🛠️ Stack · Tech + AI + Payments + Security + Skills

Stack lean e moderno. Tutto cloud-native. Free tier o piani entry per i primi mesi, scaling solo quando serve. Il principio: ogni tool deve avere una via di uscita (no vendor lock-in nemmeno per noi).

Stack Core · Prodotto

Layer	Tool	Costo	Note
Frontend + Backend	Next.js 16.2.6 + React 19	€0	PWA installabile da browser (iOS Safari + Android Chrome) · Vision 2027 React Native (70-80% code reuse)
3D Dashboard	React Three Fiber v9 stable	€0	NucleoSphere centrale + 6 pianeti orbitanti. NO v10 alpha pre-10-Giu
DB + Auth + Storage + Realtime	Supabase eu-central-1	Free → $25/mo Pro	47+9 tabelle MVP · pgvector · pg_cron · pgmq · RLS multi-tenant · project `yqhixdqipojvgzfadufo` (Frankfurt). Free tier: 500MB DB, 1GB storage, 50K MAU (sufficiente fino ~50 clienti)
Deploy + CDN	Vercel	$0 dev → $20/mo Pro	`multiverbe.com` (landing) + `multiverbe.app` (dashboard) LIVE HTTPS. Hobby tier richiede upgrade a Pro appena hai clienti paganti (ToS)
Email transazionale Multiverbe	Brevo	Free 9K/mo → $20/mo Pro 50K	Sender `noreply@multiverbe.com` via `send.multiverbe.com` (DNS verificato 2026-05-10). Decisione 2026-05-10: Brevo per Multiverbe (Resend resta solo per Metaverbe agenzia per evitare brand mix + reputation cross-contamination)
Email transazionale Metaverbe agenzia	Resend	Free 3.000/mo	Sender `send.metaverbe.com` (legacy setup)
AI Cervello Multimodale	Google Gemini API	~$0.20/cliente/mo a regime	Powering Content Studio: img/video/audio + adattamento piattaforma + analisi performance. Tier free 1500 req/giorno per `gemini-1.5-pro`
AI-Assisted Development	Claude Code Max	€110/mo (Gregorio)	Strumento principale BUILD phase Mag-Giu. Da rivalutare a luglio quando app in produzione
Workflow engine · Background agentico	Inngest cloud + Supabase Edge Functions (cron)	Free 50K runs/mo → $25/mo	🟢 Nuovo 2026-05-20 · sostituisce n8n + Python legacy. Workflow durable event-driven (auto-retry · idempotente · state checkpoint). Endpoint `app.multiverbe.app/api/inngest` (adapter `inngest/express` · SDK v4). Integrazione ufficiale Vercel↔Inngest (org Inngest "Multiverbe", scope solo progetto `multiverbe-app`) auto-provisiona `INNGEST_SIGNING_KEY` + `INNGEST_EVENT_KEY` + sync on-deploy. App sincronizzata 2026-05-21 · 1ª funzione live `booking-reminder-smart` (trigger `booking/created`). Loop AI agenti = Anthropic Tool Use native (NO LangGraph). Registrazione app via URL canonico pubblico `multiverbe.app/api/inngest` (path durabile · Inngest ri-sincronizza quello). Vercel "Protection Bypass for Automation" già attivo (`VERCEL_AUTOMATION_BYPASS_SECRET`, dal 13 Mag); gli "unattached sync" dell'auto-sync integrazione (che colpisce l'URL deployment protetto) sono rumore cosmetico, non rompono la registrazione canonica · re-sync manuale solo se cambiano le funzioni
Backend Python (legacy MAIND)	Render.com	$7/mo → $0 post-disable	🔴 DEPRECATO 2026-05-10: 14 file Python + render.yaml archiviati in `legacy/maind-python/`. Sostituito da backend nuovo Next.js + Vercel functions + Inngest. Render service da disabilitare post-test (TODO founder)

Stack AI · Routing 3-Tier

Tier	Modello	% uso	Use case
60%	Sonnet 4.6	majority	User-facing real-time (chat, suggerimenti)
30%	Haiku 4.5	batch	Task interni (classificazione, dedup, embeddings)
10%	Opus 4.7	strategic	Decisioni complex (planning, reasoning)

