From d35a50c671b3f88bb022bc17d9636bfcfdbbf21f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=40GTM=EF=BD=9Cyonks=EF=BD=9C=F0=9F=A4=96=F0=9F=8F=9B?=
 =?UTF-8?q?=EF=B8=8F=F0=9F=AA=99=EF=BD=9CJason=20Younker=20=E2=99=BE?=
 =?UTF-8?q?=EF=B8=8F?= <3+yonks@noreply.git.weown.tools>
Date: Thu, 15 Oct 2026 10:51:19 +0000
Subject: [PATCH] =?UTF-8?q?=E2=99=BE=EF=B8=8F=20WeOwnNet=20=F0=9F=8C=90=20?=
 =?UTF-8?q?|=20[=F0=9F=92=A1=20POC=20=E2=80=94=20Baserow.io=20=E2=80=94=20?=
 =?UTF-8?q?#StartWithWhy=20=E2=80=94=20v5.42.4-r1]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[🆔 REF: GTM_2026-W42_4005 | #masterCCC GTM_2026-W42_4003](https://git.weown.tools/WeOwnSeason005/pocs/src/branch/main/Baserow.md)
— 🎯 Landing @GTM directive e10c2a5e (2026-10-15T10:33:12Z, 💡︱POC︱🔵︱5️⃣︱4️⃣1️⃣️︱🗃️︱Baserow.io): NEW FILE Baserow.md on WeOwnSeason005/pocs · BP-075 footer of 🌾 DRAFT v0.1 pasted by @GTM verbatim — #HITL evidence carried in @GTM's OWN footer stamp `| #HITL by @yonks at 04:28 EDT on 15Oct2026` (stamp quoted verbatim from his paste; pre-applied to the landing copy inside the footer brackets → post-boundary, hash-neutral, canary UNCHANGED)
— 📜 Document: CHANNEL_POC_Baserow v5.42.4-r1 (Google OKF v0.2 · WeOwnVer S5·W42·D4 · upstream Baserow 2.4.1) — #StartWithWhy POC brief unpacking why we POC Baserow and why it maps to #ResponsibleAgenticAI; W1/W2/W3 carried in §1 · review charter §8 (question · T1–T6 · S1–S5 · E1–E4) · scoped negatives §7 · drafted by AI:🌾 CCC-MAIT-S004-GTM-MiMo (drafter-minted footer; relay signer 10135bbd == 🌾), landed event 6f3d442d 2026-10-15T09:40:25Z
— 🔒 BP-075: 97f8a5a507c522fad0f7dc57c50d3875de407c19984b65a8625644d4771dd72d — ✅ CANONICAL --verify rc=0 reproduced by this staging (bp075_canonical_v2 · 23,723 ch / 3,711 w / 313 L) and independently by 🐳 073c2b5b · 🐝 05312c91 (containment idx 2008) · 🚀 91ff5f75; whole-file pre-stamp 24,799 B sha256 3a2e9af6…0b63 → post-stamp 24,843 B sha256 4afb4c05…3853b3 (+44 B all-ASCII, post-boundary, hash-neutral — canary 97f8a5a5 UNCHANGED both sides)
— 🔵 [2] REVIEW record on canary 97f8a5a5: MC-BA-CCC-META 072f1d8d · 🐳 SEAT 1 073c2b5b · 💻 SEAT 2 2a707ae3→amend cad10da6 · 🚀 SEAT 6 91ff5f75 = 🔵 CONDITIONAL PASS each, 0 gate FAIL (the round's lone ⚪ FAIL on Kuma L203 was retracted by its own author — packaging-claim vs runtime-claim); 🛡️ SEAT 3 (this staging seat) did NOT score — held [1.2] backup lane; 🟩 SEAT 4 no verdict on the wire (D-468: absent ≠ pass)
— 🧹 Deliberately NOT folded (on record — owner-accepted-blob AS-IS, README 9d5e5879 precedent): MF-A doc cites `GTM_2026-W` ×0 (fold = anchor `GTM_2026-W42_4003`) · MF-B upstream list receipts lack `?per_page=3` (GitHub 34,569 B + GitLab 2,404 B reproduce byte-exact AT that param — 3-seat pin) · N2 Kuma off-state additive (`kuma.is_enabled:false`) · N3 frontmatter `generated.at 09:55:00Z` postdates landing 09:40:25Z · N4 tighten "No instance deployed" (settings API answered HTTP 200; signups off) · N5 dangling "§6.3" pointer · **W4 fold = RULING OPEN** (@GTM #COMMS:LOG 6a0e7a37; no ruling on record this thread) · P0 re-baseline W41→W42 D4 (doc §9-5) · folds later = NEW draft revision + NEW canary + THIS commit message re-mint, never silent
