diff --git a/ai-core/knowledge/ai-skills-repos.md:Zone.Identifier b/ai-core/knowledge/ai-skills-repos.md:Zone.Identifier new file mode 100644 index 0000000..d6c1ec6 Binary files /dev/null and b/ai-core/knowledge/ai-skills-repos.md:Zone.Identifier differ diff --git a/businesses/00-sns-holding/.claude/settings.local.json b/businesses/00-sns-holding/.claude/settings.local.json new file mode 100644 index 0000000..2d58c86 --- /dev/null +++ b/businesses/00-sns-holding/.claude/settings.local.json @@ -0,0 +1,8 @@ +{ + "permissions": { + "allow": [ + "Bash(pdftotext operations_agreement_review.pdf -)", + "Bash(pdftotext \"certificate-of-organization.pdf\" -)" + ] + } +} diff --git a/businesses/00-sns-holding/branding/holdings-logo.png b/businesses/00-sns-holding/branding/holdings-logo.png new file mode 100644 index 0000000..7f4fb20 Binary files /dev/null and b/businesses/00-sns-holding/branding/holdings-logo.png differ diff --git a/businesses/00-sns-holding/branding/logo-collage.png:Zone.Identifier b/businesses/00-sns-holding/branding/logo-collage.png:Zone.Identifier new file mode 100644 index 0000000..d6c1ec6 Binary files /dev/null and b/businesses/00-sns-holding/branding/logo-collage.png:Zone.Identifier differ diff --git a/businesses/00-sns-holding/docs/IRS Apply for an Employer Identification Number (EIN) online.pdf b/businesses/00-sns-holding/docs/IRS Apply for an Employer Identification Number (EIN) online.pdf new file mode 100644 index 0000000..50ba095 Binary files /dev/null and b/businesses/00-sns-holding/docs/IRS Apply for an Employer Identification Number (EIN) online.pdf differ diff --git a/businesses/00-sns-holding/docs/certificate-of-organization.pdf b/businesses/00-sns-holding/docs/certificate-of-organization.pdf new file mode 100644 index 0000000..45c049f Binary files /dev/null and b/businesses/00-sns-holding/docs/certificate-of-organization.pdf differ diff --git a/businesses/00-sns-holding/docs/inbiz-account-setup.md b/businesses/00-sns-holding/docs/inbiz-account-setup.md new file mode 100644 index 0000000..d97a68f --- /dev/null +++ b/businesses/00-sns-holding/docs/inbiz-account-setup.md @@ -0,0 +1,17 @@ +# INBiz Account Registration — Answers on File + +Answers given during the INBiz account onboarding survey (not part of the +actual Articles of Organization filing — this is the site's account setup +questionnaire). Recorded here so the same answers can be reused/checked for +consistency when registering future subsidiaries under the same INBiz account. + +**Date:** 2026-07-27 + +| # | Question | Answer | +|---|----------|--------| +| 1 | What is your role? | Business Owner | +| 2 | Primary reason for visiting INBiz? | Start a Business | +| 3 | Which state services are you most interested in? | Start a Business (Register a business, Obtain Tax ID/FEIN) | +| 4 | Size of business (number of employees)? | 0 — Holding company has no employees; it does no operating/client work (see `docs/operating-agreement.md` §1) | +| 5 | Industry / NAICS code? | 551112 — Offices of Other Holding Companies | +| 6 | Are you an Indiana resident? | Yes — St. Joseph County | diff --git a/businesses/00-sns-holding/docs/inbiz_receipt_7_27_2026.pdf b/businesses/00-sns-holding/docs/inbiz_receipt_7_27_2026.pdf new file mode 100644 index 0000000..50fb341 Binary files /dev/null and b/businesses/00-sns-holding/docs/inbiz_receipt_7_27_2026.pdf differ diff --git a/businesses/00-sns-holding/docs/irs_CP_575_G.pdf b/businesses/00-sns-holding/docs/irs_CP_575_G.pdf new file mode 100644 index 0000000..d62652f Binary files /dev/null and b/businesses/00-sns-holding/docs/irs_CP_575_G.pdf differ diff --git a/businesses/00-sns-holding/docs/kiowa-equity-framework.md b/businesses/00-sns-holding/docs/kiowa-equity-framework.md new file mode 100644 index 0000000..66d59d4 --- /dev/null +++ b/businesses/00-sns-holding/docs/kiowa-equity-framework.md @@ -0,0 +1,133 @@ +# Kiowa Equity & Vesting Framework — Legal / Paperwork / Business-Scout Role + +> **Draft / template — not legal advice.** Working draft for LegalShield / an +> Indiana-licensed attorney and a CPA to review before granting any equity or +> having Kiowa sign anything. Items in `[brackets]` need confirmation. This +> framework is meant to be applied **fresh, per venture** — it is not a Holdings-level +> equity grant. Kiowa is **not** a Member of SnS Network Solutions Holdings LLC; +> Samuel S. James remains its sole owner (see `docs/operating-agreement.md`). + +## 1. Purpose and Scope + +This framework governs the Membership Interest granted to **`[Kiowa's full legal +name]`** ("Kiowa") in any subsidiary LLC of SnS Network Solutions Holdings LLC +("Holdings") that Kiowa originates, sources, or brings to Samuel S. James +("Sam") for launch, starting with **Foodtruck1 LLC**. It is designed to be +reused, with fresh numbers, for every future venture Kiowa brings — each +venture gets its own independent grant and vesting clock; performance on one +venture has no effect on any other. + +Kiowa's role per venture is legal/paperwork (entity formation, EIN +applications) and business sourcing/scouting. Sam's role is to secure and +contribute the venture's capital. + +## 2. The Grant + +- **Interest granted:** 15% Membership Interest in the specific subsidiary LLC. +- **Cash contribution required:** $0. Kiowa contributes no capital; the + interest is granted for services (formation work + sourcing the venture). +- **Holdings' interest:** the remaining 85% of that subsidiary is held by + Holdings, preserving Sam's ownership inside the holding structure (see + `../04-foodtruck1/requirements.md` for how this applies to Foodtruck1 + specifically). +- **Membership status:** Kiowa is admitted as a full Member (voting + + economic rights) of that subsidiary as of the **Formation Date**, subject to + the vesting and forfeiture terms in §3–§4 below. +- **Formation Date** vs. **Opening Date:** the subsidiary's Formation Date + (Articles of Organization filed) may precede its **Opening Date** (the day + the venture actually begins revenue-generating operations — e.g., the day + Foodtruck1 first serves a paying customer). The vesting clock in §3 runs + from the **Opening Date**, not the Formation Date. + `[TODO: record the actual Opening Date for each venture in that venture's + own requirements/planning doc as soon as it occurs — this date controls + the entire vesting schedule below.]` + +## 3. Vesting Schedule + +Measured from the Opening Date, cumulative net profit is tracked against +**Sam's total invested capital** in that specific venture (see §5 for both +definitions). + +| Milestone | Vests | Condition | +|---|---|---| +| 3 months | 3.75% (cumulative 3.75%) | Time-based, unconditional | +| 6 months | 3.75% (cumulative 7.50%) | Time-based, unconditional | +| 9 months | 3.75% (cumulative 11.25%) | Time-based, unconditional | +| 12 months | final 3.75% (cumulative 15.00%) | **Conditional** — only vests if cumulative net profit has reached **2x** Sam's invested capital by month 12 | + +**Acceleration.** If cumulative net profit reaches 2x Sam's invested capital +at **any point before** the 12-month mark, Kiowa's interest immediately +vests in full (15%), regardless of which quarter has or hasn't passed. + +**Forfeiture.** If cumulative net profit has **not** reached 2x Sam's +invested capital by the 12-month mark, the final 3.75% tranche is +**permanently forfeited** and reverts to Holdings. Kiowa retains whatever +vested through month 9 (up to 11.25%, depending on how many quarterly +milestones had passed). There is no later opportunity to earn the forfeited +tranche back for that venture. +`[TODO: confirm this is intended to be final/permanent, with no cure period — +that is the current design.]` + +## 4. Per-Venture Independence + +Each venture Kiowa brings gets its own grant, its own Opening Date, its own +invested-capital figure, and its own 12-month vesting clock, entirely +independent of every other venture. Underperformance (or over-performance) +on one venture has no bearing on her interest in any other. + +## 5. Definitions + +- **"Sam's invested capital"** — cumulative cash Sam or Holdings contributes + to that specific subsidiary, as recorded in that subsidiary's own capital + account (same mechanism as Holdings §6). Only actual contributed capital + counts — not the value of Sam's time, brand, or other in-kind + contributions, unless the parties agree in writing to value and include + those. +- **"Cumulative net profit"** — the venture's net profit from the Opening + Date forward. + `[TODO — CPA review: define precisely — GAAP accrual vs. cash basis, + whether Kiowa's own compensation/draws (if any) are expensed before or + after this calculation, and how it's measured/certified (e.g., monthly + bookkeeping close) so there's no dispute at the 12-month checkpoint.]` + +## 6. Tax Treatment + +`[TODO — CPA/attorney review, before any grant is made:]` +- This is intended to qualify as a **profits interest** (not a capital + interest) for federal tax purposes under Rev. Proc. 93-27 / 2001-43, so + that Kiowa does not recognize taxable income upon grant. This is most + straightforward for a brand-new venture with no existing value at grant + (e.g., Foodtruck1 pre-launch); confirm the analysis separately for any + future venture that already has value by the time Kiowa joins. +- Because the interest carries a real forfeiture condition (§3), it likely + has a "substantial risk of forfeiture" for tax purposes regardless of it + being called a full grant on day one. **Recommend Kiowa file a protective + Section 83(b) election within 30 days of each grant date** — this is a + hard IRS deadline with no extensions, and it is the single highest-stakes + item in this entire arrangement if missed. +- Confirm whether the subsidiary needs its own EIN/partnership return + implications once Kiowa is admitted (same multi-member consequences + already flagged in Holdings' own operating agreement §8). + +## 7. Relationship to Other Documents + +- Kiowa's confidentiality obligations (including access to Sam's personal + information during formation/EIN work) are governed separately by + `nda-formation-partner.md` — that NDA applies regardless of which + ventures she ends up vesting into. +- Each subsidiary's own operating agreement (e.g., Foodtruck1's, still to be + drafted) should incorporate this framework's specific numbers for that + venture as the basis of Kiowa's Membership Interest, rather than repeating + bespoke terms — this doc is the source of truth for the deal logic. +- "Maintaining her value" as a legal/paperwork/scout resource is **not** + itself a condition on the equity — it's deliberately left out of the + vesting/forfeiture mechanics because it isn't an objective, enforceable + standard. The 2x/12-month profit test is the sole trigger. If ongoing + service expectations need to be enforced separately, that belongs in a + services description, not the equity terms. + +--- + +`[TODO — attorney review: confirm this entire framework, especially the +repurchase/forfeiture mechanics and the 83(b) election timing, before +granting any interest under it.]` diff --git a/businesses/00-sns-holding/docs/kiowa-partnership-agreement.html b/businesses/00-sns-holding/docs/kiowa-partnership-agreement.html new file mode 100644 index 0000000..2535536 --- /dev/null +++ b/businesses/00-sns-holding/docs/kiowa-partnership-agreement.html @@ -0,0 +1,473 @@ + + + + + +Partnership & Equity Framework — Kiowa Scott + + + + +
+ +
+

PARTNERSHIP & EQUITY FRAMEWORK

+
SnS Network Solutions Holdings LLC — Kiowa Scott
+
+ +
+
Holding entity: SnS Network Solutions Holdings LLC
+
Managing Member: Samuel S. James (97%)
+
Partner: Kiowa Scott
+
State: Indiana
+
Effective: ________________
+
+ +
+ Not legal advice. This is a working draft for LegalShield / attorney review. + Items in [brackets] need confirmation before signing. Neither party should + rely on this document until reviewed by an Indiana-licensed attorney and CPA. +
+ + +

1. Purpose & Scope

+

This framework governs the Membership Interest granted to Kiowa Scott + ("Kiowa") in any subsidiary LLC of SnS Network Solutions Holdings LLC ("Holdings") + that Kiowa originates, sources, or manages for launch. It is applied fresh, per + venture — each venture gets its own independent grant, vesting clock, and + invested-capital figure. Performance on one venture has no effect on any other.

+

Kiowa is not a Member of Holdings itself. Samuel S. James remains Holdings' + controlling owner. This framework applies only at the subsidiary level.

+ + +

2. Kiowa's Role (Per Venture)

+ + + +

3. The Grant — Split Structure

+

Total potential equity per venture: 15% Membership Interest, split into two buckets:

+ + + + + + + + + + + + + +
BucketAmountCondition
Formation Grant5%Vests immediately on the Formation Date (date Articles of Organization are + filed). Payment for sourcing the venture and completing entity formation. No + clawback.
Service Grant10%Vests in 4 equal quarterly tranches (2.5% each) from the Opening Date, + conditional on active service (see §4).
+ +
+ Formation Date = day the subsidiary's Articles of Organization are filed with + the Indiana Secretary of State.
+ Opening Date = day the venture begins revenue-generating operations (e.g., first + paying customer). The vesting clock starts here, not the Formation Date. +
+ + +

4. Service Grant — Vesting Schedule

+

Measured from the Opening Date:

+ + + + + + + + +
MilestoneVestsCumulative TotalCondition
Formation Date5.0%5.0%Immediate — formation work complete
3 months2.5%7.5%Actively performing duties
6 months2.5%10.0%Actively performing duties
9 months2.5%12.5%Actively performing duties
12 months2.5%15.0%Actively performing duties
+ +

4.1 "Actively Performing" Defined

+

At each quarterly milestone, Kiowa must be, at minimum:

+ + +

4.2 Acceleration

+

If cumulative net profit reaches 2× Sam's invested capital at any point before + month 12, all remaining unvested service tranches vest immediately — Kiowa jumps to the + full 15%. This rewards exceptional performance without punishing normal first-year economics.

+ +

4.3 Forfeiture / Separation

+

If at any quarterly milestone Kiowa is not actively performing (she resigned, + became unresponsive, or was removed for cause), that tranche and all future tranches + do not vest. She keeps the 5% formation grant + any service tranches that already + vested. Unvested tranches revert to Holdings.

+ + + + + + + + + +
ScenarioKiowa Keeps
Quits before Opening Date (formation work done)5%
Quits at month 2 (before first service tranche)5%
Active through month 3, quits at month 57.5%
Active through month 912.5%
Active through month 1215% (fully vested)
Business hits 2× at month 7, Kiowa active15% (accelerated)
+ +

No cure period. No re-earning forfeited tranches. Final and permanent.

+ + +

5. Capital Contributions & Buy-Up Option

+

The default arrangement is that Kiowa contributes $0 cash — her equity is + earned through services. However, Kiowa may elect to invest her own capital into a + venture under the following terms:

+ +

5.1 Buy-Up Mechanics

+ + +

5.2 How the Math Works

+

If Sam invests $50,000 for Holdings' share, that $50,000 buys the "remaining" + percentage after Kiowa's service grant (85% under the default). Kiowa can buy additional + points at the same rate:

+
+ Rate per point = Sam's invested capital ÷ Sam's percentage
+ Example: $50,000 ÷ 85% = $588.24 per 1% of Membership Interest
+ Kiowa wants 10% more → contributes $5,882.35 at or before Opening Date +
+

The resulting cap table would be:

+ + + + + + +
MemberInterestCapitalHow Earned
Holdings (Sam)75%$50,000Cash investment
Kiowa (service)15%$0Formation + management (vesting)
Kiowa (capital)10%$5,882Cash investment (immediate vest)
Total100%$55,882
+ + +

6. Per-Venture Independence

+

Each venture Kiowa brings or manages gets its own:

+ +

Underperformance on one venture has no bearing on her interest in any other. + Overperformance on one does not accelerate another.

+ + +

7. Distributions

+ + + +

8. Tax Treatment

+ +
+ CPA review required before any grant: confirm profits-interest qualification, + 83(b) timing, and tiered-partnership filing mechanics between the subsidiary and Holdings. +
+ + +

9. Confidentiality

+

Kiowa's access to Sam's personal information (SSN, financial accounts, IRS + correspondence) during formation work is governed by a separate Non-Disclosure + Agreement (see nda-formation-partner.md). The NDA applies regardless + of which ventures she vests into and survives termination of any individual venture + relationship.

+ + +

10. Definitions

+ + + + + + + + + + +
TermMeaning
"Holdings"SnS Network Solutions Holdings LLC
"Sam"Samuel S. James, authorized representative of Holdings
"Kiowa"Kiowa Scott
"Formation Date"Date Articles of Organization filed with IN Secretary of State
"Opening Date"Date the venture begins revenue-generating operations
"Sam's invested capital"Cumulative cash Holdings contributes to that subsidiary
"Cumulative net profit"Venture's net profit from Opening Date forward
"Actively performing"Meeting the duties defined in §4.1
+ + +

11. Worked Examples

+ +
+

Example A — Food Truck (Service Only, No Capital Buy-Up)

+

Setup: Sam invests $60,000 in Foodtruck1 LLC (truck + build-out + working capital). + Kiowa does formation work and manages the business.

+ + + + + + + + +
EventKiowa's Vested %Holdings' %
Formation Date (Articles filed)5%95%
Opening Date (first customer served)5% (clock starts)95%
Month 3 — Kiowa active, truck doing $8K/mo revenue7.5%92.5%
Month 6 — Kiowa active, truck profitable10%90%
Month 9 — Kiowa active12.5%87.5%
Month 12 — Kiowa active, cumulative profit $45K (below 2× $60K)15%85%
+

Result: Kiowa fully vests at 15% through service alone. The 2× test wasn't hit, + so no acceleration — but she wasn't penalized either. She earned it by showing up every quarter.

+

Distributions: From month 6 onward (when truck starts netting ~$4K/mo profit), + Kiowa gets 10% × $4,000 = $400/mo in distributions (growing as her vested % increases).

+
+ +
+

Example B — Food Truck (Kiowa Invests Her Own Money)

+

Setup: Same $60,000 truck. But Kiowa believes in this one and wants more skin in + the game. She contributes $7,059 of her own cash at launch.

+

Math: Sam's rate = $60,000 ÷ 85% = $705.88 per 1%. Kiowa's $7,059 buys 10% additional.

+ + + + + + +
MemberInterestCapital InType
Holdings75%$60,000Cash
Kiowa (service)15%$0Vesting per §4
Kiowa (capital)10%$7,059Immediate (cash)
Total100%$67,059
+

Day 1 (Opening Date): Kiowa already holds 5% (formation, vested) + 10% (capital, + vested) = 15% vested immediately, earning distributions from day one. Her service + tranches continue vesting quarterly toward a max of 25% total.

+

Month 6: Kiowa active → she's now at 5% + 5% (two service tranches) + 10% (capital) + = 20% vested.

+

Month 12: Fully vested → 25% total. Holdings holds 75%.

+

Distributions at month 12: If the truck nets $6K/mo, Kiowa gets 25% × $6,000 = + $1,500/mo. Plus she gets 25% of any year-end profit distribution.

+

Why Kiowa might do this: her $7,059 investment is earning distributions from day + one (no vesting wait), and she's betting that 25% of a profitable food truck is worth far + more than $7K within a year or two. If the truck does $72K/yr net profit, her 25% = $18K/yr + return on a $7K investment. That's a 257% annual return.

+
+ +
+

Example C — Second Venture (Kiowa Scouts a Laundromat)

+

Setup: Kiowa finds a laundromat opportunity. Sam invests $120,000. Kiowa invests + $14,118 (buys another 10%). Completely separate from Foodtruck1.

+ + + + + +
MemberInterestCapital
Holdings75%$120,000
Kiowa (service)15%$0
Kiowa (capital)10%$14,118
+

Month 5: The laundromat crushes it — cumulative net profit hits $240,000 (2× Sam's + $120K). Kiowa's service tranches accelerate → she immediately jumps to 25% fully + vested. No waiting for months 6, 9, 12.

+

Meanwhile, Foodtruck1 is still on its own clock, unaffected. If it's struggling, + Kiowa's laundromat success doesn't help or hurt her food truck equity.

