Finance Vault / AI Tax Strategist
Full Evaluation Report

Phase 1 — Evaluation Only Date: 2026-07-02 Model: Claude Opus 4.8 No Build Actions Taken Status: Awaiting 7 Decisions

1. Executive Summary

Dexter Williams (operator of Estate Solutions LLC, Estate Realty Group, Ahvino Enterprises LLC, and personal accounts) requested an evaluation of building a Finance Vault and AI Tax Strategist module integrated into his existing OpenClaw / Claude Code platform on a Hostinger VPS.

This document is a full evaluation report covering system feasibility, security risks, architecture recommendations, and a detailed build plan. No build actions have been taken. All findings are advisory only. Phase 2 build requires Dexter's explicit approval on 7 decisions documented in Section 7.

2. System Architecture Overview

The existing platform consists of:

Component	Location	Role
Claude Code Bridge	/opt/claude-bridge/bridge.js	Discord bot → headless Claude Code sessions via Anthropic SDK
OpenClaw (COS)	/opt/openclaw/ (root-owned)	Multi-agent orchestration platform; manages Estelle, Aria, Atlas
Workspace	/home/coder/workspace/	Git-tracked workspace; daily backup to GitHub at 5 AM
Channel Memory	/home/coder/workspace/channel-memory/	Per-channel MEMORY.md + message-log.jsonl for persistence
9 Discord Channels	Bridge-wired	#claude-code, #trading, #realestate, #estate-solutions, #ellie-email, #dexter-inbox, #platform, #fcs, #emerys-fashion
Public File Hosting	/docker/public-drops/	https://drops.srv1617495.hstgr.cloud/
Docker Containers	19 running	n8n, traefik, openclaw, est8-web, a4p, serpbear, etc.

Key Bridge.js Behavior

Every Claude Code session spawned by bridge.js uses:

const options = {
  model,
  permissionMode: "bypassPermissions",  // ← ALL permission checks skipped
  cwd: WORKSPACE,                        // ← /home/coder/workspace
  maxTurns: 400
};

3. Security Findings

4. Phase 1 Evaluation Summary — All 17 Sections

S1 — Request Classification

A Finance Vault / AI Tax Strategist module for a multi-entity small business operator. Entities: Estate Solutions LLC (GA), Estate Realty Group (GA), Ahvino Enterprises LLC (MS), Personal. Use cases: tax strategy planning, deduction categorization, entity-level analysis, CPA collaboration prep.

S2 — Platform Capability Assessment

Claude Opus 4.8 has sufficient reasoning capability for tax strategy at the small-business level. The bridge and channel memory system provides adequate persistence for multi-session work. The age encryption tool supports file-level security. Capability gap: no ZDR (Zero Data Retention) — API calls are subject to Anthropic standard data handling.

S3 — Data Classification

Data Type	Classification	Where It Can Live
Tax strategy discussions (no PII)	Sensitive	On-VPS vault dir, encrypted at rest
Research outputs (IRC citations, entity analysis)	Low sensitivity	On-VPS vault dir
Financial documents (returns, statements, K-1s)	High sensitivity / PII	OFF-VPS only (Dexter's PC or B2 encrypted)
CPA packages	Medium-high	age-encrypted export, local + B2 backup

S4 — Entity Architecture

Four entities with cross-cutting relationships require the agent to reason about: shared owners, shared vendors, equipment usage across entities (triggers IRC §267 related-party rules), and multi-state nexus (GA + MS). The agent must always ask "does this transaction involve another entity in the Dexter Williams group?" before responding about deductions, basis, or elections.

S5 — Jurisdiction Stack

Processing order: Federal (IRS) → Georgia DOR → Mississippi DOR. Source priority: IRS.gov → Treasury Regs (26 CFR) → GA DOR → MS DOR → Tax Court/Revenue Rulings → CPA-reviewed secondaries. Agent must never invert the jurisdiction stack.

