COUNCIL BRIEF CB-001: Atlantis AI Communications Domain

Atlantis ITS — May 20, 2026
Brief ID: CB-001
Version: 4.2 (All Council Votes Received — Final)
Status: ✅ APPROVED WITH CONDITIONS — 7 of 7 votes received
From: Shane Hardin (System Owner)
To: Full Atlantis Council — Ozzy, Mercy, Scout, Jimmy, Cooper, Lyra, Nova
Local Path: C:\AtlantisITS\knowledge
Forgejo Path: atlantis-docs/council/CB-001-AI-Communications-Domain.md
Compiled by: Ozzy (merged from Shane + all council responses v1-v4.2)

Version History

🗳️ CONSORTIUM VOTE — FINAL TALLY

Architecture approved. Deployment gated on all conditions in No-Go Criteria below.

Purpose

Establish atlantisits.ai as the AI command domain for Atlantis ITS with a two-inbox architecture:

1. ai@atlantisits.ai — Public-facing AI inbox (anyone can contact Atlantis AI)
2. council@atlantisits.ai — Private internal command layer (Atlantis squad only)

Domain Strategy (Confirmed)

The Two-Inbox Architecture

Why this split matters:

ai@atlantisits.ai — Public Product Surface: - Anyone can email the Atlantis AI and get a response - Scout or Nova handles triage — human approval gate on ALL replies Phase 1 - Future revenue play — positions Atlantis as genuinely AI-native - Differentiator vs. traditional MSPs - Chronicle announcement planned after Phase 1 validation (Mercy: do not bind to issue number yet)

council@atlantisits.ai — Private Command Layer: - Internal squad only — Shane + authenticated agents - CB-series briefings, SOP review, runbook coordination - Unknown senders → quarantine + log + notify Shane (not reject — Mercy) - Jimmy's strictest compliance rules apply here - BCC compliance capture for full audit trail

⛔ No-Go Criteria (Mercy — Required Before Deployment)

Do NOT launch CB-001 if any of the following are true:

• [ ] SPF, DKIM, or DMARC are not configured on atlantisits.ai
• [ ] MFA is not enabled on both Zoho accounts
• [ ] n8n IMAP/SMTP credentials are stored insecurely
• [ ] Public replies from ai@ can bypass Shane approval gate
• [ ] council@ accepts unknown senders without quarantine
• [ ] Logs are not writing to /atlantis-ops/logs/
• [ ] Personal inbox forwarding is broad or unfiltered
• [ ] Agent aliases route to wrong handler in n8n
• [ ] archive@atlantisits.ai implementation is undefined
• [ ] Personal inbox access (Jimmy/Gmail, Cooper/Outlook) revoked before validation passes
• [ ] Any validation test from the go-live checklist is incomplete

The Core Architecture: One Account Per Inbox, Infinite Aliases (Jimmy)

The trap: Separate Zoho user accounts per agent = paid license per agent. Jimmy's solution: Two primary accounts + unlimited free aliases + n8n To: header routing. Zero extra cost as squad scales.

Per-Agent Aliases — Phase 2 (Zero Cost)

Council aliases → council@atlantisits.ai:

Public aliases → ai@atlantisits.ai:

All aliases point to their respective master inbox. Zoho free tier = 2 of 5 mailboxes used. Aliases are always free regardless of squad size.

archive@ Clarification (Mercy — Required)

Mercy condition: The BCC compliance capture references archive@atlantisits.ai but the cost model only defines two mailboxes. This must be resolved before build.