+
+ + +

12. Amendments

+

This framework may be amended only by written agreement signed by both Sam and Kiowa. + Each subsidiary's operating agreement incorporates this framework's terms for that + specific venture — amendments to this framework do not retroactively change terms already + locked into a signed subsidiary operating agreement.

+ + +

13. Governing Law

+

This Agreement is governed by the laws of the State of Indiana. Each subsidiary + operating agreement is also governed by Indiana law unless otherwise specified therein.

+ + +
+

Execution

+

The undersigned acknowledge and agree to this Partnership & Equity Framework as of + the Effective Date first written above.

+ +

HOLDINGS — Samuel S. James

+
+
Signature
+

Printed name: Samuel S. James

+

Title: Managing Member, SnS Network Solutions Holdings LLC

+
+
Date
+ +

PARTNER — Kiowa Scott

+
+
Signature
+

Printed name: Kiowa Scott

+
+
Date
+
+ +
+ + + + + diff --git a/businesses/00-sns-holding/docs/legal-services.md b/businesses/00-sns-holding/docs/legal-services.md new file mode 100644 index 0000000..d7aa36c --- /dev/null +++ b/businesses/00-sns-holding/docs/legal-services.md @@ -0,0 +1,22 @@ +# Legal Services — On File + +**Provider:** LegalShield +**Plan:** Legal Small Business Basic +**Membership #:** 10179059992 +**Cost:** $59.95/mo +**Enrolled:** 2026-07-27 + +## Use this for +The attorney-review items flagged throughout `docs/operating-agreement.md` / +`docs/operating-agreement.html` — currently: +- §8 Tax Treatment (classification across parent + subsidiaries) +- §9 Liability and Indemnification (scope/exceptions) +- §10 Succession on Death or Incapacity (successor order, age-40 conditions, trust + structure, Durable Power of Attorney) +- §11 Transfer of Membership Interest (economic vs. management rights, security + interests, single-member status) + +Also the intended channel for the estate-planning side of §10 (will/trust naming +Ethan and Micah's age-40 condition, trustee designation) — confirm whether the +Small Business Basic plan covers estate planning or whether that needs a separate +LegalShield add-on / referral. diff --git a/businesses/00-sns-holding/docs/nda-formation-partner.md b/businesses/00-sns-holding/docs/nda-formation-partner.md new file mode 100644 index 0000000..504ff46 --- /dev/null +++ b/businesses/00-sns-holding/docs/nda-formation-partner.md @@ -0,0 +1,154 @@ +# Non-Disclosure Agreement — Business Formation & Personal Information + +> **Draft / template — not legal advice.** Working draft for LegalShield / an +> Indiana-licensed attorney to review before either party signs. Items in +> `[brackets]` need to be filled in or confirmed with counsel. + +**Disclosing Party:** Samuel S. James, individually, and in his capacity as sole +member of SnS Network Solutions Holdings LLC ("Holdings"), on behalf of Holdings and +its current and future subsidiaries (collectively, the "Company") + +**Receiving Party:** `Kiowa Scott`, of `[address]` + +**Effective date:** `[date]` + +--- + +## 1. Purpose + +The Receiving Party is assisting the Company with (a) preparing and filing business +formation paperwork (e.g., Articles of Organization with the Indiana Secretary of +State / INBiz) for new subsidiary entities, (b) applying for Employer Identification +Numbers (EINs) with the IRS on behalf of those subsidiaries, and (c) participating as +a Member of Foodtruck1 LLC, the Company's first subsidiary venture in which the +Receiving Party holds a direct ownership interest (together, the "Purpose"). This +Agreement governs the Receiving Party's access to and use of Confidential Information +in connection with the Purpose. + +## 2. Confidential Information + +"Confidential Information" means any non-public information disclosed to or +accessed by the Receiving Party in connection with the Purpose, including without +limitation: + +- **Personal information of Samuel S. James**, including Social Security Number, + date of birth, home address, banking and financial account details, government- + issued identification numbers, and information contained in IRS or state + correspondence (e.g., EIN confirmation notices, Secretary of State filings); +- Business and financial information of Holdings and any subsidiary not yet public, + including formation plans, ownership structure, financial statements, bank account + information, contracts, and business strategy; +- For Foodtruck1 LLC specifically, any menu, recipe, supplier, pricing, staffing, or + operational information not yet public, even though the Receiving Party is a Member + of that entity — this Agreement governs the Receiving Party's obligations **to + third parties**, not access between Members themselves. + +Confidential Information does **not** include information that: (a) is or becomes +publicly available through no fault of the Receiving Party; (b) was already +lawfully known to the Receiving Party before disclosure, as shown by contemporaneous +written records; (c) is independently developed without use of the Confidential +Information; or (d) is required to be disclosed by law, court order, or government +authority, provided the Receiving Party gives the Disclosing Party prompt written +notice (where legally permitted) before disclosing. + +## 3. Obligations of the Receiving Party + +The Receiving Party shall: + +- Use Confidential Information **solely** for the Purpose; +- Not disclose Confidential Information to any third party without the Disclosing + Party's prior written consent, except as required to complete a specific filing + (e.g., submitting information to the Indiana Secretary of State or the IRS as part + of the Purpose itself); +- Protect Confidential Information with at least the same degree of care used to + protect the Receiving Party's own confidential information, and no less than + reasonable care (e.g., not storing Social Security Numbers or banking details in + unsecured files, shared drives, or unencrypted messages); +- Not use Confidential Information for the Receiving Party's own benefit or any + purpose outside the Purpose (for example, not using Samuel S. James's personal + information to open accounts, apply for credit, or take any action unrelated to + the specific filings the Receiving Party is authorized to make); +- Return or securely destroy all Confidential Information (including copies, in any + form) upon the Disclosing Party's request or upon completion of the Purpose, + whichever comes first, except for records the Receiving Party is legally required + to retain (e.g., copies of filings she submitted on the Company's behalf). + +## 4. Term + +This Agreement is effective as of the date above and continues for as long as the +Receiving Party is engaged in the Purpose, and survives termination of that +engagement: +- **Indefinitely**, with respect to Samuel S. James's personal information (SSN, + financial account details, and similar sensitive personal identifiers); and +- For **`[X years — TODO: confirm with counsel, e.g., 3–5 years]`** after the + engagement ends, with respect to all other Confidential Information. + +Termination of the Receiving Party's paperwork/formation role does not, by itself, +affect her separate rights as a Member of Foodtruck1 LLC, which are governed by that +entity's own operating agreement. + +## 5. No License; No Employment or Membership Created by This Agreement + +Nothing in this Agreement grants the Receiving Party any ownership, license, or +intellectual property rights in the Company's brand, IP, or business, except to the +extent (if any) separately granted in writing (e.g., her Membership Interest in +Foodtruck1 LLC under that entity's operating agreement). This Agreement, by itself, +does not create an employment relationship, a partnership, or membership in Holdings +or any subsidiary other than Foodtruck1. + +## 6. Remedies + +The Receiving Party acknowledges that unauthorized disclosure or use of Confidential +Information — particularly personal information such as a Social Security Number — +may cause irreparable harm for which monetary damages alone may be inadequate, and +that the Disclosing Party is entitled to seek injunctive relief in addition to any +other remedies available at law or equity. +`[TODO — attorney review: confirm remedies clause and consider whether a liquidated +damages provision is appropriate given the sensitivity of SSN/personal financial data.]` + +## 7. Governing Law + +This Agreement is governed by and construed in accordance with the laws of the +**State of Indiana**, without regard to conflict-of-law principles. + +## 8. Miscellaneous + +- **Entire agreement.** This Agreement constitutes the entire understanding between + the parties regarding confidentiality of the information described above and + supersedes any prior oral or written understanding on that subject. +- **Amendment.** This Agreement may only be amended in a writing signed by both + parties. +- **Severability.** If any provision is held invalid or unenforceable, the remaining + provisions remain in full force and effect. +`[TODO — attorney review: consider whether this NDA should instead be incorporated +into (or accompanied by) a broader services/independent-contractor agreement covering +her paperwork/formation role, separate from her rights as a Foodtruck1 Member, which +belong in Foodtruck1's own operating agreement.]` + +--- + +## Execution + +**DISCLOSING PARTY** + +Signature: ______________________________________ + +Printed name: **Samuel S. James**, individually and on behalf of SnS Network +Solutions Holdings LLC + +Date: ______________________________________ + +
+ +**RECEIVING PARTY** + +Signature: ______________________________________ + +Printed name: **`Kiowa Scott`** + +Date: ______________________________________ + +
+ +*Prepared as a working draft. Review with an Indiana-licensed attorney (e.g., via +LegalShield — see `legal-services.md`) before either party signs.* diff --git a/businesses/00-sns-holding/docs/operating-agreement.html b/businesses/00-sns-holding/docs/operating-agreement.html new file mode 100644 index 0000000..3e86bd7 --- /dev/null +++ b/businesses/00-sns-holding/docs/operating-agreement.html @@ -0,0 +1,448 @@ + + + + + +Amended and Restated Operating Agreement — SnS Network Solutions Holdings LLC + + + + +
+ +
+ SnS Network Solutions Holdings LLC +
+

AMENDED AND RESTATED OPERATING AGREEMENT

+
SnS Network Solutions Holdings LLC
+
+
+ +
+
Entity type: Multi-Member LLC
+
State of formation: Indiana
+
EIN: 42-4099038
+
Effective date: July 28, 2026
+
+ +

1. Formation and Purpose

+

This Amended and Restated Operating Agreement (the "Agreement") is entered into by the + undersigned Members, Samuel S. James, Annie Deondria Chatman, and + Richard E. Williams (each a "Member" and collectively the "Members"), to govern + the operations of SnS Network Solutions Holdings LLC, a limited liability + company organized under the Indiana Business Flexibility Act (Indiana Code § 23-18). + This Agreement amends and restates the Company's original single-member operating + agreement in full, admitting Annie Deondria Chatman and Richard E. Williams as Members + effective as of the date above.

+

The Company is formed to act as a holding company. Its primary purpose is to own, + manage, and oversee its subsidiary entities and other business interests. The Company + is not intended to engage in operating or client-facing business, and the Members shall + conduct the Company's affairs so as to avoid incurring operating liabilities directly. + This statement of intent does not by itself eliminate or limit any liability the Company + may actually incur under law; nothing in this Agreement should be relied upon as a + guarantee against liability.

+ +

2. Registered Office and Registered Agent

+ +

Samuel S. James, as the Member serving in this role, may change the principal office + or registered agent at any time, consistent with Indiana filing requirements. Serving as + one's own registered agent requires being reliably available at the registered office + during business hours to accept service of process; if that stops being practical + (e.g., due to travel, relocation, or incapacity), the Members shall promptly appoint a + commercial registered agent service and update the designation on file with the Indiana + Secretary of State.

+ +

3. Members and Ownership

+

The Company has three Members, holding the following Membership Interests:

+ + + + + + + + + + + + + + +
MemberMembership Interest
Samuel S. James97%
Annie Deondria Chatman1%
Richard E. Williams2%
+

Each Member is admitted with full membership rights — voting, management + participation, and economic rights (allocations and distributions) — in proportion to + their Membership Interest, except as otherwise stated in this Agreement. Allocations of + profit and loss for tax purposes are made in proportion to each Member's Membership + Interest, unless the Members otherwise agree in writing and as permitted by applicable + economic-substance and tax requirements.

+

Confirm capital account and tax-allocation mechanics for the new Membership + Interests, including whether any special allocations or a formal capital contribution is + being made by Annie or Richard in exchange for their interest.

+ +

4. Management

+

The Company shall be Member-managed. Each Member has voting rights in + proportion to their Membership Interest as set out in §3. Except as otherwise stated in + this Agreement, actions and decisions of the Company require the approval of Members + holding a majority of the Membership Interests. Because Samuel S. James holds + 97% of the Membership Interests, he retains sole authority to approve or reject any + Company decision, including, without limitation:

+ +

Samuel S. James is designated the Company's day-to-day managing Member, with + authority to conduct ordinary business on the Company's behalf without a separate vote + of the other Members, subject to the majority-approval requirement above for major + decisions (e.g., admitting members, encumbering or selling material assets, or + dissolving the Company).

+

Confirm whether "major decisions" should be enumerated more specifically, and + whether Annie and Richard should have any consent rights notwithstanding their minority + interest (e.g., on related-party transactions or amendments affecting their own + interest).

+ +

5. Subsidiary Management

+

The Company is authorized to form, acquire, and hold interests in subsidiary limited + liability companies and other entities. The Company shall act as the sole member + (or controlling owner) of such subsidiaries so that the parent–subsidiary relationship + is clearly maintained.

+

To preserve limited-liability protection for the Company, the Members, and each + subsidiary, the managing Member shall:

+ + +

6. Capital Contributions and Distributions

+ + +

7. Bank Accounts, Books, and Records

+ + +

8. Tax Treatment

+

With the admission of Annie Deondria Chatman and Richard E. Williams as Members, the + Company is no longer a single-member LLC. By default, a multi-member LLC is treated as + a partnership for U.S. federal income tax purposes; each Member reports their + proportionate share of income and expense (per §3) on their individual return via a + Schedule K-1. The Members may elect a different classification (for example, taxation + as a corporation) by filing the appropriate IRS election. The best classification for + the Company depends on the overall tax strategy across the Company and its + subsidiaries, not this entity in isolation.

+

Confirm tax treatment and any elections given the Company's new multi-member + status; confirm whether Annie's and Richard's interests are capital interests or + profits interests, since the tax treatment of granting an equity interest for services + differs from a purchased/contributed interest; confirm whether a new EIN or a + partnership representative designation (BBA audit regime) is required; a partnership + tax return (Form 1065) will likely now be required in addition to/instead of prior + disregarded-entity reporting.

+ + +

9. Liability and Indemnification

+

To the fullest extent permitted by Indiana law:

+ +

Confirm this indemnification scope and its exceptions are consistent with Indiana + law and the Members' intended risk allocation; scope may need further tightening.

+ +

10. Succession on Death or Incapacity

+

+ In this section, "the Member" refers specifically to Samuel S. James, whose death or + incapacity triggers the succession provisions below — not to Annie or Richard in their + capacity as Members under §3. Decide: this section does not yet address what happens to + Annie's or Richard's own 1%/2% Membership Interest if one of them dies or becomes + incapacitated (e.g., does it pass to their estate, get bought out by the Company, or + pass to the other successor?). Revisit this with counsel before finalizing.

+

Base order of succession (applies to incapacity — see Death below for a modified + order that applies on death). Successors are considered in this order, skipping any + successor who is unavailable, unwilling, or (for Ethan and Micah, per the age condition + below) not yet eligible:

+
    +
  1. Annie Deondria Chatman
  2. +
  3. Richard E. Williams
  4. +
  5. Ethan Nathaniel James (the Member's son) — eligible only upon reaching age 40
  6. +
  7. Micah Daniel James (the Member's son) — eligible only upon reaching age 40
  8. +
+

Incapacity. Upon the Member's incapacity, the first eligible successor in the + base order above shall act as successor manager of the Company — with full + authority to manage bank accounts, subsidiaries, and Company affairs — until the Member is + no longer incapacitated. Annie and Richard rank ahead of Ethan and Micah for this purpose + regardless of the sons' age. This provision alone may not be sufficient for banks or third + parties to recognize that authority; it should be backed by a Durable Power of + Attorney naming the same successor(s) in the same order. Draft/execute a Durable + Power of Attorney consistent with this section.

+

Death. Upon the Member's death, the base order above is modified: any of Ethan or + Micah who has already reached age 40 at the time of the Member's death ranks + ahead of Annie and Richard, in their original relative order (Ethan ahead of Micah). + Annie and Richard follow immediately after any such eligible son(s). A son who has + not yet reached age 40 at the time of the Member's death is unaffected by this + reordering and remains subject to the trust provision below.

+

+ Example: both sons 40+ at death → order is Ethan, Micah, Annie, Richard. Only Micah is + 40+ → order is Micah, Annie, Richard, then Ethan (in trust until 40). Neither son is 40+ → + order remains Annie, Richard, then each son upon reaching 40 (held in trust until then).

+

The first eligible successor under this death order is admitted as a member with the + same rights the Member held. Because Ethan and Micah are not eligible until age 40, if + either is in line but under 40 at the time of the Member's death, their interest shall + be held in trust for their benefit until they reach age 40, administered by a trustee + named in the Member's estate plan (rather than held directly under this Agreement). This + requires a trust structure in the Member's will/estate plan — coordinate this section, the + successor order, and the trustee designation with an estate planning attorney.

+

The Company shall not dissolve solely because of the Member's death or + incapacity, and shall continue under the successor(s) determined above.

+ +

11. Transfer of Membership Interest

+ +

Confirm transfer/security-interest mechanics with an Indiana attorney and CPA, and + consider whether a right of first refusal or other transfer restriction should apply to + Annie's and Richard's interests before any transfer is attempted.

+ +

12. Amendments

+

This Agreement may be amended only by a written instrument signed by all + Members. Amendments are effective on the date stated in the amendment.

+

Confirm whether unanimous consent (as stated) or a majority-in-interest vote + should govern future amendments, including amendments that would change a Member's own + percentage interest.

+ +

13. Dissolution

+

The Company shall continue in perpetuity unless dissolved by:

+ +

Upon dissolution, the Company's assets shall be applied first to creditors (including any + Member, if owed), then distributed to the Members pro rata in proportion to their + Membership Interests, after which Articles of Dissolution shall be filed with the + Indiana Secretary of State.

+ +

14. Governing Law and Severability

+

This Agreement is governed by and construed in accordance with the laws of the State of + Indiana. If any provision is held invalid or unenforceable, the remaining provisions + remain in full force and effect.

+ +

15. Definitions

+
+
"Company"
SnS Network Solutions Holdings LLC.
+
"Member"
each of Samuel S. James, Annie Deondria Chatman, and Richard E. Williams, and any successor or additional member admitted under this Agreement.
+
"Membership Interest"
a Member's ownership, economic, and (unless limited) management rights in the Company, expressed as a percentage per §3.
+
"Subsidiary"
any entity in which the Company holds a controlling or sole-member interest.
+
+ +
+

Execution

+

The undersigned, being all of the Members of SnS Network Solutions Holdings LLC, + adopt and agree to this Amended and Restated Operating Agreement as of the Effective + Date first written above.

