Manual

Introduction

The Supermicro Sales Accelerator is an on-premise agentic operating system for the entire deal lifecycle — from first opportunity to a system running in production — and for the relay of thirteen people who run it together, each on an iPad. Ten stages, an agent at every junction, and a heterogeneous model council for the calls that must be right.

Two principles run through everything:

• On-premise, zero-egress by default. Deals, prices, customers and voice never leave the box. A governed gateway pulls public world data in — always audited, never carrying your data out.
• Never trust one model on a call that matters. Where the answer is judgment (compliance, sourcing, factual Q&A), a panel of different-family local models votes and an adjudicator reconciles; a lone claim is flagged, never trusted.

Getting started

Access

The app runs on the office node and is reached over the tailnet (Tailscale MagicDNS, HTTPS). There are no passwords — each person picks their name and enters a PIN (five wrong attempts lock the account for ten minutes). One person per junction, though the same person can cover several stages. On an iPad, use Share → Add to Home Screen — the app installs like a native one, icon and all.

The launcher

After the PIN, everyone lands on a launcher of department tiles — the pipeline stages they own, plus shared tools and reference. Because there are more stages than people, each user adds the departments they cover via the "Add department" tile. An admin can restrict who may add what (see Administration).

Your first deal

1. Open Worklist to see the tasks waiting on you, each with an SLA clock.
2. Open Cockpit to see any deal as a program record walking the ten stages.
3. Advance a deal and the baton passes automatically into the next roles' worklists; a bell tells them it's their turn.

The deal lifecycle

Every deal is a program record (keyed to a unique Customer ID, like a patient chart) advanced through a state machine. Stage 4, Compliance, is a hard gate — the deal cannot move to Order without an explicit human clearance.

The relay · thirteen roles

A deal is a relay, not one operator. Each role opens to its own worklist and owns specific junctions; two roles are external (no account — they act via a scoped link, see Customer portal and below).

Surfaces & tiles

One iPad-native workspace, not five stitched tools. Tiles are grouped into pipeline, tools and reference, filtered by role.

Capture & proof of work

Open a task and log what happened without typing:

• Voice. Just say it — "received six of eight, one crate damaged, burn-in running." Transcribed on-box by a native MLX-Whisper service (~200 ms warm) with a browser fallback, then mapped into the form's fields by a local model.
• Photo. Snap a packing slip or the damage; downscaled on-device.
• Proof. A signature pad, a barcode/serial scan, a device geo-stamp, and draw-on-the-photo annotation to circle the issue.
• Offline. Captures queue on a dead dock and sync idempotently on reconnect — dual timestamps preserve when it happened vs. when it landed.

Every capture is attributed to a real person, role and device, and appended to the deal's immutable event log.

The consensus councils

For the calls that must be right, a heterogeneous panel of different-family local models answers the same question independently; an adjudicator reconciles without adding facts of its own:

• Agreements the panel converges on → reliable, kept.
• Flags — a claim made by only one model, unsupported → likely a hallucination, excluded from the answer.

Used at Sourcing (supply risk from the customer's actual rig), Compliance (the hard gate), party screening, and factual Q&A on a deal. The default panel is gemma3:27b · glm-4.7-flash · qwen2.5:72b; the arbiter defaults to the local Claude bridge but can be pinned to a local model for a fully-on-prem judge.

Cost-arbitrage, tiers & guardrails

Cost-arbitrage holds the configuration quantity constant and compares the current SKU against its interchangeable alternates on total landed cost (hardware + freight) and whether the path holds the tier's committed order-to-delivery window. It recommends the cheapest window-holding path, surfacing any swap with its cost delta.

Every deal carries a tier that sets service and commercial guardrails:

A deal below the margin floor or above the discount ceiling trips an approval gate (Deal Desk / VP Sales).

AI Toolkit & model router

The AI Toolkit (a department tile → /tools/ai) bundles the non-pipeline AI utilities any desk reaches for:

How work is routed

A model router classifies each task by sensitivity × difficulty and picks a tier:

Egress gateway & world-feed

World-aware features need public data pulled in without breaking the on-prem promise. Everything that leaves the box goes through one governed proxy in the sidecar:

• Deny-by-default. Only registered connectors can egress; each is admin-toggled in the Trust Center.
• Data-scrub. Any request whose parameters carry sensitive data is hard-blocked, not just redacted.
• Ledgered. Every attempt — allowed or blocked — writes an immutable row (actor · connector · host · params · status).
• Rate-limited per connector.

Fetched data lands in a local world-feed store; the app reads only from there, so the iPad stays fast and offline-safe over the tailnet. For the demo the store is populated live by the gateway (weather) or by an agent snapshot; on customer hardware, live connectors keep it fresh.

The world-aware pipeline

On the Fulfillment stage, the lane reads real destination weather and turns it into a delivery-risk read — the shipment that warns itself:

• Clear / Watch / At-risk with a reason, e.g. "thunderstorm at Atlanta — last-leg delivery likely to slip."
• A dynamic ETA slip estimate (severe weather → ~3 days).
• The risk is read from the local world-feed store, refreshed through the gateway when stale.

The Command Center (below) rolls every in-transit lane up into a single "shipments warning themselves" panel.

Price intelligence

Shipments take months; prices move. On the Sourcing arbitrage card, a quote becomes a band, not a number:

• Forward price band. The likely price range at the delivery horizon (an 80% band), widening with the delivery lag and the item's volatility.
• Live volatility. When a market signal is present (prediction-market volatility, GPU spot, freight), the band shifts and widens to live conditions, with the named drivers.
• Recommendation. Lock now / hedge / re-quote / hold — with the dollars at stake and a Deal-Desk guardrail when the move exceeds the tier's discount ceiling.
• Slip in dollars. A weather ETA slip is priced: "a ~3-day slip ≈ +$X forward exposure — worth expediting?"

