Hoff16Studio — architecture & migration

Full-absorb design: the Studio takes over every Claude / always-on function of the Hoff16 mini; the mini becomes a non-Claude workstation. Authored 2026-09-13. Companion to MACSTUDIO-SETUP.md. Gold: Hoff16.

Decisions locked (TK, 13 Sep)

1 · What transfers (full absorb)

graph LR
  subgraph MINI["Hoff16 mini — today (Wi-Fi)"]
    direction TB
    A1["Gold-standard authority"]
    A2["Claude Desktop · 2 accounts"]
    A3["Full MCP stack"]
    A4["UniFi + energy MCPs"]
    A5["6 launchd collectors"]
    A6["Scheduled tasks"]
    A7["WhatsApp slot"]
    A8["SSH hub · hoff16"]
  end
  subgraph STUDIO["Hoff16Studio = hoff16 — target (wired 10GbE)"]
    direction TB
    B1["All mini functions"]
    B2["+ on-prem 70B (NEW)"]
  end
  MINI ==>|"full transfer"| STUDIO
  STUDIO -.->|"freed"| MINI16["mini16 — non-Claude workstation"]

2 · The logic — confidential-triage router

flowchart LR
  subgraph STU["On the Studio — localhost, nothing leaves"]
    D["Confidential doc
vault · banking · notary"] --> L["Local 70B (Ollama)
classify + extract"] --> R["Redact + summarize
on-box"]
  end
  R -->|"redacted result only"| C["Cloud Claude"]
The boundary is the point. Raw confidential content is processed entirely on-box by the local 70B; only a redacted/summarised result ever crosses to cloud Claude. Ollama binds to 127.0.0.1 — unauthenticated, so it must never be exposed on the LAN. Reach it from elsewhere only via ssh -L 11434:localhost:11434 hoff16.

3 · Network placement & the estate

graph TD
  subgraph H["Hoff16 site — LAN 10.31.16.0/24 · wired"]
    S["hoff16 = Studio
Claude + MCP + 70B(localhost)"]
    M["mini16
workstation"]
  end
  S ---|"AMS-Triangle mesh"| P["Pasteur25
10.31.1.0/24"]
  S ---|"mesh"| DBH["AMS-DBH
192.168.1.0/24"]
  S ---|"mesh"| BER["BER-Tor231
10.49.30.0/24"]
The Studio sits on the Hoff16 LAN with a fixed DHCP lease, so it is already inside the AMS-Triangle mesh — reachable from P25 / DBH / BER with zero mesh config. The 70B stays localhost-walled and is never advertised into the mesh.

4 · The main Claude processor (internal stack)

graph TD
  subgraph S["hoff16 = Studio"]
    CD["Claude Desktop
byss Max + dlulisa Enterprise"] --> MCP["MCP stack
UniFi · M365 · DO · CF · GitHub · ..."]
    CD --> COL["6 launchd collectors
+ scheduled tasks"]
    CD -.->|"confidential docs only"| O["Local 70B (Ollama)
localhost tool"]
  end
The 70B is a subordinate tool the Studio's Claude calls for on-box triage — not a Claude replacement. WhatsApp keeps its single linked-device slot here (byss Max only).

5 · Migration runbook (parallel & verified)

flowchart TD
  S0(["1 · First boot + always-on hardening
pmset · auto-login · logout-watchdog"]) --> S1["2 · Install Claude Desktop
both accounts + full MCP stack"]
  S1 --> S2["3 · Move 6 collectors + scheduled tasks
run in PARALLEL with the mini"]
  S2 --> Q{"4 · All green in parallel?"}
  Q -->|"no"| RB["Roll back — mini stays authoritative"]
  Q -->|"yes"| S3["5 · Cut gold-standard authority to the Studio"]
  S3 --> WA["6 · WhatsApp (single slot):
stop mini → copy auth_info → start Studio → verify"]
  WA --> S4["7 · Rename: Studio→hoff16, mini→mini16
repoint SSH aliases"]
  S4 --> S5(["8 · Decommission mini's Claude side
mini16 = your workstation"])
WhatsApp is the one step that cannot run in parallel. The single linked-device slot must move by a deliberate stop → copy auth_info → start → verify — never a sync, never a casual re-pair/QR (RULES §5/§12/§14). It is cut last, after everything else is proven green.

Open items