner becomes paying Med tenant #1 (R25-35k/mo)
• Shadow mode 30 days first, then progressive activation by team (Team 5 ops first → 3 → 2 → 4 → 1 last)
• First Med-specific patterns land in Meta-Brain
• First paying Med tenant achieved.

Master Gantt (approximate — gates rule, not dates)

                    2026                                             2027
       May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
P0 ████░░
P1     ████████░░                                ◄ Gate 1 fires (Aug-Oct)
P2          ░░██████░░                           ◄ Concierge client #1 live, paying
P3              ░░██████████████░░               ◄ Gate 2 fires (8 clients × 3mo)
P4                  ░░░░░░░░██████████░░         (parallel with P3)
P5                              ░░░░██████████░░ ◄ BYOK public launch
P6                          ░░░░░░██████░░░░     ◄ Gate 3 fires (NDA + GP partner)
                            (parallel with P3+P4+P5)
P7                                  ░░░░██████████░░  ◄ All 5 Med teams + safety rails
P8                                              ░░░░██████  ◄ GATE 4 + FIRST PAYING MED TENANT

What Got DELETED from the Build

Cut deliberately because they don’t earn their place at this stage:

1. LangGraph / CrewAI / AutoGen. Solve “structure one agent’s reasoning” — we don’t have that problem. n8n + Flow Core covers it.
2. DB-per-tenant. Schema isolation + row-level security + tenant_id is cheaper, faster to provision.
3. pgvector as the brain. Markdown vault IS the brain. pgvector is optional derived index only.
4. Custom Frappe apps in first 12 months. ERPNext stays vanilla.
5. LinkedIn / Facebook ads for concierge. Concierge is referral + association + 1:1.
6. Operations team hire before client #5. Niki + agents absorb ops.
7. SOC 2 audit before Med. POPIA + indemnity + IO is the right level.
8. Flow holding-company brand site. YBA Group parent stays as a one-pager.
9. Custom admin UI for tenant brain editing. Owners use Obsidian.
10. Real-time agent dashboards. Daily owner briefing email gives 95% of value.
11. Self-hosted local LLM models. Premature optimisation; revisit at year 2 if LLM spend > R30k/mo per tenant.
12. Onboarding agent. Captain does concierge onboarding personally (the relationship IS the product).
13. Blockchain anything for audit trails. Append-only Postgres + signed log files satisfies HPCSA + POPIA.

The Engineering Plan (the new code we write)

Flow Core (Node + TypeScript + Hono + Drizzle + Postgres + Redis)

The brain stem. ~2-3k lines. Knows about tenants, agents, tools, events.

Why Node: Postiz, landing pages, bridge relay, n8n custom nodes are all already TypeScript. Zero new languages for Niki to maintain.

flow-core/
├── src/
│   ├── tenants/        # CRUD, isolation guard, brand/workspace concept
│   ├── agents/         # role prompts, memory, tool catalogue
│   ├── tools/          # ERPNext, Postiz, Twilio, Healthbridge, vault-write
│   ├── events/         # Redis Streams event bus
│   ├── auth/           # Better Auth — self-hosted, SA-data-resident
│   ├── routes/         # Hono routers
│   └── lib/            # db, redis, logger, telegram
├── db/
│   ├── schema.ts       # Drizzle — single source of truth
│   └── migrations/
├── tests/
│   └── tenant-b/       # SYNTHETIC TENANT B ISOLATION TEST (mandatory CI gate)
├── Dockerfile
└── package.json

API surface: /v1/tenants, /v1/tenants/:id/agents, /v1/agents/:agentId/run, /v1/tenants/:id/vault/*, /v1/events, /v1/billing/:tenantId/usage, /v1/kill-switch/:tenantId.

Postgres tables: tenants, users, agent_runs, tool_calls, audit_log (append-only), billing_events. Every table has tenant_id NOT NULL. Drizzle middleware enforces tenant scope at the type-system level.

LLM Router (FastAPI + LiteLLM)

Internal-network only. Single Python service. ~800 lines.

