Cockpit & Cost Guardrails

D1 machine truth, Attio human lens, Stripe money. One write door, nightly sync. Spend caps and model defaults underneath.

Ruled 7/11

D1 bbe-ledger is the ledger. Attio is the lens. Stripe is the money. The cockpit is one gated Cloudflare Worker page fed by a cron snapshot, 12 tiles, honest about what it can’t see.

Part 1: Audience & Cockpit

The source-of-truth ruling

D1 bbe-ledger is the machine truth. Attio is the human truth. Stripe is the money truth. One-way sync, D1 down to Attio, neither absorbs the other.

D1 bbe-ledger owns journey.stage (cold, contacted, replied, qualified, booked, customer), the contact/identity/consent/event tables, attribution_summary, concierge_log, the beacon stream. No client install ever touches Attio, the bot reads and writes D1 only.
Attio owns the human relationship layer: dossiers, revenue enrichment, notes, tasks, heat, lead score, MRR fields, churn risk, the Win-Back 439 segment. Andrew works leads in Attio because it has a UI a SQL table never will.
Stripe (with PayPal alongside) owns cash. Neither D1 nor Attio is ever authoritative for a dollar figure.

The test that settles any future argument: if Attio vanished tomorrow, the engine keeps running. Leads still capture, journeys still advance, emails still send, attribution still rolls up. Attio is a beautiful, replaceable window onto the ledger.

One write door

One write door for DH

All new DH captures flow through the bbe-lead worker into D1 + Brevo. The old lead-capture path’s Attio + Podia writes retire for DH surfaces.

Nightly one-way sync, D1 to Attio

Upserts every new or changed D1 contact into Attio with a fixed stage mapping: cold to Cold, contacted/replied to Warm, qualified/booked to Hot, customer to Customer. Match on email, never duplicate, always add enrichment, never overwrite Attio’s human-entered fields.

Attio never writes back to D1

A correction in Attio lands in D1 as a new identity event through a small admin endpoint. Human edits are events too.

No absorption planned. Revisit only if Attio starts costing real money, or the productized engine needs a client-facing CRM surface.

The cockpit build

One Worker page, bbe-cockpit. Magic-link session gate, VIRTUO tokens, one URL Andrew opens on any device including his phone at 7am. Zero live fan-out: a Workers cron (6 CT, after Attio’s 6am revenue sync) pulls every source server-side and writes one JSON snapshot into D1. Page load reads the snapshot and renders instantly. Every tile carries a freshness stamp.

The 12 tiles

#	Tile	Source	Refresh
1	Cash collected, 7-day + MTD	Stripe, PayPal account-level	Daily + button
2	MRR + at-risk MRR	Attio fields	Daily
3	Untracked share (% revenue with no attributed source)	Computed from 1 vs D1 attribution	Daily
4	New leads, yesterday + 7-day	D1 contact rows	Live
5	Pipeline by journey.stage, week-over-week delta	D1 journey.stage	Live
6	Lead to customer conversion, trailing 30 days	D1 events	Daily
7	Owned reachable list: Brevo size + growth + open/click	Brevo API	Daily
8	Concierge/Widget: conversations, captures, handoffs	D1 concierge_log + events	Live
9	Top 3 content pieces, traffic + captures	Fathom events	Daily
10	YouTube: views, subs delta, latest video	Morning-briefing push	Daily 7am
11	AI-referral visits (ChatGPT, Perplexity, Claude, Gemini)	Fathom referrer filter	Weekly
12	Top lead source/campaign, 7-day	D1 attribution_summary	Daily

Plus a permanent blind-spot footer: “Can’t see: PayPal buyer identity, Google AI Mode, mobile-AI referrals (land as Direct).” Tile 8 reads zero until the bridge goes live to traffic. Ship it anyway, it’s the launch gauge.

The conversion spine, leaks ranked by revenue impact

Light the bridge with the audience you already own

Clear the 3 Concierge content blockers, run the win-back send to a slice of the Win-Back 439 segment. Zero new code, the only fix that can produce revenue this month. Same week: Heather’s $2,000/mo is at-risk and unreplied since 5/13. The cheapest revenue in the system is defense.

Email-gate-at-aha before any cold traffic

Identified magic-link visitors skip the gate, cold visitors hit it right before the score reveal. Precondition for paid ads.

Close the attribution loop

Purchase beacon + coded offers. Until this lands, tiles 3, 6, and 12 stay partially blind.

Per-video tracked destinations

Every video description points at a tracked capture URL, wired into post-stream.