Decision (pending Shane confirmation):

Recommended: Option A — alias to council@ for Phase 1. Promotes to dedicated mailbox only if retention/access rules require isolation.

archive@atlantisits.ai will be implemented as an alias or dedicated mailbox only after retention and access rules are defined. — Mercy

DNS Setup

Configure in Cloudflare DNS for atlantisits.ai — all records DNS Only (grey cloud):

MX Records

TXT Records

⚠️ SPF + DKIM + DMARC must be configured before first send — No-Go gate. ⚠️ Plan DNS maintenance window. Validate with dig MX atlantisits.ai before cutover.

n8n Routing Architecture

Public Inbox — ai@atlantisits.ai

External email → ai@atlantisits.ai
→ n8n IMAP trigger
→ Jimmy compliance filter (content scan, strip sensitive data)
→ Scout API — primary public handler
→ Switch by subject/content:
    "billing" / "pricing"   → Mercy lane
    "technical" / "help"    → Ozzy lane
    "research" / "intel"    → Scout lane (default)
    "Nova" / "product"      → Nova lane (Phase 2)
→ Draft reply generated
→ *** HUMAN APPROVAL GATE — Shane reviews ALL public replies Phase 1 ***
→ SMTP reply from ai@atlantisits.ai
→ BCC → archive@atlantisits.ai
→ Log → /atlantis-ops/logs/email-public.log
→ Weekly digest → #council Discord (Scout condition)

Council Inbox — council@atlantisits.ai

Internal email → council@atlantisits.ai
→ n8n IMAP trigger
→ Sender whitelist check (Jimmy)
    Known sender → proceed
    Unknown sender → QUARANTINE + log + notify Shane (not reject — Mercy)
→ Read To: header → Switch node:
    To: ozzy@...    → Ozzy API (Anthropic)
    To: mercy@...   → Mercy API (OpenAI)
    To: scout@...   → Scout API (xAI)
    To: cooper@...  → Cooper API (Copilot)
    To: jimmy@...   → Jimmy audit log only (no reply)
    To: lyra@...    → Scout ingestion → Lyra scoring
    To: council@... → Scout (default handler)
→ Approval gate (ops / financial / public content)
→ BCC → archive@atlantisits.ai (compliance capture)
→ SMTP reply from council@atlantisits.ai
→ Log → /atlantis-ops/logs/email-council.log

Routing Rules by Function (Lyra)

Access Model (Jimmy — Council Approved)

Security Rules (All Council)

Both inboxes: - [ ] MFA on both Zoho accounts — No-Go gate - [ ] Strong unique passwords — password manager - [ ] No credentials, API keys, .env, secrets — ever - [ ] SPF + DKIM + DMARC before first send — No-Go gate - [ ] DNS Only (grey cloud) in Cloudflare - [ ] Quarterly access review documented in Forgejo - [ ] All AI replies logged

council@ additional (Jimmy + Mercy): - [ ] Sender whitelist enforced - [ ] Unknown senders quarantined + logged + Shane notified (never auto-rejected Phase 1) - [ ] BCC compliance capture active - [ ] Jimmy audit log for all compliance events

ai@ additional (Scout + Mercy): - [ ] Human approval gate on ALL outgoing replies — Phase 1 non-negotiable - [ ] Content filter before Scout processes - [ ] Weekly digest of public activity → #council Discord

Standard signatures:

ai@atlantisits.ai:

Powered by Atlantis ITS AI — operating under SOP-008 v0.4.
Do not send sensitive personal, financial, or confidential data.
— ai@atlantisits.ai

council@atlantisits.ai:

This inbox is for internal Atlantis ITS AI operations only.
External senders: please use ai@atlantisits.ai.
Operating under SOP-008 v0.4.
— Atlantis ITS AI Council

Knowledge Rule (Mercy — Non-Negotiable)

Email is not source of truth. Email is intake and discussion.

Forgejo = source of truth. Important decisions promoted email → Forgejo before canonical.

