The Helios AX platform pairs a static SEO base layer with a generative intent layer: permanent, indexable pages for search authority, and agent-composed Content Blocks for real-time buyer journeys — grounded in approved Atoms, never in guesswork. Helios AX 平台結合靜態 SEO 基礎層與生成式意圖層：以永久、可索引的頁面累積搜尋權重，並由 agent 即時組合 Content Block 驅動買家旅程 — 內容一律以核准的 Atom 為依據，而非模型臆測。
Static SEO pages and generative Content Blocks have opposite physics — cacheable vs. stateful, TTFB vs. time-to-first-token. They share one domain and one edge, but never one failure mode: a full AI outage leaves the website fully functional and indexable.靜態 SEO 頁面與生成式 Content Block 的特性完全相反 — 可快取 vs. 有狀態、TTFB vs. time-to-first-token。兩者共用同一網域與 edge，但絕不共用故障模式：即使 AI 層全面停擺，網站仍完整可用、可被搜尋引擎索引。
The agent never answers from raw model knowledge. Every response is assembled from approved Atoms — reviewed units of knowledge linked to canonical Roots in Neo4j — so accuracy is a property of the pipeline, not a hope about the model.Agent 從不依賴模型原生知識作答。每個回應都由核准的 Atom 組成 — 經審核、連結至 Neo4j 中 canonical Root 的知識單元 — 因此正確性是 pipeline 的屬性，而非對模型的期望。
Compute, databases, session state and the graph sit in GCP asia-east1 (Changhua) — single-digit ms to Taipei. Two processing exceptions are disclosed rather than glossed over: gemini-embedding-2 has no asia-east1 endpoint (global / us / eu only), and Gemini inference falls back to the global endpoint where a model is not offered in-region. Both go to infosec (Q5). Everything is containerised and Terraform-defined: the exit ramp stays open by design.運算、資料庫、session 狀態與圖譜皆部署於 GCP asia-east1（彰化）— 至台北僅個位數毫秒。有兩項處理例外，我們選擇明確揭露而非帶過：gemini-embedding-2 沒有 asia-east1 endpoint（僅 global / us / eu），且區域內未提供的 Gemini 模型會落到 global endpoint。兩者皆納入 infosec 審查（Q5）。所有元件皆容器化並以 Terraform 定義：架構在設計上保留了遷出的彈性。
The five ADRs and the client questionnaire are reproduced here in full — every section, table, diagram and action item, each with its own table of contents.五份 ADR 與客戶問卷已完整收錄於此 — 包含所有章節、表格、圖表與行動項，每份文件並附獨立目錄。
Cloud Run asia-east1 behind Cloudflare Business. Vercel, Workers and a hybrid split rejected. HA menu, cost model, critical path.Cloud Run asia-east1 搭配 Cloudflare Business；否決 Vercel、Workers 與混合架構。含 HA 選項、成本模型與關鍵路徑。
ADR-002 · AI MODELSGemini 3.x per stage, deterministic-first root assignment, cost derivation, eval bars, and the jurisdiction gate.各階段選用 Gemini 3.x、確定性優先的 root 指派、成本推導、評估門檻與管轄權關卡。
ADR-003 · DATA & GRAPHLeiden/Louvain on the live graph, no SQL estate to justify Spanner, and roughly 3× the cost at agent launch.需在生產圖譜上執行 Leiden/Louvain、沒有可支撐 Spanner 的關聯式資產，且 agent 上線時成本約為 3 倍。
ADR-004 · DATA & GRAPHCommunity Edition through M4, Aura Business Critical before M5 Alpha Chat. No custom database RBAC in Helios scope.M4 前使用 Community Edition，M5 Alpha Chat 前遷移至 Aura Business Critical。Helios 範圍不含自建資料庫 RBAC。
ADR-005 · GENERATIVE UIKeying on Roots, fan-out economics, validity from Atom expiry, the AGUI cold path, and the Payload↔Atom split by surface.以 Root 為鍵、fan-out 成本、由 Atom 到期推導有效期、AGUI 冷路徑，以及依介面切分的 Payload↔Atom 分工。
Track A (website slice, delivered M4) serves ~1,000 permanent SSG/ISR pages from Cloud Run behind Cloudflare's tagged cache. Track B (agent slice, Alpha M5 / production M6) answers buyer intent through an agent loop that first tries the Content Block Library, then falls back to retrieval and assembly. Both tracks read from the same knowledge plane; only Track B depends on it at runtime. Track A（website slice，M4 交付）透過 Cloudflare 的 tagged cache，自 Cloud Run 提供約 1,000 個永久的 SSG/ISR 頁面。Track B（agent slice，Alpha M5 / 正式 M6）以 agent 迴圈回應買家意圖：先查詢 Content Block Library，未命中才進行檢索與組裝。兩軌共用同一知識平面；但只有 Track B 在執行期依賴它。
High-intent keywords ("Manufacturing ERP", "MES System", "ESG Carbon Accounting", "METIS AI Platform") are served as SSG/ISR pages with permanent URLs. Publishing feels instant: a Payload afterChange hook fires revalidateTag and a Cloudflare tag purge in the same call. This track has zero runtime dependency on the AI stack.高意圖關鍵字（「Manufacturing ERP」、「MES System」、「ESG Carbon Accounting」、「METIS AI Platform」）以具永久 URL 的 SSG/ISR 頁面提供。發佈即時生效：Payload 的 afterChange hook 會同時觸發 revalidateTag 與 Cloudflare tag purge。此軌道在執行期完全不依賴 AI 堆疊。
Instead of regenerating whole pages, the agent composes atomic Content Blocks into the active session canvas. A cheap router model classifies intent and rejects abuse before any paid model runs; the agent tier is never publicly routable — only the web tier's service identity can call it.Agent 不重新生成整個頁面，而是將原子化的 Content Block 組合進當前 session canvas。低成本的 router 模型先分類意圖並攔截濫用，之後才會呼叫付費模型；agent 層不對外開放路由 — 僅 web 層的 service identity 可呼叫。
SSG / ISR / RSC streaming, output: standalone — the reference Node server, no adapter.SSG / ISR / RSC streaming，output: standalone — 原生 Node server，無 adapter。
Editorial system on its supported persistent-Node configuration; version retention capped.以官方支援的常駐 Node 模式運行；版本保留數量已設上限。
CDN, WAF, Turnstile, Images, tag purge — replaces Cloud CDN entirely.CDN、WAF、Turnstile、Images、tag purge — 完全取代 Cloud CDN。
Web + agent tiers, asia-east1; agent service private, 60-min timeouts for streams.Web 與 agent 兩層，asia-east1；agent 服務不對外，串流逾時上限 60 分鐘。
Knowledge + context graph with native HNSW vector index. CE through M4 → Aura Business Critical before M5 (ADR-003 / ADR-004).知識與情境圖譜，內建 HNSW 向量索引。M4 前使用 CE，M5 前遷移至 Aura Business Critical（ADR-003 / ADR-004）。
Gemini 3.x per stage, context caching, quotas as the budget backstop.各階段採用 Gemini 3.x，啟用 context caching，以 quota 作為預算防線。
Visitor profiles and continue-engagement; email opt-in resume, no user accounts.訪客輪廓與續談狀態；以 email opt-in 續談，無需帳號。
CMS data, chat transcripts, and zh-TW keyword search via pg_bigm. Regional HA in Taiwan; Tokyo replica only under option C.CMS 資料、對話紀錄，並以 pg_bigm 支援 zh-TW 關鍵字搜尋。台灣區域 HA；僅在方案 C 下才建立東京副本。
Shared ISR cache handler across Cloud Run instances.跨 Cloud Run 實例的共享 ISR cache handler。
Streaming primitives and generative-UI wiring in the web tier — the library only. Vercel hosting is rejected (ADR-001).Web 層的串流基礎與生成式 UI 接線 — 僅採用此函式庫；Vercel hosting 已被否決（ADR-001）。
Design-time documentation of packages/ui; nothing fetched at runtime.packages/ui 的設計期文件；執行期不讀取任何內容。
Governed retrieval architecture: Atoms, Roots, OKF, AMS, Content Blocks.受治理的檢索架構：Atom、Root、OKF、AMS、Content Block。
| Layer層級 | Choice選型 | Region / milestone區域 / 里程碑 |
|---|---|---|
| EdgeEdge | Cloudflare Business — CDN · WAF · purge · Images · $200/mo per zone | global · TPE PoP |
| Web tierWeb 層 | Cloud Run — Next.js standalone + Payload CMS | asia-east1 · M4 |
| Agent tierAgent 層 | Cloud Run — agent loop + Atlas retrieval (native Bolt) | asia-east1 · M5–M6 |
| ISR cacheISR 快取 | Memorystore Redis, shared cache handler (TBC with Peter) | asia-east1 · M4 |
| CMS + transcripts DBCMS 與對話資料庫 | Cloud SQL Postgres — regional HA, pg_bigm; Tokyo replica = option C only | asia-east1 · M4 |
| Graph圖譜 | Neo4j — CE on GCE (private VPC) → Aura Business Critical | asia-east1 · M4→M5 |
| Visitor profiles訪客輪廓 | Firestore — profiles + continue-engagement (region immutable) | asia-east1 · M5 |
| Media媒體 | GCS + Cloudflare Images (or Cloud Connector to storage.googleapis.com) | asia-east1 · M4 |
| Models模型 | Vertex AI — Gemini 3.x via official Node SDK (not Agent Runtime) | asia-east1 · M4 |
| EmbeddingsEmbedding | gemini-embedding-2 — no asia-east1 endpoint | global / us / eu · Q5 |
ATLAS (Approved, Governed, Operationalized Retrieval Architecture) treats knowledge as a lifecycle, not a dump. Source documents are deterministically extracted, chunked, and linked to canonical Roots (products, industries, organizations) before any Atom reaches the graph. LLMs assist at the edges — parsing visuals, suggesting candidates on misses — but never auto-link, and never bypass review. ATLAS（Approved, Governed, Operationalized Retrieval Architecture）將知識視為一套生命週期，而非一次性倒入。來源文件先經確定性抽取、切分，並連結至 canonical Root（產品、產業、組織），Atom 才會進入圖譜。LLM 僅在邊緣輔助 — 解析圖像內容、在比對未命中時提出候選 — 絕不自動建立連結，也絕不繞過審核。
| Term詞彙 | Definition定義 |
|---|---|
| Atom | The canonical, approved unit of retrievable knowledge.可檢索知識的 canonical、經核准的最小單元。 |
| Root | A real-world entity (product, organization) an Atom is about — the key space for retrieval and Content Block reuse.Atom 所描述的真實世界實體（產品、組織）— 檢索與 Content Block 重用的鍵值空間。 |
| OKF | Open Knowledge Format — Git-friendly Markdown-plus-metadata; the durable source of truth for approved knowledge. Neo4j is the runtime mirror.Open Knowledge Format — 適合 Git 的 Markdown + metadata 格式；核准知識的長期 source of truth。Neo4j 為執行期鏡像。 |
| AMS | Atom Management System — operator dashboard for review, expiry alerts, and Content Block management (M5–M6; through M4 an Obsidian workflow plus an escalation queue does the job).Atom Management System — 提供審核、到期警示與 Content Block 管理的操作後台（M5–M6；M4 之前以 Obsidian 流程加上升級佇列替代）。 |
| AtomIQC | Automated pre-publication quality checks (schema, root, boundary, policy). Through M4: deterministic pipeline gates with LLM assist.發佈前自動品質檢查（schema、root、邊界、政策）。M4 之前以確定性 pipeline gate 搭配 LLM 輔助實作。 |
A Content Block is a pre-rendered UI response — an approved component from packages/ui populated with approved Atoms — live-bound to its grounding Atoms and served directly on a cache hit. Keys are built on Roots, so "Does your ERP handle automotive?" and「我們是汽車零件廠，你們的 ERP 適合嗎？」resolve to the same block. Approval gates reuse, not first service: a freshly assembled block serves immediately and queues for library entry.