Stripe-only checkout for member products

PayPal buyers are invisible to both the revoke channel and per-person attribution.

Member portal live

Closes the post-purchase leak, sets up the DWY upsell surface.

The Podia exit

Deliberate on checkout, aggressive on email. Move email now, gate checkout behind proof, roughly one quarter.

The cutover trigger, all four must hold for 30 consecutive days:

Beacon + Stripe grant/revoke ran with zero manual fixes, two consecutive clean weekly CSV diffs.
Brevo carries 100% of sends at or above the Podia deliverability baseline.
The portal serves the full member library, no Podia-only content left.
One Stripe-direct test product completed a real purchase to access to refund to revoke loop end to end.

Part 2: Cost Exposure & Guardrails

The abuse hole is the top fix

Normal operations are cheap. DH’s own absorbed AI cost lands between $66 and $332/mo even at 5x volume. The real risk lives in one place: the concierge worker’s Anthropic key has no ceiling, and a scripted abuser could burn $900 to $22,000 per day on it. The fix costs zero dollars and about an hour.

The exposure model, September Sonnet pricing ($3/$15 per MTok)

Surface	Whose key	Launch (~60 convos)	Expected (~300)	5x (~1,500)
Concierge chat + nightly Coach	DH, absorbed	$13/mo	$66/mo	$332/mo
Lead engine per cohort	DH, rebilled in retainer	$40	$81	$162
Paid tier (T3) members	Client’s or member’s own key	$0	$0	$0
Content Engine	Andrew’s Max plan, flat	$0 marginal	$0	$0

The abuse hole, sized

Attack shape	Cost to DH
1 request/sec, 24h, cache hot	~$907/day
5 requests/sec, 24h, cache hot	~$4,536/day
5 requests/sec, cache-busting inputs	~$22,000/day

The cap spec: three layers, all cheap, ship all three

Layer 1: Anthropic workspace spend limit, the hard wall

Dedicated workspace concierge-dh, monthly spend limit $100, alerts at 50%/75% to contact@designhacker.com. Same pattern for the lead engine key: $75/mo per cohort workspace. Console clicks only, no code. Worst case is now $100/mo, full stop, even if every other layer fails.

Layer 2: Cloudflare AI Gateway budget + degrade route

AI Gateway between the worker and Anthropic, free on all plans. Spend-limit rule at $60/mo, breach behavior = Dynamic Route fallback to Workers AI (Llama 3.3 70B, roughly a tenth of Claude money) instead of a dead 429. Visitors keep getting answers in “standard mode.”

Layer 3: Worker-level burst and shape limits

A Workers Rate Limiting binding keyed on IP + session (~10 messages/min), a per-conversation turn ceiling (30 turns, then the bot wraps up), and max_tokens ~1,024 on every completion. Monthly meters don’t stop a fast attacker spending a month’s budget in an hour, this layer does.

Resulting worst case with all three layers on: $100 Anthropic hard cap + a few dollars of Workers AI fallback, bounded around $110/mo, versus $22K/day unbounded today.

Absorb vs meter vs BYO

Product	AI cost treatment	Rule
Sales Concierge (DH’s own)	DH absorbs	Keep absorbing, cheap customer acquisition, but capped per the three layers, non-negotiable
Concierge re-themes for clients (Bex, etc.)	Dedicated workspace per client on DH’s org	Capped, rebilled as a retainer line item. Never an uncapped shared surface
Lead engine	DH key, rebilled inside retainer	$40/cohort inside a $2,500+ retainer holds 85%+ margin. Cap each cohort workspace at $75
Paid tier T3	Client’s or member’s own BYO key	DH keeps 100% of the system fee
Content Engine, BBB plugin, Nano Banana	Andrew’s Max plan / customer’s own Claude / $30 Gemini cap already set	Zero marginal DH cost

Cost floors per rung

Allowance ≈ 25% of the tier price, held for both ruled paid tiers. The one rung with a real floor problem: so bexy at $29.99/mo. If members chat on a DH-absorbed or client key with Sonnet, a $12-style cap is 40% of the price, Sonnet-heavy usage eats the margin alive. Rule before launch: Haiku-default with a small cap (~$3-5), or Workers-AI-first with Claude reserved for premium actions.

Every other rung is safe: Club and BBB run at $0 AI cost inside the price (BYO or customer’s own Claude), the paid AI add-on has the client paying fuel directly so the DH fee is 100% margin, DFY retainers carry $40-100/mo of engine burn inside 95%+ margin.