+ +

MEMBER — 97% Membership Interest

+ +
+
Signature
+ +

Printed name: Samuel S. James

+ +
+
Date
+ +

MEMBER — 1% Membership Interest

+ +
+
Signature
+ +

Printed name: Annie Deondria Chatman

+ +
+
Date
+ +

MEMBER — 2% Membership Interest

+ +
+
Signature
+ +

Printed name: Richard E. Williams

+ +
+
Date
+
+ +
+ + + + + diff --git a/businesses/00-sns-holding/docs/operations_agreement_review.pdf b/businesses/00-sns-holding/docs/operations_agreement_review.pdf new file mode 100644 index 0000000..c221d88 Binary files /dev/null and b/businesses/00-sns-holding/docs/operations_agreement_review.pdf differ diff --git a/businesses/03-support/branding/logo-desgin.png:Zone.Identifier b/businesses/03-support/branding/logo-desgin.png:Zone.Identifier new file mode 100644 index 0000000..d6c1ec6 Binary files /dev/null and b/businesses/03-support/branding/logo-desgin.png:Zone.Identifier differ diff --git a/businesses/README.md b/businesses/README.md index 52c58f4..9eb607b 100644 --- a/businesses/README.md +++ b/businesses/README.md @@ -1,35 +1,66 @@ -# Businesses +# SnS Network Solutions Holdings LLC — Corporate Structure -The **parent holding company** plus its **operating subsidiaries**. `divisions/` -holds the formal one-page briefs; the working scaffold, research, todo, branding, -and (later) milestones live here. +**Sole Member:** Samuel S. James +**State:** Indiana +**EIN:** 42-4099038 -## Parent (holding company — not an operating business) +``` +Samuel S. James (Sole Member) +│ +└── SnS Network Solutions Holdings LLC + │ + ├── SnS Technology Group LLC + │ ├── SnS Network Solutions LLC (networking, cabling, managed networking) + │ ├── SnS Secure LLC (cybersecurity, monitoring, compliance) + │ └── SnS Support LLC (IT help desk, managed support, break-fix) + │ + ├── SnS Hospitality Group LLC ← Kiowa Scott holds 15% (vested) + │ ├── Coffee Trailers (10 mobile drive-through locations — NW IN + S. Michigan) + │ └── Indian Food Truck (pending staff proposal) + │ + └── SnS Properties LLC + ├── Warehouse Property LLC (commercial/industrial — commissary, storage) + └── Rental Property LLC (residential or commercial rental income) +``` -| Folder | Entity | Accent | Role | -|--------|--------|--------|------| -| [`00-sns-holding/`](./00-sns-holding/) | SnS Network Solutions Holdings LLC | Parent Cyan `#10C8D8` | Owns the brand + 100% of every subsidiary; no client work, no operating liability | +## Directory Layout -## Operating subsidiaries +``` +businesses/ +├── 00-sns-holding/ Holdings legal, branding, EIN, formation docs +│ +├── sns-technology-group/ SnS Technology Group LLC +│ ├── sns-network-solutions-llc/ +│ ├── sns-secure-llc/ +│ └── sns-support-llc/ +│ +├── sns-hospitality-group/ SnS Hospitality Group LLC (Sam 85% / Kiowa 15%) +│ ├── docs/ Partnership agreement, NDA, equity framework +│ ├── coffee-trailers/ 2-year plan, 10 locations, financials +│ └── indian-food-truck/ Pending proposal +│ +└── sns-properties-llc/ SnS Properties LLC + ├── warehouse-property/ + └── rental-property/ +``` -| # | Business | Tagline | Accent | Combines (former divisions) | Status | -|---|----------|---------|--------|----------------------------|--------| -| [01](./01-networking/) | SNS Networking | The Connected Foundation | Signal Blue `#1E6FFF` | Infrastructure + Secure + Systems | **Active** | -| [02](./02-digital/) | SNS Digital | Engineered for the Cloud | Sky `#38BDF8` | Web + Software + Cloud | Planned | -| [03](./03-support/) | SNS Support | Always On | Orange `#F97316` | Unchanged | Planned | +## Key Principles -## Why 3 instead of 7 +- **Holdings = sole member (Sam only)** — no other members at the holding level +- **Kiowa's 15% is at the Hospitality Group level** — she participates in ALL mobile ventures under that group +- **All Hospitality ventures are mobile/trailer-based** — low investment, low overhead, no brick-and-mortar +- **Each group LLC is a liability silo** — a loss in one group cannot reach another +- **Properties leases to siblings** — if Properties owns a commissary, Hospitality leases it (keeps real estate insulated from operating risk) +- **Form entities when needed** — don't pay filing fees on shells with no revenue or liability -- **Networking** covers everything physical + on-prem: same job site, same skill set, - same insurance pool (GL + cyber E&O). Cabling, firewalls, cameras, and servers are - one delivery team. -- **Digital** covers everything remote/code/cloud: same delivery model (keyboard, not - ladder), same insurance category (professional E&O). Cloud infra, websites, and - custom apps are one team. -- **Support** stays separate: it's the only division with recurring-revenue SLAs and a - different contract structure (ongoing responsibility vs. project-and-done). +## Kiowa Scott — Partnership Summary -## Folder contents - -Each folder contains: a scaffold/todo doc, branding assets, and working documents. -Milestones get added once the plan is set. +| Term | Detail | +|------|--------| +| Entity | SnS Hospitality Group LLC | +| Interest | 15% (permanent after 12-month vesting) | +| Capital contributed | $0 | +| Role | Find locations, manage legal/permits, keep trailers profitable | +| If she stops working | Loses management authority, keeps 15% economic rights (passive) | +| Territory | NW Indiana and Southern Michigan | +| Full agreement | `sns-hospitality-group/docs/kiowa-partnership-agreement.html` | diff --git a/businesses/sns-corporate-structure.html b/businesses/sns-corporate-structure.html new file mode 100644 index 0000000..f6ef29b --- /dev/null +++ b/businesses/sns-corporate-structure.html @@ -0,0 +1,350 @@ + + + + + +SnS Network Solutions Holdings LLC — Corporate Structure + + + + +
+ +
+

CORPORATE STRUCTURE

+
SnS Network Solutions Holdings LLC
+
+ +
+
Sole Member: Samuel S. James
+
State: Indiana
+
EIN: 42-4099038
+
Effective: July 2026
+
+ + +
+
Samuel S. James — Sole Member
+
+
SnS Network Solutions Holdings LLC
+
+ +
+
+

SnS Technology Group LLC

+
    +
  • SnS Network Solutions LLC PLANNED
  • +
  • SnS Secure LLC PLANNED
  • +
  • SnS Support LLC PLANNED
  • +
+
+ +
+

SnS Hospitality Group LLC

+
Kiowa Scott — 15%
+
    +
  • Coffee Trailers (×10) ACTIVE
  • +
  • Indian Food Truck PENDING
  • +
+
+ +
+

SnS Properties LLC

+
    +
  • Warehouse Property LLC PLANNED
  • +
  • Rental Property LLC PLANNED
  • +
+
+
+
+ + +

Entity Summary

+ + + + + + + + + + + + + + + + + + + + + + + + + + +
EntityPurposeMembersStatus
SnS Network Solutions Holdings LLCHolding company — owns and oversees all subsidiariesSamuel S. James (100%)FORMED
SnS Technology Group LLCIT networking, cybersecurity, managed support servicesHoldings (100%)PLANNED
SnS Hospitality Group LLCMobile/trailer-based food & beverage venturesHoldings (85%) + Kiowa Scott (15%)FORMING
SnS Properties LLCReal estate — warehouse, commissary, rental incomeHoldings (100%)PLANNED
+ + +

SnS Hospitality Group — Venture Detail

+ + + + + + + + + + + + + + + + +
VentureModelTargetInvestment/UnitStatus
Coffee TrailersMobile drive-through, high-traffic lots10 locations — NW Indiana + Southern Michigan$50K first / $35K each after2-YEAR PLAN
Indian Food TruckMobile food trailerTBD — awaiting staff proposalTBDPENDING
+ + +

Partnership — Kiowa Scott

+ + + + + + + + + + +
TermDetail
EntitySnS Hospitality Group LLC
Interest15% — permanent after 12-month vesting
Capital$0 (service equity only)
Vesting5% immediate (formation) + 2.5%/quarter × 4 quarters
RoleFind locations, manage permits/legal, keep operations profitable
TerritoryNW Indiana and Southern Michigan
If she stopsLoses management authority; keeps 15% economic rights (passive member)
Agreementkiowa-partnership-agreement.html (in sns-hospitality-group/docs/)
+ + +

Structural Principles

+
+
Sole ownership at top. Sam is the only member of Holdings. No partners at the holding level.
+
Group = liability silo. Each group LLC walls off its risk from the others.
+
Mobile only (Hospitality). All ventures are trailer-based. Low cost, low overhead, no leases.
+
Properties leases to siblings. Real estate stays separate from operating risk.
+
Form when needed. Don't file entities until they have revenue or liability.
+
Partner equity at group level. Kiowa's 15% covers all Hospitality ventures, not just one.
+
+ + +

Coffee Trailer — Financial Snapshot

+ + + + + + + +
MetricPer Trailer10 Trailers (Year 2 full)
Investment$35,000-50,000~$400,000 total deployed
Revenue (100 customers × $8 × 312 days)$249,600/yr$2,496,000/yr
Net profit$140,592/yr$1,405,920/yr
Sam's 85% (after ~35% tax)$77,700/yr$777,000/yr
Kiowa's 15% (after ~35% tax)$13,700/yr$137,000/yr
+ +
+ + + + + diff --git a/businesses/sns-hospitality-group/README.md b/businesses/sns-hospitality-group/README.md new file mode 100644 index 0000000..3efda65 --- /dev/null +++ b/businesses/sns-hospitality-group/README.md @@ -0,0 +1,47 @@ +# SnS Hospitality Group LLC + +**Parent:** SnS Network Solutions Holdings LLC (85%) +**Partner:** Kiowa Scott (15% — vested, permanent after Year 1) +**Focus:** Mobile/trailer-based food & beverage ventures +**Territory:** NW Indiana and Southern Michigan + +## Membership + +| Member | Interest | Type | +|--------|----------|------| +| SnS Network Solutions Holdings LLC | 85% | Capital + control | +| Kiowa Scott | 15% | Service equity (fully vested after 12 months) | + +## Kiowa's Role +- Finding and securing high-traffic parking spots / locations +- Managing legal compliance, permits, renewals across all locations +- Overseeing day-to-day operations (hiring, scheduling, vendor relationships) +- Ensuring profitability of the mobile fleet + +## Kiowa's Equity Terms +- **5% formation grant** — vests immediately when the group is formed +- **10% service grant** — vests quarterly (2.5% per quarter) over 12 months from Opening Date +- **Permanent ownership** — once vested, the 15% is hers regardless of future involvement +- **If she stops working:** loses management authority (no decisions, no signing power) but retains economic rights (15% of distributions as a passive member) +- **Incentive alignment:** distributions only exist if the trailers are profitable; profitability requires active management + +## Ventures + +### Coffee Trailers (ACTIVE — 2-year plan) +- **Target:** 10 mobile drive-through coffee trailer locations +- **Model:** Low-cost enclosed trailers + commercial espresso equipment +- **Investment per unit:** ~$25,000 (used trailer + buildout + equipment) +- **Revenue target:** 100 customers/day × $8 avg × 6 days/wk × 312 days/yr +- **Territory:** High-traffic lots (Walmart, Chick-fil-A, gas stations, Notre Dame area) +- See `coffee-trailers/` for business plan and financials + +### Indian Food Truck (PENDING) +- Awaiting proposal from Indian staff +- See `indian-food-truck/` when ready + +## Future Ventures (not yet formed) +All future Hospitality ventures will be mobile/trailer-based. Examples: +- Smoothie/juice trailer +- BBQ trailer +- Dessert/ice cream trailer +- Mobile bar (events) diff --git a/businesses/sns-hospitality-group/coffee-trailers/README.md b/businesses/sns-hospitality-group/coffee-trailers/README.md new file mode 100644 index 0000000..2e9f448 --- /dev/null +++ b/businesses/sns-hospitality-group/coffee-trailers/README.md @@ -0,0 +1,107 @@ +# Coffee Trailers — 2-Year Business Plan + +**Entity:** Operates under SnS Hospitality Group LLC +**Concept:** Mobile drive-through coffee trailers in high-traffic parking lots +**Target:** 10 locations across NW Indiana and Southern Michigan +**Manager:** Kiowa Scott (finding spots, keeping them legal, keeping them profitable) + +## Investment Per Trailer + +| Item | Cost | +|------|------| +| Used enclosed trailer (8' × 14-16') | $6,000-9,000 | +| Buildout (window, plumbing, electric, counters, flooring) | $10,000 | +| Espresso machine (Nuova Simonelli Appia Life 2-group) | $9,000 | +| Grinder (Eureka Atom 75) | $2,000 | +| Blender, fridge, ice machine | $2,500 | +| POS + tablet | $800 | +| Signage + branding wrap | $2,500 | +| Permits, insurance, health dept | $2,000 | +| **Subtotal (trailer + equipment)** | **~$35,000** | +| 3 months operating reserve (marketing + ramp-up) | $15,000 | +| **Total per trailer (first unit)** | **~$50,000** | + +Subsequent trailers (no ramp-up reserve needed if cash-flowing): **~$35,000 each** + +## Revenue Model + +| Metric | Target | +|--------|--------| +| Customers/day | 100 (target), 120 (above average) | +| Average ticket | $8 | +| Operating days/yr | 312 (6 days/wk, 52 weeks — coffee is winter-proof) | +| Daily revenue | $800-960 | +| Monthly revenue (26 days) | $20,800-24,960 | +| Annual revenue per trailer | $249,600-299,520 | + +## Costs Per Trailer (Monthly) + +| Item | Cost | +|------|------| +| Labor (1 FT barista $16/hr + 1 PT $12/hr, loaded) | $3,616 | +| Trailer payment (if financed) | $626 | +| Workers' Comp | $80 | +| GL insurance | $42 | +| Commercial Auto | $120 | +| Lot lease (parking spot agreement) | $750 | +| Water/commissary | $200 | +| POS/software | $80 | +| Fuel/propane | $150 | +| Misc/repairs | $300 | +| **Total fixed** | **$5,964/mo** | +| Supply cost (coffee, milk, cups — 15% of revenue) | ~$3,120-3,744 | +| **Total monthly cost** | **$9,084-9,708** | + +## Profit Per Trailer + +| Performance | Monthly Profit | Annual Profit | +|-------------|---------------|---------------| +| Average (100/day) | $11,716 | $140,592 | +| Above average (120/day) | $15,252 | $183,024 | +| Strong (150/day) | $20,556 | $246,672 | + +## 2-Year Rollout Plan + +| Timeline | Trailers Open | Monthly Combined Profit | Notes | +|----------|--------------|------------------------|-------| +| Month 1-3 | 1 | $11,716 (ramp-up, may be lower) | Marketing heavy, building regulars | +| Month 4-6 | 2 | $23,432 | Trailer #2 funded by #1's profit | +| Month 7-9 | 3 | $35,148 | | +| Month 10-12 | 4 | $46,864 | | +| Month 13-15 | 5-6 | $58,580-70,296 | | +| Month 16-18 | 7-8 | $82,012-93,728 | | +| Month 19-24 | 9-10 | $105,444-117,160 | | + +## End of Year 2 (10 trailers, all at average) + +| | Annual | +|---|---| +| Combined revenue | $2,496,000 | +| Combined profit | **$1,405,920** | +| Sam's 85% after tax (35%) | **$777,021** | +| Kiowa's 15% after tax | **$137,077** | + +## Location Strategy + +**Target spots (NW Indiana + Southern Michigan):** +- Walmart / Meijer parking lots +- Near Chick-fil-A, McDonald's (capture their traffic, no coffee competition) +- Gas station lots on US-31, US-20, I-94 corridor +- Notre Dame campus perimeter (game days = 80,000+ people) +- Hospital/medical center parking areas (staff need coffee at 5am) +- Industrial parks (factory shift changes) +- Church parking lots (Mon-Sat) + +**How to secure spots:** +- Approach property managers (not tenants) with a lease proposal: $500-1,000/mo +- Walmart has a formal vendor/lease program in some locations +- Start with 1 great spot, prove the concept, use that track record to pitch the next + +## Why Coffee Trailers Win in Winter + +- Hot drinks = HIGHER demand in cold weather +- Drive-through window = customers stay in their car +- Commercial lots (Walmart, etc.) are plowed/salted first +- No food spoilage, no grease, no complex health dept issues +- Only true shutdown: blizzard days where nobody leaves home (5-10 days/yr max) +- Compare to food trucks: dead 4-6 weeks in Midwest winter diff --git a/businesses/sns-hospitality-group/docs/kiowa-equity-framework.md b/businesses/sns-hospitality-group/docs/kiowa-equity-framework.md new file mode 100644 index 0000000..66d59d4 --- /dev/null +++ b/businesses/sns-hospitality-group/docs/kiowa-equity-framework.md @@ -0,0 +1,133 @@ +# Kiowa Equity & Vesting Framework — Legal / Paperwork / Business-Scout Role + +> **Draft / template — not legal advice.** Working draft for LegalShield / an +> Indiana-licensed attorney and a CPA to review before granting any equity or +> having Kiowa sign anything. Items in `[brackets]` need confirmation. This +> framework is meant to be applied **fresh, per venture** — it is not a Holdings-level +> equity grant. Kiowa is **not** a Member of SnS Network Solutions Holdings LLC; +> Samuel S. James remains its sole owner (see `docs/operating-agreement.md`). + +## 1. Purpose and Scope + +This framework governs the Membership Interest granted to **`[Kiowa's full legal +name]`** ("Kiowa") in any subsidiary LLC of SnS Network Solutions Holdings LLC +("Holdings") that Kiowa originates, sources, or brings to Samuel S. James +("Sam") for launch, starting with **Foodtruck1 LLC**. It is designed to be +reused, with fresh numbers, for every future venture Kiowa brings — each +venture gets its own independent grant and vesting clock; performance on one +venture has no effect on any other. + +Kiowa's role per venture is legal/paperwork (entity formation, EIN +applications) and business sourcing/scouting. Sam's role is to secure and +contribute the venture's capital. + +## 2. The Grant + +- **Interest granted:** 15% Membership Interest in the specific subsidiary LLC. +- **Cash contribution required:** $0. Kiowa contributes no capital; the + interest is granted for services (formation work + sourcing the venture). +- **Holdings' interest:** the remaining 85% of that subsidiary is held by + Holdings, preserving Sam's ownership inside the holding structure (see + `../04-foodtruck1/requirements.md` for how this applies to Foodtruck1 + specifically). +- **Membership status:** Kiowa is admitted as a full Member (voting + + economic rights) of that subsidiary as of the **Formation Date**, subject to + the vesting and forfeiture terms in §3–§4 below. +- **Formation Date** vs. **Opening Date:** the subsidiary's Formation Date + (Articles of Organization filed) may precede its **Opening Date** (the day + the venture actually begins revenue-generating operations — e.g., the day + Foodtruck1 first serves a paying customer). The vesting clock in §3 runs + from the **Opening Date**, not the Formation Date. + `[TODO: record the actual Opening Date for each venture in that venture's + own requirements/planning doc as soon as it occurs — this date controls + the entire vesting schedule below.]` + +## 3. Vesting Schedule + +Measured from the Opening Date, cumulative net profit is tracked against +**Sam's total invested capital** in that specific venture (see §5 for both +definitions). + +| Milestone | Vests | Condition | +|---|---|---| +| 3 months | 3.75% (cumulative 3.75%) | Time-based, unconditional | +| 6 months | 3.75% (cumulative 7.50%) | Time-based, unconditional | +| 9 months | 3.75% (cumulative 11.25%) | Time-based, unconditional | +| 12 months | final 3.75% (cumulative 15.00%) | **Conditional** — only vests if cumulative net profit has reached **2x** Sam's invested capital by month 12 | + +**Acceleration.** If cumulative net profit reaches 2x Sam's invested capital +at **any point before** the 12-month mark, Kiowa's interest immediately +vests in full (15%), regardless of which quarter has or hasn't passed. + +**Forfeiture.** If cumulative net profit has **not** reached 2x Sam's +invested capital by the 12-month mark, the final 3.75% tranche is +**permanently forfeited** and reverts to Holdings. Kiowa retains whatever +vested through month 9 (up to 11.25%, depending on how many quarterly +milestones had passed). There is no later opportunity to earn the forfeited +tranche back for that venture. +`[TODO: confirm this is intended to be final/permanent, with no cure period — +that is the current design.]` + +## 4. Per-Venture Independence + +Each venture Kiowa brings gets its own grant, its own Opening Date, its own +invested-capital figure, and its own 12-month vesting clock, entirely +independent of every other venture. Underperformance (or over-performance) +on one venture has no bearing on her interest in any other. + +## 5. Definitions + +- **"Sam's invested capital"** — cumulative cash Sam or Holdings contributes + to that specific subsidiary, as recorded in that subsidiary's own capital + account (same mechanism as Holdings §6). Only actual contributed capital + counts — not the value of Sam's time, brand, or other in-kind + contributions, unless the parties agree in writing to value and include + those. +- **"Cumulative net profit"** — the venture's net profit from the Opening + Date forward. + `[TODO — CPA review: define precisely — GAAP accrual vs. cash basis, + whether Kiowa's own compensation/draws (if any) are expensed before or + after this calculation, and how it's measured/certified (e.g., monthly + bookkeeping close) so there's no dispute at the 12-month checkpoint.]` + +## 6. Tax Treatment + +`[TODO — CPA/attorney review, before any grant is made:]` +- This is intended to qualify as a **profits interest** (not a capital + interest) for federal tax purposes under Rev. Proc. 93-27 / 2001-43, so + that Kiowa does not recognize taxable income upon grant. This is most + straightforward for a brand-new venture with no existing value at grant + (e.g., Foodtruck1 pre-launch); confirm the analysis separately for any + future venture that already has value by the time Kiowa joins. +- Because the interest carries a real forfeiture condition (§3), it likely + has a "substantial risk of forfeiture" for tax purposes regardless of it + being called a full grant on day one. **Recommend Kiowa file a protective + Section 83(b) election within 30 days of each grant date** — this is a + hard IRS deadline with no extensions, and it is the single highest-stakes + item in this entire arrangement if missed. +- Confirm whether the subsidiary needs its own EIN/partnership return + implications once Kiowa is admitted (same multi-member consequences + already flagged in Holdings' own operating agreement §8). + +## 7. Relationship to Other Documents + +- Kiowa's confidentiality obligations (including access to Sam's personal + information during formation/EIN work) are governed separately by + `nda-formation-partner.md` — that NDA applies regardless of which + ventures she ends up vesting into. +- Each subsidiary's own operating agreement (e.g., Foodtruck1's, still to be + drafted) should incorporate this framework's specific numbers for that + venture as the basis of Kiowa's Membership Interest, rather than repeating + bespoke terms — this doc is the source of truth for the deal logic. +- "Maintaining her value" as a legal/paperwork/scout resource is **not** + itself a condition on the equity — it's deliberately left out of the + vesting/forfeiture mechanics because it isn't an objective, enforceable + standard. The 2x/12-month profit test is the sole trigger. If ongoing + service expectations need to be enforced separately, that belongs in a + services description, not the equity terms. + +--- + +`[TODO — attorney review: confirm this entire framework, especially the +repurchase/forfeiture mechanics and the 83(b) election timing, before +granting any interest under it.]` diff --git a/businesses/sns-hospitality-group/docs/kiowa-partnership-agreement.html b/businesses/sns-hospitality-group/docs/kiowa-partnership-agreement.html new file mode 100644 index 0000000..ba27554 --- /dev/null +++ b/businesses/sns-hospitality-group/docs/kiowa-partnership-agreement.html @@ -0,0 +1,453 @@ + + + + + +Partnership & Equity Framework — Kiowa Scott + + + + +
+ +
+

PARTNERSHIP & EQUITY FRAMEWORK

+
SnS Network Solutions Holdings LLC — Kiowa Scott
+
+ +
+
Holding entity: SnS Network Solutions Holdings LLC
+
Managing Member: Samuel S. James (97%)
+
Partner: Kiowa Scott
+
State: Indiana
+
Effective: ________________
+
+ +
+ Not legal advice. This is a working draft for LegalShield / attorney review. + Items in [brackets] need confirmation before signing. Neither party should + rely on this document until reviewed by an Indiana-licensed attorney and CPA. +
+ + +

1. Purpose & Scope

+

This framework governs the Membership Interest granted to Kiowa Scott + ("Kiowa") in SnS Hospitality Group LLC (the "Group"), a subsidiary of SnS + Network Solutions Holdings LLC ("Holdings"). Kiowa's 15% interest is at the + Group level — she participates in ALL mobile/trailer-based ventures operated + under the Group (coffee trailers, food trucks, and any future mobile venture).