Specializzazioni:

Mistral Medium 3 · email outreach (GDPR EU, host Francia)
Kimi K2.6 · site builder (10-30 min generazione)
Gemini 2.5 Flash · content multimodale (img/video/audio)

Cost discipline · architettura compounding:

Anthropic prompt cache: -50/-80% input
Semantic cache via embeddings Vercel KV/Upstash: hit 30-40%, -73% cost
Embedding cache deterministico: -90% cost embedding
Compounding: ~95% riduzione cost input vs baseline
Stima a regime: ~CHF 4.80/cliente/mo a uso medio (margine 95%)

VIETATI: DeepSeek (Garante IT block) · OpenRouter (uso diretto API).

Stack Pagamenti · CH-Compliant

Tool	Costo	Note
Stripe · carte credito/debito clienti CH + EU	1.5% + €0.25 transazione · nessun costo fisso	Setup: 3-4 ore + 1-2 giorni verifica
Datatrans o Payrexx · Twint per Svizzera	CHF 29-49/mese fisso + commissioni	Twint dominante in CH: 60%+ degli svizzeri lo usa. Stripe non supporta Twint diretto: serve partner certificato. Attivo solo dopo apertura conto CH (Q4 con GmbH)

Stack Marketing & Outreach

Tool	Costo	Note
Google Workspace · email domini Multiverbe	~$6/utente/mo (~CHF 18/mo per 3 caselle)	Migrazione da Register.it webmail vecchia a `info@/loris@/contact@multiverbe.com`. Necessario per outreach professionale
Instantly o Lemwarm · email warmup + sequencer	~$30/mese	Warmup automatico caselle multiverbe.com per evitare spam. Mentre Loris fa cold outreach da `loris@metaverbe.com` (dominio caldo), warmup parallelo multiverbe.com
Google Ads + Meta Ads · da Giugno	CHF 700-1.100/mo (Google 300-500 + LinkedIn 400-600)	Attivati in fase SELL Giugno. Budget iniziale modesto. Gregorio gestisce con supporto Claude Chrome
Apollo.io · prospect sourcing	Free 50 leads/mo	Sourcing primo mese Loris
Composio MCP · auto-publish	da definire	Meta Ads MCP ufficiale (mcp.meta.com/ads) per FB/IG + Composio Facebook MCP per posting Pages

🆕 2026-05-10: anche Gregorio fa cold outreach in prima persona (founder-led ABM premium, parallelo a Loris).

Stack Domini & Infrastruttura

Domini Register.it: metaverbe.com + multiverbe.com a €5,99/anno ciascuno (€12/anno totale). Eventuale multiverbe.ch pending decisione founder. Email migrate a Google Workspace.
GitHub: repository privati Gregorio. Free tier sufficiente fino a team grande.
Cloudflare: DNS, SSL, DDoS protection. Free tier basta. Eventualmente Cloudflare Workers per edge functions.
Sentry: error tracking app. Free tier 5K errors/mese, sufficiente fino a ~50 clienti.
Plausible o Posthog: analytics interno (privacy-first, no Google Analytics sull'app stessa). $9-19/mese.

🏗️ Architettura Hosting Multi-tenant · come funziona

Aggiunto 2026-05-17 audit-batch · founder request "grafico hosting + multitenant". Mostra il flusso completo end-to-end: cliente PMI fa signup → onboarding genera workspace isolato → Site Builder pubblica → sito live su sub-dominio o custom dominio. La chiave del multi-tenant è workspace_id + RLS su Supabase: ogni cliente vede SOLO i propri dati, anche se condividiamo lo stesso database fisico.