S6 — Isolation Model (4 Layers)

1. Filesystem Isolation: Vault directory at /home/coder/finance-vault/ with 0700 permissions, outside workspace git tree
2. Bridge Session Isolation: Vault handler uses permissionMode: "default" + explicit allowedTools
3. Agent Rule Isolation: System prompt prohibits writing PII to persistent memory
4. OpenClaw Exclusion: COS, Estelle, Aria, and Atlas are explicitly excluded from Finance Vault scope

S7 — Document Handling Model

Documents live OFF the VPS. Dexter decrypts on his PC and pastes relevant text into the vault Discord channel manually. The agent works from text pastes — never from raw financial document files. This keeps PII off the VPS processing pipeline.

S8 — CPA Integration Layer

The agent does strategy and planning. The CPA does execution and filing. The agent produces "CPA-ready packages" — structured summaries with citations, entity breakdown, and flagged questions. A !export-for-cpa command formats session findings into /home/coder/finance-vault/cpa-packages/. CPA corrections flow back in via Dexter paste; stored as authoritative overrides with higher confidence weight.

S9 — Backup Strategy

Data Type	Sensitivity	Backup Method
Tax research (no PII)	Low	Workspace git (after vault exclusion rules set)
Strategy outputs	Medium	age-encrypted Backblaze B2
Document transcriptions (PII possible)	High	NEVER backed up — delete after processing
CPA packages	Medium-high	age-encrypted, local + B2

S10 — OpenClaw Exclusion

COS, Estelle (Estate Solutions GHL agent), Aria (A4P), and Atlas (Platform) must have no access to Finance Vault content. COS has ssh_exec and file_write tools — the vault directory's 0700 permissions block COS (which runs as root/ubuntu, not coder... actually COS may run with elevated perms — verify). Explicit prohibition must be added to CLAUDE.md, COS operating doc, and each specialist agent's system prompt.

S11 — Encryption Architecture

The age tool is installed at /usr/bin/age. Key pair: generate on Dexter's PC; private key stays on Dexter's PC only; public key stored at /home/coder/finance-vault/.age-public-key. Encryption command: age -r $(cat /home/coder/finance-vault/.age-public-key) -o output.age input.txt. VPS only ever stores encrypted outputs.

S12 — Confidence Scoring

Every vault agent response includes a machine-parseable metadata block:

[TAX-CONFIDENCE: SETTLED | THRESHOLD | UNCERTAIN]
[ENTITY: Estate Solutions LLC]
[TAX-YEAR: 2025]
[JURISDICTION: Federal + GA]
[CPA-REVIEW-REQUIRED: YES/NO]
[CITATIONS: IRC §179(b)(1), Rev. Proc. 2024-38]

S13 — Forbidden Operations (Hard Refusals)

• Form 8283 noncash charitable deduction valuations (IRS audit magnet)
• Conservation easements or syndicated deals
• Basis calculations for inherited property without death-date FMV confirmed by estate documents
• International tax (FBAR, FATCA, foreign entities)
• S-Corp officer payroll recommendations without current-year basis stated
• Completed tax forms or schedules — strategies only, never the filing itself
• Penalty abatement requests — go directly to CPA
• Never use the words "aggressive" or "maximize" — use "optimize within settled law"

S14 — S-Corp Complexity

At least one entity is likely S-Corp elected or evaluating election. S-Corp strategies (reasonable compensation, basis tracking, QBID interaction, shareholder loans) are the single most complex area. Every S-Corp response must be prefaced with: "S-Corp planning requires current-year basis calculation. Confirm basis with your CPA before relying on this analysis." CPA escalation threshold is lower for S-Corp questions than for other tax areas.

S15 — Corrections Feedback Loop

When the agent gives wrong advice and the CPA corrects it: a !correct command records the correction alongside the original recommendation in corrections-log.md. The corrections log is injected into every session start (alongside MEMORY.md). The corrections log is included in every CPA package. This is the mechanism by which the vault agent improves over time.

