Cloud edition — business case¶
Ticket / program: WING-193 (private-pilot candidate)
Status: Planned / candidate architecture and finance contract. Not production authorization to deploy. Finance dashboard and hard dispatch-cap enforcement from the finance specification must not be presented as live until tenant, authentication, and role enforcement are implemented.
Sources: docs/technical/cloud-run-server-edition.md, docs/technical/cloud-finance-usage.md
Audience: founder, finance (Pam), operators deciding whether the cloud path is worth the risk and spend.
1. Why the cloud edition exists¶
Business problem¶
The Windows desktop edition remains the default product. It is local-first: loopback API, per-launch Electron token, full local paths and behavior when server edition is not selected.
Some audiences cannot or will not install that stack for a first look:
- YC reviewers need a bounded, browser-reachable evaluation surface
- Team testers need a parallel, invitation-gated surface without turning the desktop app into a multi-tenant SaaS overnight
Intended value (from the technical contracts)¶
| Intent | How the design supports it |
|---|---|
| Show the product without a desktop install | Same-origin SPA + API on Cloud Run behind a load balancer |
| Keep pilot blast radius small | Hard allow-list of routes; all legacy app-data routes return 503 feature_not_available_in_private_pilot; config cannot unlock them |
| Separate YC from team policy | Two audiences (yc-reviewer, team-test); entry codes are gates, not admin grants; capabilities come from the authenticated session |
| Avoid shared-mutable “demo account” chaos | Each successful code redemption can mint a cryptographically random private tenant workspace; sample workspace is immutable/read-only |
| Limit sensitive data in the cloud | Pilot stores bounded job-filter preferences; no résumé/profile/job-history/provider prompt-output documents in the pilot design |
| Control AI unit economics early | Study-guide path rate-limited and day-spend reserved; finance contract adds hard pre-dispatch caps, content-free ledger, private budget alerts |
| Exclude high-cost / out-of-scope media features for YC | Music, AI image, enhance/upscale, image-to-video marked excluded; no provider dispatch; zero estimated/actual provider cost for those paths |
What success looks like (acceptance themes, not revenue claims)¶
- Reviewers and teammates enter only with invitation material, get isolated workspaces, and cannot open non-pilot product surface
- Spend is visible in aggregate to the finance role without user content in the ledger
- Caps and alerts fire before surprise invoices become the only signal
- Rollouts fail closed if the live security boundary (instances, concurrency, ingress, NEG) is wrong
Revenue model, pricing, and customer willingness-to-pay for a cloud SKU: TODO(verify) — not established in the two source specs.
2. What it costs to run¶
Rule for this section: dollar and percentage figures below are taken only from docs/technical/cloud-finance-usage.md where present. Anything else is TODO(verify).
Figures present in cloud-finance-usage.md¶
| Item | Figure in source | Business meaning |
|---|---|---|
| Private budget alerts | 20%, 50%, 80%, 100% of application budget, plus forecast breach | Early warning ladder to Pam and Andrew before the full app budget is consumed |
| Hard dispatch caps (dimensions) | Per workspace/day, per workspace/month, application-wide/day, application-wide/month | Multi-layer brakes; crossing a cap blocks provider dispatch |
| Auto-reload of provider prepaid balance | Off initially | No silent top-up loop in v1 of the finance plan |
| GCP budget exports/alerts | Labeled separately from application hard caps | Cloud invoice alarms ≠ WorkWingman AI dispatch brakes; GCP alerts do not stop AI dispatch |
Explicitly not stated as fixed run-cost numbers in cloud-finance-usage.md¶
| Cost line | Status |
|---|---|
| Absolute application budget in USD | TODO(verify) |
| Per-workspace daily/monthly cap USD | TODO(verify) |
| Application-wide daily/monthly cap USD | TODO(verify) |
| Cloud Run / load balancer / Firestore / Secret Manager / networking monthly bill | TODO(verify) |
Anthropic (or other provider) unit prices used for calculatedUsd |
TODO(verify) in finance doc (pricing is versioned in the design; amounts not fixed there) |
| Prepaid provider balance | Show only if official provider API exposes it; otherwise Not available from provider — not “zero” |
| Forecast method, observation window, uncertainty band | Required by dashboard design; numeric parameters TODO(verify) |
| Human ops time for secret rotation, deploy verification, council review | TODO(verify) |
Related pilot controls (documented on the Cloud Run contract, not as finance ledger totals)¶
The Cloud Run server-edition deploy shape includes study-guide operator inputs such as maximum estimated cost and maximum daily spend per that feature path. Those are pilot runtime guardrails, not a full COGS model. Do not treat them as the complete cost of “running cloud edition.” For business-model math, re-verify operator-set values and GCP bills separately: TODO(verify) as a rolled-up monthly run rate.
