Sales Machine v2 — cloud architecture

Fede reviewed this page live and decided everything. What changed from the proposal:

• The cloud CAN think. The "credential lives on one Mac" premise was wrong: claude setup-token mints a long-lived subscription credential that can live in cloud secrets. Still never a metered key. The "cloud never thinks" principle below is kept as history — it no longer holds.
• Email capture → option B: the Gmail read-only login token moves into Cloudflare secrets; a scheduled Worker polls. (Not the inbound-mail subdomain.)
• Where AI thinks → inline in the Worker — the same pattern as Sparkle, the invoice Worker this architecture copies: classify, score, draft, and chat run as direct Claude calls from the Worker on the subscription token. No queue for the Mac, no container. This also unblocks chat (Decision 5) with instant answers.
• Truth → the Cloudflare database only. The nightly GitHub mirror is dropped; repo files seed the database once and become history.
• Console → option A: a real app on the Worker behind the same team login as this docs site, living in the sales-machine repo (out of propflow-docs). Static page publishes until parity.
• Unchanged: nothing outbound moves without a human yes.

Shipped the same night: the build merged after an independent ten-finding review (all fixed, boot proven locally first), and the Worker is live — board with real drag-saves, approval queue, and the inline brain answering pipeline questions on the subscription token, verified end to end in production. Still to come: the Gmail secrets onto the Worker (then the hourly inbox watcher wakes), the pretty address under the docs domain with the team login, and the one-time CI deploy token. The interim address and sign-in token live with Fede.

Three forces, all hit this week: Fede doesn't want production jobs running on his Mac mini; the email watcher we just shipped needs a scheduled home; and the board's drag-and-drop still can't save because the console is a static page with no server behind it. One cloud home fixes all three, and we already pay for the account (propflowai.co is on Cloudflare DNS; the docs site already runs on Cloudflare Pages behind Cloudflare Access).

The AI brain stays on the Mac. Our hard rule says every AI call runs on the Claude subscription — never a metered key — and that credential lives on one Mac and refreshes hourly. Cloud servers have no allowed credential to think with.

So the design principle for v2: the cloud never thinks. It receives, stores, schedules, and shows. Anything needing judgment (scoring a call, drafting a proposal, classifying a message) becomes a job in a queue that Fede's Mac picks up when it's on. Nothing outbound moves without a human yes — that floor is unchanged.

Fede wants Sean to get a ChatGPT-style experience inside the sales app — ask about any prospect, refine an outreach draft conversationally. This is the one feature that stresses Decision 2: a chat box wants answers in seconds, and the "cloud never thinks" model answers in minutes (a job queued to the Mac).

• The live DNS test for inbound mail, then the Workspace auto-copy rule (unblocks 1A).
• The Worker + database skeleton, deployed from GitHub, with the nightly git export.
• Email ingest moves to the cloud clock — the watcher we shipped this week, re-homed.
• Second signal source: the daily read of the team transcript channel — when Sean says "I'll follow up with X" in a meeting, it becomes a task on the platform.
• The board as a real app: drag saves, approval queue, live records.

Until the cloud clock exists, the email watcher stays run-on-demand — nothing gets scheduled on the Mac.