Content Block 是預先渲染的 UI 回應 — 由 packages/ui 中核准的元件填入核准的 Atom — 與其依據的 Atom 保持 live-binding，快取命中時直接送出。鍵值建立在 Root 之上，因此「Does your ERP handle automotive?」與「我們是汽車零件廠，你們的 ERP 適合嗎？」會解析到同一個 block。核准把關的是重用而非首次服務：新組裝的 block 立即送出，同時排入 library 審核佇列。
Consistency first: two prospects from one buying committee get the identical answer to the same question — a governance property, not a caching trick. Then latency (instant render vs. generate-and-stream), then an accumulating asset with a compliant route into SEO.一致性優先：同一採購委員會的兩位成員，對同一問題得到完全一致的回答 — 這是治理特性，不是快取技巧。其次是延遲（即時渲染 vs. 生成串流），再者是可累積的資產，並具備合規進入 SEO 的路徑。
Approval composes for facts, not for juxtaposition. Indexing a block is a separate explicit editorial action in AMS; the session canvas is noindex structurally; the library launches at M6 with indexability off entirely. Schema, keys and volatile types are M2–M3 build work.核准的組合性只涵蓋事實，不涵蓋並列呈現的語境。將 block 編入索引是 AMS 中獨立且明確的編輯行為；session canvas 在結構上一律 noindex；library 於 M6 上線時完全關閉索引功能。schema、鍵值與 volatile 類型屬 M2–M3 的建置工作。
| Stage階段 | Primary主要選型 | Note說明 |
|---|---|---|
| Extraction抽取 | Docling · Unlimited OCR · MinerU · Document AI · pdfplumber (no model) | Ground truth for numeric reconciliation.數值核對的基準真值。 |
| Multimodal parsing多模態解析 | gemini-3.7-flash → 3.1-pro | Escalate on flagged pages; hallucination bar = 0 on golden set.被標記頁面升級處理；golden set 上幻覺容忍為 0。 |
| Chunking切分 | No generative model不使用生成模型 | Structure-first + pinned semantic; model/threshold change = pipeline-version bump.結構優先 + 固定版本語意切分；模型或閾值變更即視為 pipeline 版本升級。 |
| FrontmatterFrontmatter | gemini-3.5-flash-lite | High-volume, low-difficulty.高量、低難度。 |
| Root assignmentRoot 指派 | Registry match (no model)Registry 比對（不使用模型） | LLM (3.1-pro) suggests on misses only — post-filtered, never auto-linked. Bar: ≥95% root resolution.LLM（3.1-pro）僅在未命中時提出候選 — 經過濾、絕不自動連結。標準：root 解析 ≥95%。 |
| Embedding | gemini-embedding-2 GA 22 Apr 2026 | 1536 indexed / 3072 archived to GCS — the only irreversible choice. No asia-east1 endpoint (global / us / eu only): the ML-processing residency exception goes to infosec (Q5) before the first full corpus embed. Alt: text-multilingual-embedding-002.1536 入索引 / 3072 歸檔至 GCS — 唯一不可逆的選擇。沒有 asia-east1 endpoint（僅 global / us / eu）：首次完整語料 embedding 前，須將此 ML 處理落地例外送 infosec 確認（Q5）。替代方案：text-multilingual-embedding-002。 |
| Reranking | flash-lite cross-encoder | Bar: ≥15% nDCG@5 uplift, ≥40% context reduction.標準：nDCG@5 提升 ≥15%、context 縮減 ≥40%。 |
| Router / guardrailRouter / 護欄 | gemini-3.1-flash-lite | Intent class, abuse rejection, token ceilings — protects the budget.意圖分類、濫用攔截、token 上限 — 守護預算。 |
| Runtime agent (M5+)執行期 agent（M5+） | gemini-3.7-flash + caching | TTFT ≤1.5s p50; cost/turn ≤$0.012 cached at introductory rates. Model is picked during M5 (gantt Mar 2027) against the real corpus — not in December.TTFT p50 ≤1.5 秒；啟用快取、依introductory 費率每輪成本 ≤$0.012。模型於 M5 期間（gantt 2027 年 3 月）依真實語料定案 — 不是在 12 月。 |
Generated text drifts toward Mainland vocabulary even from correct Traditional Chinese input (軟件→軟體, 網絡→網路, 數據→資料). A glossary constrains every generative stage; a CI validator scans for Simplified codepoints and glossary violations; the runtime agent's compliance bar is ≥99%.即使輸入為正確的繁體中文，生成文字仍可能偏向大陸用語（軟件→軟體、網絡→網路、數據→資料）。術語表約束所有生成階段；CI validator 掃描簡體碼位與術語違規；執行期 agent 的合規標準為 ≥99%。
There is no contractual cap. The working projection is ~US$1,000–1,500/month of agent runtime at 3.7 Flash introductory rates with ~60% of input cached, rising to ~$2,000–3,200 from 1 Jan 2027 when those rates double; Helios has verbally accepted that range. Controls exist because the endpoint is public and fronts a paid model: Vertex quotas, alerts at 50/75/90% of the current projection routed to a human, per-session and per-IP token ceilings, Turnstile and rate limiting, anomaly detection, and a tested kill switch that disables the agent while the site stays fully functional.並無合約上限。目前推估為 agent 執行期每月約 US$1,000–1,600（3.7 Flash introductory 費率、約 60% input 命中快取）；2027 年 1 月 1 日費率倍增後升至約 $2,000–3,200。Helios 已口頭接受此區間。控管措施之所以存在，是因為該 endpoint 公開且背後是付費模型：Vertex quota、以當期推估的 50/75/90% 發出警示並送達真人、per-session 與 per-IP token 上限、Turnstile 與速率限制、異常偵測，以及經演練的 kill switch — 停用 agent 時網站仍完整運作。
| Layer層級 | Target目標 | Basis依據 |
|---|---|---|
| Website — pages, content, search網站 — 頁面、內容、搜尋 | 99.9% | Cloudflare + Cloud Run in Taiwan (zonal redundancy) — not "two GCP regions". Survives total AI-stack failure.Cloudflare + 台灣的 Cloud Run（區域內多可用區）— 並非「兩個 GCP region」。即使 AI 堆疊全面故障仍可運作。 |
| Chat agent (from Alpha Chat M5, post-Aura)Chat agent（Alpha Chat M5 起，Aura 遷移後） | 99.5% | Depends on Vertex AI, Aura, Firestore; never offered on self-hosted CE.依賴 Vertex AI、Aura、Firestore；自架 CE 期間不提供此承諾。 |
| CMS adminCMS 後台 | 99.5% | Regional HA; brief failover windows acceptable.區域 HA；可接受短暫的容錯移轉窗口。 |
The SEO layer has zero runtime dependency on the agent stack: a full AI outage leaves the website functional and indexable, and that is tested deliberately on a game-day.SEO 層在執行期完全不依賴 agent 堆疊：AI 全面停擺時網站仍可用、可索引，並以 game-day 演練實測驗證。
Costs are production website monthly. Postgres cannot do two-region active-active; Firestore has no Asian multi-region; asia-east2 (Hong Kong) is excluded on residency and geopolitical grounds.以下為正式網站每月成本。Postgres 無法做雙區 active-active；Firestore 在亞洲沒有 multi-region；基於資料落地與地緣政治考量，排除 asia-east2（香港）。
| Option方案 | Recommendation建議 | +$/mo vs A相對 A 增額 | Website prod $/mo正式站每月 | RPO / RTORPO / RTO |
|---|---|---|---|---|
| A · Taiwan regional HA台灣區域 HA | default | 0 | ~670 | SQL zone fail: RPO 0 / RTO ~60 s. Region loss = outage; SEO holds on Cloudflare cache.SQL 單區故障：RPO 0 / RTO 約 60 秒。整區失效即中斷；SEO 由 Cloudflare 快取支撐。 |
| C · Tokyo SQL replica東京 SQL 副本 | if Q5 allows JapanQ5 允許日本時 | ~130 | ~810 | Region fail: RPO = lag (sec–min), RTO ~15–30 min, manual promote.整區故障：RPO = 延遲（秒至分），RTO 約 15–30 分，需手動提升。 |
| C+ · Tokyo origin failover東京 origin 容錯 | if Q5 allows JapanQ5 允許日本時 | ~190 | ~860 | As C, plus Cloud Run can take traffic behind a CF load balancer. ISR cache stays in Taiwan.同 C，並可在 CF 負載平衡後由 Cloud Run 接手流量。ISR 快取仍留在台灣。 |
| X · 2-region active-active雙區 active-active | avoid | ~240 | ~920 | Looks like seconds, isn't: Memorystore is single-region, so Tokyo misses the shared ISR cache. Do not sell it.看似秒級實則不然：Memorystore 為單區服務，東京取不到共享 ISR 快取。不應提案。 |
| D · Aura BC 2 GBAura BC 2 GB | required before M5 | 292 (replaces CE ~$150) | — | In-region 3-zone HA. No cross-region graph DR.區域內三可用區 HA；圖譜無跨區 DR。 |
| D+ · Aura + 1 secondaryAura + 1 個副本 | Q1 2027 review only僅 2027 Q1 檢討 | 584 | — | Secondary billed at full GB-hour.副本以完整 GB-hour 計費。 |
Phase-by-phase totals, assumptions and sensitivities are on the Cost Projection page.逐階段的合計、假設與敏感度分析請見成本推估頁。
~$387 production (Cloud SQL HA, Cloud Run, GCP Cloud CDN + Armor during build) + ~$75 staging + ~$20 development + ~$30 residual Vertex = ~$500/month expected. Quoted to Helios at ~$600/month with a billing alert at $850. Excludes Cloudflare Business, Memorystore, Neo4j GCE and agent-slice AI runtime. Cloudflare Business replaces Cloud CDN at launch. Corpus ingestion is one-time — US$1,500–3,000 across the build — never folded into a monthly figure.正式環境約 $387（Cloud SQL HA、Cloud Run、建置期使用 GCP Cloud CDN + Armor）+ staging 約 $75 + 開發約 $20 + Vertex 殘量約 $30 = 每月預期約 $510。對 Helios 報價每月約 $600，並在 $850 設帳單警示。不含 Cloudflare Business、Memorystore、Neo4j GCE 與 agent slice 的 AI 執行成本。上線時由 Cloudflare Business 取代 Cloud CDN。語料 ingestion 屬一次性費用 — 整個建置期 US$1,500–3,000 — 絕不併入每月數字。
Cloud Run $80–150 · Cloud SQL $180–260 (+~$130 under option C) · Memorystore $35–70 · Firestore + GCS $20–50 · Cloudflare Business $250 (+$5 LB under C+) · Neo4j CE $130–170 through M4 → infrastructure subtotal $700–1,000/month. Do not sum every line in one month: CE drops once Aura BC ($292) takes over. AI runtime is additional and is a projection, not a cap.Cloud Run $80–150 · Cloud SQL $180–260（方案 C 再 +約 $130）· Memorystore $35–70 · Firestore + GCS $20–50 · Cloudflare Business $250（C+ 再 +$5 LB）· Neo4j CE 於 M4 前 $130–170 → 基礎設施小計每月 $700–980。切勿把所有項目加總在同一個月：Aura BC（$292）接手後 CE 即下線。AI 執行成本另計，且屬推估而非上限。
The default is Taiwan-only: Cloud Run in asia-east1 with zonal redundancy, Cloud SQL regional HA, no Tokyo replica and no Cloudflare Load Balancing. A Tokyo replica (option C) means Postgres data at rest in Japan — an infosec choice, not a pre-commitment. Hong Kong (asia-east2) is excluded outright.預設為台灣單區：Cloud Run 部署於 asia-east1 並具區域內多可用區，Cloud SQL 採區域 HA，不建東京副本、不啟用 Cloudflare 負載平衡。東京副本（方案 C）意味 Postgres 資料落在日本 — 這是資安決策，不是預先承諾。香港（asia-east2）直接排除。
Under option A, Cloud SQL is regional HA within Taiwan — two zones, RPO 0, RTO ~60 s — and losing the region is an outage the Cloudflare cache softens for the SEO layer. It is never described as "two regions" or as active-active.在方案 A 下，Cloud SQL 為台灣區域內 HA — 雙可用區、RPO 0、RTO 約 60 秒 — 整區失效即為中斷，僅 SEO 層可由 Cloudflare 快取緩衝。絕不表述為「雙區域」或 active-active。
Game-day: kill the agent stack, verify the site stays indexable. Cloud SQL zonal failover drill. Weekly restore verification — an unverified backup is not a backup. Prove a full graph rebuild from source before M4 handover, rehearse the Aura migration after M4, and sign the Business Critical contract in August–September so lead time never becomes the M5 critical path.Game-day 演練：關閉 agent 堆疊，驗證網站仍可索引。Cloud SQL 同區容錯演練。每週還原驗證 — 未經驗證的備份不算備份。M4 交接前須實證圖譜可自來源完整重建，M4 後演練 Aura 遷移，並於 8–9 月簽訂 Business Critical 合約，避免交期成為 M5 的關鍵路徑。
Full decision records — options, scoring, trade-offs and open questions — are included as pages in this document: ADR-001 through ADR-005 plus the client questionnaire.完整決策紀錄 — 選項、評分、取捨與待決問題 — 已收錄於本文件的頁面中：ADR-001 至 ADR-005 以及客戶問卷。
Infrastructure and AI runtime cost, projected across the build, the agent slice, and the operating term. Every figure is a planning projection against August 2026 list prices — none of it is a contractual cap, and the three scopes must never be compared side by side.基礎設施與 AI 執行成本，分別推估建置期、agent slice 與維運期。所有數字皆為依 2026 年 8 月牌價所做的規劃推估 — 均非合約上限，且三種範圍絕不可並列比較。
Roughly September 2026 to the M4 deploy. Nothing is public yet: Cloud CDN and Cloud Armor front the build, Neo4j runs as a private build-time system, and Vertex spend is dominated by one-time corpus ingestion rather than by traffic. Modelled at 5 months; see the duration assumption below.約自 2026 年 9 月至 M4 部署。此時尚未對外：以 Cloud CDN 與 Cloud Armor 支撐建置期，Neo4j 作為私有的建置期系統運行，Vertex 的花費主要來自一次性的語料 ingestion 而非流量。以 5 個月模型計算；期間假設見下方。
| Line項目 | Monthly每月 | Months月數 | Phase total階段合計 |
|---|---|---|---|
| Production build environment — Cloud SQL HA, Cloud Run, GCP Cloud CDN + Armor正式建置環境 — Cloud SQL HA、Cloud Run、GCP Cloud CDN + Armor | ~$387 | 5 | ~$1,935 |
| Staging environmentStaging 環境 | ~$75 | 5 | ~$375 |
| Development environment開發環境 | ~$20 | 5 | ~$100 |
| Vertex AI — development and residual (not corpus ingestion)Vertex AI — 開發與殘量（非語料 ingestion） | ~$30 | 5 | ~$150 |
| Quoted Phase A scopePhase A 報價範圍 | ~$510 (quoted $600, alert $850)（報價 $600、警示 $850） | 5 | ~$2,550 |
| Neo4j Community Edition on GCE — private, build-time only, from M2GCE 上的 Neo4j Community Edition — 私有、僅建置期使用，自 M2 起 | $130–170 | 4 | $520–680 |
| Memorystore Redis — shared ISR cache, once wired (M3+)Memorystore Redis — 共享 ISR 快取，接線完成後（M3 起） | $35–70 | 3 | $105–210 |
| Cloudflare Business — from the launch cutover, replaces Cloud CDNCloudflare Business — 自上線切換起，取代 Cloud CDN | $250 | 1–2 | $250–500 |
| Corpus ingestion — Vertex, one-time across the whole build語料 ingestion — Vertex，整個建置期的一次性費用 | one-time一次性 | — | $1,500–3,000 |