Live map & Command Center

Live map

The route map is a real, interactive map (pan/zoom) with zero tile egress — the geography is bundled offline, no tile server. The route arc, the animated position and a weather-coloured destination marker render on it.

Command Center

A dark, big-screen war-room at /command (leadership-gated) that reads only local state and auto-refreshes:

• KPI row — pipeline value, in-transit, at-risk shipments, egress today, world feeds.
• Pipeline-by-stage funnel; a "shipments warning themselves" panel; a spotlight live map.
• The world-feed ticker and the egress ledger, side by side.

Customer portal

Give the customer a window into their order without an account. From the Cockpit deal header, click "Share with customer →" — it mints a scoped, expiring (30-day), read-only link and copies it to the clipboard.

The customer opens /c/<token> and sees, live: the order status, a milestone timeline, the shipment on the map, and their warranty/support — with no margin or internal pricing exposed. The link is the capability; there is no login.

Webhooks / event bus

The deal state machine emits events; registered systems receive a signed POST, delivered through the same governed gateway (so every delivery is scrubbed and ledgered). Register and manage subscribers in the Trust Center.

Payloads are minimal (ids + stage, no PII); a subscriber fetches detail by id. Verify the X-SM-Signature: sha256=… HMAC header with the signing secret shown once at registration.

Trust & governance

The Trust Center is the one place that answers "who can do what, what happened, and what left the box":

• RBAC. One capability model over the whole accelerator; the admin holds every capability, each role a subset.
• Audit trail. One immutable, chronological event log across every deal and actor.
• Egress ledger. Every outbound call, with per-connector on/off and the data-leak-block count.
• Webhooks. Registered integrations and their events.
• On-prem mesh & offline. Every service inside the customer boundary; the app shell opens even on a dead network and never shows stale data as live.

Administration

• Department access (/admin/departments) — a checklist of who may add which departments; home stages stay locked on, the rest greyed out.
• Connectors (Trust Center → Egress) — toggle each egress connector on/off; unconfigured connectors (missing key) stay blocked.
• Webhooks (Trust Center → Integrations) — register/remove subscribers and their events.
• Settings — model hosting, prompts and providers.
• Model routing — env-configurable: local model tiers, the frontier target, and CLAUDE_CODE_ROUTING.

Deployment & ports

The whole stack runs on the office node under pm2 and is reached over the tailnet:

pm2 start ecosystem.config.js     # proposal app + sidecar
open http://localhost:26100        # or over the tailnet via MagicDNS (HTTPS)

Porting to a customer

1. Land the stack inside their boundary with pm2; iPads reach it over the tailnet on HTTPS/MagicDNS.
2. Load their world — real SKU catalog and pricing, tiers, and connect LeadGen.
3. Turn the connectors on — register real weather/carrier/market keys in the Trust Center; run bigger local models on their heavier compute.
4. Wire identity — graduate PINs to SSO / directory-backed RBAC (a PIN brute-force lockout is already live; add TOTP at this point).

Reference

Key environment variables

Glossary

Feature matrix

Every capability in the brief and where it stands today. Almost all of it is live on-premise; the short roadmap that remains is mostly about wiring real external systems.

96% · 33 built · 1 in progress · 2 roadmap

Guided walkthrough

The journey the film narrates (the 4½-minute full-capability tour walks every beat below). Run it yourself on the live app: sign in as any of the thirteen, work your queue, and follow one deal from a cold lead to a system running in production — every hand-off logged and audited.

1. Sign in by PIN → your worklist. Pick any of the thirteen seats and land on your own queue, with SLA clocks.
2. Surface an opportunity. Qualify a lead in LeadGen and open it in the Cockpit as a program record.
3. Fill the deal brief. Six sections, prefilled and one-tap — workload, scale, timeline, constraints, dictated where needed.
4. Generate the proposal. A brand-faithful PDF with the client-tier terms already applied.
5. Run the sourcing council — and read the forward price band: risk, qualified alternates, and whether to lock, hedge or re-quote.
6. Clear the compliance gate. The council screens end-use, ECCN and destination; a lone concern is flagged, not trusted. No clear, no order.
7. Book the order. Line items and tier terms; entitlements decide which approvals gate it.
8. Watch fulfillment on the live map — the real, on-prem map that warns itself when the destination weather turns.
9. Capture on the dock, by voice, then run it through the AI Toolkit — OCR the handwritten note, print a label.
10. Hand off to the driver & customer. A scoped link to confirm delivery; and the customer's own portal to watch the order live.
11. Deploy, enable & run the estate. Config-aware runbook; courseware; managed-ops with a path to rental.
12. Make the rack earn. Open LLM Routing & Tokenomics: what this configuration can host (DeepSeek, Llama 4, Qwen…), the endpoints it exposes, and the token economics — cost per million vs market, margin, and capex payback at the utilization slider.
13. Prove the trust layer & measure. Open the Trust Center — RBAC, audit, the egress ledger, webhooks — the Command Center war-room, and the Savings dashboard: the hours and dollars the accelerator gives back, from the attributed log. Then one tap on Deck → to carry the whole deal upward as a PDF.

Demo access

Two live instances, PIN-only entry, one person per junction. Demo 1 is the primary — the hub2 office node, published to the internet via Tailscale Funnel at aina.zapus-rohu.ts.net:8443 (locally: pm2 start ecosystem.config.js → localhost:26100). Demo 2 is the public failsafe at sm.ocdevide.com (docker compose). Ports are in Deployment.