• POST /v1/complete — body: {tenant_id, agent_id, task_class, messages, max_tokens} → returns {text, model_used, cost_zar, latency_ms}
• Routing rules: accuracy_critical → Opus 4.7, consistency_critical → Sonnet 4.6 (low temp), cost_critical → Haiku 4.5, balanced → Sonnet 4.6
• BYOK: tenants on BYOK tier store own keys (libsodium-encrypted), router resolves at call time
• Budget guard: pre-call check Redis for spend; refuse with 429 + Telegram alert if would push past cap
• Fallback: 60-sec health probe per provider; on 5xx × 3 → degraded → fall to next-tier model

Tenant Brain Provisioner

~200 lines inside Flow Core. Calls git, cp -r, writes templated files. On POST /v1/tenants:

1. Creates /opt/flow/tenants/<tenant-id>/
2. Copies Richards Brain template
3. Writes tenant’s CLAUDE.md with brand name + vertical baked in via Mustache
4. Initialises local git repo
5. Creates Postgres tenant row + n8n workspace
6. Posts “Tenant provisioned” to Ops Center

Backup: every vault git push nightly to private GitHub org yba-vaults/<tenant-id>. The vault is the brain — must be replicable from git alone.

Agent Runtime (n8n workflows)

The 8 Layer 1 agents are 8 n8n workflows. Same shape:

[Trigger: cron or webhook]
   ↓
[HTTP node: GET Flow Core /agents/:id/wake → role prompt + memory]
   ↓
[HTTP node: POST LLM Router /v1/complete]
   ↓
[Switch: tool calls? → ERPNext / Postiz / Twilio / vault-write]
   ↓
[HTTP node: POST Flow Core /agents/:id/done → log run, append vault, billing event]
   ↓
[IF approval needed → Telegram approval → wait → resume]

One n8n project per tenant. Layer 2 (Med, Terra, Realty) repeats the pattern — 42 Med agents = 42 n8n workflows imported from a JSON template at provisioning.

Edge Customer-Facing Surface

Two surfaces: - edge.ybaedge.com — concierge dashboard. Read-mostly. Approve/reject buttons fire webhooks. (Phase 2) - flow.ybaedge.com — BYOK self-serve app. Self-signup, payment, key paste, tenant provision. (Phase 4-5)

Same Hono + HTMX + Tailwind stack as existing landing pages. Zero business logic — pure view onto Flow Core. Re-skin for Med/Terra/Realty in 4 hours: copy repo, change colours + copy, point at same Flow Core.

Multi-Tenant Isolation (load-bearing decision)

Pick: row-level security with tenant_id everywhere. NOT schema-per-tenant.

Reasons: 50 schemas × 42 agents-of-state = unmanageable migrations. Drizzle middleware enforces tenant scope at compile time. Postgres native RLS adds a second wall. Synthetic Tenant B test in CI is the third wall.

Cross-tenant leak = empire-ending POPIA breach. The Tenant B test runs on every PR, every release, weekly against production.

Auth/Identity

Pick: Better Auth (self-hosted TypeScript-native).

Reasons: POPIA wants SA-resident user data — Clerk/Auth0/WorkOS ship to US. Cost: free vs $1k+/month at 100 tenants. Same stack as Flow Core. We control the audit trail when (not if) we have an incident.

Auth model: email + password + TOTP for staff, magic-link for owners. Sessions in Redis. Roles: owner, staff, agent (service accounts). All tenant-scoped.

Voice Stack

• Twilio for telephony (SA mobile inbound R0.85/min, outbound R1.20/min)
• Cartesia for TTS (warm, fast, cheap — ~$0.025/min)
• Whisper-local on the VPS for STT (free)
• All-in cost per call-minute: ~R2.50; billed at R3.50 inbound / R5.00 outbound

Sample First-Week Code Plan

What Niki actually writes Monday-Friday of Week 0:

• Mon: flow-core repo, Hono skeleton, Drizzle schema, first migration, Coolify pipeline, /healthz, synthetic Tenant B test scaffold (failing, in CI)
• Tue: Brain Provisioner module, copy Richards Brain template to /opt/flow/templates/tenant-brain-v1/, wire POST /v1/tenants, provision test tenant acme-test
• Wed: llm-router Python service, FastAPI skeleton, LiteLLM, per-task routing config in YAML, BYOK key lookup, budget cap, cost logging
• Thu: First agent — Executive Assistant (lowest risk, read-only). n8n workflow, cron 07:00 daily, end-to-end smoke test
• Fri: Kill-switch. POST /v1/kill-switch/:tenantId. Synthetic Tenant B test for kill-switch isolation. Make Tenant B test pass on main.