  <!-- Workspace badge gradients (3 esempi tenant isolation) -->
  <linearGradient id="wsA" x1="0%" y1="0%" x2="100%" y2="100%">
    <stop offset="0%" stop-color="#22D3EE"/>
    <stop offset="100%" stop-color="#0EA5E9"/>
  </linearGradient>
  <linearGradient id="wsB" x1="0%" y1="0%" x2="100%" y2="100%">
    <stop offset="0%" stop-color="#4ADE80"/>
    <stop offset="100%" stop-color="#16A34A"/>
  </linearGradient>
  <linearGradient id="wsC" x1="0%" y1="0%" x2="100%" y2="100%">
    <stop offset="0%" stop-color="#FB923C"/>
    <stop offset="100%" stop-color="#EA580C"/>
  </linearGradient>

  <!-- Arrow markers · flow direction -->
  <marker id="arrowDown" markerWidth="12" markerHeight="12" refX="6" refY="9" orient="auto">
    <path d="M 1 1 L 11 1 L 6 10 Z" fill="#22D3EE" opacity="0.9"/>
  </marker>
  <marker id="arrowUp" markerWidth="12" markerHeight="12" refX="6" refY="3" orient="auto">
    <path d="M 1 11 L 11 11 L 6 2 Z" fill="#4ADE80" opacity="0.9"/>
  </marker>

  <!-- Soft drop shadow -->
  <filter id="cardShadow" x="-20%" y="-20%" width="140%" height="140%">
    <feGaussianBlur in="SourceAlpha" stdDeviation="6"/>
    <feOffset dx="0" dy="4"/>
    <feComponentTransfer><feFuncA type="linear" slope="0.4"/></feComponentTransfer>
    <feMerge><feMergeNode/><feMergeNode in="SourceGraphic"/></feMerge>
  </filter>

  <!-- Soft glow per workspace badges -->
  <filter id="badgeGlow" x="-30%" y="-30%" width="160%" height="160%">
    <feGaussianBlur stdDeviation="3" result="blur"/>
    <feMerge><feMergeNode in="blur"/><feMergeNode in="SourceGraphic"/></feMerge>
  </filter>
</defs>

<!-- Background canvas (#09090B Osservatorio) -->
<rect width="1100" height="920" fill="#09090B"/>

<!-- Subtle radial nebula -->
<ellipse cx="550" cy="460" rx="550" ry="320" fill="url(#layerClient)" opacity="0.3"/>

<!-- ============ LAYER 1 · CLIENTE PMI (signup) ============ -->
<g filter="url(#cardShadow)">
  <rect x="60" y="30" width="980" height="100" rx="20" fill="url(#layerClient)" stroke="#22D3EE" stroke-width="1" stroke-opacity="0.5"/>
</g>
<text x="80" y="62" font-family="'Bricolage Grotesque', system-ui, sans-serif" font-size="14" font-weight="700" fill="#22D3EE" letter-spacing="2">LAYER 1 · CLIENTE PMI</text>
<text x="80" y="84" font-family="'Geist', system-ui, sans-serif" font-size="18" font-weight="600" fill="#F4F4F5">Titolare PMI svizzero (ristoratore, parrucchiere, dentista…)</text>
<text x="80" y="108" font-family="'Geist Mono', monospace" font-size="12" fill="#A1A1AA">📱 mobile + 💻 desktop → signup su <tspan fill="#22D3EE">multiverbe.app</tspan> (Vite 5 PWA · auth Supabase + OAuth Google/Apple)</text>

<!-- Arrow Layer 1 → Layer 2 -->
<line x1="550" y1="135" x2="550" y2="160" stroke="#22D3EE" stroke-width="2" stroke-opacity="0.8" marker-end="url(#arrowDown)"/>
<text x="560" y="153" font-family="'Geist Mono', monospace" font-size="11" fill="#71717A">auth + JWT</text>

<!-- ============ LAYER 2 · DASHBOARD SAAS (Vite 5) ============ -->
<g filter="url(#cardShadow)">
  <rect x="60" y="170" width="980" height="130" rx="20" fill="url(#layerDash)" stroke="#4ADE80" stroke-width="1" stroke-opacity="0.5"/>
</g>
<text x="80" y="202" font-family="'Bricolage Grotesque', system-ui, sans-serif" font-size="14" font-weight="700" fill="#4ADE80" letter-spacing="2">LAYER 2 · DASHBOARD SAAS · multiverbe.app</text>
<text x="80" y="226" font-family="'Geist', system-ui, sans-serif" font-size="16" font-weight="600" fill="#F4F4F5">Vite 5 + React 19 + R3F v9 · PWA installabile · Edge serverless functions</text>