+

Kiowa is not a Member of Holdings itself. Samuel S. James remains Holdings' + sole owner. This framework applies only to SnS Hospitality Group LLC.

+

Territory: NW Indiana and Southern Michigan.

+ + +

2. Kiowa's Role (Per Venture)

+ + + +

3. The Grant — Split Structure

+

Total potential equity per venture: 15% Membership Interest, split into two buckets:

+ + + + + + + + + + + + + +
BucketAmountCondition
Formation Grant5%Vests immediately on the Formation Date (date Articles of Organization are + filed). Payment for sourcing the venture and completing entity formation. No + clawback.
Service Grant10%Vests in 4 equal quarterly tranches (2.5% each) from the Opening Date, + conditional on active service (see §4).
+ +
+ Formation Date = day the subsidiary's Articles of Organization are filed with + the Indiana Secretary of State.
+ Opening Date = day the venture begins revenue-generating operations (e.g., first + paying customer). The vesting clock starts here, not the Formation Date. +
+ + +

4. Service Grant — Vesting Schedule

+

Measured from the Opening Date (first coffee trailer serves its first paying customer):

+ + + + + + + + +
MilestoneVestsCumulative TotalCondition
Formation Date (Group LLC filed)5.0%5.0%Immediate — formation work complete
3 months2.5%7.5%Actively performing duties
6 months2.5%10.0%Actively performing duties
9 months2.5%12.5%Actively performing duties
12 months2.5%15.0%Actively performing duties
+ +

4.1 "Actively Performing" Defined

+

At each quarterly milestone, Kiowa must be, at minimum:

+ + +

4.2 Acceleration

+

If cumulative net profit reaches 2× Sam's invested capital at any point before + month 12, all remaining unvested service tranches vest immediately — Kiowa jumps to the + full 15%. This rewards exceptional performance without punishing normal first-year economics.

+ +

4.3 During Vesting (Months 1-12)

+

If at any quarterly milestone Kiowa is not actively performing (she resigned, + became unresponsive, or was removed for cause), that tranche and all future tranches + do not vest. She keeps the 5% formation grant + any service tranches that already + vested. Unvested tranches revert to Holdings.

+ + + + + + + + + +
Scenario (During Vesting Year)Kiowa Keeps
Quits before Opening Date (formation work done)5%
Quits at month 2 (before first service tranche)5%
Active through month 3, quits at month 57.5%
Active through month 912.5%
Active through month 1215% (fully vested)
Business hits 2× at month 7, Kiowa active15% (accelerated)
+ +

4.4 After Full Vesting (Month 12+) — Permanent Ownership

+

Once Kiowa is fully vested at 15%, the equity is hers permanently. She owns + it free and clear regardless of future involvement.

+

If she stops working after full vesting:

+ +

Her incentive to keep working: distributions only exist if the trailers are + profitable, and profitability requires active management. 15% of nothing is nothing.

+ + +

5. Distributions

+ + + +

6. Group-Level Ownership

+

Kiowa's 15% Membership Interest is in SnS Hospitality Group LLC as a whole, + not in any individual venture. She participates economically in every venture the Group + operates — coffee trailers, food trucks, and any future mobile business added to the + Group.

+

Her distributions are 15% of the Group's combined net profit across all + ventures. A strong-performing coffee trailer can offset a slower food truck month — + diversification benefits her.

+ + +

7. Distributions

+ + + +

8. Tax Treatment

+ +
+ CPA review required before any grant: confirm profits-interest qualification, + 83(b) timing, and tiered-partnership filing mechanics between the subsidiary and Holdings. +
+ + +

9. Confidentiality

+

Kiowa's access to Sam's personal information (SSN, financial accounts, IRS + correspondence) during formation work is governed by a separate Non-Disclosure + Agreement (see nda-formation-partner.md). The NDA applies regardless + of which ventures she vests into and survives termination of any individual venture + relationship.

+ + +

10. Definitions

+ + + + + + + + + + +
TermMeaning
"Holdings"SnS Network Solutions Holdings LLC
"Sam"Samuel S. James, authorized representative of Holdings
"Kiowa"Kiowa Scott
"Formation Date"Date Articles of Organization filed with IN Secretary of State
"Opening Date"Date the venture begins revenue-generating operations
"Sam's invested capital"Cumulative cash Holdings contributes to that subsidiary
"Cumulative net profit"Venture's net profit from Opening Date forward
"Actively performing"Meeting the duties defined in §4.1
+ + +

9. Worked Examples

+ +
+

Example A — Year 1: 2 Coffee Trailers (Slightly Above Average)

+

Setup: Sam invests $50K for Trailer #1 (Month 1), then $35K for Trailer #2 + (Month 4, funded from Trailer #1 profits). Both doing 120 customers/day at $8 avg.

+ + + + + +
MetricTrailer #1 (12 months)Trailer #2 (9 months)Combined
Revenue$299,520$224,640$524,160
Costs (supply + fixed)-$116,496-$87,372-$203,868
Net profit$183,024$137,268$320,292
+

Kiowa's Year 1:

+ +

Sam's Year 1 after tax: ~$180,000

+
+ +
+

Example B — Year 2: Scale to 10 Trailers

+

Setup: 10 trailers running by month 20, all at average (100 customers/day, $8). + Year 2 full-year profit with all 10 running:

+ + + + + +
MetricPer Trailer10 Trailers
Annual revenue$249,600$2,496,000
Annual costs-$109,008-$1,090,080
Net profit$140,592$1,405,920
+

Distributions (full year, all 10 running):

+ + + + +
MemberSharePre-taxAfter taxMonthly
Holdings (Sam) — 85%$1,195,032$776,771$64,731/mo
Kiowa — 15%$210,888$137,077$11,423/mo
+

Kiowa clears $137K after tax with 10 trailers at average performance. Goal met.

+
+ +
+

Example C — Kiowa Stops Working (Year 3+, Fully Vested)

+

Scenario: At month 14 (fully vested since month 12), Kiowa decides to step back. + 10 trailers running, $1.4M annual profit.

+ +

Key: Kiowa has every incentive to stay — if she leaves, whoever replaces her may + not manage as well, profits could drop, and her passive 15% shrinks. But she can never + be forced to work, and she can never lose the equity.

+
+ + +

12. Amendments

+

This framework may be amended only by written agreement signed by both Sam and Kiowa. + Each subsidiary's operating agreement incorporates this framework's terms for that + specific venture — amendments to this framework do not retroactively change terms already + locked into a signed subsidiary operating agreement.

+ + +

13. Governing Law

+

This Agreement is governed by the laws of the State of Indiana. Each subsidiary + operating agreement is also governed by Indiana law unless otherwise specified therein.

+ + +
+

Execution

+

The undersigned acknowledge and agree to this Partnership & Equity Framework as of + the Effective Date first written above.