Cost posture summary¶
- AI spend is intended to be capped, reserved before dispatch, alerted on a percentage ladder, and ledgered without user content
- Infrastructure spend is a separate GCP signal; it must not be confused with application AI caps
- No auto-reload reduces surprise recharge loops at the provider prepaid layer
- Until the finance plan is implemented, do not claim live dashboards or live hard-cap enforcement from that specification alone
3. Risks and controls¶
3.1 Security and trust¶
| Risk | Business impact | Control (from sources) |
|---|---|---|
| Invitation code leak / brute force | Unauthorized pilot access; reputational damage with YC/team | High-entropy codes; only SHA-256 hashes in Secret Manager; rate limits; rotation/revocation; plaintext never in source/image/logs/deploy commands |
| Session theft / CSRF | Act as another pilot user | HttpOnly Secure SameSite=Strict host-only cookie; CSRF on unsafe methods; session expiry ≤ 7 days; rotate after entry/Google bind |
| Cross-tenant data bleed | Privacy incident; deal risk | Per-redemption private workspace; server-resolved context only; fail closed if missing; tests required against unscoped queries |
| Full product surface exposed early | Support burden, multi-tenant data risk, scope creep | Mechanical route allow-list; 503 for legacy routes; SPA presents locked scope |
| Over-privileged cloud identity | Blast radius on compromise | Dedicated project + runtime SA: secret accessor on named secrets, narrow Firestore role; no owner/editor; no broad deploy/storage roles |
| Secrets in images or CI history | Key compromise | Secrets via Secret Manager injection; never env-on-CLI; image/history checks; gitleaks gate handling as release blocker |
| Scaling out too early | Rate-limit ceilings multiply; abuse cost | Max instances 1, concurrency 1 enforced; live verifier fails closed otherwise |
| Side-door Cloud Run URL | Bypass intended edge policy | Ingress internal-and-cloud-load-balancing; no default URL; LB + serverless NEG topology; post-deploy boundary script |
| Finance data to wrong people | Sensitive spend intel leak | finance role server-verified, Google-bound, Pam only by design; codes/ownership/domain/client claims insufficient; Andrew alerts ≠ automatic dashboard |
| Content in cost systems | Career PII / prompts in billing tools | Content-free ledger fields only; pseudonymous workspace id; acceptance canaries for prompts/résumés/keys absent from ledger/logs/alerts/exports |
3.2 Cost and abuse¶
| Risk | Business impact | Control (from sources) |
|---|---|---|
| Unbounded AI dispatch | Bill shock | Hard caps before dispatch; concurrency-safe reserve; client cannot override; refund/correction rules must be explicit and idempotent |
| YC media features accidentally on | Large provider bills for out-of-scope demos | Excluded capabilities; no dispatch; zero cost contribution; blocked-attempt count only (content-free) |
| Confusing GCP alerts with product caps | False sense of safety or ignored signals | Separate labeling; GCP alerts do not prevent AI dispatch; app caps do |
| Alert spam / fatigue | Real thresholds ignored | Deduplicate each threshold per budget period; retries must not spam; aggregate spend + links only |
| Pricing history rewritten | Untrustworthy unit economics | Pricing versioned; calculated USD distinguishable from provider-invoiced actuals; price change → new version |
3.3 Delivery and governance¶
| Risk | Business impact | Control (from sources) |
|---|---|---|
| Deploying without authority | Governance failure | Andrew’s explicit authorization for exact target and time window |
| Shipping insecure build | Security incident | Council review, Semgrep, gitleaks evidence path, Firestore disposable integration test, read-only/non-root image validation |
| “Almost live” finance UI | Misleading operators/investors | Spec status: planned/locked; no live claim until authz implemented |
| Operator treats pilot as full SaaS | Over-commitment to customers | Desktop remains default; pilot route lock; multi-instance edition requires distributed limiter before scale-out |
3.4 Residual / open items¶
- Absolute dollar budgets and GCP monthly run rate: TODO(verify)
- Whether cloud edition becomes a paid SKU vs YC/demo-only: TODO(verify)
- Long-term multi-instance cost/performance tradeoff after distributed limiting: TODO(verify)
- Insurance, legal review, and customer DPA implications of cloud hosting: TODO(verify) (outside these two technical specs)
4. Decision framing¶
Proceed with private pilot only when:
- Release blockers in the Cloud Run contract are satisfied
- Live boundary verification passes after deploy
- Invitation and secret handling follow the out-of-band / hash-only rules
- Stakeholders accept the short menu (study guide + demo job explorer + session model)—not the full desktop product
- Finance stakeholders accept that percentage alert ladders and multi-layer caps are designed, but absolute USD budgets and live enforcement need verification/implementation status called out honestly
Do not use this document to claim production readiness, fixed monthly cloud COGS, or live finance dashboards beyond what the source specs authorize.
5. Source map¶
| Topic | Primary source |
|---|---|
| Runtime, routes, IAM, deploy shape, rate limits, release blockers | docs/technical/cloud-run-server-edition.md |
| Finance role, ledger, dashboard fields, hard caps, alerts, provider admin, acceptance gates | docs/technical/cloud-finance-usage.md |