End of week 1: ~1,200 lines of code, deployed Flow Core, deployed LLM Router, working tenant provisioner, working EA agent, working kill-switch, green isolation test in CI.

Captain / Niki / Agents Allocation

The Allocation Principle

Captain is rare and strategic. Niki is dense and operational. Agents are on-demand specialists. If Captain finds himself doing something Niki could’ve done, that’s a process bug — log it and fix the allocation.

Allocation Matrix (excerpt)

Captain’s Typical Week (18 hrs)

What Captain DOESN’T do: type code, configure servers, write copy from scratch, do bookkeeping, build n8n flows, troubleshoot deployments, draft compliance docs, post to Telegram. Niki delivers all of that ready for review.

Niki’s Continuous Job

• Every minute: Coolify, Docker, n8n health checks, Postiz queue
• Every hour: bridge messages, Telegram inbound, agent error counts, backups
• Daily 07:00: Ops Center morning report
• Daily 21:00: Ops Center evening report
• Weekly Friday 17:00: Captain weekly digest
• Weekly Sunday 22:00: Meta-Brain Pattern Extractor
• Monthly 1st: monthly review pack, bookkeeping reconcile, compliance feed refresh
• Monthly last Friday: synthetic Tenant B isolation test (NON-NEGOTIABLE)
• Continuous: ingest sources, maintain wiki, build code per spec, deploy, post Edge content, reconcile bank feeds, draft agent SOPs, prep next concierge onboarding

Escalation Path

P1 — Captain DM page immediately, day or night: - Cross-tenant data leak (any) - Customer-facing service down >15 min business hours, >60 min off-hours - Payment failure on customer billing - POPIA-flagged event - Clinical red-flag triage misfire (Med tenants) - LLM cost spike >R500/hour for any single tenant - Customer angry enough to threaten cancellation

P2 — Wait for next morning Ops Center report: - Single n8n workflow failed but auto-retry succeeded - Non-blocking bug Captain should know about - Compliance feed stale by <7 days

P3 — Niki just fixes it, mentions in weekly digest: - Routine deploy, wiki maintenance, <R200 monthly impact

Rule: Niki tries safe mitigation for max 10 min before paging. Better to wake Captain over false alarm than let a leak run.

Captain-Offline Runbook (7-day holiday)

Continues: all deployed services, all concierge agents, daily Ops Center reports, Edge content posting, scheduled n8n, Meta-Brain pattern extraction, wiki, bookkeeping, compliance feeds.

Pauses: new customer sales calls, new concierge onboarding starts, architecture/vision decisions, PR merges to master that touch Layer 1 or shared infra, vendor contracts.

Escalation while offline: Niki tries containment, posts Ops Center + Captain DM + Nyx via bridge. Nyx is the on-call escalation point — Nyx decides whether to actually wake Captain.

First Hire (month 9-12)

Trigger: 5+ concierge clients × 60+ days, MRR ≥R150k × 3 months, Captain hours-per-client ≥6/week, 3 months runway in bank for salary.

Role: Concierge Operations Manager (NOT a developer): - Owns customer relationship from client #2 onwards (Captain keeps client #1) - Runs the 4-week onboarding playbook - Fronts monthly client reviews - Triages support tickets needing human voice - Domain match matters (medical for Med, agency for Edge) - R30-40k/mo. Reports to Captain weekly, works with Niki daily

Why not a developer first: Niki + agents already do development. Bottleneck is human-customer-relationship hours. This hire unlocks 10-20 hrs/week of Captain time and lifts concierge ceiling from 7 → 15.

Monthly Review Meeting

90 min, first Saturday of the month, 09:00-10:30. Niki preps pack Friday 18:00.

The First 90 Days Playbook (Weeks 0-13)

Pre-Week-0 Checklist (must be true before Mon 2026-05-04)

• R6k Flow concierge client informed they migrate to Flow concierge stack, target go-live Week 4
• Captain confirmed v3.3 architecture shape (3 engines, Flow as platform, vertical brands, concierge first)
• Captain authorised Niki to get 3 indemnity quotes (Hollard / Santam / specialist broker — R8m)
• Pricing locked: R45k setup + R18.5k/mo concierge
• VPS health green: ERPNext, Postiz, n8n, CashCircuit, social audit page
• Captain earmarked SA POPIA lawyer (Michalsons or equivalent)
• Day-job baseline confirmed (~8 hrs/wk for legacy clients)
• “Captain offline 7 days” runbook in skeleton form