+ +

HOLDINGS — Samuel S. James

+
+
Signature
+

Printed name: Samuel S. James

+

Title: Managing Member, SnS Network Solutions Holdings LLC

+
+
Date
+ +

PARTNER — Kiowa Scott

+
+
Signature
+

Printed name: Kiowa Scott

+
+
Date
+
+ +
+ + + + + diff --git a/businesses/sns-hospitality-group/docs/nda-formation-partner.md b/businesses/sns-hospitality-group/docs/nda-formation-partner.md new file mode 100644 index 0000000..504ff46 --- /dev/null +++ b/businesses/sns-hospitality-group/docs/nda-formation-partner.md @@ -0,0 +1,154 @@ +# Non-Disclosure Agreement — Business Formation & Personal Information + +> **Draft / template — not legal advice.** Working draft for LegalShield / an +> Indiana-licensed attorney to review before either party signs. Items in +> `[brackets]` need to be filled in or confirmed with counsel. + +**Disclosing Party:** Samuel S. James, individually, and in his capacity as sole +member of SnS Network Solutions Holdings LLC ("Holdings"), on behalf of Holdings and +its current and future subsidiaries (collectively, the "Company") + +**Receiving Party:** `Kiowa Scott`, of `[address]` + +**Effective date:** `[date]` + +--- + +## 1. Purpose + +The Receiving Party is assisting the Company with (a) preparing and filing business +formation paperwork (e.g., Articles of Organization with the Indiana Secretary of +State / INBiz) for new subsidiary entities, (b) applying for Employer Identification +Numbers (EINs) with the IRS on behalf of those subsidiaries, and (c) participating as +a Member of Foodtruck1 LLC, the Company's first subsidiary venture in which the +Receiving Party holds a direct ownership interest (together, the "Purpose"). This +Agreement governs the Receiving Party's access to and use of Confidential Information +in connection with the Purpose. + +## 2. Confidential Information + +"Confidential Information" means any non-public information disclosed to or +accessed by the Receiving Party in connection with the Purpose, including without +limitation: + +- **Personal information of Samuel S. James**, including Social Security Number, + date of birth, home address, banking and financial account details, government- + issued identification numbers, and information contained in IRS or state + correspondence (e.g., EIN confirmation notices, Secretary of State filings); +- Business and financial information of Holdings and any subsidiary not yet public, + including formation plans, ownership structure, financial statements, bank account + information, contracts, and business strategy; +- For Foodtruck1 LLC specifically, any menu, recipe, supplier, pricing, staffing, or + operational information not yet public, even though the Receiving Party is a Member + of that entity — this Agreement governs the Receiving Party's obligations **to + third parties**, not access between Members themselves. + +Confidential Information does **not** include information that: (a) is or becomes +publicly available through no fault of the Receiving Party; (b) was already +lawfully known to the Receiving Party before disclosure, as shown by contemporaneous +written records; (c) is independently developed without use of the Confidential +Information; or (d) is required to be disclosed by law, court order, or government +authority, provided the Receiving Party gives the Disclosing Party prompt written +notice (where legally permitted) before disclosing. + +## 3. Obligations of the Receiving Party + +The Receiving Party shall: + +- Use Confidential Information **solely** for the Purpose; +- Not disclose Confidential Information to any third party without the Disclosing + Party's prior written consent, except as required to complete a specific filing + (e.g., submitting information to the Indiana Secretary of State or the IRS as part + of the Purpose itself); +- Protect Confidential Information with at least the same degree of care used to + protect the Receiving Party's own confidential information, and no less than + reasonable care (e.g., not storing Social Security Numbers or banking details in + unsecured files, shared drives, or unencrypted messages); +- Not use Confidential Information for the Receiving Party's own benefit or any + purpose outside the Purpose (for example, not using Samuel S. James's personal + information to open accounts, apply for credit, or take any action unrelated to + the specific filings the Receiving Party is authorized to make); +- Return or securely destroy all Confidential Information (including copies, in any + form) upon the Disclosing Party's request or upon completion of the Purpose, + whichever comes first, except for records the Receiving Party is legally required + to retain (e.g., copies of filings she submitted on the Company's behalf). + +## 4. Term + +This Agreement is effective as of the date above and continues for as long as the +Receiving Party is engaged in the Purpose, and survives termination of that +engagement: +- **Indefinitely**, with respect to Samuel S. James's personal information (SSN, + financial account details, and similar sensitive personal identifiers); and +- For **`[X years — TODO: confirm with counsel, e.g., 3–5 years]`** after the + engagement ends, with respect to all other Confidential Information. + +Termination of the Receiving Party's paperwork/formation role does not, by itself, +affect her separate rights as a Member of Foodtruck1 LLC, which are governed by that +entity's own operating agreement. + +## 5. No License; No Employment or Membership Created by This Agreement + +Nothing in this Agreement grants the Receiving Party any ownership, license, or +intellectual property rights in the Company's brand, IP, or business, except to the +extent (if any) separately granted in writing (e.g., her Membership Interest in +Foodtruck1 LLC under that entity's operating agreement). This Agreement, by itself, +does not create an employment relationship, a partnership, or membership in Holdings +or any subsidiary other than Foodtruck1. + +## 6. Remedies + +The Receiving Party acknowledges that unauthorized disclosure or use of Confidential +Information — particularly personal information such as a Social Security Number — +may cause irreparable harm for which monetary damages alone may be inadequate, and +that the Disclosing Party is entitled to seek injunctive relief in addition to any +other remedies available at law or equity. +`[TODO — attorney review: confirm remedies clause and consider whether a liquidated +damages provision is appropriate given the sensitivity of SSN/personal financial data.]` + +## 7. Governing Law + +This Agreement is governed by and construed in accordance with the laws of the +**State of Indiana**, without regard to conflict-of-law principles. + +## 8. Miscellaneous + +- **Entire agreement.** This Agreement constitutes the entire understanding between + the parties regarding confidentiality of the information described above and + supersedes any prior oral or written understanding on that subject. +- **Amendment.** This Agreement may only be amended in a writing signed by both + parties. +- **Severability.** If any provision is held invalid or unenforceable, the remaining + provisions remain in full force and effect. +`[TODO — attorney review: consider whether this NDA should instead be incorporated +into (or accompanied by) a broader services/independent-contractor agreement covering +her paperwork/formation role, separate from her rights as a Foodtruck1 Member, which +belong in Foodtruck1's own operating agreement.]` + +--- + +## Execution + +**DISCLOSING PARTY** + +Signature: ______________________________________ + +Printed name: **Samuel S. James**, individually and on behalf of SnS Network +Solutions Holdings LLC + +Date: ______________________________________ + +
+ +**RECEIVING PARTY** + +Signature: ______________________________________ + +Printed name: **`Kiowa Scott`** + +Date: ______________________________________ + +
+ +*Prepared as a working draft. Review with an Indiana-licensed attorney (e.g., via +LegalShield — see `legal-services.md`) before either party signs.* diff --git a/businesses/sns-hospitality-group/indian-food-truck-legacy/docs/operating-agreement.md b/businesses/sns-hospitality-group/indian-food-truck-legacy/docs/operating-agreement.md new file mode 100644 index 0000000..50a4c85 --- /dev/null +++ b/businesses/sns-hospitality-group/indian-food-truck-legacy/docs/operating-agreement.md @@ -0,0 +1,341 @@ +# Operating Agreement for Foodtruck1 LLC + +> **Draft / template — not legal advice.** This is a working draft for a +> **two-member** Indiana LLC that is a subsidiary of SnS Network Solutions Holdings +> LLC. Unlike the other subsidiaries, this one is **not** wholly owned by Holdings — +> it has a second Member holding a performance-vesting interest. Have an +> Indiana-licensed attorney and a CPA review and finalize this before either party +> signs. Items in `[brackets]` need your specific information; items marked +> `[TODO — attorney/CPA review]` should be confirmed with counsel. + +**Entity:** `[Foodtruck1 LLC — confirm final legal name once filed]` (the "Company") +**Parent:** SnS Network Solutions Holdings LLC (the "Parent Company"), 85% Member +**Second Member:** `Kiowa Scott` ("Kiowa"), 15% Member (vesting) +**State of formation:** Indiana +**Effective date:** `[Effective Date — the date this Agreement is adopted]` + +--- + +## 1. Formation and Purpose + +This Operating Agreement (the "Agreement") is entered into by the Members, **SnS +Network Solutions Holdings LLC** (the "Parent Company") and **`Kiowa Scott`** +("Kiowa"), to govern the operations of **Foodtruck1 LLC**, a limited +liability company organized under the Indiana Business Flexibility Act (Indiana Code +§ 23-18). + +The Company is an **operating subsidiary** formed to operate a mobile food truck +business. Unlike the Parent Company, the Company **does** conduct client-facing +work and carries the operating liability associated with that work (food service, +a commercial vehicle, and — depending on the staffing model chosen — employees), +which is why it is held in a separate LLC, walling that liability off from the +Parent Company and from every sibling subsidiary. + +## 2. Registered Office and Registered Agent + +- **Principal office:** `[Principal business address]` +- **Registered agent:** `[Registered agent name]` +- **Registered office address:** `[Indiana street address of the registered agent]` + + +## 3. Members and Ownership + +| Member | Membership Interest | Capital Contributed | +|---|---|---| +| SnS Network Solutions Holdings LLC | 85% | `[$ amount — Sam's invested capital in this venture]` | +| Kiowa | 15% (subject to vesting — see §5) | $0 | + +Kiowa is admitted as a full Member — with voting and economic rights — as of the +Effective Date, granted in exchange for her services (business formation/paperwork +work and originating this venture), not for a cash contribution. Her 15% interest is +subject to the vesting and forfeiture terms in §5, which control over any +inconsistent provision elsewhere in this Agreement. + +Allocations of profit and loss for tax purposes are made in proportion to each +Member's Membership Interest, subject to §5 and §8. +`[TODO — CPA review: confirm capital account mechanics for a $0-contribution, +services-for-equity Member, and how allocations should work while her interest is +partly unvested — see §5 and §8.]` + +## 4. Management + +The Company shall be **Member-managed**. Because the Parent Company holds a Membership +Interest majority (85%), the Parent Company — acting through its authorized +representative, **Samuel S. James** — retains sole authority to approve or reject +major Company decisions, including: + +- Entering into contracts, leases, and vendor/supplier agreements; +- Opening and controlling the Company's bank and financial accounts; +- Procuring insurance and equipment; +- Hiring and directing employees, or engaging an independent operator, per the + staffing model chosen (see §10); +- Admitting any new member (which requires amending this Agreement — see §12). + +**Day-to-day management** (routes, customers, daily operations) is delegated to +`[TODO: designate — Kiowa, a hired operator under a lease/license arrangement, or a +hired manager under a direct-hire staffing model; pending the staffing-model decision +referenced in `../requirements.md`]`, who reports to Samuel S. James as the Parent +Company's authorized representative. + +## 5. Vesting and Forfeiture of Kiowa's Membership Interest + +This section is the controlling reference for Kiowa's equity — consistent with, and +incorporating, the terms of +[`../../00-sns-holding/docs/kiowa-equity-framework.md`](../../00-sns-holding/docs/kiowa-equity-framework.md). + +**5.1 Vesting schedule.** Measured from the Company's **Opening Date** (the date the +Company begins revenue-generating operations — `[TODO: record actual date once +known]` — not the date this Agreement is signed or the date Articles of Organization +are filed): + +| Milestone (from Opening Date) | Vests | Condition | +|---|---|---| +| 3 months | 3.75% (cumulative 3.75%) | Time-based, unconditional | +| 6 months | 3.75% (cumulative 7.50%) | Time-based, unconditional | +| 9 months | 3.75% (cumulative 11.25%) | Time-based, unconditional | +| 12 months | final 3.75% (cumulative 15.00%) | Conditional — only vests if cumulative net profit has reached **2x** the Parent Company's invested capital (per §3) by month 12 | + +**5.2 Acceleration.** If the Company's cumulative net profit reaches 2x the Parent +Company's invested capital at any point before the 12-month mark, Kiowa's interest +immediately and fully vests to 15%, regardless of which quarterly milestone has or +has not yet passed. + +**5.3 Forfeiture and repurchase.** If cumulative net profit has **not** reached 2x +the Parent Company's invested capital by the 12-month mark, the final 3.75% tranche +does not vest. The Parent Company has the option (exercisable within +`[TODO — e.g., 90 days]` of the 12-month mark) to repurchase that unvested tranche +from Kiowa for **`[$1.00 — nominal consideration, given no cash was paid in]`**. Upon +exercise, Kiowa's Membership Interest permanently reduces to whatever had vested +through month 9 (up to 11.25%), and the repurchased tranche is transferred to the +Parent Company. There is no cure period and no later opportunity to re-earn the +forfeited tranche for this venture. + +**5.4 Distributions during the vesting period.** Until any tranche is forfeited under +§5.3, Kiowa receives distributions on her full 15% Membership Interest as if fully +vested (consistent with profits-interest tax treatment — see §8). Forfeiture under +§5.3 applies only prospectively: distributions already paid to Kiowa before the +forfeiture date are not clawed back. +`[TODO — CPA review: confirm this "full distributions during vesting, forfeiture only +prospective" approach is consistent with, or needs a formal forfeiture-allocation +provision for, profits-interest safe-harbor tax treatment.]` + +**5.5 Independence from other ventures.** This vesting arrangement applies only to +Kiowa's interest in this Company. It has no effect on, and is not affected by, any +equity Kiowa may be granted in any other subsidiary she originates. + + +## 6. Bank Accounts, Books, and Records + +- The Company shall maintain **its own bank account(s)**, separate from the Parent + Company's and from every sibling subsidiary's accounts. +- The Company shall keep accurate books and records of its finances, contracts, and + material decisions — including records sufficient to verify the vesting milestones + in §5 (cumulative net profit, by quarter, from the Opening Date) — retained at the + principal office as required by Indiana law. + +## 7. Capital Contributions and Additional Distributions + +- **Capital contributions:** The Parent Company may contribute additional capital to + the Company as needed; contributions are recorded in the Company's books against + its capital account. Kiowa is not required or expected to make cash contributions. +- **Distributions:** Subject to §5.4, distributions of available profits are made pro + rata to the Members' respective Membership Interests, at the times and amounts the + Parent Company determines under §4, subject to the Company's financial obligations + and applicable law (the Company may not make a distribution that would render it + unable to pay its debts as they come due). + +## 8. Tax Treatment + +With two Members, the Company is, by default, treated as a **partnership** for U.S. +federal income tax purposes; each Member reports their share of income and expense +via a Schedule K-1. Because the Parent Company is itself a multi-member LLC taxed as +a partnership, this creates a **tiered partnership structure** requiring coordination +between the Company's and the Parent Company's returns. +`[TODO — CPA/attorney review: (1) confirm Kiowa's interest is structured and +documented as a profits interest under Rev. Proc. 93-27/2001-43, not a capital +interest, to avoid immediate taxable income to her on grant; (2) confirm whether +Kiowa should file a protective Section 83(b) election within 30 days of the Effective +Date given the forfeiture condition in §5.3 — this is a hard IRS deadline; (3) confirm +tiered-partnership filing mechanics between this Company and the Parent Company; (4) a +Form 1065 will be required for this Company.]` + +- **EIN:** `[Company EIN — obtain from the IRS once Articles of Organization are filed]` +- **Fiscal year:** `[Fiscal year — typically the calendar year]` + +## 9. Liability and Indemnification + +To the fullest extent permitted by Indiana law: + +- No Member shall be **personally liable** for the debts, obligations, or + liabilities of the Company solely by reason of being a member; and +- The Company shall **indemnify and hold harmless** each Member (and any authorized + manager or agent) against claims, losses, and expenses arising from the good-faith + management of the Company within the scope of authority granted under this + Agreement, except for acts of fraud, willful misconduct, bad faith, or acts taken + outside that authority. +`[TODO — attorney review: confirm indemnification scope, especially given the +Company's operating (not passive-holding) risk profile.]` + +## 10. Insurance, Licensing, and Staffing + +Given the Company's mobile food-service operations, the following are required +before operations begin (see `../requirements.md` for current cost estimates and +status): + +- **Workers' Compensation** — mandatory under Indiana law from employee #1, if the + direct-hire staffing model is used. +- **General Liability** — required for the mobile food vendor permit. +- **Commercial Auto** — required for the truck; a personal auto policy will not cover + commercial use. +- **Mobile food vendor / health department permit** — required from South Bend / + St. Joseph County before operating. + +**Staffing model:** Direct W-2 hire — 1 full-time cook/manager ($24/hr) and 2 +part-time crew members ($12/hr, 25 hrs/wk each). Total loaded monthly labor: +approximately $7,800. + +## 11. Minimum Operating Requirements & Financial Targets + +The Company shall operate a minimum of **288 days per calendar year** (6 days per +week, 48 weeks), accounting for up to 4 weeks of planned downtime due to weather, +maintenance, holidays, or unforeseen events. + +### 11.1 Investment & Loan Repayment + +- **Total initial investment:** $50,000 (contributed by the Parent Company) +- **Repayment target:** Full repayment of invested capital within **24 months** of + the Opening Date +- **Required pre-tax annual profit (to meet repayment after taxes):** $38,462/yr + (~$3,205/mo at the Parent Company's 75% share, grossed up for ~35% combined + federal, state, and self-employment taxes) + +### 11.2 Monthly Financial Obligations + +The Company's fixed monthly costs, payable regardless of revenue: + +| Item | Monthly Cost | +|------|-------------| +| Labor (loaded — cook + 2 PT crew + employer taxes) | $7,800 | +| Truck payment (48mo @ ~8%) | $854 | +| Workers' Compensation insurance | $150 | +| General Liability insurance | $42 | +| Commercial Auto insurance | $170 | +| Commissary kitchen rental | $400 | +| Fuel | $500 | +| Software (payroll + ERP) | $100 | +| LegalShield (legal services) | $60 | +| Phone/POS | $100 | +| Miscellaneous/repairs buffer | $490 | +| **Total fixed monthly** | **$10,666** | + +During downtime weeks, fixed costs continue. Labor reduces to cook-only retention +(~$1,085/wk loaded) to avoid losing a key employee; part-time crew is zeroed. + +### 11.3 Revenue Targets + +Assuming 30% food cost and 288 operating days per year: + +| Metric | Target | +|--------|--------| +| **Breakeven revenue (annual)** | $182,640 ($15,220/mo) | +| **Revenue to meet 2-year payback** | $232,641/yr ($808/operating day) | +| **Minimum daily revenue target** | $808/day | +| **At $14/plate** | **58 customers/day** | +| **At $15/plate** | 54 customers/day | +| **At $12/plate** | 68 customers/day | + +### 11.4 Reporting + +The Company shall maintain monthly records sufficient to track: +- Total operating days vs. the 288-day minimum +- Daily revenue and customer count +- Cumulative net profit vs. the invested capital repayment schedule +- Food cost percentage (target: ≤30% of revenue) + +These records support the vesting milestones in §5 and are available to both Members +upon request. + +## 12. Transfer of Membership Interest + +- **Economic vs. management rights.** A Member may assign, pledge, or transfer the + economic rights (right to distributions/profits) in all or part of their Membership + Interest at that Member's discretion, without that alone making the transferee a + member. +- **Admission as a member.** A transferee is admitted as a member — with voting and + management rights, not just economic rights — only upon amendment of this Agreement + under §12. +- **Repurchase right.** The Parent Company's repurchase right over Kiowa's unvested + tranche under §5.3 is not a general transfer restriction — it applies only in the + specific forfeiture circumstance described there. +`[TODO — attorney review: consider whether a right of first refusal should apply to +either Member's Membership Interest before any transfer to a third party is +attempted.]` + +## 13. Amendments + +This Agreement may be amended only by a **written instrument signed by all Members**. +`[TODO — attorney review: given the Parent Company holds a voting majority (85%), +consider whether any amendment that would change Kiowa's Membership Interest, the §5 +vesting/forfeiture terms, or her distribution rights should specifically require +Kiowa's consent, even though general amendments could otherwise be read to need only +majority approval.]` + +## 14. Dissolution + +The Company shall continue in perpetuity unless dissolved by: + +- The written election of Members holding a majority of the Membership Interests; or +- Operation of Indiana law. + +Upon dissolution, the Company's assets shall be applied first to creditors, then +distributed to the Members pro rata in proportion to their (then-vested) Membership +Interests, after which Articles of Dissolution shall be filed with the Indiana +Secretary of State. + +## 14. Governing Law and Severability + +This Agreement is governed by and construed in accordance with the laws of the +**State of Indiana**. If any provision is held invalid or unenforceable, the +remaining provisions remain in full force and effect. + +## 15. Definitions + +- **"Company"** — Foodtruck1 LLC. +- **"Parent Company"** — SnS Network Solutions Holdings LLC. +- **"Kiowa"** — `Kiowa Scott`, the Company's second Member. +- **"Membership Interest"** — a Member's ownership, economic, and (unless limited) + management rights in the Company, expressed as a percentage per §3, subject to §5. +- **"Opening Date"** — the date the Company begins revenue-generating operations, as + defined in §5.1. + +--- + +## Execution + +The undersigned, being all of the Members of Foodtruck1 LLC, adopt and agree to this +Operating Agreement as of the Effective Date first written above. + +**MEMBER — 85% Membership Interest** + +By: ______________________________________ + +Name: **Samuel S. James** + +Title: Authorized Representative / Sole Member of SnS Network Solutions Holdings LLC + +Date: ______________________________________ + +