— 🚦 Landing battery: `pocs/raw/branch/main/Baserow.md` HTTP 404 pre-landing + repo live (raw README.md HTTP 200, this session) · stamped landing footer == @GTM-pasted footer byte-identical (this staging) · relay 6f3d442d contains the disk bytes (containment idx 2008 · 🐳/🐝/🚀, plus my verify rc=0) · ⛔ Stage ≠ Push — lands main via @GTM:ADMIN only (#127)
— 🧾 CCC-ID: leader line carries BOTH mints per the landed PRJ-541 window (e6d55d17 L3 `[🆔 REF: GTM_2026-W41_4010 | #masterCCC GTM_2026-W41_4008]` · its CCCID cell names 4010 the commit-message-lane mint, in REF) — REF slot = `GTM_2026-W42_4005` (this message's work-item mint, 🐳 2026-10-15T10:36:33Z, R-194) · #masterCCC = `GTM_2026-W42_4003` (CREATE mint, 9afe09ab) — two anchors, two jobs, not collapsed

## @yonks:ADMIN Changes (Human Review — #HITL stamp on @GTM's pasted BP-075 footer @ 04:28 EDT 15Oct2026 · commit-message directive e10c2a5e @ 2026-10-15T10:33:12Z)
- VERSION: v5.42.4-r1 — 💡 POC — Baserow.io — #StartWithWhy (Google OKF v0.2 · WeOwnVer S5·W42·D4 · upstream Baserow 2.4.1)
- FILE: Baserow.md (NEW — @GTM directive "filename = Baserow" + .md extension for Gitea raw render)
- SOT: https://git.weown.tools/WeOwnSeason005/pocs/src/branch/main/Baserow.md (post-push; raw HTTP 404 pre-landing)
- REPO: WeOwnSeason005 / pocs (raw README.md HTTP 200 this session)
- FOLDER: / (root)
- AUTHOR: doc = AI:🌾 CCC-MAIT-S004-GTM-MiMo (drafter-minted footer, signer 10135bbd) · compilation yonks (CCC-ID: @GTM | Gitea: @yonks) · stamped landing copy + commit message = AI:🛡️ CCC-MAIT-S004-GTM-GLM (bc385d5e, SEAT 3) per @GTM e10c2a5e · push = @GTM:ADMIN (Jason Younker) only
- SUBJECT: Baserow.io POC #StartWithWhy — why this POC and why it matters for #ResponsibleAgenticAI
- HASH: 97f8a5a507c522fad0f7dc57c50d3875de407c19984b65a8625644d4771dd72d — ✅ CANONICAL (--verify rc=0 pre- AND post-stamp) · CHARS 23723 | WORDS 3711 | LINES 313 — canary UNCHANGED across the +44 B HITL stamp
- STAGE: landing source = OUTBOX/CHANNEL_POC_Baserow_v5.42.4-r1_LANDING_STAMPED.md (24,843 B · sha256 4afb4c05a5aee4263c9a107a4f2d39033459603d4026ca42f4022097993853b3 · canary 97f8a5a5) · pen draft OUTBOX/CHANNEL_POC_Baserow_v5.42.4-r1.md left UNTOUCHED (24,799 B · 3a2e9af6…0b63)
- LANE-CCC-ID: REF slot = GTM_2026-W42_4005 (work-item mint, 🐳 10:36:33Z, R-194) · #masterCCC = GTM_2026-W42_4003 (create mint, 9afe09ab — doc anchor) — landed-PRJ-541 slot mapping (e6d55d17)
- TRAILERS (on push): Co-authored-by: Jason Younker <3+yonks@noreply.git.weown.tools> · Signed-off-by: Jason Younker <3+yonks@noreply.git.weown.tools>
- OPEN @GTM RULINGS at staging: W4 fold in/out of §1 · P0 re-baseline W41→W42 D4 (panel, 🐳 4004) · filename case ("Baserow" literal stands; BASEROW.md = S005 house style alternative — 🐳 4005 §2) · HITL-stamp clock (04:28 EDT precedes the pinned bytes ~1h10m; EDT→MDT slip reading vs re-cut — 🐳 4005 §3; stamp carried VERBATIM from @GTM's paste meanwhile) — folding any = one-line edit and/or NEW canary + re-mint of this message (@GTM only)

#FlowsBros #FedArch #WeOwnSeason005 #CCC #CCCMait #POC #Baserow #StartWithWhy #ResponsibleAgenticAI #ZeroTo100 #BuildThePIPELINE #GoogleOKF #OKFv02 #BP075 #TMPL007 #CCCbuzzAgent #CCC-MAIT-S004-GTM-GLM #CCC-MAIT-SQUAD #Seat3 #GLM #GLM53Flash #Zai #FELG #Core6 #HITL #R011 #R194 #StageNeverPush #v5.42.4-r1

tagline: "💡 POC Baserow.io v5.42.4-r1 (#StartWithWhy) — canary 97f8a5a5 — @GTM:ADMIN push only."

