ExoBrain — Reusable Household AI Platform
Authenticated multi-tenant household AI with isolated state, private model access, and an operator control plane.
ExoBrain — authenticated household runtime
Sanitized architecture: private implementation details are intentionally omitted; the diagram shows the control boundaries discussed in this case study.
ExoBrain is an invite-only, local-first household AI service built as a reusable host/application rather than a persona-specific runtime. It combines OIDC household authentication, isolated Account → User → Persona state, a private OpenAI-compatible model endpoint over Tailscale, account quotas/uploads/privacy flows, durable background workers, and a separately authenticated operator control plane in a controlled single-host beta topology.
01. Tenant identity is derived from authenticated principals
Protected requests authenticate the household session, revalidate account/user/persona state, and resolve the runtime from trusted principal-derived keys. Client headers, query parameters, and request bodies cannot select another tenant. Tenant state is isolated below account, user, and persona paths rather than sharing one default household runtime.
02. Household and operator control live in separate authentication realms
Household users authenticate through OIDC while the operator uses a separate administrator realm. The /admin surface controls household, session, quota, privacy, backup, and operational workflows without allowing browser-supplied identity shortcuts or arbitrary shell execution.
03. Durable workers make privacy and operations recoverable
Privacy exports and operator jobs use transactional claims, leases, bounded retries, readiness-visible health, and restart recovery. The operator worker is restricted to a closed set of server-controlled work kinds such as backup creation, backup verification, staging restore drills, feedback exports, and account deletion.
04. Online deletion is account-scoped and fail-closed
Account deletion acquires a durable operation lock, quiesces the account, revokes sessions, cancels conflicting work, evicts runtimes, stages and removes tenant state through trusted paths, deletes account-scoped records, and verifies absence while other accounts continue operating.
05. Deployment discipline is part of the product boundary
The beta topology uses Caddy TLS, loopback-only application binding, a read-only container filesystem, non-root UID, Tailscale-only model traffic, immutable image digests, exact schema checks, explicit migrations, and verified backups/restore drills. Missing or partial security configuration fails closed instead of falling back to a fake production mode.
06. Extensions contribute capabilities without granting themselves authority
Manifest-driven extensions contribute skills, adapters, MCP declarations, providers, and capability declarations. Runtime policy remains the source of authorization: extensions can describe capabilities but cannot self-grant permission. That keeps the reusable platform extensible without making plugin installation equivalent to authority escalation.
A reusable household AI host that separates tenancy, authentication, privacy, operator work, deployment, and extension policy from any one persona — allowing systems such as Della to remain specialized without forcing persona-specific semantics into the platform core.