| Phase 1 totalPhase 1 合計 | — | — | ~$4,900–6,900 |
The $850 billing alert applies to the quoted Phase A scope only. The three lines below it are real spend in the same window but sit outside that quote — they belong to the steady-state architecture and simply start early. Ingestion is one-time: 3–5 full passes at $110–200 each plus 20–40 partial passes on a ~10% development subset, plus contingency. Folding it into a monthly figure overstates the run-rate by roughly $300–600 a month.$850 的帳單警示僅適用於 Phase A 報價範圍。其下三個項目在同一期間確實會產生費用，但不在該報價內 — 它們屬於穩態架構，只是提早啟用。Ingestion 為一次性：3–5 次完整批次（每次 $110–200），加上在約 10% 開發子集上的 20–40 次部分批次，再加預備。若把它併入每月數字，會讓月營運成本高估約 $300–600。
Roughly February to April 2027 — Alpha Chat is gantt M5 (Mar 2027) and M6 production is date-TBC. Modelled at 3 months.約 2027 年 2 月至 4 月 — Alpha Chat 為 gantt 的 M5（2027 年 3 月），M6 正式版日期未定。以 3 個月模型計算。
| Line項目 | Monthly每月 | Note說明 |
|---|---|---|
| Live website — unavoidable from M4已上線網站 — 自 M4 起無可避免 | ||
| Cloud Run — web tier, one region, min-instancesCloud Run — web 層、單一區域、最小實例 | $80–150 | Scales with real traffic隨實際流量變動 |
| Cloud SQL — 2 vCPU / 8 GB, regional HACloud SQL — 2 vCPU / 8 GB、區域 HA | $180–260 | Option A. +~$130 under option C方案 A。方案 C 再 +約 $130 |
| Memorystore Redis — shared ISR cacheMemorystore Redis — 共享 ISR 快取 | $35–70 | TBC with Peter; whatever replaces it still pairs with tag purge待與 Peter 確認；無論以何者取代，仍與 tag purge 配對 |
| Firestore + GCS + egressFirestore + GCS + 流出 | $20–50 | Media volume lives in GCS, 50–300 GB媒體容量在 GCS，50–300 GB |
| Cloudflare BusinessCloudflare Business | $250 | List, per zone. +$5 for LB under option C+牌價，每 zone。方案 C+ 再 +$5 LB |
| Website subtotal網站小計 | $565–780 | Runs whether or not the agent ships無論 agent 是否上線都會發生 |
| Agent slice — additionalAgent slice — 額外增加 | ||
| Neo4j Aura Business Critical — 2 GB minimumNeo4j Aura Business Critical — 最小 2 GB | $292 | $146/GB. Starts at the migration, before M5$146/GB。自遷移起算，早於 M5 |
| Neo4j CE — migration overlapNeo4j CE — 遷移重疊期 | $130–170 | One month only, then CE is decommissioned僅一個月，之後 CE 即除役 |
| Cloud Run — agent tier at Alpha volumeCloud Run — Alpha 量級的 agent 層 | $40–90 est. | Incremental to the web tier; planning estimate相對 web 層的增額；屬規劃估算 |
| Vertex AI runtime — Alpha chat trafficVertex AI 執行 — Alpha 對話流量 | $250–600 est. | 10–25% of production turn volume at ~$0.013/turn cached為正式量的 10–25%，每輪含快取約 $0.013 |
| Agent subtotalAgent 小計 | $582–982 | — |
| Phase 2 run-ratePhase 2 月營運成本 | ~$1,150–1,760 | 3 months ≈ $3,600–5,500 including the CE overlap month and a pre-warm batch (tens of dollars)3 個月約 $3,600–5,500，含 CE 重疊月與預熱批次（數十美元） |
Alpha chat volume is the one number nobody can know before M5. The range above models Alpha at 10–25% of the production assumption (180k turns/month); at 100% it would already be the post-launch figure. If Alpha is opened wider than planned, this line moves first and moves fastest — which is exactly why the per-session and per-IP ceilings, Turnstile, and the kill switch are in place before any public chat traffic.Alpha 的對話量是 M5 之前無人能確知的數字。上述區間以正式量假設（每月 18 萬輪）的 10–25% 模型化 Alpha；若達 100%，就已經等同上線後的數字。若 Alpha 開放範圍超出計畫，這一項會最先、也最快變動 — 這正是為何在任何公開對話流量之前，就必須先備妥 per-session 與 per-IP 上限、Turnstile 與 kill switch。
Steady state. The website and the agent are both in production, MonoMind operates the platform, and the largest single line is no longer infrastructure — it is model inference.穩定狀態。網站與 agent 皆已上線、由 MonoMind 維運，而最大的單一成本項已不再是基礎設施 — 而是模型推論。
| Line項目 | Monthly每月 | 12 months12 個月 |
|---|---|---|
| Cloud Run — web + agent tiersCloud Run — web 與 agent 層 | $120–240 | $1,440–2,880 |
| Cloud SQL — regional HACloud SQL — 區域 HA | $180–260 | $2,160–3,120 |
| Memorystore RedisMemorystore Redis | $35–70 | $420–840 |
| Firestore + GCS + egressFirestore + GCS + 流出 | $20–50 | $240–600 |
| Cloudflare BusinessCloudflare Business | $250 | $3,000 |
| Neo4j Aura Business Critical — 2 GBNeo4j Aura Business Critical — 2 GB | $292 | $3,504 |
| Infrastructure subtotal基礎設施小計 | $900–1,190 | $10,800–14,300 |
| Vertex AI runtime — expected, ~60% of input cached, post-1 Jan 2027 ratesVertex AI 執行 — 預期值，約 60% input 命中快取，2027/01/01 後費率 | $2,100 globalglobal · $2,300 asia-east1 | $25,200–27,600 |
| Expected run-rate預期月營運成本 | ~$3,000–3,490 | ~$36,000–42,000 |
| Upper bound — no caching, uncached agent runtime $3,200上界 — 無快取，agent 執行成本 $3,200 | ~$4,390 | ~$53,000 |
| Line項目 | Cost成本 | When適用時機 |
|---|---|---|
| Option C — Tokyo Postgres replica方案 C — 東京 Postgres 副本 | +$100/mo (+$1,560/yr) | Only if infosec allows data-at-rest in Japan (Q5 / Q7)僅在資安允許資料落地日本時（Q5 / Q7） |
| Option C+ — Tokyo origin failover方案 C+ — 東京 origin 容錯 | +$200/mo (+$2,280/yr) | As C, plus a Cloud Run min-instance in Tokyo and Cloudflare LB同 C，另加東京的 Cloud Run 最小實例與 Cloudflare LB |
| Aura D+ — one secondary regionAura D+ — 一個次要區域 | +$600/mo (+$7,008/yr) | Q1 2027 review only, against real traffic僅 2027 Q1 依實際流量檢討 |
| Aura Graph Analytics — community detection runsAura Graph Analytics — 社群偵測執行 | $0.40/GB-hour | On demand. A 2 GB Leiden job for 10 hours ≈ $8隨需。2 GB 的 Leiden 作業執行 10 小時約 $8 |
| Re-ingestion pass — pipeline version bump, new corpus重新 ingestion — pipeline 版本升級、新增語料 | $110–200 per pass每次 | Whenever the embedding model, chunking threshold, or source corpus changes每當 embedding 模型、切分閾值或來源語料變更時 |
| Assumption假設 | Value used採用值 | Confidence and how to settle it把握度與確認方式 |
|---|---|---|
| Website traffic網站流量 | 200k visitors/month, 800 GiB CDN egress每月 20 萬訪客、800 GiB CDN 流出 | Engineering estimate. Twelve months of analytics (Q4) replaces it with data.工程估算。以 12 個月的分析數據（Q4）取代。 |
| Agent volume at production正式期 agent 量體 | ~30k sessions × ~6 turns ≈ 180k turns/month約 3 萬 session × 每 session 約 6 輪 ≈ 每月 18 萬輪 | The single largest driver. Cost scales linearly with it.最大的成本驅動因子，成本與其呈線性關係。 |
| Agent volume at AlphaAlpha 期 agent 量體 | 10–25% of production正式量的 10–25% | Unknowable before M5. Depends entirely on how widely Alpha is opened.M5 之前無從得知，完全取決於 Alpha 的開放範圍。 |
| Context cache hit rateContext 快取命中率 | ~60% of input cached約 60% input 命中快取 | The dominant lever — cached input is 1/10 of input price. 0% caching takes runtime from ~$2,100 to ~$3,000/month.主導槓桿 — 快取 input 為 input 價格的十分之一。完全不快取會使執行成本由約 $2,100 升至約 $3,200／月。 |
| Gemini pricingGemini 價格 | Post-1 Jan 2027 rates ($1.50 / $7.50 per 1M) for all agent runtime所有 agent 執行皆採 2027/01/01 後費率（每 1M $1.50 / $7.50） | Introductory rates end 31 Dec 2026, before Alpha Chat. No phase in this projection enjoys them.導入費率於 2026/12/31 結束，早於 Alpha Chat。本推估中沒有任何階段適用該費率。 |
| Vertex endpointVertex endpoint | asia-east1 adds 10% over globalasia-east1 較 global 加計 10% | Both shown. Region choice is a residency decision, not a cost decision.兩者皆已列出。區域選擇屬落地決策，而非成本決策。 |
| HA topologyHA 拓撲 | Option A — Taiwan only, no Tokyo replica方案 A — 僅台灣、不建東京副本 | Default until infosec picks (Q5 / Q7). C and C+ deltas are above.在資安決定前的預設（Q5 / Q7）。C 與 C+ 的增額見上表。 |
| Content inventory內容盤點量 | ~1,000 documents (range 700–1,400); ~4,600 pages of ingestion corpus約 1,000 份文件（區間 700–1,400）；ingestion 語料約 4,600 頁 | Drives ingestion cost linearly and database sizing.線性影響 ingestion 成本與資料庫容量。 |
| Phase durations各階段期間 | Phase 1 = 5 months; Phase 2 = 3 monthsPhase 1 = 5 個月；Phase 2 = 3 個月 | Phase 1 spans the unresolved clock conflict — contract launch 30 Dec 2026 against gantt M4 mid-Jan 2027. A 4–6 month range moves the phase total by roughly ±$700.Phase 1 橫跨尚未解決的時程衝突 — 合約上線日 2026/12/30 對比 gantt 的 M4（2027 年 1 月中）。以 4–6 個月計，階段合計約變動 ±$700。 |
| Cloud SQL pricingCloud SQL 價格 | ±10% until a calculator screenshot在取得計價工具截圖前 ±10% | Enterprise 2 vCPU / 8 GB / 100 GB SSD, 730 h/month.Enterprise 2 vCPU / 8 GB / 100 GB SSD，每月 730 小時。 |
| # | Variable變數 | Effect影響 |
|---|---|---|
| 1 | Agent turn volumeAgent 輪次量 | Linear on the largest post-launch line. Halving traffic saves ~$1,000/month; doubling it costs ~$2,000/month more.與上線後最大的成本項呈線性關係。流量減半約可節省每月 $1,050；加倍則每月增加約 $2,100。 |
| 2 | Cache hit rate快取命中率 | ~$1,000/month between 0% and 60% cached at production volume. Engineering effort, not a vendor negotiation.在正式量下，0% 與 60% 命中率之間相差每月約 $1,100。這是工程投入，而非與供應商議價。 |
| 3 | Image tokenisation rate影像 tokenise 比率 | 260 versus 1,550 tokens per page is a 6× swing on the parsing portion of ingestion. Verified empirically on 20 real pages in week 1.每頁 260 對比 1,550 tokens，對 ingestion 的解析部分造成 6 倍擺盪。第 1 週以 20 個實際頁面實測確認。 |
| 4 | HA optionHA 方案 | $0 / +$130 / +$200 per month for A / C / C+. A one-line infosec decision.A / C / C+ 分別為每月 $0 / +$130 / +$190。一個資安決策即可決定。 |
| 5 | Number of ingestion passesIngestion 批次次數 | $110–200 each. Pipeline-version discipline keeps this from becoming a recurring cost.每次 $110–200。嚴守 pipeline 版本紀律，可避免其變成經常性支出。 |
| 6 | Website traffic網站流量 | Modest. Cloud Run and egress flex within $100–200/month; Cloudflare Business is flat per zone.影響溫和。Cloud Run 與流出費用在每月 $100–200 間浮動；Cloudflare Business 為每 zone 固定價。 |
| 7 | Graph size圖譜大小 | Aura bills $146/GB. Growing past 2 GB is the only way this line moves — worth watching, not worth optimising early.Aura 以 $146/GB 計費。唯有超過 2 GB 才會使此項變動 — 值得留意，但不值得提早最佳化。 |
Consolidate on Cloud Run asia-east1 fronted by Cloudflare Business. Vercel, Cloudflare Workers, and a hybrid split rejected.統一採用 asia-east1 的 Cloud Run，前端由 Cloudflare Business 承接。否決 Vercel、Cloudflare Workers 與混合切分架構。
MonoMind (architecture) · Helios digital marketing owner · Helios IT / infosec · NorthwindMonoMind（架構）· Helios 數位行銷負責人 · Helios IT / 資安 · Northwind
Related: ADR-002 (AI model pipeline), ADR-003 (why Neo4j), ADR-004 (Neo4j edition & migration), ADR-005 (content block library).相關文件：ADR-002（AI 模型 pipeline）、ADR-003（為何選 Neo4j）、ADR-004（Neo4j 版本與遷移）、ADR-005（Content Block Library）。
These clocks are not the same. Do not collapse them.以下三套時程並不相同，不可混為一談。
| Term詞彙 | Means定義 |
|---|---|
| Mn (M1–M7) | Client sign-off on the Helios AX Task Gantt.客戶在 Helios AX Task Gantt 上的簽核點。 |
| Contract Phase A / B合約 Phase A / B | Commercial milestones — Phase A internal completion 20 Dec 2026; official launch 30 Dec 2026.商務里程碑 — Phase A 內部完成 2026/12/20；正式上線 2026/12/30。 |
| Website slice / agent sliceWebsite slice / agent slice | Architecture: static site + CMS versus chat / AGUI / Content Blocks.架構切分：靜態網站 + CMS，相對於 chat / AGUI / Content Block。 |
Some M5/M6 deliverables are built in M2–M3. "Phase 2" in older drafts meant the agent slice, not a gantt start date.部分 M5/M6 交付項目在 M2–M3 建置。舊版草稿中的「Phase 2」指的是 agent slice，而非 gantt 的起始日期。
Two workloads with opposite physics behind one domain.同一個網域背後，是兩種物理特性完全相反的工作負載。
| Static SEO base layer靜態 SEO 基礎層 | Generative intent layer (AGUI)生成式意圖層（AGUI） | |
|---|---|---|
| Rendering渲染 | SSG / ISR, permanent URLs, ~700–1,400 pagesSSG / ISR、永久 URL、約 700–1,400 個頁面 | Streamed content blocks into a live session canvas將 content block 串流至即時 session canvas |
| Traffic流量 | Read-heavy, cacheable, bursty crawler load讀取為主、可快取、爬蟲流量突發 | Low volume, long-lived, stateful量少、連線長、有狀態 |
| Hot path熱路徑 | CDN edge → static HTMLCDN edge → 靜態 HTML | Gemini ↔ Atlas GraphRAG (Neo4j) ↔ Firestore (profiles) + PostgreSQL (chat transcripts), N tool-call loopsGemini ↔ Atlas GraphRAG（Neo4j）↔ Firestore（訪客輪廓）+ PostgreSQL（對話紀錄），N 次工具呼叫迴圈 |
| Latency that matters關鍵延遲指標 | TTFB to the visitor對訪客的 TTFB | Time-to-first-token, then tokens/sec首 token 時間，其後為 token/秒 |
| Failure blast radius故障影響範圍 | SEO / domain authoritySEO / 網域權重 | One session單一 session |
| Slice切分 | Website (deliver M4)Website（M4 交付） | Agent (deliver M5–M6; build starts M3)Agent（M5–M6 交付；M3 起建置） |
| Constraint項目 | Value內容 |