<!-- Inner 3-card flow: Onboarding · Site Builder · Pianeti Dashboard -->
<rect x="90" y="246" width="295" height="42" rx="10" fill="rgba(74,222,128,0.08)" stroke="rgba(74,222,128,0.3)"/>
<text x="105" y="265" font-family="'Geist', system-ui, sans-serif" font-size="13" font-weight="600" fill="#4ADE80">① Onboarding 4-step</text>
<text x="105" y="282" font-family="'Geist Mono', monospace" font-size="10" fill="#A1A1AA">7 cuciti + 14 fallback · brand + tone</text>

<rect x="402" y="246" width="295" height="42" rx="10" fill="rgba(74,222,128,0.08)" stroke="rgba(74,222,128,0.3)"/>
<text x="417" y="265" font-family="'Geist', system-ui, sans-serif" font-size="13" font-weight="600" fill="#4ADE80">② Site Builder Kimi K2.6</text>
<text x="417" y="282" font-family="'Geist Mono', monospace" font-size="10" fill="#A1A1AA">6-stage AI pipeline · gate ≥85</text>

<rect x="714" y="246" width="296" height="42" rx="10" fill="rgba(74,222,128,0.08)" stroke="rgba(74,222,128,0.3)"/>
<text x="729" y="265" font-family="'Geist', system-ui, sans-serif" font-size="13" font-weight="600" fill="#4ADE80">③ 7 Pianeti Dashboard 3D</text>
<text x="729" y="282" font-family="'Geist Mono', monospace" font-size="10" fill="#A1A1AA">NucleoSphere + Multiverbe AI</text>

<!-- Arrow Layer 2 → Layer 3 -->
<line x1="450" y1="305" x2="450" y2="330" stroke="#A855F7" stroke-width="2" stroke-opacity="0.8" marker-end="url(#arrowDown)"/>
<text x="460" y="323" font-family="'Geist Mono', monospace" font-size="11" fill="#71717A">INSERT workspace + site + brand</text>

<!-- ============ LAYER 3 · SUPABASE (DB centrale multi-tenant) ============ -->
<g filter="url(#cardShadow)">
  <rect x="60" y="340" width="980" height="200" rx="20" fill="url(#layerDB)" stroke="#A855F7" stroke-width="1" stroke-opacity="0.5"/>
</g>
<text x="80" y="372" font-family="'Bricolage Grotesque', system-ui, sans-serif" font-size="14" font-weight="700" fill="#C084FC" letter-spacing="2">LAYER 3 · DATA + AI · Supabase eu-central-1 (Frankfurt)</text>
<text x="80" y="396" font-family="'Geist', system-ui, sans-serif" font-size="16" font-weight="600" fill="#F4F4F5">PostgreSQL · pgvector · pg_cron · pgmq · Realtime · RLS multi-tenant</text>
<text x="80" y="418" font-family="'Geist Mono', monospace" font-size="11" fill="#A1A1AA">Project <tspan fill="#C084FC">yqhixdqipojvgzfadufo</tspan> · 39 tabelle · 15 migrations · brand memory pgvector namespaced per tenant</text>

<!-- 3 workspace badges (multi-tenant visualization) -->
<text x="80" y="450" font-family="'Geist Mono', monospace" font-size="10" font-weight="700" fill="#71717A" letter-spacing="1.5">WORKSPACE ISOLATION · ogni cliente vede SOLO i propri dati (RLS workspace_id)</text>

<!-- Workspace A · Trattoria Lugano -->
<g filter="url(#badgeGlow)">
  <rect x="90" y="465" width="295" height="60" rx="14" fill="rgba(34,211,238,0.12)" stroke="url(#wsA)" stroke-width="1.5"/>
</g>
<circle cx="115" cy="495" r="14" fill="url(#wsA)"/>
<text x="115" y="500" font-family="'Geist', system-ui, sans-serif" font-size="14" font-weight="700" fill="#09090B" text-anchor="middle">A</text>
<text x="140" y="488" font-family="'Geist', system-ui, sans-serif" font-size="13" font-weight="600" fill="#22D3EE">workspace_A · Trattoria Lugano</text>
<text x="140" y="506" font-family="'Geist Mono', monospace" font-size="10" fill="#A1A1AA">sites · bookings · contacts · contents</text>
<text x="140" y="520" font-family="'Geist Mono', monospace" font-size="9" fill="#71717A">🔒 RLS: WHERE workspace_id = uid()</text>

