# {{productName}} Architecture

{{productName}} runs on the {{productName}} platform — same Pi-on-premise spawn model, same Neo4j graph, same admin/public agent split, same Claude native surface. The `real-agent` premium bundle layers UK estate-agency-specific workflows and connectors on top.

## Three-layer composition

```
Plain-English request
        │
        ▼
Intent router (recognises the workflow)
        │
        ▼
Master workflow (one of five named jobs)
        │
        ▼
Building-block skills (auto-activated, never named to the operator)
        │
        ▼
Connectors (Loop CRM, PropertyData, portals, comms)
```

The operator never picks a skill, never picks a connector, and never invokes a slash command. They describe what they need; the router finds the workflow; the workflow composes the skills; the skills read and write through the connectors.

## Approval gating

Every write action — message send, document e-sign, payment instruction, listing publication — pauses for explicit operator approval before it fires. The pause is presented as a chat-native prompt ("send these three reminders?" with yes/edit/skip per item). No write action ever runs unattended.

Read actions do not pause. The morning round produces a snapshot without asking permission to look.

## Specialist split

Five specialists ship with the bundle. Four (Negotiator, Valuer, Compliance, Listing Curator) are admin-side: they run inside the operator's session and are dispatched by intent. One (Buyer Enquiry) is public-side: it runs in the visitor-facing chat on the agency's published domain.

The admin-side specialists embed domain knowledge from the sub-plugins and operate against Loop CRM, the memory graph, and (for Compliance) live web search for current legislation. The public-side specialist runs on a restricted tool surface and answers only from the agency knowledge base.

## Landing-page hosting

A property's "for sale" landing page is hosted durably on Cloudflare Pages. The `property-brochure` pipeline emits the web bundle as the canonical Pages source tree at `<accountDir>/pages/<slug>/`, and admin deploys it with `cloudflare:site-deploy`; the page answers on `https://<slug>.pages.dev/` and stays up when the install device is offline. The Listing Curator writes that Pages URL to the `:Listing` the public agent renders, so a buyer is always sent to the durable page. This is the durable home for the landing page, replacing the earlier device-tunnel default (`admin:publish-site`), which went dark whenever the device or tunnel was down.

## Per-account customization

Each {{productName}} install carries its own customization profile: brand voice, knowledge-base spine, Loop CRM credentials, PropertyData API key, and the agent's territory. Profile changes happen through conversation with the admin agent, not through a settings UI.