|---|---|
| Audience受眾 | Taiwan only. No mainland China requirement.僅限台灣。無中國大陸需求。 |
| Cloud mandate雲端指定 | None; client open to recommendation.無指定；客戶接受建議。 |
| Infra deadline基礎設施期限 | Dev environment + infrastructure by ~10 Sep 2026 (3 weeks).開發環境與基礎設施須於 2026/09/10 前完成（3 週）。 |
| Delivery deadline交付期限 | Website slice: editor-ready UAT in November; contract Phase A internal completion 20 Dec 2026; official launch 30 Dec 2026. Gantt M4 deploy is mid-Jan 2027 — resolve which clock is binding. Agent slice: Alpha Chat M5 (Mar 2027), production M6 — not Dec 2026–Jan 2027.Website slice：11 月完成可供編輯使用的 UAT；合約 Phase A 內部完成 2026/12/20；正式上線 2026/12/30。Gantt 的 M4 部署落在 2027 年 1 月中 — 須釐清何者具約束力。Agent slice：Alpha Chat M5（2027 年 3 月）、正式 M6 — 並非 2026 年 12 月至 2027 年 1 月。 |
| Operating term維運期 | MonoMind operates the platform for 12 months post-launch. Content managed by the client via Payload CMS and ATLAS.上線後由 MonoMind 維運 12 個月。內容由客戶透過 Payload CMS 與 ATLAS 管理。 |
| Locale語系 | zh-TW primary, en secondary (localisation infrastructure enabled; slug not localised — one URL path per page).zh-TW 為主、en 為輔（啟用在地化基礎架構；slug 不在地化 — 每個頁面一組 URL 路徑）。 |
| Graph database圖資料庫 | CE on GCE through website launch (M4). Aura Business Critical before Alpha Chat (M5).網站上線（M4）前使用 GCE 上的 CE。Alpha Chat（M5）前遷移至 Aura Business Critical。 |
| AI cost (projection)AI 成本（推估） | ~US$1,000–1,500/month agent runtime at current 3.7 Flash introductory rates with caching; ~US$2,000–3,000/month from 1 Jan 2027 when those rates double. Helios indicated verbally that this range is acceptable. Not a contractual cap.以現行 3.7 Flash 導入費率並啟用快取，agent 執行期每月約 US$1,000–1,600；2027/01/01 費率倍增後為每月約 US$2,000–3,200。Helios 已口頭表示可接受此區間。並非合約上限。 |
| Backup / HA備份 / HA | Daily backup. No contractual HA. Default HA is option A (§5.5): two zones in Taiwan, no Tokyo replica, until infosec picks otherwise.每日備份。合約未載 HA。預設為方案 A（§5.5）：台灣雙可用區、不建東京副本，直到資安另行決定。 |
| Infosec資安 | Requirements not yet clarified — see Client Questionnaire Q5.需求尚未釐清 — 見客戶問卷 Q5。 |
The 12-month operating term moves weight onto observability, runbook quality, cost predictability, and architectural simplicity — MonoMind gets paged.12 個月的維運期，把重量壓在可觀測性、維運手冊品質、成本可預測性與架構簡潔上 — 因為半夜被叫起來的是 MonoMind。
asia-east1 is Changhua County, Taiwan — in-country. Vercel has no Taiwan region; nearest compute is Tokyo (~35–45 ms RTT) or Singapore (~50–60 ms).Origin 所在區域成為延遲的主導變數。GCP asia-east1 位於台灣彰化縣 — 境內。Vercel 沒有台灣區域，最近的運算在東京（RTT 約 35–45 毫秒）或新加坡（約 50–60 毫秒）。| # | Criterion準則 | Weight權重 |
|---|---|---|
| C1 | Dev velocity — time to first prod deploy, preview envs, debugging loop開發速度 — 首次上線時間、預覽環境、除錯循環 | 16% |
| C2 | Next.js feature fidelity — ISR, PPR, RSC streaming, after, node middleware, use cacheNext.js 功能相容度 — ISR、PPR、RSC streaming、after、node middleware、use cache | 12% |
| C3 | Payload CMS fit — runtime model, DB adapter maturity, media pipeline, admin responsivenessPayload CMS 適配 — 執行模型、DB adapter 成熟度、媒體流程、後台反應速度 | 12% |
| C4 | Agent runtime fit — long SSE streams, timeout ceilings, billing during I/O waitAgent 執行環境 — 長時間 SSE 串流、逾時上限、I/O 等待期間的計費 | 12% |
| C5 | Data-plane adjacency — hops to Vertex, Neo4j, Firestore; auth model資料平面鄰近性 — 至 Vertex、Neo4j、Firestore 的跳數；認證模型 | 11% |
| C6 | Cache correctness & SEO control — on-demand revalidation from CMS, purge latency快取正確性與 SEO 控制 — 由 CMS 觸發的即時 revalidation、purge 延遲 | 10% |
| C7 | Cost model & predictability成本模型與可預測性 | 9% |
| C8 | Ops burden & handover維運負擔與交接 | 9% |
| C9 | Regional reach & compliance區域覆蓋與合規 | 3% |
| C10 | Portability / exit cost可攜性 / 遷出成本 | 6% |
asia-east1, fronted by Cloudflare.統一採用 asia-east1 的 Google Cloud Run，前端由 Cloudflare 承接。| Layer層級 | Choice選型 | Region區域 |
|---|---|---|
| Web tierWeb 層 | Cloud Run — Next.js output: standalone · Payload CMSCloud Run — Next.js output: standalone · Payload CMS | asia-east1 |
| Agent tierAgent 層 | Cloud Run — agent loop, Atlas GraphRAG over native Bolt; Vertex AI via the official Node SDK (not Agent Runtime); chat UI uses the Vercel AI SDK (library only, not Vercel hosting). Separate service, not publicly routable.Cloud Run — agent 迴圈、以原生 Bolt 連接 Atlas GraphRAG；透過官方 Node SDK 使用 Vertex AI（非 Agent Runtime）；chat UI 使用 Vercel AI SDK（僅函式庫，非 Vercel hosting）。獨立服務且不對外路由。 | asia-east1 |
| CDN / WAF / purge / imagesCDN / WAF / purge / 圖片 | Cloudflare Business — replaces Cloud CDN entirelyCloudflare Business — 完全取代 Cloud CDN | global edge, TPE PoP全球 edge、TPE PoP |
| ISR cacheISR 快取 | Memorystore Redis, shared cache handlerMemorystore Redis，共享 cache handler | asia-east1 |
| Payload databasePayload 資料庫 | Cloud SQL PostgreSQL, regional HA. Tokyo replica only if infosec picks option C (§5.5).Cloud SQL PostgreSQL，區域 HA。僅在資安選擇方案 C 時才建東京副本（§5.5）。 | asia-east1 |
| Session stateSession 狀態 | Firestore — visitor profiles and continue-engagement (email opt-in resume, no traditional accounts). PostgreSQL — chat transcripts, CMS data, Chinese search (pg_bigm).Firestore — 訪客輪廓與續談（email opt-in 續談，無傳統帳號）。PostgreSQL — 對話紀錄、CMS 資料、中文搜尋（pg_bigm）。 | asia-east1 |
| Graph圖譜 | Neo4j — CE through M4 → Aura Business Critical before M5Neo4j — M4 前用 CE → M5 前遷至 Aura Business Critical | asia-east1 |
| Media媒體 | GCS; resize/transform at the edge via Cloudflare Images or Cloud Connector to storage.googleapis.comGCS；於 edge 以 Cloudflare Images 或 Cloud Connector 連至 storage.googleapis.com 進行縮放與轉換 | asia-east1 bucket; global edge deliveryasia-east1 bucket；全球 edge 派送 |
| Models模型 | Vertex AI — see ADR-002Vertex AI — 見 ADR-002 | asia-east1 where available可用時採 asia-east1 |
| Criterion (weight)準則（權重） | A: Vercel | B: CF Workers | C: Cloud Run + CF ✅ | D: Hybrid |
|---|---|---|---|---|
| C1 Dev velocity開發速度 (16%) | 5 | 3 | 3 | 4 |
| C2 Next.js fidelityNext.js 相容度 (12%) | 5 | 4 | 4.5 | 5 |
| C3 Payload fitPayload 適配 (12%) | 4 | 2 | 5 | 4 |
| C4 Agent runtimeAgent 執行環境 (12%) | 4 | 3 | 5 | 5 |
| C5 Data adjacency資料鄰近性 (11%) | 2 | 2 | 5 | 5 |
| C6 Cache / SEO快取 / SEO (10%) | 5 | 4 | 4 | 5 |
| C7 Cost成本 (9%) | 3 | 5 | 4 | 3 |
| C8 Ops & handover維運與交接 (9%) | 4 | 3 | 5 | 3 |
| C9 Regional區域覆蓋 (3%) | 4 | 4 | 5 | 4 |
| C10 Portability可攜性 (6%) | 3 | 3 | 5 | 4 |
| Weighted total加權總分 | 4.01 | 3.20 | 4.43 | 4.27 |
connect(), but with strict per-invocation connection limits and no warm Bolt pool — unsuitable for Atlas GraphRAG's native driver pattern. Payload-on-D1 is less battle-tested than Postgres; Payload on Workers today is REST-first (GraphQL incomplete). Cloudflare's edge breadth is worth little for a single-market audience. PostgreSQL remains on Cloud SQL in asia-east1 for Payload and for Chinese keyword search via pg_bigm. Cloudflare D1 (SQLite) cannot index two-character Traditional Chinese terms and is out of scope.B — 透過 OpenNext 的 Cloudflare Workers（否決）。Workers 可用 connect() 建立對外 TCP，但每次呼叫的連線數限制嚴格且無常駐 Bolt 連線池 — 不適合 Atlas GraphRAG 的原生驅動模式。Payload-on-D1 的實戰驗證不如 Postgres；Payload 在 Workers 上目前以 REST 為主（GraphQL 尚不完整）。對單一市場受眾而言，Cloudflare 的 edge 廣度價值有限。PostgreSQL 仍留在 asia-east1 的 Cloud SQL，供 Payload 與 pg_bigm 中文關鍵字搜尋使用。Cloudflare D1（SQLite）無法索引兩字元的繁體中文詞，不在範圍內。output: standalone runs the reference Node server); most portable; cleanest handover. Cost: ~1.5–2 weeks of platform work (ISR cache handler, preview-env tooling, purge wiring) — a one-time cost.C — Cloud Run + Cloudflare（採用）。origin 在境內；原生 Bolt 並保有常駐連線池；以 ADC 存取 Firestore/Vertex，免金鑰管理；Payload 運行於官方支援的常駐伺服器模式；完整的上游 Next.js 語意（output: standalone 執行參考 Node server）；可攜性最高；交接最乾淨。代價：約 1.5–2 週平台工程（ISR cache handler、預覽環境工具、purge 接線）— 一次性成本。Cloudflare offers purge by URL, hostname, tag, prefix, and purge-everything on all plans; only rate limits differ. Purge is typically sub-second (Instant Purge). Business limits (10 req/sec, bucket 50, 100 ops/request) far exceed editorial publishing traffic, so tag purge does not drive the tier decision. Business is selected for support tier, WAF/bot controls, and the 100% uptime SLA — required because we propose an SLA to Helios and cannot promise more than our vendors do. List price $200/month per zone; Load Balancing additional. Revisit only if the infosec review surfaces an Enterprise-gated requirement.Cloudflare 在所有方案都提供以 URL、主機名稱、tag、前綴清除以及全站清除，差別只在速率限制。清除通常在一秒內完成（Instant Purge）。Business 的限制（10 req/秒、bucket 50、每次請求 100 筆）遠高於編輯發佈的流量，因此 tag purge 並非選擇方案的理由。選擇 Business 是為了支援等級、WAF/bot 控制與 100% uptime SLA — 我們既向 Helios 承諾 SLA，就不能超出供應商的承諾。牌價每月每 zone $250，Load Balancing 另計。僅在資安審查出現需 Enterprise 才能滿足的要求時才重新評估。
Next.js ISR on Cloud Run requires a shared origin cache because multiple container instances each hold their own memory. Memorystore Redis is the shared ISR cache handler; Cloudflare caches HTML at the edge. On publish, Payload's afterChange hook triggers revalidateTag() and a Cloudflare tag purge together. Vercel is not required; this is the standard self-hosted Next.js pattern.在 Cloud Run 上執行 Next.js ISR 必須有共享的 origin 快取，因為多個容器實例各自持有記憶體。Memorystore Redis 擔任共享的 ISR cache handler；Cloudflare 在 edge 快取 HTML。發佈時，Payload 的 afterChange hook 會同時觸發 revalidateTag() 與 Cloudflare tag purge。不需要 Vercel；這是自架 Next.js 的標準模式。
| Content內容 | Cached at快取位置 | Invalidation失效方式 |
|---|---|---|
Immutable assets (/_next/static/*, hashed media)不可變資產（/_next/static/*、雜湊命名媒體） | Cloudflare, max-age=31536000, immutable | Never — filenames are content-hashed永不 — 檔名以內容雜湊命名 |
| SSG / ISR HTMLSSG / ISR HTML | Cloudflare (tagged) and Next.js ISR / MemorystoreCloudflare（帶 tag）與 Next.js ISR / Memorystore | Cache-Tag per page + Payload afterChange → Cloudflare purge API + revalidateTag每頁 Cache-Tag + Payload afterChange → Cloudflare purge API + revalidateTag |
Payload admin (/admin/*)Payload 後台（/admin/*） | Never cached不快取 | — |
Agent + AGUI routes (/api/chat*, /api/agui*)Agent 與 AGUI 路由（/api/chat*、/api/agui*） | Bypass — explicit cache rule繞過 — 明確的快取規則 | — |
Tagging scheme: emit Cache-Tag: page-{id}, collection-{slug}, product-{id}, global-nav per response.Tag 方案：每個回應送出 Cache-Tag: page-{id}, collection-{slug}, product-{id}, global-nav。
afterChange and invalidates Cloudflare Cache-Tag and Memorystore revalidateTag — never /admin/*, /api/chat* or /api/agui*. Content Blocks are driven by Atom version / valid_through and invalidate through the hot/warm/cold fan-out in ADR-005 — never through Cloudflare. Bridge only when a block is indexed as a public page: emit extra tags atom-{id}, block-{id} so a material Atom change can purge that SEO URL. Memorystore ISR remains TBC with Peter; whatever replaces it still pairs with Cloudflare tag purge — that pairing is the ISR story, not Content Blocks.是兩層機制，不是同一條管線。兩者可能共用 tag 名稱，但失效機制不同。CDN + ISR 由 Payload afterChange 驅動，使 Cloudflare Cache-Tag 與 Memorystore revalidateTag 失效 — 絕不涵蓋 /admin/*、/api/chat* 或 /api/agui*。Content Block 由 Atom 版本／valid_through 驅動，透過 ADR-005 的 hot/warm/cold fan-out 失效 — 絕不經由 Cloudflare。只有當 block 以公開頁面身分被索引時才橋接：額外送出 atom-{id}、block-{id}，讓 Atom 的實質變更能清除該 SEO URL。Memorystore ISR 仍待與 Peter 確認；無論以何者取代，都仍與 Cloudflare tag purge 配對 — 那才是 ISR 的敘事，與 Content Block 無關。X-Accel-Buffering: no, Cache-Control: no-cache, no-transform, no Rocket Loader or auto-minify. Proxy buffering is the standard cause of streams that work locally and fail in production.在這些路徑上停用緩衝與轉換：X-Accel-Buffering: no、Cache-Control: no-cache, no-transform，不啟用 Rocket Loader 或自動壓縮。Proxy 緩衝是「本機正常、上線失敗」串流問題的標準原因。Block reuse (ADR-005) sits inside the application, above Cloudflare; it does not change these rules.Block 重用（ADR-005）位於應用層、在 Cloudflare 之上，並不改變上述規則。