<!-- Workspace B · Parrucchiere Bellinzona -->
<g filter="url(#badgeGlow)">
  <rect x="402" y="465" width="295" height="60" rx="14" fill="rgba(74,222,128,0.12)" stroke="url(#wsB)" stroke-width="1.5"/>
</g>
<circle cx="427" cy="495" r="14" fill="url(#wsB)"/>
<text x="427" y="500" font-family="'Geist', system-ui, sans-serif" font-size="14" font-weight="700" fill="#09090B" text-anchor="middle">B</text>
<text x="452" y="488" font-family="'Geist', system-ui, sans-serif" font-size="13" font-weight="600" fill="#4ADE80">workspace_B · Salone Bellinzona</text>
<text x="452" y="506" font-family="'Geist Mono', monospace" font-size="10" fill="#A1A1AA">sites · bookings · contacts · contents</text>
<text x="452" y="520" font-family="'Geist Mono', monospace" font-size="9" fill="#71717A">🔒 RLS: WHERE workspace_id = uid()</text>

<!-- Workspace C · Studio Dentistico -->
<g filter="url(#badgeGlow)">
  <rect x="714" y="465" width="296" height="60" rx="14" fill="rgba(251,146,60,0.12)" stroke="url(#wsC)" stroke-width="1.5"/>
</g>
<circle cx="739" cy="495" r="14" fill="url(#wsC)"/>
<text x="739" y="500" font-family="'Geist', system-ui, sans-serif" font-size="14" font-weight="700" fill="#09090B" text-anchor="middle">C</text>
<text x="764" y="488" font-family="'Geist', system-ui, sans-serif" font-size="13" font-weight="600" fill="#FB923C">workspace_C · Studio Dentistico</text>
<text x="764" y="506" font-family="'Geist Mono', monospace" font-size="10" fill="#A1A1AA">sites · bookings · contacts · contents</text>
<text x="764" y="520" font-family="'Geist Mono', monospace" font-size="9" fill="#71717A">🔒 RLS: WHERE workspace_id = uid()</text>

<!-- 2 arrows: Layer 2 publish() ↓ and Layer 3 → Layer 4 SSR query ↑ -->
<line x1="380" y1="545" x2="380" y2="570" stroke="#FB923C" stroke-width="2" stroke-opacity="0.8" marker-end="url(#arrowDown)"/>
<text x="245" y="563" font-family="'Geist Mono', monospace" font-size="11" fill="#71717A">publish() API · revalidate ISR</text>

<line x1="720" y1="570" x2="720" y2="545" stroke="#4ADE80" stroke-width="2" stroke-opacity="0.8" marker-end="url(#arrowUp)"/>
<text x="740" y="563" font-family="'Geist Mono', monospace" font-size="11" fill="#71717A">SSR query · read site by slug</text>

<!-- ============ LAYER 4 · SITES RUNTIME (Next.js 16) ============ -->
<g filter="url(#cardShadow)">
  <rect x="60" y="580" width="980" height="120" rx="20" fill="url(#layerSites)" stroke="#FB923C" stroke-width="1" stroke-opacity="0.5"/>
</g>
<text x="80" y="612" font-family="'Bricolage Grotesque', system-ui, sans-serif" font-size="14" font-weight="700" fill="#FB923C" letter-spacing="2">LAYER 4 · SITES RUNTIME · multiverbe-sites (Vercel Pro)</text>
<text x="80" y="636" font-family="'Geist', system-ui, sans-serif" font-size="16" font-weight="600" fill="#F4F4F5">Next.js 16 + React 19 + Tailwind v4 · ISR 60s · SSG · Edge Zurich PoP</text>
<text x="80" y="658" font-family="'Geist Mono', monospace" font-size="11" fill="#A1A1AA">Route: <tspan fill="#FB923C">/{slug}</tspan> → fetch site da Supabase (RLS bypassed via service_role server-side) → render SSR ≤2.0s LCP mobile</text>
<text x="80" y="678" font-family="'Geist Mono', monospace" font-size="11" fill="#A1A1AA">Tier-aware quality: Starter (CSS) · Pro (GSAP + Flux Pro 2) · Business (R3F hero + View Transitions)</text>