+ +**MEMBER — 15% Membership Interest (vesting per §5)** + +Signature: ______________________________________ + +Printed name: **`Kiowa Scott`** + +Date: ______________________________________ + +
+ +*Prepared as a working draft. Review with an Indiana-licensed attorney and a CPA +before either party signs.* diff --git a/businesses/sns-hospitality-group/indian-food-truck-legacy/requirements.md b/businesses/sns-hospitality-group/indian-food-truck-legacy/requirements.md new file mode 100644 index 0000000..e9fc9f8 --- /dev/null +++ b/businesses/sns-hospitality-group/indian-food-truck-legacy/requirements.md @@ -0,0 +1,65 @@ +# Food Truck #1 — Requirements & Planning + +**Entity:** subsidiary of SnS Network Solutions Holdings LLC — **but unlike the other +subsidiaries, Holdings is NOT the sole member here.** Foodtruck1 LLC will have two +Members: +- **SnS Network Solutions Holdings LLC** — 85%, holding Sam's ownership stake (keeps + Sam's interest inside the liability/succession structure described in + [`../00-sns-holding/00-sns-holding.md`](../00-sns-holding/00-sns-holding.md)) +- **Kiowa** — 15%, granted for $0 cash under + [`../00-sns-holding/docs/kiowa-equity-framework.md`](../00-sns-holding/docs/kiowa-equity-framework.md), + vesting quarterly over 12 months from Foodtruck1's Opening Date, contingent on + cumulative net profit reaching 2x Sam's invested capital in Foodtruck1 by month 12 + +This does **not** change Holdings' own cap table — Sam remains the sole owner of +SnS Network Solutions Holdings LLC itself (see `../00-sns-holding/docs/operating-agreement.md`). +The two-member structure applies only at the Foodtruck1 subsidiary level. +Draft operating agreement: [`docs/operating-agreement.md`](./docs/operating-agreement.md). + +`[TODO: fill in the remaining brackets in that agreement — entity legal name, EIN, +registered agent, day-to-day manager, staffing model — and record the actual Opening +Date and Sam's total invested capital here once known, since both drive the vesting +framework's math. Then route it through LegalShield for review before signing.]` + +**Owner role:** Sam (via Holdings, 85%) and Kiowa (15%, vesting) co-own the truck; +day-to-day running (routes, customers) is not done by Sam. + +## Staffing Model — decision pending +Two options discussed, not yet chosen: +- **Lease/License model** — truck leased to an independent operator (their own + business entity) for flat rent or % of revenue. Operator hires/manages their own + staff; no W-2/1099 question for the subsidiary at all. Cleanest for liability and + avoids employer obligations entirely. +- **Direct W-2 hire model** — subsidiary hires ~3 employees directly (cooks/crew). + Food-truck crew doing the core work almost certainly must be **W-2, not 1099** + (behavioral + financial control tests both point to employee status). + +Whichever model is chosen changes everything below — the cost estimates in this doc +assume the **direct W-2 hire model** (3 employees). + +## Software / Ops Cost Estimates + +| Item | Estimate | Notes | +|---|---:|---| +| **Gusto** (payroll) | **$80/mo** (high end) | Covers withholding calc, federal/state tax deposits & filings, new-hire reporting, year-end W-2s. Actual quote for 3 employees on the Plus tier runs ~$80–116/mo; using $80 as the planning number. | +| **ERPNext hosting** (Frappe Cloud) | **$20/mo** (confirmed) | Decision: **Frappe Cloud "Servers" plan** (shared VM, dedicated bench) instead of self-hosting on AWS. Cheaper than the $44/mo self-hosted AWS Lightsail 8GB option calculated earlier, and Frappe manages patching/backups/snapshots instead of us. Plenty for our light (1–3 user) usage. | +| **Total planning estimate** | **$100/mo** | Software/ops line only — excludes wages, employer payroll tax match, workers' comp premium, and any insurance/permits (see Outstanding Items below). | + +## Mandatory Insurance (fact-checked) + +| Coverage | Mandatory? | Est. Cost | Notes | +|---|---|---:|---| +| **Workers' Compensation** | **Yes — Indiana law, no employee-count exemption.** Required from employee #1. Penalties for skipping: up to $50/day fine, plus a misdemeanor (up to 1 yr jail / $5,000 fine). | **~$75–150/mo** | Food-service class code rate ~$1.00–4.50 per $100 payroll nationally; exact number depends on actual wages once set. | +| **General Liability** | **Functionally yes** — not a blanket state law, but every mobile food vendor permit requires proof of GL (typically $1M/occurrence, $2M aggregate, city/county named as additional insured) before the permit is issued. | **~$42/mo (~$500/yr)** | Confirm exact limit with South Bend / St. Joseph County health dept when applying for the permit. | +| **Commercial Auto** | **Yes** — Indiana requires liability coverage on any vehicle on public roads, and a personal auto policy typically **excludes commercial use**, so the truck needs its own commercial policy. | **~$170/mo (~$2,041/yr)** | Bundled GL + commercial auto + equipment/build-out coverage commonly runs **$300–700/mo** total industry-wide — treat the two lines above as a floor. | +| **Health insurance (ACA employer mandate)** | **No** — mandate only applies at 50+ full-time-equivalent employees. Not a factor at 3 employees. | $0 | Common misconception; explicitly not required at this size. | + +**Revised planning total, insurance included:** ~$80 (Gusto) + $20 (Frappe Cloud) + ~$75–150 (workers' comp) + ~$42 (GL) + ~$170 (commercial auto) ≈ **$390–460/mo**, before wages, the employer FICA match, and SUTA. + +## Outstanding Items (not yet priced/decided) +- [ ] Confirm staffing model (lease vs. W-2) before finalizing payroll requirements +- [x] Workers' compensation insurance — confirmed mandatory, ballpark cost above; get real quote once wages are set +- [ ] Mobile food vendor permit / health department licensing — confirm which entity holds it, and exact GL limit required by South Bend / St. Joseph County +- [x] Commercial auto insurance for the truck — confirmed mandatory, ballpark cost above +- [ ] Employer payroll tax match (~7.65% FICA) + Indiana SUTA — scales with actual wages, not a fixed cost +- [ ] Lease/License Agreement or W-2 onboarding paperwork (W-4, WH-4, I-9) — draft with LegalShield once model is chosen diff --git a/businesses/sns-hospitality-group/indian-food-truck/README.md b/businesses/sns-hospitality-group/indian-food-truck/README.md new file mode 100644 index 0000000..6fe679d --- /dev/null +++ b/businesses/sns-hospitality-group/indian-food-truck/README.md @@ -0,0 +1,12 @@ +# Indian Food Truck — PENDING + +**Entity:** Will operate under SnS Hospitality Group LLC +**Status:** Awaiting proposal from Indian staff +**Type:** Mobile/trailer-based (consistent with Hospitality Group model) + +## Next Steps +- [ ] Receive and review staff proposal +- [ ] Confirm investment amount +- [ ] Confirm menu concept and target market +- [ ] Identify locations (same high-traffic strategy as coffee trailers) +- [ ] Draft operating requirements (288+ operating days, revenue targets) diff --git a/businesses/sns-properties-llc/README.md b/businesses/sns-properties-llc/README.md new file mode 100644 index 0000000..f4e3eab --- /dev/null +++ b/businesses/sns-properties-llc/README.md @@ -0,0 +1,16 @@ +# SnS Properties LLC + +**Parent:** SnS Network Solutions Holdings LLC (sole member) +**Focus:** Real estate holdings — warehouse space, rental properties + +## Subsidiaries + +| Entity | Purpose | +|--------|---------| +| Warehouse Property LLC | Commercial/industrial space (potential commissary, storage) | +| Rental Property LLC | Residential or commercial rental income | + +## Status +Structure planned. Form when acquiring first property. Properties lease to sibling +operating entities (e.g., Hospitality Group leases commissary space from Properties). +This keeps real estate assets insulated from operating liability. diff --git a/businesses/sns-technology-group/README.md b/businesses/sns-technology-group/README.md new file mode 100644 index 0000000..7215d2e --- /dev/null +++ b/businesses/sns-technology-group/README.md @@ -0,0 +1,15 @@ +# SnS Technology Group LLC + +**Parent:** SnS Network Solutions Holdings LLC (sole member) +**Focus:** IT networking, security, and managed support services + +## Subsidiaries + +| Entity | Focus | +|--------|-------| +| SnS Network Solutions LLC | Networking infrastructure, cabling, managed networking | +| SnS Secure LLC | Cybersecurity, monitoring, compliance | +| SnS Support LLC | IT help desk, managed support, break-fix | + +## Status +Structures planned. Form each entity when it has revenue or client-facing liability. diff --git a/infra/future-stack-decisions.md b/infra/future-stack-decisions.md new file mode 100644 index 0000000..6eaea6a --- /dev/null +++ b/infra/future-stack-decisions.md @@ -0,0 +1,227 @@ +# Future Stack Decisions — SNS Network Solutions + +> Decisions made 2026-07-25 during brainstorming session. Apply these when building out the 3-rack environment. + +--- + +## Decisions Locked + +| Decision | Choice | Replaces | Reason | +|----------|--------|----------|--------| +| Perimeter firewall | **OPNsense** | OpenWRT (for racks/client sites) | Enterprise GUI, built-in Suricata IDS/IPS, CARP HA, traffic shaping. OpenWRT stays only for embedded APs. | +| Client/remote connectivity | **OpenZiti** | OpenVPN | OpenVPN is too slow. OpenZiti = zero-trust, no open ports, per-service access, faster (peer-to-peer). | +| Network Access Control | **PacketFence** | Nothing (new layer) | 802.1X, captive portal, device profiling, BYOD enforcement, rogue device isolation. | +| Mesh (personal/homelab) | **NetBird** (keep) | — | Already working. Not for client delivery — that's OpenZiti. | +| LLM API routing | **OpenRouter** | — | API key: sk-or-v1-607da... (free tier, 4000 token cap per request unless credits added) | + +--- + +## The Stack (consolidated) + +### Networking & Access (the perimeter + admission + connectivity triad) + +``` +Internet + │ + ▼ +┌──────────────┐ +│ OPNsense │ ← What traffic is allowed in/out (firewall + IDS/IPS) +└──────┬───────┘ + │ +┌──────▼───────┐ +│ PacketFence │ ← Who/what is allowed ON the network (NAC, 802.1X) +└──────┬───────┘ + │ +┌──────▼───────┐ +│ OpenZiti │ ← How services are accessed (zero-trust overlay, per-app) +└──────────────┘ +``` + +### Full Stack (3-Rack) + +| Layer | Tool | Role | +|-------|------|------| +| Perimeter firewall | OPNsense | Stateful firewall, IDS/IPS (Suricata), VLANs, traffic shaping | +| NAC | PacketFence | Network admission, 802.1X, captive portal, device profiling | +| Zero-trust connectivity | OpenZiti | Service-level access, no open ports, replaces VPN | +| Secrets | OpenBao | All credentials, transit encryption, audit log | +| Identity | OpenLDAP | Employee/contractor directory, SSO source | +| IaC | OpenTofu | Provision client environments reproducibly | +| Observability | Graylog + OpenTelemetry | Log management, SIEM, search, dashboards, alerting (replaces standalone OpenSearch) | +| Vulnerability scanning | OpenVAS | Scheduled client network scans | +| Threat intel | OpenCTI | IOC aggregation, threat actor tracking | +| Honeypots | OpenCanary | Intrusion detection decoys | +| Compliance | OpenSCAP | CIS/NIST benchmark audits | +| Network fleet management | OpenWISP | Manage OPNsense/AP fleets across client sites | +| Storage | OpenZFS | Backup targets, snapshots, data integrity (runs on Proxmox natively) | +| AI agents | OpenClaw + OpenRouter | Chief/Scout/Scribe + LLM API routing | +| Serverless automation | OpenFaaS | Webhook handlers, client onboarding, alert processors | + +### Removed / Not Using + +| Tool | Reason | +|------|--------| +| ~~OpenVPN~~ | Too slow. Replaced by OpenZiti. | +| ~~ZeroTier~~ (for clients) | Network-level access (full LAN) instead of service-level. Keep NetBird for personal homelab only. | +| ~~OpenWRT~~ | Not using at all. OPNsense covers firewall/routing; no embedded router flashing. | +| ~~OpenProject~~ | Tested on pve2 (LXC 215) — didn't like it. Destroyed. | +| ~~OpenSearch~~ (standalone) | Tested on pve2 (LXC 216) — using Graylog instead (includes OpenSearch under the hood + better UI/SIEM). | + +--- + +## Revenue Services Enabled + +| Service | Tools | Billing | +|---------|-------|---------| +| Managed firewall + IDS | OPNsense | Monthly per-site | +| Zero-trust remote access | OpenZiti | Monthly per-endpoint | +| NAC / BYOD enforcement | PacketFence | Setup + monthly | +| Vulnerability scanning | OpenVAS | Monthly/quarterly report | +| Compliance audits | OpenSCAP | Per-engagement | +| Managed backup | OpenZFS + PBS + OMV | Monthly per-TB | +| Threat monitoring | OpenCTI + OpenCanary + Suricata | Monthly retainer | +| Infrastructure builds | OpenTofu + Proxmox + Ansible | Project-based | +| Secrets management | OpenBao (at client) | Setup + monthly | + +--- + +## OpenRouter API + +- **Key:** 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 +- **Status:** Free tier (4000 token max per request) +- **Usage:** Add `"max_tokens": 500` (or less) to stay within limits +- **Wire into:** LiteLLM or AI Core `.env` when ready +- **Add credits:** https://openrouter.ai/settings/credits + +--- + +--- + +## Repository Links (all tools) + +| Tool | Repo / Site | License | +|------|-------------|---------| +| **OPNsense** | https://github.com/opnsense/core | BSD-2 | +| **OPNcentral** | Built-in OPNsense plugin (os-central) | BSD-2 | +| **PacketFence** | https://github.com/inverse-inc/packetfence | GPL-2.0 | +| **OpenZiti** | https://github.com/openziti/ziti | Apache-2.0 | +| **OpenBao** | https://github.com/openbao/openbao | MPL-2.0 | +| **OpenTofu** | https://github.com/opentofu/opentofu | MPL-2.0 | +| **OpenLDAP** | https://github.com/openldap/openldap | OpenLDAP Public License | +| **OpenTelemetry** | https://github.com/open-telemetry/opentelemetry-collector | Apache-2.0 | +| **OpenTelemetry Contrib** | https://github.com/open-telemetry/opentelemetry-collector-contrib | Apache-2.0 | +| **OpenSearch** | https://github.com/opensearch-project/OpenSearch | Apache-2.0 | +| **OpenVAS** | https://github.com/greenbone/openvas-scanner | GPL-2.0 | +| **OpenCTI** | https://github.com/OpenCTI-Platform/opencti | Apache-2.0 | +| **OpenCanary** | https://github.com/thinkst/opencanary | BSD-3 | +| **OpenSCAP** | https://github.com/ComplianceAsCode/content | BSD-2 | +| **OpenFaaS** | https://github.com/openfaas/faas | MIT | +| **OpenProject** | https://github.com/opf/openproject | GPL-3.0 | +| **OpenZFS** | https://github.com/openzfs/zfs | CDDL / BSD | +| **OpenClaw** | https://github.com/openclaw/openclaw | MIT | +| **OpenRouter** | https://openrouter.ai (API service, not self-hosted) | Commercial (API) | +| **OpenWISP** | https://github.com/openwisp | GPL-3.0 | +| **Proxmox VE** | https://git.proxmox.com | AGPL-3.0 | +| **Grafana** | https://github.com/grafana/grafana | AGPL-3.0 | +| **Prometheus** | https://github.com/prometheus/prometheus | Apache-2.0 | + +### Official Docs / Sites + +| Tool | Documentation | +|------|--------------| +| OPNsense | https://docs.opnsense.org | +| PacketFence | https://www.packetfence.org/doc/ | +| OpenZiti | https://openziti.io / https://docs.openziti.io | +| OpenBao | https://openbao.org/docs/ | +| OpenTofu | https://opentofu.org/docs/ | +| OpenTelemetry | https://opentelemetry.io/docs/ | +| OpenSearch | https://opensearch.org/docs/ | +| OpenVAS (Greenbone) | https://greenbone.github.io/docs/ | +| OpenCTI | https://docs.opencti.io | +| OpenFaaS | https://docs.openfaas.com | +| OpenProject | https://www.openproject.org/docs/ | + +--- + +## Network Switching — MikroTik (No Licensing) + +**Decision:** MikroTik CRS series. Zero license fees forever. RouterOS included with hardware. + +### Why MikroTik + +- $0 licensing — ever. RouterOS included, free upgrades. +- Full L2/L3 switching + routing in one device +- REST API (RouterOS 7+) + native API (port 8728) +- Full Ansible support (`community.routeros` collection) +- Full Python support (`librouteros`, `routeros-api`, or plain REST) +- PacketFence compatible (SNMP + RADIUS/802.1X) +- Cheapest enterprise-grade option (~$130-500 vs Cisco $1000+) + +### Suggested Rack Layout + +| Rack | Switch | Model | Role | +|------|--------|-------|------| +| Rack 1 | **CRS354-48G-4S+2Q+** | 48× 1G + 4× SFP+ 10G + 2× QSFP+ 40G | Core/distribution | +| Rack 2 | **CRS326-24G-2S+** | 24× 1G + 2× SFP+ 10G | Client services | +| Rack 3 | **CRS326-24G-2S+** | 24× 1G + 2× SFP+ 10G | Lab/security | +| Inter-rack | 10G SFP+ DAC cables | Between switches | Backbone | + +**Total hardware cost: ~$500-700** (Cisco equivalent: $5,000+) + +### Automation + +**Ansible:** +```yaml +ansible-galaxy collection install community.routeros + +# Modules: api, api_modify, api_info, api_facts, command +- community.routeros.api: + hostname: 192.168.122.10 + path: interface bridge vlan + add: + bridge: bridge1 + vlan-ids: 100 +``` + +**Python (REST API — RouterOS 7+):** +```python +import requests +r = requests.get('https://switch-ip/rest/interface', + auth=('admin', 'password'), verify=False) +print(r.json()) +``` + +**Python (native API):** +```python +import routeros_api +connection = routeros_api.RouterOsApiPool('switch-ip', + username='admin', password='password', plaintext_login=True) +api = connection.get_api() +interfaces = api.get_resource('/interface') +for iface in interfaces.get(): + print(iface['name']) +``` + +### Integration With Stack + +| Tool | Integration | +|------|-------------| +| Ansible | `community.routeros` — provision, configure, update from code | +| OpenTofu | Triggers Ansible post-provision (switch auto-configures on boot) | +| PacketFence | RADIUS + SNMP for 802.1X NAC (officially supported) | +| Graylog | Syslog receiver (point switch logging at Graylog) | +| OpenTelemetry | SNMP receiver collects switch metrics | +| Python | REST API or native API for custom scripts/monitoring | + +### Avoid (licensing traps) + +| Brand | Why Not | +|-------|---------| +| Cisco (Catalyst/Nexus) | SmartNet + DNA licenses + per-feature licensing | +| Aruba/HPE | Pushing cloud subscriptions (Aruba Central) | +| Meraki | Hardware bricks if license expires | +| Juniper (Mist) | Cloud-AI management is subscription-based | + +--- + +*Document created: 2026-07-25 | Status: Planning | Next: Deploy OpenZiti controller on Rack 1 when hardware is ready* diff --git a/products/secure/scc/agents/AGENT-blueprint-extractor.md b/products/secure/scc/agents/AGENT-blueprint-extractor.md new file mode 100644 index 0000000..4dac907 --- /dev/null +++ b/products/secure/scc/agents/AGENT-blueprint-extractor.md @@ -0,0 +1,184 @@ +# AGENT: Blueprint Layout Extractor + +## Purpose + +Takes a UI screenshot/mockup image and outputs a **structural blueprint document** — categorized placeholders describing WHAT goes in each position, not the actual values shown. The output is a reusable template that can be filled with different data for different deployments. + +--- + +## Agent Identity + +**Name:** Blueprint Extractor +**Input:** One UI screenshot/mockup image +**Output:** A structured markdown document with positional placeholders in `[CATEGORY-NAME]` format + +--- + +## Instructions for the Agent + +### WHAT TO DO + +1. **Scan the image top-to-bottom, left-to-right** +2. **Identify the grid/layout structure** — how many columns, rows, panels +3. **For each panel, list every visual element** — but describe its PURPOSE, not its content +4. **Use `[PLACEHOLDER-NAME]` format** for every element +5. **For graphics/icons/images, DESCRIBE what the graphic represents and its visual behavior** (e.g., "circular gauge with animated sweep", "3D isometric cube with scan lines") +6. **Include a text-based grid diagram** at the end showing spatial relationships + +### WHAT NOT TO DO + +- DO NOT write the actual text/values shown in the image +- DO NOT describe colors unless the color IS the category (e.g., [STATUS-COLOR-INDICATOR]) +- DO NOT generate code +- DO NOT interpret data — describe the container, not the contents +- DO NOT