The autonomous designer-in-residence of the Norfield VPS: every backend system on this box gets a published site, no human in the loop.

Every system on this box gets a real site, without anyone writing it

The Architect watches /opt/norfield-systems and the running containers, reads each system's own documentation, writes the page with one sandboxed model call, and publishes it end to end. No ticket, no design review, no human in the loop.

Zero tools granted Builds run in the cloud Five-minute scan loop Verified before live

What the daemon does

One hardened Node.js process on the Norfield VPS, doing the same things on a fixed loop.

Five-minute discovery

Scans /opt/norfield-systems and the running Docker containers for new or changed systems. Anything that appears or moves is picked up on the next pass.

Reads only its subject

For a given system it reads that system's own documentation — README and package.json — and nothing else, then scrubs anything secret-shaped before the text leaves the machine.

One sandboxed call

The words come from a single call to the claude CLI, granted zero tools and none of the publisher credentials. The model can only ever return text.

Strict schema gate

Returned words must be plain text: no HTML, no links, no capabilities the source documentation does not support. Copy that fails the gate is not rendered.

One audited template

Every site is rendered through the same reviewed Next.js template carrying the Norfield brand tokens. The model never supplies markup.

Builds happen in the cloud

The rendered site is pushed to a private GitHub repository and built by Cloudflare Pages. This VPS never runs a frontend build.

Proof before live

The Architect wires a real subdomain, then refuses to record the site as live until the published page provably serves its own generator marker.

From directory change to published page

1

Scan

Every five minutes, walk /opt/norfield-systems and the running Docker containers, then pick out the systems that are new or have changed since the last pass.

2

Read and scrub

Open only that system's README and package.json. Remove anything secret-shaped before a single character is handed to the model.

3

Write

Make one call to the claude CLI with zero tools and no publisher credentials. Text goes in, text comes back, and that is the whole surface.

4

Gate and render

Hold the copy to the schema — plain text, no HTML, no links, no invented capabilities — then render it through the one audited Next.js template.

5

Publish

Push to a private GitHub repository, let Cloudflare Pages build the site, and wire a real subdomain for it.

6

Verify

Fetch the published page and look for its own generator marker. Until that marker is served, the site is not recorded as live.

Signals from the loop

5 minFixed loop, always on
Discovery interval
0Text in, text out
Tools granted to the model
0Cloudflare Pages builds them
Frontend builds on this VPS
1Audited, brand tokens applied
Template every site is cut from

A pass, from the outside

root@vps — norfield-architect
$ systemctl status norfield-architect
active (running) — scan loop: every 5 minutes
$ ls /opt/norfield-systems
norfield-architect norfield-gatekeeper norfield-ledger
$ journalctl -u norfield-architect -n 6 --no-pager
scan: 3 systems seen, 1 changed since last pass
read: README.md + package.json only; secret-shaped content scrubbed
copy: schema gate passed — plain text, no links, no invented capabilities
publish: pushed to private repo; Cloudflare Pages build queued
verify: generator marker served — recorded live
$

Where the work moves

Hand-built site
Architect run
Someone has to notice the system exists and find time to write about it.
The five-minute scan notices, on the pass after the change lands.
Copy drifts away from the README as the system moves.
Copy is written from that system's own README and package.json.
Wording and markup are decided again for every site.
Words pass a schema gate; markup comes from one audited template.
Build tooling and credentials sit wherever the site gets built.
No frontend build on this VPS, and the model call holds no publisher credentials.
A site is published when a person says it is.
Live is recorded only after the page serves its own generator marker.

The shape of a run

1scan.interval = 5m
2scan.sources = /opt/norfield-systems, running docker containers
3read.allow = README, package.json (that system only)
4read.scrub = anything secret-shaped, before it leaves the machine
5copy.call = claude CLI, once
6copy.tools = none
7copy.credentials = none
8copy.schema = plain text only; no HTML; no links; no invented capabilities
9render.template = one audited Next.js template + Norfield brand tokens
10publish.repo = private GitHub repository
11build.runner = Cloudflare Pages (never on this VPS)
12live.requires = published page serves its own generator marker
The fixed rules each pass follows, stated plainly.

Five gates every page passes

Gate 1

Scrub

Only that system's README and package.json are read, and anything secret-shaped is removed before a single character leaves the machine.

Gate 2

Sandbox

One call to the claude CLI, granted zero tools and none of the publisher credentials. The only thing the model can return is text.

Gate 3

Schema

The returned copy must be plain text with no HTML, no links, and no capabilities the source documentation does not support. Failing copy is not rendered.

Gate 4

Template

Approved words go into the single audited Next.js template carrying the Norfield brand tokens. Nothing model-authored ever becomes markup.

Gate 5

Proof

After the subdomain is wired and Cloudflare Pages has built the site, it is recorded live only once the published page provably serves its own generator marker.

Questions operators ask

How quickly does a new system get a site?

Discovery runs every five minutes, so a system dropped into /opt/norfield-systems or started as a container is picked up on the next pass. Publishing then waits on the Cloudflare Pages build and on the generator marker check before the site is recorded live.

What does the model actually see?

Only that system's own documentation — its README and package.json — after secret-shaped content has been scrubbed. The call is granted zero tools, so the model cannot go and read anything else on the machine, and it is given none of the publisher credentials.

Can a generated page contain HTML or links?

No. The schema gate accepts plain text only: no HTML, no links, and no capabilities the source documentation does not support. All markup comes from the one audited Next.js template.

Does this VPS build the frontend?

No. Rendered sites are pushed to a private GitHub repository and Cloudflare Pages builds them in the cloud. The build toolchain never runs here.

What stops a broken deploy from being reported as live?

The Architect refuses to record a site as live until it can confirm the published page serves its own generator marker. Wiring the subdomain is not enough on its own.

Is a human in the loop anywhere?

Not inside a run. People own the two audited artifacts — the template and the schema — but discovery, writing, rendering, publishing and verification all happen without one.

About the Architect

The Architect is one Node.js process with a narrow job: keep the public face of every backend system on this VPS current, without asking anyone. One template, one set of brand tokens, one path from a system's own documentation to a published page. The parts that could go wrong are fenced: the model call gets zero tools and no publisher credentials, the returned words must survive a strict schema gate, the frontend build runs in Cloudflare's cloud rather than here, and a site is not recorded live until the page serves its own generator marker.