<!-- Arrow Layer 4 → Layer 5 -->
<line x1="550" y1="705" x2="550" y2="730" stroke="#F472B6" stroke-width="2" stroke-opacity="0.8" marker-end="url(#arrowDown)"/>
<text x="560" y="723" font-family="'Geist Mono', monospace" font-size="11" fill="#71717A">Vercel Domains API + Cloudflare DNS</text>

<!-- ============ LAYER 5 · DNS PUBLIC ============ -->
<g filter="url(#cardShadow)">
  <rect x="60" y="740" width="980" height="70" rx="20" fill="url(#layerDNS)" stroke="#F472B6" stroke-width="1" stroke-opacity="0.5"/>
</g>
<text x="80" y="767" font-family="'Bricolage Grotesque', system-ui, sans-serif" font-size="14" font-weight="700" fill="#F472B6" letter-spacing="2">LAYER 5 · DNS PUBBLICO · auto-SSL Let's Encrypt</text>
<text x="80" y="791" font-family="'Geist Mono', monospace" font-size="12" fill="#E5E7EB"><tspan fill="#F472B6">*.multiverbe.app</tspan> wildcard (Starter+Pro · zero-touch cliente) · <tspan fill="#F472B6">custom-domain.com</tspan> CNAME (Business · cliente porta dominio)</text>

<!-- ============ LAYER 6 · VISITATORI FINALI ============ -->
<g filter="url(#cardShadow)">
  <rect x="60" y="822" width="980" height="78" rx="20" fill="url(#layerVisit)" stroke="#FACC15" stroke-width="1" stroke-opacity="0.5"/>
</g>
<text x="80" y="848" font-family="'Bricolage Grotesque', system-ui, sans-serif" font-size="14" font-weight="700" fill="#FACC15" letter-spacing="2">LAYER 6 · VISITATORI FINALI · i clienti dei clienti (HTTPS)</text>

<!-- 4 site URL pills colored per workspace -->
<g>
  <rect x="80" y="864" width="220" height="26" rx="13" fill="rgba(34,211,238,0.15)" stroke="rgba(34,211,238,0.6)"/>
  <text x="190" y="881" font-family="'Geist Mono', monospace" font-size="11" font-weight="600" fill="#22D3EE" text-anchor="middle">trattoria.multiverbe.app</text>
</g>
<g>
  <rect x="320" y="864" width="220" height="26" rx="13" fill="rgba(74,222,128,0.15)" stroke="rgba(74,222,128,0.6)"/>
  <text x="430" y="881" font-family="'Geist Mono', monospace" font-size="11" font-weight="600" fill="#4ADE80" text-anchor="middle">parrucchiere.multiverbe.app</text>
</g>
<g>
  <rect x="560" y="864" width="220" height="26" rx="13" fill="rgba(251,146,60,0.15)" stroke="rgba(251,146,60,0.6)"/>
  <text x="670" y="881" font-family="'Geist Mono', monospace" font-size="11" font-weight="600" fill="#FB923C" text-anchor="middle">dentista.multiverbe.app</text>
</g>
<g>
  <rect x="800" y="864" width="220" height="26" rx="13" fill="rgba(250,204,21,0.15)" stroke="rgba(250,204,21,0.6)"/>
  <text x="910" y="881" font-family="'Geist Mono', monospace" font-size="11" font-weight="600" fill="#FACC15" text-anchor="middle">ristorante.com (custom)</text>
</g>