Go-Live Validation Checklist

Personal inbox access (Jimmy/Gmail, Cooper/Outlook) must NOT be revoked until ALL of these pass:

• [ ] ai@ public inbox test: external sender → Scout responds → Shane approves → reply sent
• [ ] council@ alias route test: jimmy@ → Jimmy audit log, no reply
• [ ] council@ alias route test: ozzy@ → Ozzy responds correctly
• [ ] Approval gate test: public reply blocked until Shane approves
• [ ] Logging test: both email-public.log and email-council.log writing
• [ ] Quarantine test: unknown sender to council@ → quarantine + Shane notified
• [ ] Reply signing test: signature present on outbound replies
• [ ] BCC capture test: archive@ receives copy of all council replies
• [ ] Weekly digest test: #council Discord receives public inbox summary

Cost Model

SOP-008 Assessment (Jimmy — 100% Section 16 Alignment)

Documents Generated by This Brief

Action Items

Implementation Timeline

Tonight (Wednesday May 20)
→ CB-001 v4.2 pushed to Forgejo ✅
→ archive@ decision confirmed by Shane

↓ Before VPS deploy weekend
→ DNS maintenance window planned
→ No-Go Criteria reviewed — all gates confirmed ready

↓ Hetzner VPS deploy weekend (funds pending)
→ n8n live on PostgreSQL
→ Zoho accounts created: ai@ + council@
→ MX + SPF + DKIM + DMARC configured
→ MFA + signatures enabled
→ n8n wired: public routing + council routing
→ Jimmy compliance filter + quarantine rule active
→ BCC compliance capture active
→ Approval gate active
→ Full go-live validation checklist runs

↓ Post-validation
→ All checklist items pass
→ Personal inbox access revoked (Jimmy/Gmail, Cooper/Outlook)
→ Weekly public digest → #council Discord active
→ CB-001 CLOSED ✅
→ Chronicle announcement: "Email our AI at ai@atlantisits.ai"

↓ Phase 2
→ Per-agent aliases added (free)
→ Nova email routing agent
→ atlas@ reserved identity activated

V24 Memory Items (Log Wednesday)

- CB-001 v4.2 — UNANIMOUSLY APPROVED WITH CONDITIONS — 7/7 votes
- atlantisits.ai = AI command domain. atlantisits.co = business/client.
- Two-inbox architecture: ai@ (public) + council@ (private)
- Phase 1: two Zoho accounts, free tier (2 of 5 mailboxes)
- Phase 2: unlimited aliases — ozzy@, mercy@, scout@, cooper@, jimmy@, lyra@, atlas@
- Jimmy alias architecture: infinite aliases, zero extra cost
- Zoho MX: mx.zoho.com (10), mx2.zoho.com (20), mx3.zoho.com (50)
- SPF + DKIM + DMARC required before go-live (No-Go gate)
- Human approval gate: ALL public replies Phase 1 (Scout + Mercy condition)
- Unknown council@ senders: quarantine + log + notify Shane (not reject)
- archive@ = alias to council@ Phase 1 (pending Shane confirmation)
- Personal inbox revocation: ONLY after full go-live validation passes
- Weekly public inbox digest → #council Discord (Scout condition)
- SOP-010, HT-019, HT-020 queued
- No-Go Criteria section added (Mercy)
- Go-live validation checklist: 9 tests must pass before revocation
- Chronicle announcement after Phase 1 validation (no issue number bound)
- Jimmy: SOP-008 Section 16 = 100% alignment. Revocation = greatest security win.
- Cooper: email as intake, Forgejo as canonical — exactly Cooper's mandate.

References

• SOP-008 v0.4 — AI Production Risk Review
• ATLANTIS_AI_MEMORY.md V23 (May 14, 2026)
• updates.md May 20, 2026
• RUNBOOK-Hetzner-VPS-Phase1-v3.md
• Zoho Mail: zoho.com/mail
• Cloudflare DNS: dash.cloudflare.com
• n8n IMAP Trigger: docs.n8n.io/integrations/builtin/trigger-nodes/n8n-nodes-base.imaptrigger
• n8n Send Email: docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.sendemail
• CB-001 v1.0 through v4.1 (superseded)
• CB-002 v1.0 — Nova Voice (companion brief)

CB-001 v4.2 — FINAL — compiled by Ozzy — May 20, 2026
7/7 council votes received — unanimously approved with conditions
Store at: C:\AtlantisITS\knowledge\CB-001-AI-Communications-Domain.md
Push to Forgejo: atlantis-docs/council/CB-001-AI-Communications-Domain.md
Deployment gated on No-Go Criteria — see checklist above