skip graphics — describe what the graphic IS and what it COMMUNICATES + +### NAMING CONVENTION + +Format: `[PANEL-CONTEXT-ELEMENT]` + +Examples: +- `[BRAND-LOGO]` — not "SnS Secure logo" +- `[NETWORK-TRAFFIC-GRAPH]` — not "line chart showing 5.42 Gbps" +- `[VAULT-STATUS-GRAPHIC]` — not "green circle with lock icon" +- `[FLEET-VEHICLE-CARD]` — not "picture of armored SUV" + +### GRAPHIC/IMAGE ELEMENTS — REQUIRED FIELDS + +When a graphic, icon, chart, or visual element is encountered: + +``` +| Position | Category | +|----------|----------| +| [location] | [PLACEHOLDER-NAME] | +| Graphic Type | [type: gauge/chart/icon/map/3d-render/diagram/logo] | +| Graphic Description | [what it represents visually and functionally] | +| Behavior | [static/animated — describe animation if applicable] | +| Communicates | [what information this graphic conveys to the operator] | +``` + +### PANEL STRUCTURE FORMAT + +``` +#### Panel [N] — [Grid Position] +| Position | Category | +|----------|----------| +| Panel Header | [SECTION-TITLE] | +| Element 1 | [PLACEHOLDER] | +| Element 2 | [PLACEHOLDER] | +| ... | ... | +``` + +### FULL DOCUMENT STRUCTURE + +```markdown +# [PAGE-NAME] — Blueprint Layout + +## TOP BAR (full width, fixed) +[table of top bar elements] + +## MAIN CONTENT ([N]-column layout) + +### LEFT COLUMN +#### Panel 1 — [position] +[table] + +### CENTER COLUMN +#### Panel N — [position] +[table] + +### RIGHT COLUMN +#### Panel N — [position] +[table] + +## BOTTOM BAR (full width, fixed) +[table of bottom bar elements] + +## LAYOUT GRID SUMMARY +[ASCII art showing spatial relationships] +``` + +--- + +## Example Input → Output + +**Input:** A dashboard screenshot showing a network status panel with a live traffic graph, a table of connections, and a circular encryption indicator. + +**Output:** +``` +#### Panel 3 — Top-Center +| Position | Category | +|----------|----------| +| Panel Header | [TRAFFIC-MONITOR-TITLE] | +| Status Indicator | [LIVE-FEED-INDICATOR] | +| Graphic Type | Line chart (time-series) | +| Graphic | [TRAFFIC-RATE-TIMESERIES-GRAPH] | +| Graphic Description | Rolling time-series line graph showing throughput over time. X-axis = time, Y-axis = rate unit. | +| Behavior | Animated — new data points append right, old scroll left (live feed) | +| Communicates | Real-time throughput rate trending up/down/stable | +| X-Axis Label | [TIME-RANGE-LABELS] | +| Y-Axis Label | [RATE-UNIT-LABELS] | +| Legend | [GRAPH-LEGEND-ITEMS] | +| Below Graph Header | [TOP-CONNECTIONS-TITLE] | +| Table Header Row | [SOURCE-COL] [DESTINATION-COL] [PROTOCOL-COL] [RATE-COL] [STATUS-COL] | +| Table Body | [CONNECTION-ROWS] | +``` + +--- + +## Existing Open-Source Tools (reference / potential integration) + +These don't do what this agent does, but could feed INTO it: + +| Tool | Repo | What it provides | +|------|------|-----------------| +| **ui-screenshot-to-prompt** | https://github.com/s-smits/ui-screenshot-to-prompt | Grid slicing + OCR + region descriptions. Could pre-segment the image into regions before this agent categorizes them. | +| **layout-detector-mcp** | https://github.com/katlis/layout-detector-mcp | MCP server — finds asset positions, detects layout patterns (radial/grid/stacked/sidebar). Returns JSON with coordinates. Could provide the spatial structure this agent then labels. | +| **UIED** | https://github.com/MulongXie/UIED | CV-based UI element detection. Classifies elements (button, text, image, input) and exports bounding boxes as JSON. Could identify element TYPES before this agent assigns PURPOSE. | +| **ScreenCoder** | https://github.com/leigest519/ScreenCoder | Screenshot → HTML/CSS. Understands layout structure to generate code — internal representation could be repurposed for blueprint extraction. | +| **clearshot** | https://github.com/udayanwalvekar/clearshot | "Structured screenshot intelligence for AI coding tools." Provides structured data from screenshots. | + +### Pipeline concept (if building a tool): +``` +[Screenshot] → UIED (detect elements) → layout-detector (spatial relationships) → THIS AGENT (semantic categorization) → [Blueprint.md] +``` + +--- + +## How to Use This Agent (with any AI coding assistant) + +### Option 1 — Paste as a system prompt +Copy the "Instructions for the Agent" section into your AI assistant's context, then provide the screenshot image. + +### Option 2 — As a Kiro skill +Place this file at `.kiro/skills/blueprint-extractor/SKILL.md` and invoke with: +``` +/blueprint-extractor [attach image] +``` + +### Option 3 — As a reusable prompt template +``` +You are a Blueprint Layout Extractor. I will give you a UI screenshot. + +Your job: output a structural blueprint document listing every visual element +as a [CATEGORY-PLACEHOLDER], describing WHAT goes in each position — NOT the +actual values shown. + +For graphics/images: describe the graphic TYPE, what it REPRESENTS, its +BEHAVIOR (static/animated), and what it COMMUNICATES to the operator. + +Format: top-to-bottom, left-to-right, panel-by-panel, with an ASCII grid +summary at the end. + +DO NOT write the actual text values. DO NOT generate code. DO NOT skip +graphics — describe them. +``` + +--- + +## Notes + +- No existing open-source tool does this exact task (semantic placeholder extraction from UI mockups) +- The closest is `ui-screenshot-to-prompt` but it outputs implementation briefs, not reusable templates +- This is fundamentally a **vision model task** (needs multimodal AI like Claude, GPT-4V, Gemini) — not solvable with pure CV alone because it requires understanding PURPOSE not just PIXELS +- Could be productized as an MCP server that accepts an image and returns the blueprint markdown diff --git a/products/secure/scc/blueprints/scc-blueprint.png b/products/secure/scc/blueprints/scc-blueprint.png new file mode 100644 index 0000000..17fe53a Binary files /dev/null and b/products/secure/scc/blueprints/scc-blueprint.png differ diff --git a/products/secure/scc/blueprints/scc-encrypt-blueprint.png b/products/secure/scc/blueprints/scc-encrypt-blueprint.png new file mode 100644 index 0000000..a8cbf7a Binary files /dev/null and b/products/secure/scc/blueprints/scc-encrypt-blueprint.png differ diff --git a/products/secure/scc/blueprints/scc-networkmonitor-blueprint.png b/products/secure/scc/blueprints/scc-networkmonitor-blueprint.png new file mode 100644 index 0000000..49b7114 Binary files /dev/null and b/products/secure/scc/blueprints/scc-networkmonitor-blueprint.png differ diff --git a/products/secure/scc/blueprints/scc-tacticalfleet-blueprint.png b/products/secure/scc/blueprints/scc-tacticalfleet-blueprint.png new file mode 100644 index 0000000..55ca127 Binary files /dev/null and b/products/secure/scc/blueprints/scc-tacticalfleet-blueprint.png differ diff --git a/products/secure/scc/blueprints/scc-threatintel-blueprint.png b/products/secure/scc/blueprints/scc-threatintel-blueprint.png new file mode 100644 index 0000000..554b5bf Binary files /dev/null and b/products/secure/scc/blueprints/scc-threatintel-blueprint.png differ diff --git a/products/secure/scc/docs/SCC-FEASIBILITY.md b/products/secure/scc/docs/SCC-FEASIBILITY.md new file mode 100644 index 0000000..7f703b0 --- /dev/null +++ b/products/secure/scc/docs/SCC-FEASIBILITY.md @@ -0,0 +1,317 @@ +# SnS Secure Command Center (SCC) — Feasibility & Build Requirements + +## What This Document Answers + +What will it take — technically, financially, and time-wise — to build a terminal-based security command center product as described in the SCC blueprints? This document is based on real research, not speculation. + +--- + +## Product Summary + +A **terminal-native security operations platform** that: +- Runs as a TUI (Terminal User Interface) on **Fedora Linux servers only** +- Implements all **7 layers of digital security** as core, non-optional requirements +- Uses open-source tooling (OpenBao, ZeroTier, Graphify, Termix, tmux, superfile, micro) +- Renders full-color, themed panels with 3D visual elements in the terminal +- Also works in the browser via a **browser extension** +- Has **anti-theft self-destruct** mechanism (Fedora-locked, hardware-bound) +- Is a commercial product for SnS Network Solutions + +--- + +## Language Decision: Go vs Rust + +### Recommendation: **Rust** + +| Factor | Go | Rust | Winner | +|--------|-----|------|--------| +| Raw performance | Fast (GC pauses) | Fastest (no GC, zero-cost abstractions) | Rust | +| TUI framework | Bubble Tea (mature, superfile uses it) | Ratatui (mature, very active, dashboard-focused) | Tie | +| Memory safety | GC-managed | Compile-time guaranteed, no runtime | Rust | +| Crypto libraries | Good (`crypto/` stdlib) | Excellent (`ring`, `rustls`, RustCrypto) | Rust | +| Binary security | Easy to decompile (reflection, strings) | Hard to reverse-engineer (no runtime, stripped binary = opaque) | Rust | +| Build time | Fast (seconds) | Slow (minutes for full rebuild) | Go | +| Hiring/contributors | Easier to find Go devs | Harder, but growing | Go | +| Anti-tamper | Harder to protect (runtime introspection) | Easier (static binary, no reflection) | Rust | +| Browser/WASM | Possible | First-class WASM support | Rust | +| Ecosystem for security tools | Good | Excellent (lots of security tooling in Rust) | Rust | + +**Why Rust wins for THIS product:** +1. The anti-theft requirement demands a binary that's hard to reverse-engineer. Rust's stripped static binaries are significantly harder to decompile than Go binaries (which embed type info and are trivially disassembled with `go tool objdump`). +2. Performance-critical real-time rendering of terminal graphics with zero GC pauses. +3. WASM compilation for the browser extension is first-class in Rust. +4. The security/crypto ecosystem in Rust (`ring`, `rustls`, `sodiumoxide`, `age`) is battle-tested. +5. Ratatui + `ratatui-image` gives us dashboards + inline graphics in one crate. + +**The trade-off:** slower development velocity (Rust is harder to write). Budget ~2x the dev time vs Go for the same feature set. + +--- + +## Core Technology Stack + +### TUI Rendering Layer + +| Component | Tool | Repo | Role | +|-----------|------|------|------| +| TUI framework | **Ratatui** | https://github.com/ratatui/ratatui | Panel layout, widgets, event loop, theming | +| Image/3D in terminal | **ratatui-image** | https://github.com/benjajaja/ratatui-image | Sixel/Kitty/iTerm2 graphics protocol rendering | +| GPU-accelerated terminal | **Ghostty** or **Kitty** | https://github.com/ghostty-org/ghostty / https://github.com/kovidgoyal/kitty | Required terminal emulator (supports graphics protocols) | +| 3D in terminal | **Ratty** (reference) | https://github.com/orhun/ratty | GPU-rendered terminal with inline 3D (proof this is possible) | +| Terminal multiplexer | **tmux** | https://github.com/tmux/tmux | Session persistence, split panes, detach/reattach | +| Text editor (embedded) | **micro** | https://github.com/zyedidia/micro | In-app config/log editing | + +### Security & Encryption Layer (7 Layers Mandatory) + +| Layer | Implementation | Tool/Lib | +|-------|---------------|----------| +| 1. Physical | Hardware fingerprint binding (TPM + MAC + disk serial) | Custom Rust (reads `/sys/class/dmi/`, TPM PCR values) | +| 2. Network Perimeter | Mesh VPN, encrypted tunnels | **ZeroTier** (peer-to-peer mesh) | +| 3. Identity & Access | Secrets management, token auth, MFA | **OpenBao** (Vault fork, secrets/certs/keys) | +| 4. Application | Input validation, encrypted IPC, code signing | Rust type system + `ring` crate | +| 5. Data | AES-256-GCM at rest, TLS 1.3 in transit, key rotation | `rustls` + `aes-gcm` + `age` crates | +| 6. Monitoring | Event detection, anomaly alerts, audit trail | Custom (inotify + conntrack + auditd integration) | +| 7. Recovery | Encrypted backups, integrity verification, self-heal | `blake3` hashing + OpenBao transit engine | + +### Networking & Remote Access + +| Component | Tool | Repo | Role | +|-----------|------|------|------| +| Mesh networking | **ZeroTier** | https://github.com/zerotier/ZeroTierOne | Encrypted P2P overlay network between all SCC nodes | +| SSH management | **Termix** | https://github.com/Termix-SSH/Termix | Self-hosted SSH + RDP/VNC management (replaces Termius) | +| Knowledge graph | **Graphify** | https://github.com/Graphify-Labs/graphify | Infrastructure relationship mapping + neural graph data | + +### File Management & Operations + +| Component | Tool | Repo | Role | +|-----------|------|------|------| +| File manager (TUI) | **superfile** | https://github.com/yorukot/superfile | Multi-panel encrypted vault file browsing (reference for UX) | +| Text editor | **micro** | https://github.com/zyedidia/micro | Inline config editing within the SCC | +| Session management | **tmux** | https://github.com/tmux/tmux | Persistent sessions, multi-pane layouts | + +### Browser Extension + +| Component | Tool | Repo | Role | +|-----------|------|------|------| +| Terminal in browser | **xterm.js** | https://github.com/xtermjs/xterm.js | Renders the TUI in-browser with full escape code support | +| Ghostty-web | **ghostty-web** | https://github.com/coder/ghostty-web | xterm.js-compatible VT100 in browser (Kitty protocol support) | +| WASM backend | Rust → WASM | Built-in (`wasm-pack`) | Compile the SCC rendering engine to WASM for browser | +| Extension framework | Manifest V3 | Chrome/Firefox native | Browser extension shell | + +--- + +## Anti-Theft / Self-Destruct System + +### How It Works + +``` +┌───────────────────────────────────────────────────────────┐ +│ BOOT SEQUENCE │ +├───────────────────────────────────────────────────────────┤ +│ 1. Read hardware fingerprint (TPM PCR, MAC, disk serial, │ +│ CPU model, motherboard UUID from DMI) │ +│ 2. Hash fingerprint with embedded salt → machine_id │ +│ 3. Compare machine_id against encrypted license blob │ +│ 4. Verify OS = Fedora (read /etc/os-release) │ +│ 5. Verify kernel = expected (no VM/container spoof check) │ +│ │ +│ IF ANY CHECK FAILS: │ +│ ┌─────────────────────────────────────────────────────┐ │ +│ │ a. Collect: IP, hostname, username, MAC, timestamp │ │ +│ │ b. POST theft report to public endpoint (dead-drop) │ │ +│ │ c. Overwrite all local config/keys with zeros │ │ +│ │ d. Delete all SCC binaries and data │ │ +│ │ e. Remove self from systemd / cron / autostart │ │ +│ │ f. Final: shred the theft-report log locally │ │ +│ └─────────────────────────────────────────────────────┘ │ +└───────────────────────────────────────────────────────────┘ +``` + +### Technical Implementation Details + +| Requirement | How | +|-------------|-----| +| Fedora-only | Check `/etc/os-release` for `ID=fedora`. Also verify `rpm -q fedora-release` exists. | +| Hardware binding | Combine: `/sys/class/dmi/id/product_uuid` + `/sys/class/net/*/address` + disk serial (`/sys/block/*/device/serial`) + TPM endorsement key (if available). HMAC with embedded secret. | +| License blob | Encrypted file containing the expected machine hash + expiry date + customer ID. Signed with Ed25519. | +| Theft reporting | POST to a pre-configured public endpoint (could be a GitHub Gist API, a Forgejo webhook, or an S3-presigned URL). Data: IP (via external service), machine info, timestamp. | +| Self-destruct | `shred -vfz -n 3` on all SCC files → `rm -rf` the install dir → remove systemd units → overwrite with zeros. | +| Anti-debug | Detect ptrace attachment, refuse to run under strace/gdb. Check `/proc/self/status` TracerPid. | +| Binary obfuscation | Strip symbols, use `#[no_mangle]` sparingly, embed encrypted strings (decrypt at runtime only). | + +### Legal Note + +Self-destruct + theft reporting is legally defensible if: +- The EULA explicitly states this behavior +- The "public repo" report does NOT include passwords or personal data — only machine identifiers and IP +- The software clearly belongs to you (commercial license, not GPL) +- Consider using a **proprietary license with source-available inspection** (like SSPL or BSL) so customers can audit but not redistribute + +--- + +## Fedora Server Requirement — Enforcement + +| Check | Method | Bypass difficulty | +|-------|--------|-------------------| +| OS identity | `/etc/os-release` `ID=fedora` | Easy to spoof (edit file) | +| Package manager | `rpm --eval '%{fedora}'` returns version | Medium (need full rpm DB) | +| SELinux | `getenforce` = Enforcing (Fedora ships SELinux) | Medium | +| DNF/systemd | `/usr/bin/dnf` exists + `systemctl` PID 1 | Medium | +| Kernel string | `uname -r` contains `.fc` suffix | Easy to spoof | +| **Combined hash** | Hash ALL of the above together | Hard to spoof all at once | + +**Recommendation:** Don't rely on any single check. Combine 5+ signals into a composite score. If <3 pass, trigger self-destruct. This makes casual piracy very hard without running actual Fedora. + +--- + +## What It Will Take to Build + +### Phase 1 — Core TUI Shell (Months 1-3) + +| Task | Effort | Output | +|------|--------|--------| +| Ratatui project scaffold + theme engine (green-on-black military) | 2 weeks | Themed panel framework | +| Panel layout system (3-column, resizable, tabbed) | 2 weeks | SCC shell with 5 tabs | +| Hardware fingerprint + license system | 2 weeks | Boot gate + Fedora enforcement | +| OpenBao integration (secrets, key rotation) | 2 weeks | Layer 3 + 5 operational | +| ZeroTier integration (mesh network status) | 1 week | Layer 2 connected | +| Anti-theft self-destruct mechanism | 1 week | Theft reporting + wipe | +| tmux session embedding | 1 week | Session management working | + +**Deliverable:** A Fedora-locked TUI shell that boots with hardware verification, shows 5 tabbed panels, connects to OpenBao and ZeroTier, and self-destructs if moved. + +### Phase 2 — Module Implementation (Months 4-7) + +| Module | Effort | Dependencies | +|--------|--------|-------------| +| Cyber Ops (CLI status dashboard) | 3 weeks | Ratatui widgets, system metrics | +| Network Monitor (live traffic + topology) | 4 weeks | conntrack, netfilter, nftables parsing | +| Encrypted Vault (file browser + encryption) | 4 weeks | superfile-style UX + age/AES-256 | +| Threat Intel (IOC feeds + CVE tracking) | 3 weeks | OSINT API integrations | +| Tactical Fleet (GPS + vehicle tracking) | 3 weeks | GPS feed protocol, map rendering | +| Neural Graph (live force-directed viz) | 3 weeks | Graphify integration + event feed | + +### Phase 3 — Browser Extension (Months 8-9) + +| Task | Effort | +|------|--------| +| Compile Ratatui render engine to WASM | 2 weeks | +| xterm.js / ghostty-web frontend | 2 weeks | +| Manifest V3 extension shell | 1 week | +| Secure WebSocket bridge (SCC server ↔ browser) | 1 week | +| Auth + encryption for browser channel | 1 week | + +### Phase 4 — Hardening & Ship (Months 10-12) + +| Task | Effort | +|------|--------| +| Security audit (fuzz testing, pen testing) | 3 weeks | +| Performance optimization + stress testing | 2 weeks | +| Installer / packaging (Fedora RPM) | 1 week | +| Documentation + operator training materials | 2 weeks | +| Beta testing with controlled deployment | 4 weeks | + +### Total Estimated Timeline + +| Scenario | Duration | Team | +|----------|----------|------| +| Solo developer (you + AI) | 12-18 months | 1 person | +| Small team (2-3 Rust devs) | 6-9 months | 2-3 people | +| With AI-accelerated development | 8-12 months | 1 person + AI pair | + +### Cost Estimate (Solo + AI) + +| Item | Cost | +|------|------| +| Development time (12 months, opportunity cost) | $0 (self-funded sweat equity) | +| Fedora Server (dev/test VMs) | $0 (existing homelab) | +| ZeroTier (free tier up to 25 nodes) | $0 | +| OpenBao (self-hosted, open source) | $0 | +| Domain + Cloudflare (existing) | $0 | +| Security audit (external, optional) | $2,000-$5,000 | +| GPU terminal (Kitty/Ghostty) | $0 (open source) | +| **Total hard costs** | **$0 - $5,000** | + +--- + +## Risk Assessment + +| Risk | Likelihood | Impact | Mitigation | +|------|-----------|--------|-----------| +| Rust learning curve slows development | High | Medium | Use AI pair programming; start with working Ratatui examples | +| Self-destruct triggers falsely (hardware change) | Medium | High | Grace period + re-activation flow; don't wipe on first failure | +| Terminal graphics don't look as good as mockups | Medium | Medium | Require Kitty/Ghostty; use Sixel for raster; accept TUI limits | +| Browser extension performance (WASM overhead) | Medium | Low | Keep browser as secondary; TUI is primary | +| Fedora check bypassed by sophisticated attacker | Low | Medium | Combine 5+ signals; TPM binding is hardest to fake | +| OpenBao/ZeroTier API changes break integration | Low | Low | Pin versions; abstract behind interfaces | + +--- + +## GitHub Repos Reference List + +### Core Stack (MUST USE) + +| Tool | Repo | Role in SCC | +|------|------|-------------| +| Ratatui | https://github.com/ratatui/ratatui | TUI rendering engine | +| ratatui-image | https://github.com/benjajaja/ratatui-image | Terminal graphics (Sixel/Kitty) | +| OpenBao | https://github.com/openbao/openbao | Secrets management, encryption, key rotation | +| ZeroTier | https://github.com/zerotier/ZeroTierOne | Encrypted mesh networking | +| Graphify | https://github.com/Graphify-Labs/graphify | Knowledge graph / neural graph data | +| Termix | https://github.com/Termix-SSH/Termix | SSH + remote desktop management | +| superfile | https://github.com/yorukot/superfile | File manager UX reference (Encrypted Vault module) | +| xterm.js | https://github.com/xtermjs/xterm.js | Browser extension terminal renderer | +| tmux | https://github.com/tmux/tmux | Session persistence + multiplexing | +| micro | https://github.com/zyedidia/micro | Embedded text editor | + +### Supporting / Reference + +| Tool | Repo | Role | +|------|------|------| +| Ghostty | https://github.com/ghostty-org/ghostty | Recommended terminal emulator (GPU-accelerated) | +| Kitty | https://github.com/kovidgoyal/kitty | Alternative GPU terminal + graphics protocol spec | +| Ratty | https://github.com/orhun/ratty | Proof-of-concept: 3D graphics in terminal | +| ghostty-web | https://github.com/coder/ghostty-web | Browser-side VT100 with Kitty protocol | +| Bubble Tea | https://github.com/charmbracelet/bubbletea | Go TUI framework (superfile's engine, reference only) | +| ui-screenshot-to-prompt | https://github.com/s-smits/ui-screenshot-to-prompt | Blueprint extraction helper | +| layout-detector-mcp | https://github.com/katlis/layout-detector-mcp | MCP layout analysis from screenshots | +| UIED | https://github.com/MulongXie/UIED | UI element detection from images | +| Wazuh | https://github.com/wazuh/wazuh | SIEM/HIDS (event source for Threat Intel) | +| Suricata | https://github.com/OISF/suricata | Network IDS (event source for Network Monitor) | +| Trivy | https://github.com/aquasecurity/trivy | Vulnerability scanner | +| gitleaks | https://github.com/gitleaks/gitleaks | Secret scanning | + +### Rust Crypto Crates (not GitHub repos, from crates.io) + +| Crate | Role | +|-------|------| +| `ring` | Core cryptographic primitives (AES, SHA, ECDSA) | +| `rustls` | TLS 1.3 implementation | +| `aes-gcm` | AES-256-GCM encryption | +| `age` | File encryption (used by Encrypted Vault) | +| `ed25519-dalek` | License blob signing/verification | +| `blake3` | Fast hashing for integrity checks | +| `sodiumoxide` | NaCl bindings (alternative crypto) | + +--- + +## Decision Points (Need Your Input) + +1. **License model:** Proprietary? Source-available (BSL)? Per-seat? Per-server? Proprietary ( Not for sale) +2. **Theft report endpoint:** Public GitHub Gist? Private webhook? Forgejo repo? Public github +3. **Browser extension:** Chrome-only? Firefox too? Both? cHROME ONLY +4. **Fleet module:** Real GPS hardware integration? Or IP-based/software-defined "fleet"? +5. **First module to build:** Which SCC tab ships first as MVP? *Vault tab is first. +6. **Naming:** Is "SCC" the product name, or is there a market-facing brand? This will not be marketed it s form my company SnS network solutions (a PRODUCTT of secure devision) + +--- + +## Bottom Line + +This is buildable. It's a **12-month solo project** (with AI acceleration) or a **6-month team effort**. The hardest parts are: +1. The anti-theft hardware binding (must be robust but not false-positive prone) +2. Terminal 3D graphics (possible with Kitty protocol + Sixel, but limited vs the mockup's visual richness) +3. The browser extension (WASM + WebSocket bridge is non-trivial) + +The open-source tooling exists for every major component. The novel code is the **integration layer** (wiring OpenBao + ZeroTier + Graphify + ratatui into a cohesive product) and the **anti-theft system** (no existing OSS does this in the way you described). + +Rust is the right choice because: hardest to reverse-engineer, fastest execution, best crypto ecosystem, first-class WASM for browser extension, and memory safety without a garbage collector. diff --git a/products/secure/scc/docs/neural-security-graph.md b/products/secure/scc/docs/neural-security-graph.md new file mode 100644 index 0000000..8f01d81 --- /dev/null +++ b/products/secure/scc/docs/neural-security-graph.md @@ -0,0 +1,240 @@ +# Neural Security Graph — Research & Tooling + +## Product Context — SnS Secure Command Center (SCC) + +The SCC is a **military/defense-grade security operations platform** with 5 modules: +- **Cyber Ops** — main dashboard: terminal CLI, network traffic, tactical map, encryption status, fleet overview, threat level +- **Network Monitor** — real-time traffic, segment topology, top talkers, protocol distribution, firewall rule hits, security alerts +- **Tactical Fleet** — vehicle tracking (armored transport, executive protection), GPS map, mission/fuel/maintenance status +- **Threat Intel** — global threat landscape, IOCs, CVE tracking, threat actors, campaign progress, intelligence feeds +- **Encrypted Vault** — classified document storage, key rotation, zero-trust data flow pipeline, access control, integrity monitoring + +**Visual language**: terminal-green on black, monospace fonts, panel-based layout, real-time live data, military C2 aesthetic. + +The **Neural Security Graph** is a proposed addition/layer — a live force-directed visualization where infrastructure nodes pulse like neurons when accessed, and the graph grows organically as new connections form. + +--- + +## Key Open-Source Tooling + +### 1. Graphify — Knowledge Graph Engine (graph data layer) + +| | | +|---|---| +| **Repo** | https://github.com/Graphify-Labs/graphify | +| **What it does** | Turns code, configs, docs, and infra-as-code into a queryable knowledge graph (JSON) | +| **Install** | `uv tool install graphifyy` | +| **Relevant extras** | `graphifyy[mcp]` (MCP server), `graphifyy[terraform]` (HCL/Terraform extraction) | +| **License** | Open source (MIT) | +| **Key feature** | Local-first AST parsing via tree-sitter — code never leaves the machine | +| **Language** | Python | + +**Role in SCC:** Builds the static graph structure from infra configs (nftables, netplan, cloud-init, docker-compose, Proxmox configs). This is the "brain anatomy" — the connections that exist. Queryable via MCP server or CLI. + +**Useful commands:** +```bash +graphify extract ./infra/ --code-only # local, no API needed +graphify query "what connects br0 to the internet" +graphify path "ws-nat" "wlp2s0" +graphify watch ./dotfiles # auto-rebuild on change +python -m graphify.serve graph.json --transport http --port 8080 --api-key "$SECRET" +``` + +--- + +### 2. Superfile — Terminal File Manager (TUI framework reference) + +| | | +|---|---| +| **Repo** | https://github.com/yorukot/superfile | +| **Website** | https://superfile.dev | +| **What it does** | Modern, fancy terminal file manager with multi-panel layout | +| **Install** | `bash -c "$(curl -sLo- https://superfile.dev/install.sh)"` | +| **License** | MIT | +| **Language** | Go (built on [Bubble Tea](https://github.com/charmbracelet/bubbletea) TUI framework) | + +**Features relevant to SCC:** +- **Multi-panel split view** — multiple directory panes side-by-side (maps to SCC's panel-based layout) +- **Keyboard-driven navigation** — vim-like keybindings (matches the terminal-operator UX of SCC) +- **20+ built-in themes** — Catppuccin, Nord, Tokyo Night, Dracula, Gruvbox (SCC uses its own dark/green military theme) +- **Plugin system** — extensible with git status, system monitoring, custom commands +- **Fuzzy search** — quick file/node lookup +- **Image preview** — inline terminal rendering +- **Bulk operations** — multi-select, batch actions +- **Customizable hotkeys** — every key remappable +- **Built on Bubble Tea** — the Go TUI framework (same tech could power a terminal-native SCC) + +**Role in SCC:** Superfile's architecture is a **direct reference for building the Encrypted Vault module as a TUI**. Its multi-panel, theme-able, plugin-extensible design is exactly what an operator terminal for classified file management needs. The Bubble Tea framework underneath is the same one we'd use to build a terminal-native version of the full SCC dashboard. + +**Specifically maps to SCC modules:** +| Superfile feature | SCC module it maps to | +|---|---| +| Multi-panel file browsing | Encrypted Vault (browse classified docs across panels) | +| Plugin system (git status, sys monitor) | Cyber Ops (live system vitals as plugins) | +| Theme engine (green-on-black) | All modules (military C2 aesthetic) | +| Fuzzy search | Network Monitor (search nodes/connections), Threat Intel (search IOCs) | +| Bulk operations | Fleet management (batch commands to vehicles) | +| Keyboard-driven | All modules (operator efficiency, no mouse needed) | + +--- + +### 3. Bubble Tea — Go TUI Framework (the engine) + +| | | +|---|---| +| **Repo** | https://github.com/charmbracelet/bubbletea | +| **What it does** | The Elm-architecture TUI framework that powers superfile | +| **Ecosystem** | [Lip Gloss](https://github.com/charmbracelet/lipgloss) (styling), [Bubbles](https://github.com/charmbracelet/bubbles) (components) | +| **License** | MIT | + +If we build SCC as a terminal-native app (not browser), Bubble Tea + Lip Gloss is the stack. Gives us panels, borders, colors, responsive layouts, and keyboard handling — all in Go with no dependencies. + +--- + +## Event Sources (the "nerve impulses") + +| Source | What it catches | Tool/Command | +|--------|----------------|--------------| +| File access | Config reads/writes, vault document access | `inotifywait -m -r -e access,open,modify` | +| Network connections | New flows through NAT/firewall | `conntrack -E -e NEW` | +| SSH sessions | Remote access events | `journalctl -f -t sshd` | +| Service state | Start/stop/restart | `journalctl -f` filtered by unit | +| Security events | Sensitive file access | `auditd` with custom rules | +| Graph changes | New infra relationships | `graphify watch` / `graphify --watch` | +| Fleet telemetry | Vehicle GPS, speed, fuel | Custom feed (GPS tracker API) | +| Threat feeds | IOCs, CVEs, actor activity | OSINT feeds, honeypots, partner sharing | + +--- + +## Visualization Approaches + +### Option A — Browser-based (D3.js force graph + WebSocket) + +Best for the **neural firing** effect. Rich animations, glow, particle trails along edges. + +| Tool | Role | Link | +|------|------|------| +| D3.js (force layout) | Graph physics + rendering | https://github.com/d3/d3-force | +| WebSocket API | Real-time event push to browser | Native browser API | +| Graphify `graph.html` | Starting point (already force-directed) | Generated by `graphify extract` | + +Extends Graphify's output with: +- WebSocket client receiving live events +- SVG glow/pulse animations on node activation (neuron firing) +- Edge particle animations (impulse traveling along connection) +- Dynamic node/edge insertion (graph grows organically) +- Decay: inactive nodes dim, active nodes brighten +- Fits into the SCC dashboard as an embedded panel (Network Monitor → Topology Map, or its own tab) + +### Option B — Terminal-native (Bubble Tea / Go) + +Same stack as superfile. Pure terminal, no browser. Fits the SCC aesthetic perfectly. + +| Tool | Role | Link | +|------|------|------| +| Bubble Tea | TUI framework (event loop, components) | https://github.com/charmbracelet/bubbletea | +| Lip Gloss | Styling (green-on-black, borders, panels) | https://github.com/charmbracelet/lipgloss | +| Bubbles | Pre-built components (tables, spinners, viewports) | https://github.com/charmbracelet/bubbles | + +Terminal approach caps at ~50-100 visible nodes but matches the operator terminal UX from the blueprints exactly. Could render a simplified topology map with ANSI color pulses. + +### Option C — Hybrid (terminal panels + embedded browser graph) + +The SCC shell is a terminal app (Bubble Tea) with panels for CLI, tables, status. The neural graph is a browser panel served locally (`localhost:8080`) or rendered via Sixel/Kitty graphics protocol for inline terminal display. + +--- + +## Supporting Security Tools (complement the graph) + +| Category | Tool | Link | Role in SCC | +|----------|------|------|-------------| +| HIDS/SIEM | Wazuh | https://github.com/wazuh/wazuh | Event source → feeds alerts to Cyber Ops + Threat Intel | +| Vulnerability scanning | Trivy | https://github.com/aquasecurity/trivy | Feeds Top Vulnerabilities in Threat Intel | +| Secret scanning | gitleaks | https://github.com/gitleaks/gitleaks | Vault integrity checks | +| Network IDS/IPS | Suricata | https://github.com/OISF/suricata | Feeds Network Monitor + security alerts | +| Log aggregation | Grafana Loki | https://github.com/grafana/loki | Backend for all activity logs | +| Uptime/health | Uptime Kuma | https://github.com/louislam/uptime-kuma | Node health status (already running on pve2) | +| Encryption | Age / SOPS | https://github.com/FiloSottile/age | Vault encryption layer | + +--- + +## Architecture + +``` +┌─────────────────────────────────────────────────────────────────────────┐ +│ SnS SECURE COMMAND CENTER │ +├─────────────────────────────────────────────────────────────────────────┤ +│ │ +│ ┌─────────────┐ ┌──────────────┐ ┌─────────────┐ ┌──────────────┐ │ +│ │ CYBER OPS │ │ NETWORK │ │ TACTICAL │ │ THREAT │ │ +│ │ (main CLI │ │ MONITOR │ │ FLEET │ │ INTEL │ │ +│ │ + status) │ │ (topology) │ │ (GPS map) │ │ (IOC/CVE) │ │ +│ └──────┬──────┘ └──────┬───────┘ └──────┬──────┘ └──────┬───────┘ │ +│ │ │ │ │ │ +│ └─────────────────┼──────────────────┼─────────────────┘ │ +│ │ │ │ +│ ┌──────▼──────────────────▼──────┐ │ +│ │ NEURAL SECURITY GRAPH │ │ +│ │ (force-directed, live pulses) │ │ +│ │ │ │ +│ │ Graphify (structure) ──────┐ │ │ +│ │ Event feed (WebSocket) ────┤ │ │ +│ │ D3.js / Bubble Tea (render)┘ │ │ +│ └────────────────────────────────┘ │ +│ │ +│ ┌─────────────────────────────────────────────────────────────────────┐ │ +│ │ ENCRYPTED VAULT │ │ +│ │ (superfile-style TUI: multi-panel, classified docs, key rotation) │ │ +│ └─────────────────────────────────────────────────────────────────────┘ │ +│ │ +├─────────────────────────────────────────────────────────────────────────┤ +│ EVENT SOURCES: inotify · conntrack · auditd · journald · suricata │ +│ GRAPH ENGINE: Graphify (graph.json) · MCP server · watch mode │ +│ TUI FRAMEWORK: Bubble Tea + Lip Gloss (Go) — or browser (D3.js) │ +└─────────────────────────────────────────────────────────────────────────┘ +``` + +--- + +## 7 Layers of Digital Security (reference) + +1. **Physical Security** — hardware locks, encrypted drives, secure access +2. **Network Perimeter** — firewalls, VPN/mesh, NAT, DDoS mitigation +3. **Identity & Access Management** — SSO, MFA, least-privilege, scoped tokens +4. **Application Security** — input validation, parameterized queries, WAF +5. **Data Security** — encryption at rest/transit, tokenization, backup encryption +6. **Monitoring & Detection** — logs, SIEM, IDS, anomaly detection +7. **Recovery & Resilience** — tested backups, DR runbooks, incident response + +The Neural Security Graph serves **Layer 6** but provides visibility into Layers 2–5 by mapping their configurations as queryable relationships. The Encrypted Vault covers **Layer 5**. Threat Intel feeds **Layers 2–4** with actionable intelligence. + +--- + +## SCC Module → Open-Source Mapping + +| SCC Module | Primary OSS Tool | Secondary | +|------------|-----------------|-----------| +| Cyber Ops (CLI dashboard) | Bubble Tea (TUI) | Graphify (status queries) | +| Network Monitor | Suricata + Graphify (topology) | D3.js (live graph) | +| Tactical Fleet | Custom (GPS feed) | Bubble Tea (TUI panels) | +| Threat Intel | Wazuh + OSINT feeds | Graphify (IOC relationships) | +| Encrypted Vault | Superfile (TUI file mgr pattern) + Age (encryption) | gitleaks (integrity) | +| Neural Graph (new) | Graphify + D3.js | inotify/conntrack (events) | + +--- + +## Status + +- [ ] Define scope: which SCC modules are being built vs. conceptual +- [ ] Decide: terminal-native (Bubble Tea/Go) vs. browser (D3/Electron) vs. hybrid +- [ ] Install Graphify and build initial graph from infra configs +- [ ] Prototype the neural firing visualization +- [ ] Map superfile's plugin architecture to Encrypted Vault module +- [ ] Integrate event sources (inotify, conntrack, auditd) +- [ ] Connect to real security tooling (Wazuh/Suricata as event feeders) + +--- + +## Notes + +*Waiting on Sam to define: what is this product? A real deployable tool for clients? An internal ops dashboard? A product you're selling? That determines build priority and tech choices.* diff --git a/products/secure/scc/docs/scc-encrypt-blueprint.md b/products/secure/scc/docs/scc-encrypt-blueprint.md new file mode 100644 index 0000000..c6ab266 --- /dev/null +++ b/products/secure/scc/docs/scc-encrypt-blueprint.md @@ -0,0 +1,192 @@ +# SCC Encrypted Vault — Blueprint Layout + +## TOP BAR (full width, fixed) + +| Position | Category | +|----------|----------| +| Top-Left | [BRAND-LOGO] | +| Top-Left (beside logo) | [BRAND-NAME] | +| Top-Left (sub-logo) | [BRAND-TAGLINE] | +| Top-Center | [NAV-TABS] | +| Top-Center (active) | [NAV-TAB-ACTIVE] | +| Top-Right | [USER-IDENTITY] | +| Top-Right (below user) | [SESSION-ID] | +| Top-Right (below session) | [CLEARANCE-LEVEL] | +| Top-Right (icon) | [AUTH-LOCK-ICON] | + +--- + +## MAIN CONTENT (3-column layout) + +### LEFT COLUMN + +#### Panel 1 — Top-Left +| Position | Category | +|----------|----------| +| Panel Header | [VAULT-STATUS-TITLE] | +| Center Graphic | [VAULT-STATUS-GRAPHIC] | +| Graphic Description | Circular shield/lock emblem with concentric rings — represents vault seal state. Animated rotation or glow when vault is active/healthy. | +| Below Graphic | [VAULT-PRODUCT-NAME] | +| Below Name | [VAULT-PROTECTION-LABEL] | +| Below Label | [VAULT-PROTECTION-SUBLABEL] | +| Row 1 (icon + label + value) | [VAULT-INTEGRITY-METRIC] | +| Row 2 (icon + label + value) | [ENCRYPTION-LAYER-COUNT] | +| Row 3 (icon + label + value) | [KEY-ROTATION-STATUS] | +| Row 4 (icon + label + value) | [ACCESS-CONTROL-STATUS] | +| Row 5 (icon + label + value) | [AUDIT-LOGGING-STATUS] | +| Bottom | [LAST-CHECK-TIMESTAMP] | + +#### Panel 2 — Mid-Left +| Position | Category | +|----------|----------| +| Panel Header | [ENCRYPTION-OVERVIEW-TITLE] | +| Row 1 | [ALGORITHM-TYPE] | +| Row 2 | [KEY-SIZE] | +| Row 3 | [HASH-ALGORITHM] | +| Row 4 | [KEY-DERIVATION-METHOD] | +| Row 5 | [VAULT-SALT] | +| Row 6 | [HMAC-STATUS] | +| Row 7 | [QUANTUM-RESISTANT-STATUS] | + +#### Panel 3 — Bottom-Left +| Position | Category | +|----------|----------| +| Panel Header | [STORAGE-UTILIZATION-TITLE] | +| Graphic | [STORAGE-BAR-CHART] | +| Value | [STORAGE-USED-VS-TOTAL] | +| Sub-value | [STORAGE-PERCENTAGE] | +| Legend Row 1 | [USED-INDICATOR] | +| Legend Row 2 | [AVAILABLE-INDICATOR] | +| Legend Row 3 | [RESERVED-INDICATOR] | + +--- + +### CENTER COLUMN + +#### Panel 4 — Top-Center +| Position | Category | +|----------|----------| +| Panel Header | [VAULT-CONTENTS-TITLE] | +| Stat Box 1 | [DOCUMENT-COUNT] | +| Stat Box 2 | [CREDENTIAL-COUNT] | +| Stat Box 3 | [KEYS-CERTS-COUNT] | +| Stat Box 4 | [CONFIGURATION-COUNT] | +| Stat Box 5 | [INTEL-PACKET-COUNT] | +| Stat Box 6 | [BACKUP-SET-COUNT] | + +#### Panel 5 — Mid-Center (file browser) +| Position | Category | +|----------|----------| +| Breadcrumb | [FILE-PATH-BREADCRUMB] | +| Toolbar | [FILE-ACTION-BUTTONS] | +| Toolbar Right | [SEARCH-INPUT] | +| Table Header Col 1 | [FILE-NAME-HEADER] | +| Table Header Col 2 | [FILE-TYPE-HEADER] | +| Table Header Col 3 | [FILE-SIZE-HEADER] | +| Table Header Col 4 | [LAST-MODIFIED-HEADER] | +| Table Header Col 5 | [CLASSIFICATION-HEADER] | +| Table Header Col 6 | [OWNER-HEADER] | +| Table Rows | [FILE-LIST-ROWS] | + +#### Panel 6 — Mid-Center (below file browser) +| Position | Category | +|----------|----------| +| Panel Header | [DATA-FLOW-TITLE] | +| Step 1 (icon + label) | [FLOW-STEP-AUTH] | +| Arrow | [FLOW-CONNECTOR] | +| Step 2 (icon + label) | [FLOW-STEP-ZERO-TRUST] | +| Arrow | [FLOW-CONNECTOR] | +| Step 3 (icon + label) | [FLOW-STEP-ENCRYPTION] | +| Arrow | [FLOW-CONNECTOR] | +| Step 4 (icon + label) | [FLOW-STEP-STORAGE] | +| Arrow | [FLOW-CONNECTOR] | +| Step 5 (icon + label) | [FLOW-STEP-INTEGRITY] | +| Arrow | [FLOW-CONNECTOR] | +| Step 6 (icon + label) | [FLOW-STEP-AUDIT] | + +#### Panel 7 — Bottom-Center +| Position | Category | +|----------|----------| +| Panel Header | [ACTIVITY-LOG-TITLE] | +| Row Format | [TIMESTAMP] [EVENT-TYPE] [EVENT-DESCRIPTION] [ACTION-TAG] | +| Row Types | [SYSTEM-EVENT] / [READ-EVENT] / [WRITE-EVENT] / [BLOCKED-EVENT] | + +--- + +### RIGHT COLUMN + +#### Panel 8 — Top-Right +| Position | Category | +|----------|----------| +| Panel Header | [KEY-MANAGEMENT-TITLE] | +| Sub-header | [PRIMARY-KEY-LABEL] | +| Icon | [KEY-STATUS-ICON] | +| Row 1 | [KEY-ID] | +| Row 2 | [KEY-CREATED-DATE] | +| Row 3 | [KEY-EXPIRY-DATE] | +| Action Button | [ROTATE-KEYS-BUTTON] | +| Sub-section Header | [RECENT-ROTATIONS-TITLE] | +| Rotation Row Format | [ROTATION-DATE] [KEY-VERSION] [ROTATION-STATUS] | +| Action Link | [VIEW-KEY-HISTORY-LINK] | + +#### Panel 9 — Mid-Right +| Position | Category | +|----------|----------| +| Panel Header | [ACCESS-CONTROL-TITLE] | +| Stat | [ACTIVE-SESSION-COUNT] | +| Session Row Format | [USERNAME] [LOGIN-TIMESTAMP] [STATUS-INDICATOR] | +| Action Link | [VIEW-ACCESS-LOG-LINK] | + +#### Panel 10 — Bottom-Right +| Position | Category | +|----------|----------| +| Panel Header | [INTEGRITY-MONITOR-TITLE] | +| Graphic | [INTEGRITY-MONITOR-GRAPHIC] | +| Graphic Description | 3D isometric cube/server block with layered horizontal scan lines — represents the physical storage cluster being scanned. Animated scan sweep when integrity check is running. | +| Primary Metric Label | [INTEGRITY-SCORE-LABEL] | +| Primary Metric Value | [INTEGRITY-SCORE-VALUE] | +| Primary Metric Max | [INTEGRITY-SCORE-MAX] | +| Primary Metric Status Word | [INTEGRITY-STATUS-WORD] | +| Row 1 Label | [REDUNDANCY-LABEL] | +| Row 1 Value | [REDUNDANCY-TYPE] | +| Row 2 Label | [GEOGRAPHIC-REPLICAS-LABEL] | +| Row 2 Value | [GEOGRAPHIC-REPLICA-COUNT] | +| Row 2 Status | [GEOGRAPHIC-REPLICA-STATUS] | +| Row 3 Label | [LAST-SCAN-LABEL] | +| Row 3 Value | [LAST-SCAN-TIMESTAMP] | + +--- + +## BOTTOM BAR (full width, fixed) + +| Position | Category | +|----------|----------| +| Bottom-Left | [SYSTEM-TIMESTAMP] | +| Bottom-Center-Left | [CONNECTION-STATUS-INDICATOR] | +| Bottom-Center | [UPTIME-COUNTER] | +| Bottom-Right | [SYSTEM-HEALTH-BAR] | +| Bottom-Far-Right | [HEALTH-PERCENTAGE] | + +--- + +## LAYOUT GRID SUMMARY + +``` +┌──────────────────────────────────────────────────────────────────────┐ +│ [BRAND-LOGO] [BRAND-NAME] [NAV-TABS...] [USER] [SESSION] │ +├────────────┬─────────────────────────────────────┬───────────────────┤ +│ │ [VAULT-CONTENTS-STAT-BOXES] │ │ +│ [VAULT- ├─────────────────────────────────────┤ [KEY-MANAGEMENT] │ +│ STATUS] │ [FILE-BROWSER-TABLE] │ │ +│ │ │ │ +├────────────┤ ├───────────────────┤ +│ [ENCRYPT- ├─────────────────────────────────────┤ [ACCESS-CONTROL] │ +│ OVERVIEW] │ [DATA-FLOW-PIPELINE] │ │ +│ ├─────────────────────────────────────┤ │ +├────────────┤ [ACTIVITY-LOG] ├───────────────────┤ +│ [STORAGE- │ │ [INTEGRITY- │ +│ UTIL] │ │ MONITOR] │ +├────────────┴─────────────────────────────────────┴───────────────────┤ +│ [TIMESTAMP] [CONNECTION] [UPTIME] [SYSTEM-HEALTH-BAR] │ +└──────────────────────────────────────────────────────────────────────┘ +```