Media files live in GCS, not Postgres — the database stores metadata rows. Content inventory hypothesis: ~700–1,400 documents (60+ products × 4–6 pages, solutions, microsites, news, blog, corporate); central estimate ~1,000.媒體檔案存於 GCS 而非 Postgres — 資料庫只存 metadata 列。內容盤點假設：約 700–1,400 份文件（60 多項產品 × 4–6 頁、解決方案、微型網站、新聞、部落格、企業資訊）；中位估計約 1,000 份。
| Component組成 | Size大小 |
|---|---|
| Rich text (Lexical JSON) + fields — 1,000 docs × ~40 KB per locale富文本（Lexical JSON）+ 欄位 — 1,000 份 × 每語系約 40 KB | ~40 MB (zh-TW) + ~40 MB (en)約 40 MB（zh-TW）+ 約 40 MB（en） |
| Media metadata — 10k assets × 5–8 variants × ~3 KB媒體 metadata — 1 萬個資產 × 5–8 種變體 × 約 3 KB | ~40 MB |
| Indexes (+40%)索引（+40%） | ~48 MB |
| Live datasetLive 資料集 | ~170 MB |
Version history is the whole story — Payload stores a full snapshot per version: uncapped with autosave 8–20 GB; maxPerDoc: 20 with autosave ≥10 s ~1.5 GB; maxPerDoc: 10 explicit save only ~800 MB.關鍵在版本歷史 — Payload 每個版本存一份完整快照：不設上限且開啟 autosave 為 8–20 GB；maxPerDoc: 20 搭配 autosave 間隔 ≥10 秒約 1.5 GB；maxPerDoc: 10 且僅手動儲存約 800 MB。
versions.maxPerDoc: 20, autosave interval ≥10 s (or explicit save — client decides, Questionnaire Q9), scheduled prune job, autovacuum tuning. Expect 1–3 GB at 12 months. Provision Cloud SQL db-custom-2-8, 100 GB SSD with auto-increase (Cloud SQL IOPS scale with disk size). Enable cloudsql.enable_pg_bigm at instance creation (changing it later requires a restart) and run CREATE EXTENSION pg_bigm once per database — required for Traditional Chinese keyword search. GCS media is where the real volume lives (50–300 GB, single-digit $/month). Enable Payload localisation infrastructure now — retrofitting after a thousand documents exist is a migration; configuring now is a config line.決策。versions.maxPerDoc: 20、autosave 間隔 ≥10 秒（或僅手動儲存 — 由客戶決定，問卷 Q9）、排程清理作業、調校 autovacuum。12 個月預期 1–3 GB。配置 Cloud SQL db-custom-2-8、100 GB SSD 並開啟自動擴充（Cloud SQL 的 IOPS 隨磁碟大小而增）。於建立執行個體時啟用 cloudsql.enable_pg_bigm（事後變更需重啟），並在每個資料庫執行一次 CREATE EXTENSION pg_bigm — 繁體中文關鍵字搜尋所必需。真正的容量在 GCS 媒體（50–300 GB，每月個位數美元）。現在就啟用 Payload 在地化基礎架構 — 等到有上千份文件才補做就是一次資料遷移，現在做只是一行設定。Default topology (option A): Cloud Run in asia-east1 only (GCP zonal redundancy, not a second region). Cloud SQL regional HA (two zones in Taiwan, RPO 0, RTO ~60 s). Daily backup + PITR. No Tokyo replica. No Cloudflare Load Balancing. Neo4j CE is a single box until Aura. Vertex degrades to the static site.預設拓撲（方案 A）：Cloud Run 僅部署於 asia-east1（GCP 區域內多可用區，而非第二個 region）。Cloud SQL 區域 HA（台灣雙可用區，RPO 0、RTO 約 60 秒）。每日備份 + PITR。不建東京副本。不啟用 Cloudflare 負載平衡。遷移至 Aura 前 Neo4j CE 為單機。Vertex 失效時降級為靜態網站。
Unit math: Cloud SQL Enterprise 2 vCPU / 8 GB / 100 GB SSD, 730 h/mo; Cloud Run instance-based 2×(1 vCPU / 1 GiB) in the primary; CF Business $250; Memorystore ~$40; Firestore/GCS ~$30. Treat SQL as ±10% until a calculator screenshot. Excludes staging, AI runtime, ingestion, media egress.單位計算：Cloud SQL Enterprise 2 vCPU / 8 GB / 100 GB SSD，每月 730 小時；主要區域 Cloud Run 以實例計費 2×(1 vCPU / 1 GiB)；CF Business $250；Memorystore 約 $40；Firestore/GCS 約 $30。在取得計價工具截圖前，SQL 視為 ±10%。不含 staging、AI 執行、ingestion 與媒體流出費用。
| Option方案 | Recommend建議 | +$/mo vs A相對 A 增額 | Website prod $/mo正式站每月 | RPO / RTORPO / RTO | Data outside Taiwan台灣境外資料 |
|---|---|---|---|---|---|
| A · Taiwan regional HA台灣區域 HA | Default | 0 | ~670 | SQL zone fail: RPO 0 / ~60 s. Region loss = outage. SEO holds on Cloudflare cache.SQL 單區故障：RPO 0 / 約 60 秒。整區失效即中斷。SEO 由 Cloudflare 快取撐住。 | Embeddings + some Gemini only (Q5)僅 embedding 與部分 Gemini（Q5） |
| C · Tokyo SQL replica東京 SQL 副本 | If Q5 allows JapanQ5 允許日本時 | ~130 | ~810 | Region fail: RPO = lag (sec–min). RTO ~15–30 min, manual promote.整區故障：RPO = 延遲（秒至分）。RTO 約 15–30 分，需手動提升。 | Postgres copy in Tokyo + Q5 ML exceptions東京的 Postgres 副本 + Q5 的 ML 例外 |
| C+ · Tokyo origin failover東京 origin 容錯 | If Q5 allows JapanQ5 允許日本時 | ~190 | ~860 | Same as C, plus Cloud Run can take traffic after CF LB. ISR cache still Taiwan-only.同 C，並可在 CF LB 之後由 Cloud Run 接手流量。ISR 快取仍僅在台灣。 | Same as C; compute in Tokyo during failover同 C；容錯期間運算在東京 |
| X · 2-region active-active雙區 active-active | Avoid | ~240 | ~920 | Looks like seconds. Memorystore is still single-region — Tokyo misses shared ISR.看似秒級。但 Memorystore 仍是單區服務 — 東京取不到共享 ISR。 | Same as C+同 C+ |
| D · Aura BC 2 GBAura BC 2 GB | Required before M5 | 292 (replaces CE ~$150)292（取代 CE 約 $150） | — | In-region 3-zone HA. No cross-region graph DR.區域內三可用區 HA。圖譜無跨區 DR。 | Confirm asia-east1 with Neo4j須與 Neo4j 確認 asia-east1 |
| D+ · Aura + 1 secondaryAura + 1 副本 | Q1 2027 only僅 2027 Q1 | 584 | — | Secondary billed at full GB-hour.副本以完整 GB-hour 計費。 | Graph replica outside Taiwan if secondary is Tokyo若副本設於東京，則圖譜副本在台灣境外 |
C is a zonal SQL replica in asia-northeast1 (same size as primary, plus ~$0.12/GiB replication egress). C+ adds one Cloud Run min-instance in Tokyo plus Cloudflare LB ($5). X doubles primary min-instances without a second ISR cache — do not sell it.C 是位於 asia-northeast1 的區域型 SQL 副本（規格與主庫相同，另加約 $0.12/GiB 的複寫流出費）。C+ 再加上東京一個 Cloud Run 最小實例與 Cloudflare LB（$5）。X 只是把主要區域的最小實例數加倍，卻沒有第二組 ISR 快取 — 不應向客戶提案。
| Tier層級 | Target目標 | Rationale依據 |
|---|---|---|
| Static / SEO layer靜態 / SEO 層 | 99.9% | Cloudflare + Cloud Run in Taiwan (zonal redundancy). Survives total AI-stack failure. Not "two GCP regions."Cloudflare + 台灣的 Cloud Run（區域內多可用區）。AI 堆疊全面故障仍可運作。並非「兩個 GCP region」。 |
| Agent / AGUI (after Aura / M5 only)Agent / AGUI（僅 Aura 遷移後、M5 起） | 99.5% | Depends on Vertex, Aura, Firestore. Not offered on CE.依賴 Vertex、Aura、Firestore。CE 期間不提供。 |
| Payload adminPayload 後台 | 99.5% | Regional HA; brief failover windows.區域 HA；容許短暫的容錯移轉窗口。 |
The SEO layer has zero runtime dependency on the agent stack. Full AI outage leaves the website functional and indexable. Test it deliberately (game-day, item A17).SEO 層在執行期完全不依賴 agent 堆疊。AI 全面中斷時，網站仍可用且可被索引。並以 game-day 刻意驗證（行動項 A17）。
Production (Cloud SQL HA, Cloud Run, GCP Cloud CDN + Armor — Phase A build footprint) ~$387 · Staging ~$75 · Development ~$20 · Vertex AI (dev/residual, not corpus ingestion) ~$30 → ~$500/month expected, billing alert $850. Quote to Helios: ~$600/month. Phase A uses GCP Cloud CDN + Armor during build; Cloudflare Business replaces Cloud CDN at launch. Phase A scope excludes Cloudflare Business, Memorystore Redis, Neo4j GCE, and agent-slice AI runtime. Traffic inputs (200k visitors, 800 GiB CDN egress) are engineering estimates — confirm with the client before contract. Vertex corpus ingestion is one-time, not monthly: US$1,500–3,000 across the build. Do not fold it into the ~$510 figure.正式環境（Cloud SQL HA、Cloud Run、建置期的 GCP Cloud CDN + Armor）約 $387 · Staging 約 $75 · 開發 約 $20 · Vertex AI（開發／殘量，非語料 ingestion）約 $30 → 每月預期約 $510，帳單警示 $850。對 Helios 報價：每月約 $600。Phase A 建置期使用 GCP Cloud CDN + Armor；上線時由 Cloudflare Business 取代 Cloud CDN。Phase A 範圍不含 Cloudflare Business、Memorystore Redis、Neo4j GCE 與 agent slice 的 AI 執行成本。流量假設（20 萬訪客、800 GiB CDN 流出）為工程估算 — 簽約前須與客戶確認。Vertex 語料 ingestion 為一次性而非每月：整個建置期 US$1,500–3,000。不可併入約 $510 的數字。
Cloud Run (web, 1 region, min-instances; agent later) $80–150 · Cloud SQL (2 vCPU / 8 GB, regional HA) $180–260 HA-only, +~$130 if option C · Memorystore Redis (1–2 GB) $35–70 · Firestore + GCS + egress $20–50 · Cloudflare Business $250, +$5 LB if C+ · Neo4j CE on GCE (through M4, drops after Aura migration) $130–170 → infrastructure subtotal $700–1,000/month. Vertex AI runtime from M5 is additional: ~$1,000–1,600 intro with caching → ~$2,000–3,200 from 1 Jan 2027. Neo4j Aura Business Critical from M5: ~$300/month at 2 GB. Do not sum every line in one month — Neo4j CE drops after the Aura BC migration. Component ranges are planning estimates.Cloud Run（web、單一區域、最小實例；agent 稍後）$80–150 · Cloud SQL（2 vCPU / 8 GB，區域 HA）僅 HA 為 $180–260，方案 C 再 +約 $130 · Memorystore Redis（1–2 GB）$35–70 · Firestore + GCS + 流出 $20–50 · Cloudflare Business $250，C+ 再 +$5 LB · GCE 上的 Neo4j CE（M4 前，Aura 遷移後下線）$130–170 → 基礎設施小計每月 $700–980。M5 起的 Vertex AI 執行成本另計：導入價含快取約 $1,000–1,600 → 2027/01/01 起約 $2,000–3,200。M5 起的 Neo4j Aura Business Critical：2 GB 每月約 $292。切勿把所有項目加總在同一個月 — Aura BC 遷移後 Neo4j CE 即下線。各項區間為規劃估算。
AI runtime is a projection, not a contractual cap. Operational controls — Vertex quotas, per-session ceilings, Turnstile, rate limiting — exist because the agent endpoint is public and fronts a paid model, not because a budget ceiling was contracted.AI 執行成本是推估，不是合約上限。營運控管 — Vertex quota、per-session 上限、Turnstile、速率限制 — 之所以存在，是因為 agent endpoint 公開且背後是付費模型，而非因為合約訂了預算天花板。
| Workstream工作項 | Build from建置期間 | Deliver / sign-off交付 / 簽核 |
|---|---|---|
| Website + CMS網站 + CMS | M2–M3 | M4 |
| ATOM pipeline, ontology, golden setATOM pipeline、本體、golden set | M2–M3 | Graph schema sign-off M5圖譜 schema 簽核 M5 |
| Content Block schema / keys / volatile types (ADR-005 B1–B4)Content Block schema / 鍵值 / volatile 類型（ADR-005 B1–B4） | M2–M3 | Library M6Library M6 |
| Chat agentChat agent | Plan M3; runtime model pick during M5M3 規劃；執行期模型於 M5 選定 | Alpha M5, production M6Alpha M5、正式 M6 |
Primary visitor path stays in Taiwan; native Bolt with a warm pool; ADC with zero key management; Payload on its supported configuration; full upstream Next.js semantics; near-instant tag purge from Payload hooks; the SEO layer survives total AI-stack failure; a portable Terraform-defined handover artifact.主要訪客路徑留在台灣；原生 Bolt 並保有常駐連線池；ADC 免金鑰管理；Payload 運行於官方支援組態；完整的上游 Next.js 語意；由 Payload hook 觸發近乎即時的 tag purge；AI 堆疊全面故障時 SEO 層仍存活；以 Terraform 定義、可攜的交接成果。
We own the ISR cache handler, preview-env tooling and purge wiring (~1.5–2 weeks up front); we own the runbook for 12 months; preview environments are functional, not delightful; SSE-over-Cloudflare needs §5.3 handled correctly.ISR cache handler、預覽環境工具與 purge 接線都由我們自建（前期約 1.5–2 週）；維運手冊由我們負責 12 個月；預覽環境堪用但談不上好用；SSE 走 Cloudflare 必須正確處理 §5.3。
Platform build overruns 3 weeks → reassess scope · month 3 → Cloud SQL sizing versus real numbers · 31 Dec 2026 → Gemini introductory-rate expiry, re-model the runtime projection · month 9 → handover planning · China enters scope → separate property.平台建置超過 3 週 → 重新評估範圍 · 第 3 個月 → 以實際數據檢視 Cloud SQL 規格 · 2026/12/31 → Gemini 導入費率到期，重估執行成本 · 第 9 個月 → 交接規劃 · 中國大陸納入範圍 → 另建獨立網站。
{component, props} JSON validated against Zod schemas from the governed UI Component Library — never arbitrary JSX or HTML (AGUI-generated novel UI passes a human approval queue).Agent 只輸出經受治理 UI Component Library 的 Zod schema 驗證的 {component, props} JSON — 絕不輸出任意 JSX 或 HTML（AGUI 生成的新元件須通過人工審核佇列）。/api/chat before any public traffic.開放任何公開流量前，/api/chat 須先有 Turnstile 與速率限制。revalidateTag → visible-at-edge latency.平台驗證（3 天）：Cloud Run 上的 Next.js standalone + Memorystore cache handler + Cloudflare；量測 revalidateTag 至 edge 可見的延遲。gemini-embedding-2 GA confirmed (22 Apr 2026). Not on asia-east1 — use the global/us/eu endpoint; resolve embedding ML-processing residency with infosec before the first full corpus embed.已完成：確認 gemini-embedding-2 已 GA（2026/04/22）。不提供 asia-east1 — 須使用 global/us/eu endpoint；首次完整語料 embedding 前，與資安確認 ML 處理落地問題。db-custom-2-8, 100 GB SSD auto-increase, regional HA, daily backups + PITR. Tokyo replica only if infosec picks option C.Cloud SQL：db-custom-2-8、100 GB SSD 自動擴充、區域 HA、每日備份 + PITR。僅在資安選擇方案 C 時才建東京副本。versions.maxPerDoc: 20 and autosave policy at first deploy.首次部署即設定 Payload versions.maxPerDoc: 20 與 autosave 政策。Settled: website slice for November UAT / M4 · agent slice Alpha M5 / production M6 · zh-TW primary, en secondary · AI cost treated as a projection · Neo4j CE through M4, Aura BC before M5 · HA default option A until Q5.已確定：website slice 於 11 月 UAT / M4 · agent slice Alpha M5 / 正式 M6 · zh-TW 為主、en 為輔 · AI 成本視為推估 · Neo4j 於 M4 前用 CE、M5 前遷至 Aura BC · 在 Q5 回覆前 HA 預設為方案 A。
