Tech Stack | Avalon

The Hardware Question (answered honestly)

The Grid can be the infrastructure for everything except the one thing that matters most. That exception needs to be stated plainly rather than discovered in week three.

GTX 1660 ×24

6 GB VRAM each — ArcRig1 + ArcRig2

Not viable for this workload. Cannot hold an SDXL pipeline. Runs SD1.5 inpainting only with aggressive offload, at latency measured in tens of seconds per image, single-stream. Twenty-four of them do not add up to one usable card for this, because the workload does not shard across small cards. No tensor cores (Turing architecture).

RTX 3070 ×5

8 GB VRAM each — ArcRig3

Marginal. SD1.5 inpainting is fine. SDXL inpainting fits only with CPU offload and sequential loading, which trades VRAM for latency. Five of them could serve a closed beta. They cannot serve a launch.

Recommendation (D-06): Hosted GPU burst for image generation at MVP. The Grid runs everything else: API, orchestration, graph, storage, telemetry, portal, catalog, admin. Generation is a single outbound call behind ArcRouter.

Crossover math (illustrative): At $0.03/image, 4 variants + segmentation = roughly $0.15/session. A 24 GB class card at ~$2,000 delivers 3–6 seconds per inpaint. At 10,000 MAU doing 3 sessions/month, the card pays for itself in about 5 months. The decision flips fast with traction, which is exactly why E-09 (versioned engine contract) and C10 (route through ArcRouter) matter: they make the flip a config change. Migration to sovereign inference (P-08) is Phase 5.

Inference Options (D-06)

1

Burst and disclose

Hosted GPU burst, vendor named in consent text, contract for zero-retention and no-training. Fastest path to launch. Requires legal review of vendor terms.

2

Buy the hardware

Purchase or rent a dedicated 24 GB card under Grid control before launch. Cleaner story, slower and more capital. Selfie never leaves the Grid. P-08 becomes now, not Phase 5.

3

Burst for beta, migrate before public launch

Explicit beta consent that names the inference vendor. Migrate to sovereign inference before opening to the public. This is an explicit written decision, not a drift. Recommended.

Compliance coupling: Bursting generation off the Grid means the user's selfie reaches a third-party GPU vendor. That is directly in tension with treating selfies as the most restricted data class. The burst decision (D-06) and the compliance posture (D-04) are the same decision wearing two hats. Resolve them together.

Stack

Layer	Technology	Notes
Client	React + TypeScript, Vite, mobile-first PWA Tailwind + GRID-HANDOFF-AVALON-DESIGN-001 tokens On-device WASM face landmarking (MediaPipe Tasks)	PWA over native: one codebase, no app store review cycle on a product whose consent flow will change several times in the first months. Native (A-11) when retention justifies it. Landmarks discarded immediately, never transmitted.
API	TypeScript API (Fastify or Hono)	Transactional surface only. Keeps the render pipeline separate from the HTTP surface.
Orchestration	Python worker (render pipeline) ArcFlow (job queue, retry, nightly eval) ArcRouter (every model call, text or image)	CV and diffusion ecosystem is Python. Fighting that costs more than the polyglot boundary. ArcFlow: Avalon is a good first real production workload — bounded, well-defined stages, obvious retry semantics.
Consent data	Postgres	Consent records do not go in a graph. They need to be provably immutable and queryable under subpoena. ACID required.
Knowledge graph	Neo4j (own instance, ArcHelm)	Style taxonomy, stylist graph, SUITS weighting, catalog relationships. Own instance per R12, with backups.
Telemetry	ClickHouse via ArcTrace	Hard exclusion filter on image payloads (P-03). Verify that filter empirically. An assertion in a doc is not a control.
Object store	Grid-local MinIO or Cloudflare R2	Enforced lifecycle TTL and encryption at rest. Decision gates on D-06 and D-04 together.
Segmentation model	Off-the-shelf face-parsing at MVP. Fine-tuned Phase 3 (E-11).	Fine-tune on proprietary textured-hair data. Largest quality improvement in the package is here, not in the generation model.
Generation model	SDXL-class inpainting + depth control + image-prompt adapter	Decided by bake-off against held-out set of textured-hair subjects (4A–4C), not by benchmark reputation. Do not select a model whose demo gallery is entirely light-skinned.
Platform	Cloudflare (DNS, WAF, image delivery) SOPS/age Vault (secrets) k3d/ArgoCD on ArcHelm	Consistent with existing Grid practice. Stripe at Phase 4.

Device Reality (Rev D)

The stack assumes a decent front camera, WASM on-device landmarking, and a PWA. Each assumption has a cost that is not evenly distributed.

On-device landmarking is slow on low-end Android. WASM face-mesh inference that feels instant on a recent iPhone can take seconds on a budget Android device. Test on cheap hardware in Phase 1, not at beta. If too slow, the fallback is server-side landmarking — a materially worse compliance position (see D-04).
PWA install friction on iOS is real. Add-to-home-screen is not discoverable. Plan for most users staying in the browser. Design the browser experience as the primary one, not a degraded path.
Camera quality is a fairness problem, not just a quality problem. Low-light performance on darker skin is worse on cheaper sensors. A naive quality gate threshold will reject a disproportionate share of the intended audience before the model ever runs, while the model itself is fair. Requirements (doctrine C16, feature P-12): tune the quality gate against real photos from low-end hardware, instrument rejection rate by skin tone, prefer coaching and re-capture over rejection, treat a rising rejection rate in any cohort as a defect.

Safety and Abuse (MVP, not hardening)

An open image-generation endpoint attracts misuse. This is feature P-14 and it is MVP. Minimum stack:

Input classification before generation (prohibited content, third-party face uploads flagged by attestation flow)
Output classification before delivery
Logging of both, without retaining the images themselves past the standard TTL
A named human who owns reports and incidents. Not a queue nobody watches.

Latency Budget

Target: first variant visible in under 20 seconds, all four in under 45. Variants generate in parallel and stream to the client as each completes. Don't make her wait for all four — the perceived wait is the time to the first image. If budget cannot be met, reduce variant count before reducing quality.

Client quality gate and on-device landmarking

<1s (on-device)

Upload

1–3s

Segmentation

1–3s

Generation, per variant (run in parallel)

5–15s each

Face Lock composite + fidelity gate + edge blend

<1s

Delivery

<1s

Reuse Beyond Avalon

Charles's stated intent was to leverage the capability elsewhere. What is actually reusable, in order of value. The visualizer UI itself is the least reusable and least defensible part.

01 — Highest value

Render engine contract (E-09)

Masked-region image transformation service with identity-preservation guarantee and automated fairness gate. Directly reusable for any try-on or visualization product, and licensable (R13). The Grid primitive we are building first.

02

Consent and retention architecture (CN-01–CN-04)

Every Grid product that touches biometric or sensitive personal data needs this. Build it once, properly, here, because here is where the exposure is highest. Promote it to a Grid primitive afterward.

03

Fidelity eval pattern (P-06)

Automated check that a generative pipeline is not degrading outputs for a demographic. Generalizes far past hair. A credible thing to be able to show an enterprise client.

04

Feasibility pattern (F-01)

"Can this person actually get this outcome" sitting on top of a generative "what would it look like." Transfers to any product where the pretty picture and the real-world constraint can diverge — which is most of them.