Supporting system

HQ.VPS

Private MCP and HTTP backend for audited personal operations and approval-gated write proposals.

Tier: Supporting system
Pillar: Agent governance
Visibility: Private
Status: proprietary
Date: Dec 2025

Case boundary

Private MCP/HTTP backend for personal operations with typed stores, dashboard modules, approval-gated writes, backups, and audit logs.

Claim boundary

Architecture and control surface only; private data, credentials, and operational traces are not public evidence.

HQ.VPS is a private backend for agent-assisted personal operations.

It exposes MCP tools, domain adapters, dashboard modules, and audited write boundaries behind a loopback/private-network runtime.

System

Domain adapters for calendar, notes, finances, projects, people, health, inventory, and related workflows
Typed JSON stores with size limits and schema validation
Dashboard modules composed across adapters
MCP tools and HTTP routes share the same policy boundaries

Runtime

Loopback HTTP API and stdio MCP server
Tailscale-served private access with bearer auth and no-store headers
systemd VPS layout managed through project-control scripts
Automatic backups and structured audit logs

Proof

Write proposals require explicit approval, UUID tracking, and short-lived TTLs
Delete operations are blocked at the mutation gate
Subprocess environment scrubbing strips credentials before shell delegation
Google Workspace wrappers keep external side effects behind policy checks