Outstanding — tracked in the Client Discovery Questionnaire: content owner (Q1), product catalog as structured data (Q2), source documents + rights (Q3), analytics (Q4), infosec requirements (Q5), domain/DNS (Q6), SLA sign-off (Q7), Neo4j contract ownership (Q8), editorial team + autosave (Q9), zh-TW glossary (Q10), model jurisdiction policy (Q11).待辦 — 追蹤於客戶探索問卷：內容負責人（Q1）、結構化產品目錄（Q2）、來源文件與權利（Q3）、分析數據（Q4）、資安需求（Q5）、網域／DNS（Q6）、SLA 簽核（Q7）、Neo4j 合約歸屬（Q8）、編輯團隊與 autosave（Q9）、zh-TW 術語表（Q10）、模型管轄權政策（Q11）。
Gemini 3.x per stage; deterministic-first root assignment; DeepSeek V4 Pro as a jurisdiction-gated challenger; eval criteria and cost derivation per stage.各階段採用 Gemini 3.x；root 指派以確定性比對優先；DeepSeek V4 Pro 為受管轄權限制的挑戰者；逐階段的評估準則與成本推導。
MonoMind (architecture) · Helios (budget owner + infosec) · NorthwindMonoMind（架構）· Helios（預算負責人與資安）· Northwind
Related: ADR-001 (hosting), ADR-004 (Neo4j), ADR-005 (content block library).相關文件：ADR-001（主機）、ADR-004（Neo4j）、ADR-005（Content Block Library）。
The pipeline converts source documents into approved Atoms in Neo4j (ATLAS), plus a separate runtime chat agent (Alpha M5 / production M6; ingestion build starts M2–M3). Model selection is quality-first. Cost is a working projection to keep us honest, not a contractual cap; Helios has indicated verbally that the projected range is acceptable. The platform is model-agnostic; staying inside Vertex AI wins on auth, region, and quota simplicity, so the bar for leaving is "measurably better," not "plausibly better." Site locale is zh-TW primary, en secondary; the ingestion corpus and runtime agent gates in §5–§6 remain Traditional-Chinese-first — English pages are authored or translated, not bulk-generated in the website slice.此 pipeline 將來源文件轉換為 Neo4j（ATLAS）中核准的 Atom，另有獨立的執行期 chat agent（Alpha M5 / 正式 M6；ingestion 於 M2–M3 開始建置）。模型選型以品質優先。成本是用來保持誠實的推估，而非合約上限；Helios 已口頭表示可接受推估區間。平台與模型無關；留在 Vertex AI 內在認證、區域與 quota 上較單純，因此離開的門檻是「可量測地更好」，而非「看起來更好」。網站語系為 zh-TW 為主、en 為輔；§5–§6 的 ingestion 語料與執行期 agent 關卡仍以繁體中文優先 — 英文頁面是人工撰寫或翻譯，並非在 website slice 中批次生成。
| Stage階段 | Primary主要選型 | Escalation升級路徑 | Rationale理由 |
|---|---|---|---|
| 1. Deterministic extraction1. 確定性抽取 | Docling / Unlimited OCR / MinerU / Document AI / pdfplumber | — | Not a model. Ground truth for the reconciliation pass.非模型。核對階段的基準真值。 |
| 2. Multimodal parsing2. 多模態解析 | gemini-3.7-flash | gemini-3.1-pro on flagged pages被標記頁面升級至 gemini-3.1-pro | Current-gen multimodal, 1M context. Runs after deterministic extraction, not instead of it.當代多模態、1M context。在確定性抽取之後執行，而非取代它。 |
| 3. Chunking3. 切分 | No generative model — ATLAS §5 playbook不使用生成模型 — ATLAS §5 手冊 | — | Structure-first, then pinned embedding-based semantic chunking. Reproducible when model + threshold + pipeline version are pinned.結構優先，再進行固定版本的 embedding 語意切分。只要模型、閾值與 pipeline 版本固定即可重現。 |
| 4. Metadata / frontmatter4. Metadata / frontmatter | gemini-3.5-flash-lite | gemini-3.7-flash | High-volume, low-difficulty.高量、低難度。 |
| 5. Root assignment + relationship extraction5. Root 指派與關係抽取 | Deterministic registry matching (no model)確定性 registry 比對（不使用模型） | gemini-3.1-pro on miss path; 3.7-flash routine; DeepSeek V4 Pro challenger if jurisdiction clears未命中路徑用 gemini-3.1-pro；例行用 3.7-flash；管轄權放行時由 DeepSeek V4 Pro 挑戰 | Per ATLAS §6.3: LLM output is candidate suggestions, post-filtered against the registry, never auto-linked.依 ATLAS §6.3：LLM 輸出僅為候選建議，須與 registry 後置比對過濾，絕不自動建立連結。 |
| 6. Embedding6. Embedding | gemini-embedding-2 — 1536-dim indexed, 3072-dim archived to GCSgemini-embedding-2 — 1536 維入索引、3072 維歸檔至 GCS | Alt. text-multilingual-embedding-002 for low latency and cross-language support替代方案 text-multilingual-embedding-002，具低延遲與跨語言支援 | Multimodal fit for image-locked content; MRL preserves dimension optionality.適合鎖在圖片中的內容；MRL 保留了維度選擇的彈性。 |
| 7. Reranking7. 重排序 | gemini-3.5-flash-lite cross-encodergemini-3.5-flash-lite 交叉編碼器 | — | Highest-leverage cheap addition; also shrinks per-turn prompts.投報率最高的低成本增益，同時縮短每輪 prompt。 |
| 8. Runtime router / guardrail8. 執行期 router / 護欄 | gemini-3.1-flash-lite | — | Intent classification, abuse detection, escalation. Keeps classification turns off the Flash/Pro meters.意圖分類、濫用偵測、升級判斷。讓分類輪次不計入 Flash/Pro 計費。 |
| 9. Runtime agent (Alpha M5; pick against the real corpus during M5, not December)9. 執行期 agent（Alpha M5；於 M5 期間依真實語料選定，而非 12 月） | gemini-3.7-flash + context cachinggemini-3.7-flash + context caching | gemini-3.1-pro multi-hop; MiniMax M3 challenger subject to jurisdiction + tool-calling verification多跳推理用 gemini-3.1-pro；MiniMax M3 挑戰者須通過管轄權與 tool-calling 驗證 | Decide against the real corpus.依真實語料決定。 |
| Corpus語料 | Volume量體 |
|---|---|
| A: Source PDFs (brochures, spec sheets, case studies, whitepapers)A：來源 PDF（型錄、規格書、案例、白皮書） | ~300 docs × ~12 pages = ~3,600 pages約 300 份 × 約 12 頁 = 約 3,600 頁 |
| B: Existing web pagesB：現有網頁 | ~1,000 pages約 1,000 頁 |
| Total合計 | ~4,600 pages約 4,600 頁 |
Traditional Chinese tokenises at roughly 1 token per character (versus ~0.75/word for English); a dense page ≈ 1,000 tokens. This assumption moves the whole estimate linearly.繁體中文的 tokenise 約為每字元 1 個 token（英文約每字 0.75）；一頁密集內容約 1,000 tokens。此假設會線性放大或縮小整份估算。
Sensitivities (ranked): corpus size; image tokenisation rate (260 versus 1,550 tok/page is a 6× swing — verify empirically on 20 real pages in week 1); chunk count; caching implemented or not; retry rate (suppress with constrained decoding).敏感度（依影響排序）：語料規模；影像 tokenise 比率（每頁 260 對比 1,550 token，是 6 倍的擺盪 — 第 1 週以 20 個實際頁面實測）；chunk 數量；是否實作快取；重試率（以受限解碼抑制）。
Volume assumption: ~30k sessions × ~6 turns ≈ 180k turns/month; ~8k in + ~800 out per turn → ~1.44B in + 144M out. Rates below are Vertex global 3.7 Flash; asia-east1 (non-global) adds 10%. Thinking tokens bill as output and are the main upside risk on the 800-out assumption.量體假設：約 3 萬 session × 每 session 約 6 輪 ≈ 每月 18 萬輪；每輪約 8k input + 800 output → 約 14.4 億 input + 1.44 億 output。以下費率為 Vertex global 的 3.7 Flash；asia-east1（非 global）加計 10%。thinking token 以 output 計費，是 800 output 假設的主要上行風險。
| Case情境 | Intro (through 31 Dec 2026)導入價（至 2026/12/31） | From 1 Jan 20272027/01/01 起 |
|---|---|---|
| Uncached (upper bound)無快取（上界） | ~$1,600 | ~$3,200 |
| Expected, ~60% of input cached預期，約 60% input 命中快取 | ~$1,000 | ~$2,100 |
| Vertex asia-east1, expected cacheVertex asia-east1，預期快取 | ~$1,100 | ~$2,300 |
Primary lever: Gemini context caching on the system prompt and stable retrieved context (cached input is 1/10 of input price). Secondary: tighter retrieval via reranking, Flash-Lite routing for classification turns. These are projections, not a cap.主要槓桿：對 system prompt 與穩定的檢索脈絡啟用 Gemini context caching（快取 input 為 input 價格的十分之一）。次要槓桿：以重排序收斂檢索範圍、分類輪次改走 Flash-Lite。這些是推估，不是上限。
| Model模型 | Modality模態 | ContextContext | Licence授權 | ~$ in/out per 1M每 1M in/out 約值 | Notes說明 |
|---|---|---|---|---|---|
| Gemini 3.7 Flash | Multimodal多模態 | 1M / 64K out | Closed封閉 | 0.75 / 3.75 (doubles 1 Jan 2027)0.75 / 3.75（2027/01/01 倍增） | Newest Flash最新 Flash |
| Gemini 3.1 Pro | Multimodal多模態 | 1M / 64K out | Closed封閉 | 2 / 12 | Flagship旗艦 |
| Gemini 3.5 / 3.1 Flash-Lite | Multimodal多模態 | 1M | Closed封閉 | 0.30 / 2.50 · 0.25 / 1.50 | Volume tier. Do not use 2.5 Flash-Lite rates ($0.10 / $0.40) — that family shuts down in October.大量級距。不可沿用 2.5 Flash-Lite 費率（$0.10 / $0.40）— 該系列 10 月停用。 |
| DeepSeek V4 Flash | Text only僅文字 | 1M / 384K out | MIT | 0.14 / 0.28 (cache 0.0028)0.14 / 0.28（快取 0.0028） | 284B MoE, 13B active284B MoE，啟用 13B |
| DeepSeek V4 Pro | Text only僅文字 | 1M / 384K out | MIT | 0.435 / 0.87 (cache 0.0036)0.435 / 0.87（快取 0.0036） | 1.6T MoE, 49B active; SWE-bench Verified 80.6%, tied with Gemini 3.1 Pro1.6T MoE，啟用 49B；SWE-bench Verified 80.6%，與 Gemini 3.1 Pro 並列 |
| GLM (Zhipu) | No image input無影像輸入 | 1M / 131K out | MIT | sub-$1 tier$1 以下級距 | Shipping model is GLM-5.2 — confirm which "GLM 3" refers to出貨型號為 GLM-5.2 — 須確認「GLM 3」所指為何 |
| MiniMax M3 | Multimodal in多模態輸入 | 1M / 262K out | Commercial-restricted商用受限 | 0.60 / 2.40 list牌價 0.60 / 2.40 | Benchmarks first-party; verify tool-calling on the chosen provider基準測試為官方自評；須在選定供應商上驗證 tool-calling |
Capability eliminations: DeepSeek V4 (both variants) and GLM take no image input → excluded from parsing, where the image-locked content lives. Gemini and MiniMax M3 are the only parsing candidates.依能力排除：DeepSeek V4（兩種變體）與 GLM 皆不支援影像輸入 → 排除於解析階段，而內容正是鎖在圖片裡。解析階段的候選只有 Gemini 與 MiniMax M3。
Where a second vendor could pay: stage 5's LLM portion. DeepSeek V4 Pro ties Gemini 3.1 Pro on SWE-bench Verified at ~1/5 input and ~1/14 output price, and its ~120× cache-hit discount fits a workload where ~87% of input is a static prefix. Run the bake-off only if jurisdiction clears.第二供應商可能划算之處：階段 5 的 LLM 部分。DeepSeek V4 Pro 在 SWE-bench Verified 與 Gemini 3.1 Pro 並列，input 價格約為五分之一、output 約十四分之一，且其約 120 倍的快取命中折扣，正好契合「約 87% input 是固定前綴」的工作負載。僅在管轄權放行時才進行比測。
All bars run against the golden set (30–50 hand-verified zh-TW documents: dense spec tables, image-locked diagrams, mixed-language pages). These are also proposed as the missing thresholds for ATLAS spec §14.2.所有門檻都對 golden set 執行（30–50 份人工驗證的 zh-TW 文件：密集規格表、鎖在圖片中的圖說、混合語言頁面）。這些門檻同時作為 ATLAS 規格 §14.2 尚缺標準的提案。
| Criterion準則 | Method方法 | Bar門檻 |
|---|---|---|
| Numeric cell fidelity數值欄位保真度 | Diff every number versus deterministic extraction將每個數字與確定性抽取結果比對 | ≥99% — the liability criterion≥99% — 責任準則 |
| Hallucination rate幻覺率 | Output content absent from source輸出中出現來源不存在的內容 | 0 |
| Structure preservation結構保留 | Heading-hierarchy F1 versus human annotation標題層級 F1 對比人工標註 | ≥0.95 |
| Diagram description utility圖說可用度 | Human 1–5 rating, 30 diagrams30 張圖，人工 1–5 分評分 | ≥4.0 mean平均 ≥4.0 |
| TC purity繁體純度 | Simplified codepoint scan簡體碼位掃描 | 0 occurrences0 次 |
Schema validity 100% (constrained decoding) · tag precision ≥0.85 / recall ≥0.80 versus human labels · summary faithfulness ≥98% (no claims absent from the chunk) · glossary violations 0.Schema 合規 100%（受限解碼）· tag precision ≥0.85 / recall ≥0.80（對比人工標註）· 摘要忠實度 ≥98%（不得出現 chunk 中沒有的陳述）· 術語違規 0。
No generative model. Requirements: an embedding-model or threshold change is a pipeline-version bump triggering a re-atomization diff; the chunking agent selects strategy per document type (logged in chunking_strategy) and enriches metadata, but never overrides boundaries outside the pinned procedure; a hard assertion that no chunk exceeds the embedding model's input ceiling — silent truncation permanently degrades retrieval.不使用生成模型。要求：變更 embedding 模型或閾值即視為 pipeline 版本升級，並觸發 re-atomization 差異比對；chunking agent 可依文件類型選擇策略（記錄於 chunking_strategy）並擴充 metadata，但絕不可在固定程序之外改動邊界；並以硬性斷言確保沒有任何 chunk 超過 embedding 模型的 input 上限 — 靜默截斷會永久劣化檢索品質。
| Criterion準則 | Method方法 | Bar門檻 |
|---|---|---|
| Root resolution accuracy (deterministic + LLM combined)Root 解析準確率（確定性 + LLM 合併） | % mentions linked to the correct registry entry連結至正確 registry 條目的提及比例 | ≥95% — decides the stage; deterministic matching handles the head, the LLM sees only the tail≥95% — 決定該階段成敗；確定性比對處理頭部，LLM 只看尾部 |
| Duplicate entity rate重複實體率 | Distinct nodes created per real entity每個真實實體被建立的節點數 | ≤2% |
| Ontology adherence本體遵循 | % triples using only allowed labels / relationship types僅使用允許標籤／關係類型的三元組比例 | 100% with constrained decoding受限解碼下 100% |
| Relationship precision / recall關係 precision / recall | Versus a hand-annotated gold subgraph, 50 chunks對比人工標註的 gold 子圖，50 個 chunk | P ≥0.90, R ≥0.80 |