S16 — Decisions Required (5 from Phase 1, 2 added by Opus 4.8)

See Section 7 of this document for full decision list.

S17 — Build Plan

See Section 8 of this document for the revised 11-step build plan.

5. Opus 4.8 Extended Analysis

What Phase 1 Underweighted

The Agent System Prompt Is the Most Critical Build Artifact

Phase 1 listed "write the system prompt" as Step 6 of 9. This undersells it by a factor of 10. The system prompt IS the tax strategist. Everything else is infrastructure. A poorly-written system prompt produces hallucinated citations, cross-entity contamination, jurisdiction bleed, and overconfident output that bypasses CPA review gates.

The system prompt needs 12 distinct constraint blocks:

1. [ENTITY ISOLATION] — Never mix deductions, basis, or elections across entities
2. [TAX YEAR SPECIFICITY] — Always specify tax year; IRC sections change annually
3. [JURISDICTION STACK] — Federal → GA → MS; cite jurisdiction for every rule
4. [CITATION STANDARD] — IRC section + subsection + current year; never cite a "summary site"
5. [CONFIDENCE TIERING] — 3 tiers: Settled law | Active litigation/changing | Requires CPA judgment
6. [ESTIMATE LABELING] — Every dollar figure carries ±range and "estimate, not a tax opinion"
7. [HARD REFUSALS] — Specific list of what agent never does
8. [DOCUMENT HANDLING] — Process attachments without storing PII in memory
9. [MEMORY HYGIENE] — What gets written to MEMORY.md vs. discarded after session
10. [CPA ESCALATION TRIGGERS] — Exact conditions that force "take this to your CPA"
11. [STRATEGY vs. COMPLIANCE] — Agent does planning; CPA does execution/filing
12. [DISASTER RECOVERY] — If agent is wrong, how is it captured and corrected?

The bypassPermissions Fix Needs Specificity

Switching to permissionMode: "default" alone is insufficient. Without specifying which tools are allowed, default mode will pop permission prompts in a headless session and hang silently. The vault channel handler must include an explicit allowedTools list:

allowedTools: ["Read", "Write", "Bash", "Glob", "Grep"],
// Blocked: WebSearch, Agent, WebFetch, Edit
// Edit blocked → use Write for full-file rewrites (better audit trail)
// WebSearch blocked → local tax knowledge base instead
// Agent blocked → no sub-agent spawning from vault sessions

The #trading Channel Is an Undocumented Risk

Trading crons are paused but the channel still has a MEMORY.md. If it contains financial strategy data that could contaminate vault sessions, it should be purged before Phase 2 begins.

Attachment Pipeline Is a Data Classification Problem

When a Discord attachment is read by a Claude Code session, the content flows through the session context window → potentially into MEMORY.md and message-log.jsonl → potentially into Anthropic API logs (no ZDR on this account). The system prompt must explicitly prohibit writing PII from documents to persistent memory.

New Recommendations (Not in Phase 1)

Rec A — Structured Tax Year Workspace Model

/home/coder/finance-vault/
├── entities/
│   ├── estate-solutions-llc/
│   │   ├── 2024/
│   │   ├── 2025/
│   │   └── active/
│   ├── estate-realty-group/
│   ├── ahvino-enterprises/
│   └── personal/
├── research/
│   ├── federal/
│   ├── georgia/
│   └── mississippi/
├── cpa-packages/
├── session-logs/
├── corrections-log.md
└── vault.config.json

This structure forces every agent action to be scoped to a specific entity and tax year. vault.config.json holds entity metadata (type, state, fiscal year, member references) — NO actual EINs or SSNs in plaintext.