**♾️ WeOwnNet 🌐 [DUNA][.OCA] Ecosystem** ● 🏡 Real Estate and 🤝 cooperative ownership for everyone ● An 🤗 inclusive community, *by 👥 invitation only*.
---
 Baserow.md | 325 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 325 insertions(+)
 create mode 100644 Baserow.md

diff --git a/Baserow.md b/Baserow.md
new file mode 100644
index 0000000..faf1d89
--- /dev/null
+++ b/Baserow.md
@@ -0,0 +1,325 @@
+---
+type: Channel
+title: "💡︱POC︱🔵︱5️⃣︱4️⃣1️⃣︱🗃️︱Baserow.io — POC (Proof Of Concept) for Baserow.io — #StartWithWhy"
+description: "<CHANNEL_NAME>:<💡︱POC︱🔵︱5️⃣︱4️⃣1️⃣︱🗃️︱Baserow.io> | POC (Proof Of Concept) for Baserow.io | Home Page: https://Baserow.io/ | #devTEAM SME = @PLT | Candidate THIRD #SharedBrain pillar for WeOwn.Cloud #HybridArchitecture — #ResponsibleAgenticAI"
+tags: [poc, proofofconcept, baserow, baserowio, sharedbrain, hybridarchitecture, responsibleagenticai, startwithwhy, weownseason005, mcp, doks, zero-to-100, build-the-pipeline, plt, open-core, no-code-database]
+status: active
+created: 2026-10-15
+version: "v5.42.4-r1"
+weownver: "v5.42.4-r1"
+okf: "v0.2"
+resource: "https://baserow.io/"
+channel_id: "c34d487c-3bbd-4039-8618-4b6d21c2beea"
+generated:
+  by: "AI:🌾 CCC-MAIT-S004-GTM-MiMo (Xiaomi MiMo-V2.6-Pro) — lane [1.1] per @GTM directive 6c59a9c8 (2026-10-15T09:26:50Z)"
+  at: "2026-10-15T09:55:00Z"
+sources:
+  - id: directive
+    resource: "Buzz event 6c59a9c867cea5dba276d977c962b632abd3f802eb1c9f76457d8da614a1cce4 (@GTM, 2026-10-15T09:26:50Z, channel c34d487c)"
+    note: "Lane [1.1]: create POC for Baserow v5.42.4-r1 DOCUMENT unpacking #StartWithWhy → receive REVIEW feedback → finalize."
+  - id: origin-signal
+    resource: "Buzz event aab18e9f275845638adf1842a42ba6c427477841107c7bfde596a01e5329cd82 (@GTM, 2026-09-30T13:53:29Z) — relay of Signal 14:28 EDT 29Sep2026"
+    note: "THE ORIGIN — the three-part why, quoted verbatim in §1."
+  - id: review-contract
+    resource: "RESEARCH/BASEROW_POC_STARTWITHWHY_GROUND_TRUTH_AND_REVIEW_CONTRACT_W42D4_FEDARCHBUZZ.md (🐝 LEARN+ORCHESTRATE, 2026-10-15T09:30–09:48Z)"
+    note: "Frozen WHY corpus + consolidated G1–G10 rubric. This draft is written against that bar."
+  - id: deployment-learn
+    resource: "RESEARCH/BASEROW_POC_DEPLOYMENT_LEARN_W40D3.md (🐝, 2026-09-30) — chart, supply chain, MinIO, licence mix"
+  - id: chart-region-learn
+    resource: "RESEARCH/BASEROW_POC_CHART_110_AND_REGION_MATRIX_LEARN_W40D7.md (🐝, 2026-10-05) — chart 1.1.0, bitnamilegacy, ATL1/MEM1 matrix"
+  - id: domain-learn
+    resource: "RESEARCH/BASEROW_POC_DOMAIN_DECISION_WEOWNTOOLS_LEARN_W41D1.md (🐝, 2026-10-05) — baserow.weown.tools zone decision"
+  - id: freetier-learn
+    resource: "RESEARCH/BASEROW_FREE_TIER_VALUE_LEARN_W41D3.md (🐝, 2026-10-07) — 76-row pricing grid + source package split"
+  - id: pivot-learn
+    resource: "RESEARCH/BASEROW_KANBAN_HERMES_PLANE_POCLIST_LEARN_W41D3.md (🐝, 2026-10-07) — Kanban→Hermes · plane.so→#POCList · AOP.biz no-SSO"
+  - id: smtp-learn
+    resource: "RESEARCH/BASEROW_SMTP_PROTON_INTERIM_SENDGRID_TARGET_LEARN_W41D4.md (🐝, 2026-10-08) — Proton interim / Twilio target posture"
+  - id: own-upstream-pull
+    resource: "GitLab tags API + GitHub releases API — own pull 2026-10-15T09:31:28Z"
+    note: "gitlab tags 200 · 2,404 B · sha256 f4af549e1d7cd13b5501757001185155327986c1dee79a7c3ebcc857ebe8302f · newest 2.4.1 (commit created_at 2026-10-13T17:10:59+02:00). github releases 200 · 34,569 B · sha256 2f153eaeab9a08220d323895bab8217119e2247c6f280d29ed7bad0a91f49dee · 2.4.1 published 2026-10-13T15:39:27Z."