Week-by-Week

What Slips First (priority order)

If Captain misses a week, items drop in this order:

1. LinkedIn content posts (skip the writing first)
2. Captain’s own dogfood pace (brand #6 → next week is fine)
3. New pipeline calls (cancel discovery before existing-client check-ins)
4. Half-quarter retro / strategic reviews
5. Internal documentation (Niki absorbs)

HARD FLOORS — never slip: - Existing-client check-ins (15 min/day for first 2 weeks of each tenant’s life) - Per-tenant kill-switch test (monthly) - Synthetic Tenant B isolation test (weekly) - Indemnity insurance in force - Operator Agreement signed before any tenant goes live

Q1 Success Criteria (must all be true Fri 2026-08-07)

1. 3-5 paying concierge clients live (min 3, stretch 5)
2. MRR R55-90k
3. Q1 cash banked R250-350k
4. Captain has 5+ of his own brands on Flow Core for 30+ days
5. Zero P1 bugs across all live tenants for final 7 days
6. Zero cross-tenant data leaks ever
7. Synthetic Tenant B test passing weekly
8. Captain hours per concierge ≤8/week, trending toward 6
9. Indemnity insurance bound and active (R8m)
10. Healthbridge conversation initiated
11. At least one GP prospect in active conversation
12. Meta-Brain operational with at least 1 Layer 1 promotion candidate
13. “Captain offline 7 days” runbook tested at least once
14. Compliance evidence pack complete

12 of 14 green = Q1 win, Q2 starts as growth quarter. <12 = Q2 starts as remediation quarter.

The Living-Document System

File Structure

The plan lives inside Richards Brain, peer to architecture pages.

/opt/claude-workspace/projects/richards-brain/wiki/plan/
├── README.md             # plan map, current version, how to read
├── current.md            # symlink to active versioned plan
├── v1-2026-05-03.md      # this document, frozen at approval
├── v2-YYYY-MM-DD.md      # next snapshot when Captain pivots
├── gates.md              # gate dashboard (monthly review surface)
├── workitems/            # one .md per work item
│   ├── WI-001-flow-core-skeleton.md
│   └── …
└── briefings/            # daily/weekly Niki rollups
    └── YYYY-MM-DD-daily.md

Work-Item State Machine

Every work item has frontmatter:

---
id: WI-014
title: Wire Healthbridge sandbox claim submission
status: in-progress      # pending | in-progress | blocked | done | deleted
gate: gate-4-med-launch
owner: niki
blocked_by: [WI-007]
blocks: [WI-021]
deliverables: [...]
---

Transitions: pending → in-progress → done (Niki). * → deleted (Captain only — Niki proposes, never executes). Niki updates updated: on every state change. The file IS the audit log.

Niki’s Automation Cron

Versioning

When Captain pivots: Niki snapshots current.md to vN-YYYY-MM-DD.md (frozen forever), writes vN+1 with the new shape, top of new version says “What changed and why” quoting Captain’s exact words + date, lands a Meta-Brain decisions/ page linking old + new + the patterns/items that drove the call. current.md symlink repoints. Old versions stay readable forever.

Month-6 Re-Read Experience

In November 2026 Captain opens wiki/plan/README.md. He sees: 1. Where we are now — current empire stage, gate progress, MRR, active clients 2. What’s done — collapsed list of done items grouped by gate (the receipts) 3. What’s next — current in-progress items 4. Why we are here — version diff log with Captain’s own words on every pivot 5. What we learned — top 10 Meta-Brain patterns ranked by impact

He reads it in 10 minutes. Doesn’t have to ask anyone.

What I’d Like You to Decide

Three things:

1. Approve v1 of the development plan? Yes/no/push back on a specific bit.
2. Authorise Niki to scaffold Phase 0 starting Monday 2026-05-04? This means Niki creates the flow-core repo, starts writing code, builds the synthetic Tenant B test scaffold. No customer-facing changes.
3. Approve the lawyer engagement? Pick 1 of 3 (Michalsons / Webber Wentzel / Novation) and authorise Niki to send the brief.

Once those three are green, Week 0 starts.

Synthesised by Niki on 2026-05-02 from 5 parallel specialist sweeps (Master Sequencer, Engineering Architect, Allocation Specialist, 90-Day Playbook Designer, Living-Document Architect). Captain reviews; Niki dispatches Phase 0 the moment Captain green-lights.