| Traversal answerability圖走訪可答率 | % of 50 gold questions answerable from the extracted subgraph50 題 gold 問題中可由抽取子圖回答的比例 | ≥90% — the only criterion measuring what we actually care about≥90% — 唯一真正衡量我們在意之事的準則 |
| zh-TW label fidelityzh-TW 標籤保真 | Entity labels in Traditional Chinese, glossary-compliant實體標籤為繁體中文且符合術語表 | 100% |
Recall@10 ≥0.90 and nDCG@10 ≥0.75 on 100 hand-written zh-TW query/chunk pairs · multimodal retrieval (zh-TW query → correct diagram) Recall@10 ≥0.70 · dimension sensitivity: <3 pt nDCG loss at 1536 versus 3072. Dimension strategy: index 1536; archive 3072 as Parquet in GCS (~600 MB) so the index can be rebuilt at any supported dimension without re-paying inference. Embedding is the only irreversible choice — changing it means re-embedding the corpus, rebuilding every HNSW index, and re-validating retrieval.在 100 組人工撰寫的 zh-TW 查詢／chunk 配對上，Recall@10 ≥0.90、nDCG@10 ≥0.75 · 多模態檢索（zh-TW 查詢 → 正確圖說）Recall@10 ≥0.70 · 維度敏感度：1536 相對 3072 的 nDCG 損失 <3 個百分點。維度策略：索引採 1536；3072 以 Parquet 歸檔於 GCS（約 600 MB），使索引可在任何支援的維度重建而無須重新支付推論費用。Embedding 是唯一不可逆的選擇 — 一旦更換就得重新 embedding 整份語料、重建每個 HNSW 索引，並重新驗證檢索品質。
nDCG@5 uplift ≥15% over raw hybrid retrieval (below this the stage is not paying for itself) · added latency p95 ≤300 ms · ≥40% reduction in tokens sent to generation.相對於原始混合檢索，nDCG@5 提升 ≥15%（低於此值代表該階段不划算）· 增加延遲 p95 ≤300 毫秒 · 送入生成的 token 減少 ≥40%。
Groundedness ≥95% (claims traceable to a retrieved Atom) · tool-call accuracy ≥95% on 100 scripted turns · TTFT p50 ≤1.5 s / p95 ≤3 s · TC terminology compliance ≥99% on 200 generated responses · out-of-scope handling ≥95% (declines rather than fabricates) · cost/turn ≤$0.012 with caching at introductory rates (≈$0.024 uncached after 1 Jan 2027; caching holding ~60% of input keeps it near $0.012).依據性 ≥95%（陳述可追溯至檢索到的 Atom）· 100 輪腳本對話的 tool-call 準確率 ≥95% · TTFT p50 ≤1.5 秒 / p95 ≤3 秒 · 200 則生成回應的繁中術語合規 ≥99% · 範圍外處理 ≥95%（婉拒而非編造）· 導入費率下含快取每輪成本 ≤$0.012（2027/01/01 後無快取約 $0.024；維持約 60% input 命中快取可讓成本接近 $0.012）。
The site also ships en as a secondary locale; this section applies to zh-TW source material, labels, and agent replies — not to hand-authored English CMS copy. Source material is Taiwan-produced, which removes most drift risk from the input side. The residual risk is on the generation side: models — especially Simplified-trained candidates (DeepSeek, GLM, MiniMax) — drift toward Mainland technical vocabulary even in otherwise correct Traditional text (軟件→軟體, 網絡→網路, 數據→資料, 信息→資訊, 專案 not 項目). Runtime agent replies are fully generated and reach prospects without human review, so risk concentrates there.網站同時提供 en 作為次要語系；本節適用於 zh-TW 的來源素材、標籤與 agent 回覆 — 不適用於人工撰寫的英文 CMS 內容。來源素材為台灣製作，已消除輸入端的大部分用語漂移風險。殘餘風險在生成端：模型 — 尤其是以簡體訓練的候選（DeepSeek、GLM、MiniMax）— 即使產出正確的繁體文字，仍會漂向大陸技術用語（軟件→軟體、網絡→網路、數據→資料、信息→資訊、專案而非項目）。執行期 agent 的回覆完全由模型生成，且未經人工審核就送到潛在客戶面前，風險因此集中於此。
Blocking for the runtime agent's §5 bar; advisory for the ingestion path.對執行期 agent 的 §5 門檻具阻擋性；對 ingestion 路徑則為建議性。
gemini-embedding-2 is GA (22 Apr 2026). It is not available on a single-region asia-east1 endpoint — only global, us, or eu. Resolve embedding ML-processing residency with infosec before the first full corpus embed.已確認（2026 年 8 月）：gemini-embedding-2 已 GA（2026/04/22）。但不提供單一區域的 asia-east1 endpoint — 僅有 global、us 或 eu。首次完整語料 embedding 前，須與資安確認 ML 處理落地問題。MonoMind (architecture + ATLAS product) · Helios IT / infosec · NorthwindMonoMind（架構與 ATLAS 產品）· Helios IT / 資安 · Northwind
Related: ADR-001 §5.5 option D and §5.6; ADR-004 requires Business Critical before Alpha Chat.相關文件：ADR-001 §5.5 方案 D 與 §5.6；ADR-004 要求 Alpha Chat 前須完成 Business Critical。
Greenfield Graph RAG clusters knowledge nodes, summarizes each community with Gemini, then retrieves against those summaries plus vector search and a 2-hop Cypher walk. That workflow must run against the live graph. Spanner Graph can now run some algorithms in-database (June 2026). It still does not run Leiden or Louvain, it still assumes a relational estate we do not have, and the production bill starts on Enterprise compute rather than a graph-sized instance.全新建置的 Graph RAG 會將知識節點分群、以 Gemini 為每個社群產生摘要，再針對這些摘要搭配向量檢索與兩跳 Cypher 走訪進行檢索。此流程必須在生產圖譜上執行。Spanner Graph 自 2026 年 6 月起可在資料庫內執行部分演算法，但仍不支援 Leiden 或 Louvain，仍假設存在我們沒有的關聯式資產，且生產帳單的起點是 Enterprise 運算，而非圖譜規模的執行個體。
The production comparison uses AuraDB Business Critical at the 2 GB minimum — the M5 agent-launch tier in ADR-001 and ADR-004. Aura Professional is not the bar: it has no operator RBAC and no 99.95% SLA.生產環境的比較基準是 AuraDB Business Critical 的最小 2 GB 規格 — 即 ADR-001 與 ADR-004 中 M5 agent 上線所需的層級。Aura Professional 不符標準：沒有 operator RBAC，也沒有 99.95% SLA。
| Criterion準則 | Neo4j AuraDB BC | Spanner Graph |
|---|---|---|
| Community detection社群偵測 | Leiden, Louvain, PageRank via Aura Graph Analytics透過 Aura Graph Analytics 提供 Leiden、Louvain、PageRank | Native as of June 2026: PageRank, label propagation, modularity clustering, WCC. No Leiden/Louvain. Enterprise edition + Data Boost.2026 年 6 月起原生支援：PageRank、label propagation、modularity clustering、WCC。不支援 Leiden/Louvain。需 Enterprise 版 + Data Boost。 |
| Greenfield graph全新圖譜 | Graph-first以圖為本 | Relational overlay on Spanner tables建構在 Spanner 資料表上的關聯式覆層 |
| Hybrid RAG templates混合式 RAG 樣板 | Existing Cypher + vector patterns既有的 Cypher + 向量模式 | Custom GQL glue須自行撰寫 GQL 膠合層 |
| Production cost生產成本 | $300/mo at 2 GB BC minimum. Analytics $0.40/GB-hour, only while running.BC 最小 2 GB 每月 $292。分析 $0.40/GB-hour，僅執行期間計費。 | Graph requires Enterprise. 1 node ≈ $900/mo compute ($1.23/node-hour × 730 h) plus SSD and Data Boost. 100 PU is not a comparable HA instance.Graph 需 Enterprise。單節點運算約每月 $898（$1.23/node-hour × 730 小時），另計 SSD 與 Data Boost。100 PU 並非同級的 HA 執行個體。 |
| SLA / RBAC | 99.95% 3-zone cluster, operator RBAC from BC99.95% 三可用區叢集，BC 起提供 operator RBAC | 99.99% regional; Graph gated to Enterprise / Enterprise Plus區域級 99.99%；Graph 功能限 Enterprise / Enterprise Plus |
Compare production Graph RAG. Do not compare Aura Free, Community Edition, or Spanner Standard — none of those can host this workload.比較的是生產級 Graph RAG。請勿拿 Aura Free、Community Edition 或 Spanner Standard 相比 — 三者皆無法承載此工作負載。
| Line項目 | Neo4j (adopted)Neo4j（採用） | Spanner Graph (rejected)Spanner Graph（否決） |
|---|---|---|
| Through M4 (website slice)M4 前（website slice） | CE on GCE ≈ $130–200/mo, then dropped. Graph is not on the public request path.GCE 上的 CE 約每月 $130–170，之後下線。圖譜不在公開請求路徑上。 | Enterprise from the first graph schema. No CE equivalent.自第一版圖 schema 起即需 Enterprise。無 CE 對應方案。 |
| From M5 (agent slice)M5 起（agent slice） | Aura BC 2 GB: $300/mo ($146/GB × 2 GB). Replaces CE.Aura BC 2 GB：每月 $292（$146/GB × 2 GB），取代 CE。 | Enterprise 1 node: ≈ $900/mo compute, before storage and algorithm runs.Enterprise 單節點：運算約 每月 $900，尚未計入儲存與演算法執行。 |
| Community-detection runs社群偵測執行 | Aura Graph Analytics $0.40/GB-hour. A 2 GB Leiden job for 10 hours ≈ $8.Aura Graph Analytics $0.40/GB-hour。2 GB 的 Leiden 作業執行 10 小時約 $8。 | Data Boost — a separate SPU-hour meter on every algorithm call.Data Boost — 每次演算法呼叫皆另計 SPU-hour。 |
| 12-month operating term (post-M5)12 個月維運期（M5 後） | $292 × 12 ≈ $3,500, plus sparse analytics.$292 × 12 ≈ $3,500，加上零星分析用量。 | ≈ $10,800+ compute at 1 node, plus storage and Data Boost.單節點運算約 $10,800 以上，另計儲存與 Data Boost。 |
List prices checked August 2026 against Neo4j Aura pricing and Spanner pricing. Spanner Graph is an Enterprise feature; Standard ($0.90/node-hour) cannot host it. Regional Enterprise $1.23/node-hour is the published Iowa rate — asia-east1 is the same order; confirm in the calculator before contract.牌價於 2026 年 8 月對照 Neo4j Aura 與 Spanner 定價查核。Spanner Graph 屬 Enterprise 功能；Standard（$0.90/node-hour）無法承載。區域級 Enterprise $1.23/node-hour 為 Iowa 公告價 — asia-east1 屬同一量級；簽約前請於計價工具確認。
Leiden/Louvain remains a Neo4j capability — the reason not to use Spanner. It is not a retrieval stage.Leiden/Louvain 是 Neo4j 的能力 — 也是不採用 Spanner 的理由。它本身並非檢索階段。
gemini-embedding-2, 1536 indexed). Write into Neo4j.Ingest。以 Docling 解析。結構優先切分，再進行固定版本語意切分 — 邊界不使用生成模型。確定性擴充；root 以 registry 優先。以 Vertex 對核准的子 Atom 產生 embedding（gemini-embedding-2，1536 入索引），寫入 Neo4j。atom_id@version.Retrieve。先查 Content Block 快取。命中即直接送出、不做生成。未命中：root + ACL + 敏感度前置過濾；對子 Atom 做向量 ANN；展開父節點、root 與媒體；以 Flash-Lite 重排序；由 Gemini 依此組包作答。每項陳述都可追溯至 atom_id@version。Through M4: self-hosted Community Edition, a build-time system with no custom RBAC. Before M5: migrate to Aura Business Critical, before the agent goes live.M4 前：自架 Community Edition，作為建置期系統且不自建 RBAC。M5 前：在 agent 上線之前遷移至 Aura Business Critical。
MonoMind (architecture + ATLAS product) · Helios IT / infosec · Neo4j (commercial)MonoMind（架構與 ATLAS 產品）· Helios IT / 資安 · Neo4j（商務）
Related: ADR-001 (hosting), ADR-002 (models), ADR-003 (why Neo4j).相關文件：ADR-001（主機）、ADR-002（模型）、ADR-003（為何選 Neo4j）。
Plan: start on self-hosted Neo4j Community Edition, migrate to a managed Aura tier later. Helios is new to Neo4j; the contract is not initiated. Separately, ATLAS (DB-agnostic by design) is developed and tested against Community Edition as its open-core compatibility target. Two projects must not be conflated.計畫：先以自架的 Neo4j Community Edition 起步，稍後遷移至託管的 Aura 層級。Helios 首次接觸 Neo4j，合約尚未啟動。另一方面，ATLAS（設計上與資料庫無關）以 Community Edition 作為 open-core 相容目標進行開發與測試。這兩個專案不可混為一談。
| ATLAS (product)ATLAS（產品） | Helios (client delivery)Helios（客戶交付） | |
|---|---|---|
| Goal目標 | Governed GraphRAG framework, CE-compatible open core受治理的 GraphRAG 框架、相容 CE 的 open core | Working website; editor-ready UAT November / M4 launch可運作的網站；11 月可供編輯使用的 UAT / M4 上線 |
| Timeline時程 | Product roadmap, ongoing產品藍圖，持續進行 | Fixed contractual dates合約固定日期 |
| Needs CE compatibility?需要 CE 相容嗎？ | Yes — the open-core premise是 — open-core 的前提 | No否 |
| Needs graph-level access control?需要圖層級存取控制嗎？ | Possibly, as a product feature可能，作為產品功能 | No through M4 — network isolation + single credential. From M5: Aura Business Critical operator RBAC (not available on Aura Professional).M4 前不需要 — 以網路隔離加單一憑證即可。M5 起：Aura Business Critical 的 operator RBAC（Aura Professional 不提供）。 |
Enterprise extends CE with clustering, online backup, RBAC, and LDAP. The gaps that matter here:Enterprise 在 CE 之上增加了叢集、線上備份、RBAC 與 LDAP。在此情境下真正重要的缺口如下：
| Gap缺口 | Consequence後果 |
|---|---|
| No online/hot backup — dump/load only, database stopped無線上／熱備份 — 僅能在停機狀態下 dump/load | Daily backup requires a nightly downtime window (acceptable pre-production) or crash-consistent disk snapshots (not a validated graph backup)每日備份需要夜間停機視窗（生產前可接受），或使用 crash-consistent 磁碟快照（但那不是經驗證的圖譜備份） |
| No clustering or HA — single instance無叢集或 HA — 單一執行個體 | No agent-layer SLA is achievable on CE; any host event is a full outageCE 上無法達成 agent 層 SLA；任何主機事件都是全面中斷 |
| No RBAC — basic auth only無 RBAC — 僅基本認證 | See §3見 §3 |
| Single database單一資料庫 | No clean dev/staging/prod separation within one instance同一執行個體內無法乾淨區分開發／測試／正式 |
| Self-managed everything全部自管 | Patching, monitoring, disk growth, backup verification — on MonoMind for the operating term修補、監控、磁碟成長、備份驗證 — 維運期間皆由 MonoMind 負責 |
Vector indexes are available in CE, so the core GraphRAG retrieval path works. Encryption at rest is mitigated by default GCE persistent-disk encryption. The gaps are operational and security-related, not functional.CE 具備向量索引，因此核心 GraphRAG 檢索路徑可運作。靜態加密由 GCE 永久磁碟的預設加密涵蓋。這些缺口屬維運與資安層面，而非功能層面。
Correct through M4 precisely because the agent is not in the website launch: Neo4j is a development and ingestion system, not a production request-path dependency.M4 前採用 CE 之所以正確，正因為 agent 不在網站上線的範圍內：Neo4j 是開發與 ingestion 系統，而非生產請求路徑上的相依項。
