# Platform

> Isolation, Clients and preview, Quota and usage, Updates

## Isolation

*Every project, every Assistant and every shared domain is its own Linux user on the host.*

- The platform service runs as its own user; platform code and backups sit in directories those users can't read. The host deletes the source once built and keeps only the build.
- Processes can't see each other in `/proc`; every seat process has a memory cap, and CPU is shared fairly between seats (one seat can't starve its neighbours, and idle cores aren't left unused); a preview port is reachable only by the project that owns it; AI users can't reach the cloud metadata service.
- Root (`sudo`) for an AI turn is requested per turn and approved by the owner or the Admin team.
- The reviewer and the grader are read-only; an Assistant reads projects through read-only tools and changes things by filing; while Auto-Run holds a project, its chat seat is read-only.
- Members see only the projects assigned to their teams, plus Assistants shared with them.

## Clients and preview

*The web app is the full Studio, the iPhone has a native app, and what gets built shows up right in the Preview panel.*

- **Web**: The full Studio
- **iOS**: The GenkiAI app, currently on TestFlight; native tabs on iPhone, the full web Studio on iPad. It opens on the Spaces directory, where you create, delete and switch Spaces
- **Push**: APNs on iPhone, Web Push in browsers, same content
- **Web preview**: A managed dev server per project (4 at once, reclaimed after 60 idle minutes); on a Space it opens in a new tab at a separate address only link holders can reach
- **iPhone simulator**: A headless simulator streamed into the Preview panel, and the AI drives the same device through `sim-debug`; it needs a Mac, so the team pairs one of its own Macs with a Space on Linux

## Quota and usage

*Models run on the Claude / Codex subscription accounts the owner has signed in to. When the quota runs out, it waits where it is and carries on once the quota is back.*

- The owner can sign in to several accounts.
- When Auto-Run hits a limit, it pauses at the current step. If another signed-in account has room (under 95% used) it switches to it, says so in chat and picks up when you press Continue; if none has room, it resumes by itself at the reset time, or waits for Continue when the reset time is unknown.
- When a chat turn hits a limit, it is not retried automatically; the limit is only logged.
- The USAGE card in Status: each account's usage windows (5-hour and 7-day for Claude accounts, 7-day only for Codex), plus 7 days of token use per project.
- Call and meeting minutes are counted per person per week; over the storage allowance, new Auto-Runs wait while chat keeps working.

## Updates

*A Space updates itself. It builds in the background, waits until it is idle, takes a snapshot and switches atomically, and it rolls back if the switch fails.*

1. When the platform publishes a new version, online Spaces are told, and each downloads and builds it in the background.
2. It waits until it is idle, meaning no Auto-Run, chat, scheduled job or Assistant turn is running. New runs are refused while it switches.
3. Before switching it snapshots the database and holds new turns, then switches releases atomically and restarts; a failure rolls back.
4. Clients show an Updating screen and come back on their own.