Air-gap mode and the Firestore portability shim

Turtini's enterprise direction is **portable data, portable inference, portable presence**. The product runs on Firestore + Cloud Functions by default, but the data layer is abstracted behind a shim so an air-gapped deployment can swap Firestore for Postgres (and the inference path can swap Anthropic Direct for Bedrock GovCloud, vLLM, or an internal gateway) without rewriting application code.

What's shipped today (Phase 1):

• **Data layer abstraction.** Every context that talks to Firestore goes through `src/lib/db` — a small adapter surface (`collection().doc()`, `.where()`, `.onSnapshot()`, server timestamps, transactions). The same surface is implemented by both Firestore and a Postgres-backed driver. Today the Firestore driver is the live one; the Postgres driver runs in the same shape for migration testing.
• **Streaming change capture.** Debezium + Kafka tail Firestore writes and emit typed change events into a Postgres replica with declared schemas (CRM tables come first). The point is to have a parallel system of record an air-gapped deployment can read directly without going through Firestore.
• **Stable typed schema.** Each domain (Contacts, Accounts, Opportunities, etc.) has a Postgres schema that mirrors the Firestore shape — chunked work, one module at a time, to avoid a big-bang migration. Phase 1 covers Contacts; further chunks roll out incrementally.

What air-gap mode unlocks once it's complete:

• **Deploy inside your VPC / your GCP project / your AWS GovCloud account.** The application binary runs against your Postgres + your inference endpoint + your Storage bucket; no callbacks to Turtini's central tenancy.
• **No Anthropic Direct dependency.** Pair air-gap deployment with Wally Sovereignty (BYO Anthropic-compatible or OpenAI-compatible endpoint) to keep every byte of AI traffic in your boundary.
• **No outbound from your perimeter** other than the third parties you explicitly opted into (e.g., Stripe Connect if you accept payments, your SIEM destination, your CRM connector targets).
• **Same UI, same modules, same upgrades.** Air-gap deployments take the same versioned releases as commercial Turtini, gated through your own change-control window.

Who this is for:

This isn't the default Turtini experience and most orgs don't need it. The customers that do:

• Federal contractors with FedRAMP High or DoD IL5 obligations on their data
• Sovereign / national-account customers contractually owed in-country residency
• Large enterprises with security teams that prefer running shared infrastructure inside their own boundary
• Anyone who needs to demonstrate to a regulator that the system of record is *theirs*, not a SaaS

What's still in progress:

Phase 1 covers the shim plus CRM-first replica. Phase 2 covers Accounting + Workforce; Phase 3 covers everything else. Each phase is independently shippable so commercial Turtini benefits from the same migrations along the way (better Firestore performance, cleaner audit, faster cross-region reads).

How to engage:

If air-gap deployment fits your compliance posture, contact your account team. The conversation is contract-driven (sizing, environment, change-control cadence, who operates what), not a self-serve toggle — once we agree on scope, you get the same Turtini you'd get on the commercial side, running inside your boundary.