neo4j-admin database dump to GCS within a scheduled downtime window; weekly restore verification — an unverified backup is not a backup.於排定的停機視窗每晚執行 neo4j-admin database dump 至 GCS；每週驗證還原 — 未經驗證的備份不算備份。The migration completes before M5 Alpha Chat, not after website launch and not "sometime in December." That is the moment Neo4j becomes a production dependency with an SLA, and every CE gap becomes a live risk simultaneously.遷移須在 M5 Alpha Chat 之前完成，而非網站上線之後，也不是「12 月的某個時候」。那正是 Neo4j 成為帶 SLA 的生產相依項的時點，屆時所有 CE 缺口會同時變成實際風險。
Need to initiate contact now: enterprise contract lead times run weeks and can silently become the M5 critical path.須立即啟動接觸：企業合約交期以週計，可能無聲無息成為 M5 的關鍵路徑。
November loses a workstream (custom RBAC) it never required; through-M4 infrastructure is cheap and unblocked by any Aura contract; the Business Critical contract is opened now at minimum size so migration can complete before agent launch, with Q1 2027 reserved for resize / multi-region; ATLAS's product requirements stop distorting client delivery; the rebuildable-graph posture keeps the early phase low-risk.11 月少掉一條它從未需要的工作線（自建 RBAC）；M4 前的基礎設施便宜且不受 Aura 合約阻擋；現在就以最小規格啟動 Business Critical 合約，使遷移能在 agent 上線前完成，2027 Q1 則保留給規格調整／多區域；ATLAS 的產品需求不再扭曲客戶交付；可重建的圖譜姿態讓前期風險維持在低點。
Two Neo4j environments to reason about (CE for ATLAS CI, Aura for Helios); a migration event before M5 — schedule it after M4 website launch, with a rehearsal, never Alpha-eve; a self-managed database in the runbook until that migration.要同時管理兩個 Neo4j 環境（ATLAS CI 用 CE、Helios 用 Aura）；M5 前有一次遷移事件 — 應排在 M4 網站上線之後並先行演練，絕不排在 Alpha 前夕；在遷移完成前，維運手冊中都有一套自管資料庫。
Aura Business Critical migration complete and rehearsed is a hard gate before M5 Alpha Chat · Neo4j contract lead time tracked weekly · Q1 2027 review of secondaries / multi-region on real traffic.完成並演練過的 Aura Business Critical 遷移是 M5 Alpha Chat 前的硬性關卡 · 每週追蹤 Neo4j 合約交期 · 2027 Q1 依實際流量檢討副本／多區域。
Keying on Roots, re-render economics for live-binding, validity from Atom expiry, the AGUI cold path, the indexability gate, and the Payload↔Atom split by surface.以 Root 為鍵、live-binding 的重繪成本、由 Atom 到期推導有效期、AGUI 冷路徑、可索引性關卡，以及依介面切分的 Payload↔Atom 分工。
The ATLAS specification defines Content Blocks, live-binding, the approval lifecycle, Roots, and Atom expiry. This ADR covers only the design questions the specification leaves open. Library delivery is M6 (gantt: Content Block Caching). Schema, keying, and volatile types are M2–M3 build work — they block Payload schema in week 3, not M6. The Payload↔Atom boundary is decided in §7. Invalidation is application-layer, not Cloudflare.ATLAS 規格已定義 Content Block、live-binding、核准生命週期、Root 與 Atom 到期。本 ADR 只處理規格未定的設計問題。Library 於 M6 交付（gantt：Content Block Caching）。schema、鍵值與 volatile 類型屬 M2–M3 建置工作 — 它們卡住的是第三週的 Payload schema，而非 M6。Payload↔Atom 邊界已於 §7 定案。失效機制屬應用層，與 Cloudflare 無關。
Deciders: MonoMind (architecture) · Helios (editorial + SEO owner) · Northwind. Related: ADR-001 §5.2–5.3, ADR-002, ADR-004, ATLAS spec §9 / §10 / §12.0.決策者：MonoMind（架構）· Helios（編輯與 SEO 負責人）· Northwind。相關文件：ADR-001 §5.2–5.3、ADR-002、ADR-004、ATLAS 規格 §9 / §10 / §12.0。
A Content Block is a pre-rendered UI response assembled from approved Atoms and approved UI Components, live-bound to its grounding Atoms, served directly on a cache hit (ATLAS §12.0). It is best treated as an incrementally maintained materialized view: blocks declare their base relations (Atoms) and updates propagate. That framing imports the right questions — what are the base relations, what invalidates the view, how is it refreshed — and the well-understood failure mode of the class (§3).Content Block 是預先渲染的 UI 回應，由核准的 Atom 與核准的 UI 元件組成，與其依據的 Atom 保持 live-binding，快取命中時直接送出（ATLAS §12.0）。最好把它視為增量維護的物化檢視：block 宣告其基礎關聯（Atom），更新則向下傳播。這個框架帶進了正確的問題 — 基礎關聯是什麼、什麼會使檢視失效、如何刷新 — 也帶進該類設計眾所周知的失效模式（§3）。
A stale cache entry costs a slow page; a stale Content Block presents an outdated spec or price to a prospect with the authority of a personalised answer. That asymmetry drives §3–§5.過期的快取項目只是頁面變慢；過期的 Content Block 卻會以個人化答案的權威感，把過時的規格或價格呈現給潛在客戶。這種不對稱性驅動了 §3–§5 的設計。
Approval semantics, per the spec: a freshly rendered block is served immediately to the requesting user and queued for approval to enter the Content Block Library — approval gates reuse, not first service. Approval composes for facts (approved Atoms + approved Components ⇒ trustworthy block); §6 covers where composition alone is insufficient.依規格的核准語意：新渲染的 block 會立即送出給提出請求的使用者，同時排入核准佇列以進入 Content Block Library — 核准把關的是重用，而非首次服務。核准對事實具組合性（核准的 Atom + 核准的元件 ⇒ 可信的 block）；§6 說明僅靠組合性不足之處。
A reuse layer is only as good as its key, and Roots are the right primitive — the bounded, canonical, enumerable set that unbounded natural language reduces to.重用層的品質完全取決於它的鍵，而 Root 正是正確的基本單位 — 一個有界、正規、可列舉的集合，無界的自然語言最終都會歸約到它。
This is what makes "Does your ERP handle automotive?" and「我們是汽車零件廠，你們的ERP適合嗎？」resolve to the same block.這正是「Does your ERP handle automotive?」與「我們是汽車零件廠，你們的ERP適合嗎？」能解析到同一個 block 的原因。
Semantic near-match fallback: embed the block spec (intent + Root set + component), never the raw utterance. Start the similarity threshold conservative (~0.92 cosine) and relax only against measured precision — a false positive serves a subtly wrong answer with full confidence; a miss costs a few cents.語意近似比對（後備）：對 block spec（intent + Root 集合 + 元件）做 embedding，絕不對原始語句。相似度閾值先保守設在約 0.92 cosine，只有在量測到 precision 後才放寬 — 誤判會以十足自信送出微妙錯誤的答案，未命中只花幾美分。
Live-binding introduces the characteristic failure of incrementally maintained views: fan-out. Atoms are not uniformly connected — a core product Atom may ground thousands of blocks; a niche case-study Atom, three. Eager re-render of every dependent block on Atom update produces: (1) a cost spike against a projected AI bill with no automatic brake; (2) a thundering herd on Neo4j and Vertex simultaneously; (3) editorial surprise — one approval click triggers a large, expensive, invisible job.Live-binding 帶來增量維護檢視的典型失效：fan-out。Atom 的連結度並不均勻 — 一個核心產品 Atom 可能支撐數千個 block，冷門案例 Atom 只支撐三個。若每次 Atom 更新都立即重繪所有相依 block，會造成：(1) 對推估中的 AI 帳單形成沒有自動煞車的成本尖峰；(2) 同時對 Neo4j 與 Vertex 形成瞬時洪峰；(3) 編輯端的意外 — 一次核准點擊觸發龐大、昂貴且不可見的作業。
Proposed policy (input to the Content Block Spec working session; the spec currently specifies eager re-render in §9.3 / §12.0):建議政策（作為 Content Block 規格工作會議的輸入；規格目前在 §9.3 / §12.0 指定為立即重繪）：
Instrumentation: track the blocks-per-Atom distribution in AMS, and show blast radius at approval time — "approving this Atom refreshes N blocks" — a one-line UI addition that eliminates the surprise.量測：在 AMS 中追蹤每個 Atom 支撐的 block 分布，並於核准時顯示影響範圍 — 「核准此 Atom 將刷新 N 個 block」 — 一行 UI 就能消除意外。
This reuses the spec's valid_through lifecycle and AMS expiry alerting instead of adding a second staleness clock, and an expiring Atom surfaces its downstream blast radius in the same alert. Per spec §9.6, an Atom escalating at expiry removes dependent blocks from serving until resolved.此做法沿用規格的 valid_through 生命週期與 AMS 到期警示，避免出現第二套過期時鐘；且即將到期的 Atom 會在同一則警示中顯示其下游影響範圍。依規格 §9.6，到期時升級處理的 Atom 會使相依 block 暫停服務，直到問題解決。
Volatile-content allow-list: Atom types carrying prices, version numbers, or delivery commitments are flagged in the schema; blocks grounded on them get a hard short ceiling regardless of nominal expiry and are never indexable. A schema property, not a per-block judgement call.Volatile 內容允許清單：帶有價格、版本號或交付承諾的 Atom 類型在 schema 中標記；以其為依據的 block 無論名目到期日為何都套用嚴格的短上限，且永不可索引。這是 schema 屬性，不是逐個 block 的人為判斷。
When no existing component fits, AGUI generates a novel component that must pass human approval before joining the UI Component Library. The user asking the triggering question cannot wait on that queue, and serving unapproved novel UI defeats the gate.當沒有既有元件適用時，AGUI 會生成新元件，而該元件須通過人工核准才能進入 UI Component Library。提出觸發問題的使用者不可能等待該佇列，但送出未核准的新 UI 又會讓關卡失去意義。
Behaviour: serve a generic approved fallback component (prose block, structured list, summary) grounded on the same Atoms immediately; queue the AGUI-generated component for review; it serves the next visitor with that need. This makes AGUI a library-growth mechanism rather than a request-path dependency — its latency and approval turnaround never appear in a live conversation.行為：立即以同一批 Atom 為依據，送出通用的已核准 fallback 元件（散文區塊、結構化清單、摘要）；並將 AGUI 生成的元件排入審核，由它服務下一位有相同需求的訪客。這讓 AGUI 成為 library 的成長機制，而非請求路徑的相依項 — 其延遲與核准週期絕不會出現在即時對話中。
Corollary: the generic fallback set is load-bearing, not filler. Design it early and well — it is what every tailored-path failure degrades to.推論：通用 fallback 集合是承重結構，不是填充物。必須及早且用心設計 — 所有客製路徑的失敗都會降級到它。
Approval composes for facts, not for juxtaposition: an approved component and approved Atoms can still mislead as a whole — a comparison placing a legacy product beside a current one without lifecycle context; a capability matrix where an empty cell reads as "feature absent" rather than "unknown." In-session this is acceptable (conversational context, follow-ups). For indexing it is not: a published page has no context to correct it, and search engines' scaled-content enforcement turns on editorial oversight of the published artifact, not its inputs. Publishing velocity disproportionate to editorial capacity is a documented detection signal, and the commercial premise of this platform is SEO-led — the downside is asymmetric.核准對事實具組合性，但對並列呈現沒有：核准的元件加核准的 Atom，整體仍可能誤導 — 例如把舊產品與現行產品並排卻缺少生命週期脈絡；或功能矩陣中的空格被讀成「無此功能」而非「未知」。在對話中這可以接受（有對話脈絡與追問）；用於索引則不行：已發布的頁面沒有可修正的脈絡，而搜尋引擎對規模化內容的執法，看的是對已發布成果的編輯監督，而非其輸入。發布速度與編輯產能不成比例，是已被記錄的偵測訊號，而本平台的商業前提正是以 SEO 為主 — 下檔風險並不對稱。
noindex in its entirety, enforced structurally.Session canvas 全域 noindex，並在結構上強制執行。The original failure mode — two independently editable copies of the same spec, the agent confidently contradicting the website — is not a schema conflict under this split. Chat and generative UI read Atoms; the public static page is whatever Payload published.原先擔心的失效模式 — 同一份規格存在兩份可各自編輯的副本，導致 agent 自信地與網站互相矛盾 — 在此切分下並不構成 schema 衝突。Chat 與生成式 UI 讀 Atom；公開的靜態頁面就是 Payload 所發布的內容。
ATLAS §15 still holds for approved knowledge on the agent / UI path (OKF / Atoms). It does not make Atoms the publish authority for static pages.ATLAS §15 對 agent / UI 路徑上的核准知識（OKF / Atom）依然成立，但這並不使 Atom 成為靜態頁面的發布權威。
A block hit does not eliminate a turn — retrieval may be skipped on an exact hit, but the conversational wrapper and misses remain; composition is roughly 30–40% of turn cost, so a 50% hit rate yields ~17% runtime reduction (~$300/month at steady state). Real, and not the reason to build it.命中 block 並不會省下一整輪 — 精確命中時可略過檢索，但對話外殼與未命中的情況仍在；組裝約佔每輪成本的 30–40%，因此 50% 命中率約帶來 17% 的執行成本降低（穩態下每月約 $270）。這是真實的，但不是建置它的理由。
Realistic steady-state hit rate for a bounded product-catalog domain with good Root resolution: 30–60%, not 90 — the long tail does not compress. Pre-warm before M6 / Alpha: batch-generate blocks for the product catalog × common intent archetypes (tens of dollars at ADR-002 economics; doubles as an eval corpus and editor review material). Instrument hit rate by tier and intent class from day one — below ~20% at launch + 1 month means the keying strategy is wrong, not the threshold.在 Root 解析良好的有界產品目錄領域，實際的穩態命中率為 30–60% 而非 90% — 長尾無法壓縮。M6 / Alpha 前先預熱：以「產品目錄 × 常見意圖原型」批次生成 block（依 ADR-002 的成本結構僅需數十美元，同時可作為評估語料與編輯審閱素材）。自第一天起依層級與 intent class 量測命中率 — 上線後一個月若低於約 20%，問題出在鍵值策略，而非閾值。
intent_class taxonomy with the Helios sales team. M2–M3以 Root 為基礎的 block 鍵值 schema；與 Helios 業務團隊定義 intent_class 分類。M2–M3noindex on the canvas and non-indexed blocks.可索引性作為 AMS 中獨立且明確的操作；canvas 與未索引 block 在結構上 noindex。intent_class taxonomy with us (sales team input).與我們共同定義 intent_class 分類（需業務團隊投入）。