Rec B — Local Tax Knowledge Base

The agent works from downloaded, verified source documents in /research/ — not live web search. Documents: IRS Pub. 334, IRS Pub. 535, GA Form 600S instructions, MS Form 84-105 instructions, current-year Rev. Procs. relevant to construction/restoration. Agent cites by document name and page number. More reliable than web search — tax law doesn't change mid-session but web results do.

Rec C — Confidence Metadata on Every Response

Machine-parseable block on every response (already detailed in S12 above). Allows Dexter to filter responses by confidence level and quickly identify what needs CPA review.

Rec D — S-Corp as a Separate Skill Tier

S-Corp questions (basis, reasonable compensation, QBID, shareholder loans) are the highest-complexity area. They should be recognized as a distinct trigger with higher CPA-escalation thresholds and a mandatory basis confirmation disclaimer on every response.

Rec E — Corrections Log Feedback Loop

Already described in S15. This is the single most important mechanism for long-term vault agent quality. Without it, the agent will repeat the same wrong answers indefinitely.

Rec F — Wife Upload Portal: Client-Side Encryption

The upload portal encrypts documents in the browser using Dexter's age public key BEFORE upload. The VPS only receives encrypted blobs. The agent never processes the encrypted blob — Dexter decrypts on his PC and pastes relevant text into the vault channel. VPS never touches plaintext financials.

Rec G — Disaster Case Protocol

If the agent confidently gives wrong tax advice and the CPA corrects it:

• !correct [original recommendation] / [CPA correction] — records both in corrections-log.md
• Corrections log injected at session start
• Corrections log included in every CPA package export
• Agent learns from its own errors within the same vault context

6. Recommended Architecture

Layer	What	Where
Processing Engine	Claude Opus 4.8 via bridge	On-VPS, /home/coder/finance-vault/
Document Storage	Financial documents (returns, statements, K-1s)	OFF-VPS — Dexter's PC (encrypted folder) or Backblaze B2 (age encrypted)
Research Library	IRS publications, state tax authority docs	On-VPS, /home/coder/finance-vault/research/
Strategy Outputs	Analysis, recommendations, citations	On-VPS vault dir (age encrypted for CPA packages)
Persistent Memory	Channel MEMORY.md (no PII)	On-VPS, /home/coder/finance-vault/memory/
Backup	Strategy/research only — no PII	age-encrypted to Backblaze B2 (separate from workspace git)
Agent Access	COS, Estelle, Aria, Atlas	EXCLUDED — zero access to vault

7. 7 Decisions Required Before Phase 2

8. Phase 2 Build Plan — 11 Steps

9. Agent System Prompt Design Notes

CPA Escalation Triggers (Non-Exhaustive)

• Any S-Corp basis question
• Any installment sale (IRC §453)
• Any NOL carryback election
• Any like-kind exchange (IRC §1031) with real estate
• Any transaction between related entities (§267)
• Any year the business has a significant loss requiring source analysis
• Any question involving estimated tax penalties or underpayment
• Any question about changing accounting methods (Form 3115)

Memory Hygiene Rules

The agent MUST write to MEMORY.md: entity context, open strategy questions, decisions made in prior sessions, elected tax positions.

The agent MUST NOT write to MEMORY.md: specific dollar amounts from statements, account numbers, Social Security numbers, EINs, names of specific transactions, anything that would constitute a PII exposure if MEMORY.md were accessed by another session.

Confidence Tier Definitions

Tier	Meaning	CPA Required?
SETTLED	Black-letter law, no active controversy, established by statute or long-standing IRS guidance	No (but always wise)
THRESHOLD	Settled law with fact-dependent application, or subject to reasonableness tests (e.g., reasonable compensation)	Strongly recommended
UNCERTAIN	Active litigation, changing guidance, novel application, or aggressive position	Required — flag explicitly

10. Feasibility Verdict

---

Current Status

This evaluation is complete. No build actions have been taken. The vault does not exist yet. All findings are advisory.

Phase 2 build begins when Dexter provides answers to all 7 decisions in Section 7 of this document.