🎯 Spiegazione layer-by-layer

Layer	Cosa fa	Tech	Multi-tenant safety
1 · Cliente PMI	Signup founder via mobile/desktop	`multiverbe.app` PWA	Auth Supabase + JWT con `workspace_id` claim
2 · Dashboard SaaS	Onboarding 4-step + Site Builder Kimi + 6 Pianeti 3D	Vite 5 + React 19 + R3F v9	Client-side query con `auth.uid()` · zero leak cross-workspace
3 · Data + AI	Storage centrale tutti i tenant + Multiverbe AI orchestratrice	Supabase eu-central-1 · pgvector · pg_cron	RLS policy `WHERE workspace_id = auth.uid()` su tutte le tabelle · cliente A NON può mai leggere dati cliente B
4 · Sites Runtime	Server-side render del sito pubblico per slug	Next.js 16 · ISR 60s · Edge Zurich	`service_role` bypassa RLS server-side (necessario per public read) · slug→workspace_id resolve sicuro
5 · DNS pubblico	Routing wildcard + custom domain	Vercel Pro wildcard + Cloudflare	Vercel Domains API auto-aggiunge subdomain idempotent (409 OK)
6 · Visitatori finali	Browser visitatore → sito cliente HTTPS	HTTP/2 · auto-SSL Let's Encrypt	Edge cache per slug · revalidate on publish ≤5s

🔒 Garanzie di sicurezza multi-tenant

RLS sempre attiva su tabelle cliente-facing (sites, bookings, contacts, contents, ecc.) · skill multiverbe-supabase-rls-patterns per audit pattern.
service_role key MAI esposta client-side · solo server-side in Vercel env vars per Sites Runtime + webhook handlers.
Slug reserved blacklist (35 reserved: admin, api, www, app, bos, sites, mail, ftp, dev, staging, ecc.) impedisce spoofing endpoint Multiverbe.
Rate limit per workspace su publish API (10/min) · check-slug API (30/min per IP).
Backup PITR Supabase Pro · DR test quarterly (skill dr-test).

Costi Mensili Totali · Stima Realistica

Mag · Build Phase · ~€250/mese

Voce	Costo
Claude Code Max ×2 (Opus + Sonnet)	€220
Domini	€2
Email warmup	$30
API extra (Claude/Gemini/Kimi)	~CHF 50
Tutto il resto (free)	€0
Totale	~€250 + CHF 1.500 API spalmati 28gg

Giu · Sell Phase · ~CHF 1.000/mese

Voce	Costo
Stack base (sopra)	~€140
Vercel Pro (1° cliente)	$20
Brevo (volume)	$20
Google Workspace	$18
Google + Meta Ads	CHF 700
Totale	~CHF 1.000

Lug+ · Scale Phase · ~CHF 1.500-2.000/mese

Voce	Costo
Stack a regime	~CHF 250
Twint via Datatrans	CHF 49
Supabase Pro	$25
Gemini API a volume	~$50-100
Ads scaling	CHF 1.000-1.500
Totale	~CHF 1.500-2.000

Hard rules tecniche

Workspace isolation — OGNI query DB filtra per workspace_id. Skill multiverbe-supabase-rls-patterns.
R3F v9 stable — NO v10 alpha. Hard gate 10 Giu.
DeepSeek MAI — bloccato in Italia.
SMTP — credenziali in DB (smtp_configs), NON in env var.
Direct DB Supabase è IPv6 only — usare SQL Editor o MCP per DDL.
RLS attivo su TUTTE le tabelle.
Pseudonimizzazione obbligatoria prima di Anthropic (US, fuori EU Data Boundary). Helper: frontend/.../src/lib/pii-pseudonymize.ts + server-side equivalente.
OpenRouter MAI uso diretto API.

Anthropic (US) · Mistral (FR) · Google Gemini (US) · OpenAI (post-Series-A only) · Stripe (US/IRL) · Datatrans/Payrexx (CH) · Brevo (FR — transactional Multiverbe) · Resend (US — Metaverbe agenzia only) · Vercel (US/EU) · Supabase (US/EU project Frankfurt) · Sentry (US/EU) · Cloudflare (US/global) · Register.it (IT — DNS + mailbox SMTP).

🏗️ Principi Architetturali · Solidità + Agentic by Design

L'architettura tecnica deve supportare un prodotto che cresce nel tempo senza riscritture continue. Principi non negoziabili. (Sezione duplicata in [[operations]] per cross-reference roadmap esecuzione.)

