Every interesting constraint on this app comes from something that already exists next to it.
The system context table earns its place
Architecture docs in this family carry a table with four columns: the sibling or external service, the relationship, the data exchanged, and — the column people skip and shouldn't — failure behavior. Writing the failure column forces a decision that is otherwise deferred until three in the morning: when this dependency is down, does the product degrade, or stop?
For Touchstone the answers are unusually varied, and each one is a design statement.
- The Pippa brain — the assistant identity, docked as a required sidekick surface. If it is unreachable, the engine keeps serving its read surfaces. The dashboard does not need the assistant to be a dashboard.
- The portfolio app — read-only holdings for ownership badges. Failure behavior: the dashboard renders without badges; never blocks. The badge is an enrichment, and enrichments must not be able to take down the thing they enrich.
- The shared kit — the delegation queue kernel, vendored in as generated copies. Failure behavior is unusual and instructive: a drift check fails the test suite. The kernel is code, not runtime data, so its failure mode belongs in CI rather than at runtime.
- The market data providers — one paid REST provider for US data, one library for Korean and Japanese quotes, and a public macro-series source. Failure behavior: an honest error status, a staleness chip, or a last-known snapshot with its date. Never a fabricated value, never a silent swap to a different provider.
Canonical ownership, stated once
Beside the context table sits a second one that answers a sharper question: for each piece of data, who owns it, and what is this product allowed to do with it? Product identity and release version are owned by a shared manifest and only projected here. Assistant identity, conversations and memory are owned by the brain — client boundary only, never duplicated. Holdings are owned by the portfolio app — read-only badge queries, never a stored copy. Valuation snapshots, market gauges, the delegation queue and its reports are owned by this repository, and the engine is their only writer.
That last clause is the one that quietly makes a lot of things possible later: one writer. It is why a cache can be keyed on a write counter instead of a timer, why snapshots can be append-only without a coordination protocol, and why there is exactly one place to look when a number is wrong.