🤖 Agentic by Design

Ogni pianeta è un agente: ha goal, può chiamare altri agenti via Centro, può pianificare task multi-step.
Brand memory persistente: ogni decisione AI passa dalla brand memory del cliente (no allucinazioni off-brand).
Tool-calling standardizzato: ogni satellite espone interfaccia AI-callable (function-calling Claude/Kimi/Gemini).
Self-learning loop: il sistema osserva quali contenuti/strategie convertono e adatta brand memory automaticamente.

🛡️ Solidità Tecnica

Multi-tenancy via RLS Supabase: row-level security su ogni tabella. Zero data leak tra tenant.
Type safety end-to-end: TypeScript strict, Zod validation su API, types Supabase generati.
Test coverage minima 60%: unit + integration sui satelliti core (Web, Booking, CRM).
Observability: Sentry errori, logging strutturato AI calls (cost + latency + outcome).
Backup automatici: Supabase daily, retention 30gg.

📈 Scalabilità Modulare

Pianeti pluggable: nuovo pianeta = nuova folder + nuova entry nel router. Zero impatto sugli altri.
API-first: ogni feature interna è prima un endpoint API, poi una UI. Permette integrazioni future enterprise.
Multi-AI router: il Centro decide a runtime quale modello usare (Claude per reasoning, Kimi per code/UI, Gemini per multimodale, Haiku per task veloci).
Cost-aware: ogni AI call loggata con cost. Budget alert per cliente se uso eccessivo.

Skills Claude Inventory

Cosa Loris/team trova installato il giorno 1. Source di verità: CLAUDE.md root.

Skills custom Multiverbe (10) · `~/.claude/skills/`

multiverbe-design — Nebula Glass design system (PRIMA per UI)
multiverbe-ch-compliance — nDSG + GDPR + DPA + DSAR
multiverbe-cold-outreach-ch — Loris playbook (cold email/call/DM W1-W4)
multiverbe-r3f-patterns — NucleoSphere + i Pianeti R3F (7 canonici · oggi 6 in scena, Finanza da aggiungere)
multiverbe-sector-onboarding — 5 macro × 21 settori + AI fallback
multiverbe-security-ch — Cybersecurity Swiss + periodic checks
multiverbe-stripe-checkout-edges — Revenue edge cases Stripe
multiverbe-supabase-rls-patterns — RLS deep + audit script
multiverbe-incident-response — 5-step playbook breach (4h target)
metaverbe-agency-projects — Workflow agenzia (dual-business)

Slash commands custom (`~/.claude/commands/`)

/launch-checklist · /security-weekly · /security-monthly · /dr-test · /incident-start · /loris-cadence · /giorno

Plugins ufficiali abilitati (15)

vercel · frontend-design · superpowers · plugin-dev · claude-md-management · supabase · coderabbit · stripe · code-review · security-guidance · feature-dev · playwright · skill-creator · github · context7

📌 Subscription tools security (iubenda, Klaro, Bitwarden, Aegis, Apollo, Yubikey, LinkedIn Sales Nav) → vedi [[operations]] sub-section "Reminders Calendar + Subscription Tools". 📌 Skills extra dettaglio (BE sec-16 verbatim): cloned GitHub OSS (5), baseline n8n+ads+seo (32), Security Toolkit GitHub top 5 install pre-launch (gitleaks, trufflehog, OWASP skill, semgrep, supabase-mcp, trivy), context7 + Figma + Chrome DevTools MCP roadmap → file dedicato ops/be-sections-extra-2026-05-10.md sezioni 6-9.

Ultimo update: 2026-05-11 · migrazione verbatim sec-06 Stack BE 4475-4630 + scenari costi Mag/Giu/Lug + Architettura Principi (cross-ref con [[operations]]) + Skills Inventory (sync con CLAUDE.md root). Brevo + Vercel multi-project + 21 settori + 10 custom skills + 6 slash commands + 15 plugins. Owner: Gregorio (decisioni stack) Skill chain: multiverbe-security-ch + multiverbe-supabase-rls-patterns + multiverbe-stripe-checkout-edges + multiverbe-ch-compliance