+  - id: live-channel
+    resource: "buzz channels get + channels members --channel c34d487c-3bbd-4039-8618-4b6d21c2beea — own read 2026-10-15T09:52Z"
+    note: "22 members = 1 owner + 4 human members + 17 bots."
+---
+
+# 💡︱POC︱🔵︱5️⃣︱4️⃣1️⃣︱🗃️︱Baserow.io — POC v5.42.4-r1
+
+> **#StartWithWhy** — Why we are running a POC for Baserow.io, why Baserow is the candidate, and why it matters for **#ResponsibleAgenticAI + Build the PIPELINE + #ZeroTo100**.
+>
+> **Version `v5.42.4-r1` = the DOCUMENT stamp (WeOwnVer `v{S}.{W}.{D}-r{REV}` — S005 · W42 · D4).** It is **not** a Baserow product release. The upstream product pin is stated in §5.1 and nothing in this doc claims otherwise.
+
+---
+
+## 1 — #StartWithWhy — the ORIGIN, verbatim
+
+The why already exists in @GTM's own words (Signal 14:28 EDT 29Sep2026, relayed to this channel as `aab18e9f`, 2026-09-30T13:53:29Z). Quoted, not paraphrased:
+
+> ```
+> @[♾️] @PLT (Dilonne Muchingami) | Please #FastTrack deployment of Baserow.io as a POC for WeOwn.Dev ... we will use sub-domain Baserow.WeOwn.app
+>
+> I want this deployed in the NEW v5 DOKS that @[♾️] @SHD (Shahid) deployed in ATL1 / MEM1 #DigitalOcean data centers.  This will also be a great time to do #PeerReview of his deployment.
+>
+> Baserow will likely be THIRD #SharedBrain PILLAR for our WeOwn.Cloud #HybridArchitecture for #ResponsibleAgenticAI
+> 1) Supabase (Database / OAuth)
+> 2) ownCloud (Cloud File Storage)
+> 3) Baserow (Database with great UX/UI for non-techies)
+>
+> I have created a NEW POC CHANNEL within FELG.WeOwn.Buzz to drive our execution strategy.
+> ```
+
+**Three separable whys — kept apart, per the review contract:**
+
+| # | Why | Verbatim anchor |
+|:-:|:--|:--|
+| **W1** | **Fast-track a POC for WeOwn.Dev** — an evaluation, not a purchase, not an adoption | *"Please #FastTrack deployment … as a POC for WeOwn.Dev"* |
+| **W2** | **#PeerReview of @SHD's NEW v5 DOKS cluster** — the POC is the first real workload on the new ATL1/MEM1 deployment | *"This will also be a great time to do #PeerReview of his deployment"* |
+| **W3** | **Candidate pillar ③ of the #SharedBrain** — under `WeOwn.Cloud` #HybridArchitecture, for **#ResponsibleAgenticAI** | the numbered 3-pillar list |
+
+> ⚠️ **W2 is the why easiest to drop.** It is a second deliverable riding the same deployment. This doc carries it (§6.3); a POC report that covers only W1+W3 is incomplete.
+
+---
+
+## 2 — WHY a POC at all (and why now)
+
+**The thing under test is not "does Baserow have features."** It is: **can WE run it in OUR data plane, and does the free tier carry OUR responsibilities.** Neither question is answerable from a pricing page. Both are load-bearing because the target is a **cooperative that must own its own data**.
+
+| Test | Question | Why it can only be answered by a POC |
+|:--|:--|:--|
+| **A — our data plane** | Does the pinned chart run on the v5 DOKS (ATL1 / MEM1) inside our DNS, TLS, object-store and email posture? | ATL1 and MEM1 are **not interchangeable** (W38 D5, re-confirmed W40 D7): Spaces/Registry/Managed PostgreSQL exist at **ATL1** and are **absent at MEM1**; Volumes · NFS · LB · VPC-peering exist at both. Region choice changes the architecture. |
+| **B — the free-tier ceiling** | Does "Always Free" carry what a #ResponsibleAgenticAI data pillar actually needs? | Unlimited data is genuinely free; **the governance layer is not** (§4). That tension can only be measured against real co-op workloads, not a compare grid. |
+
+**Why now — and an honest scheduling fact.** The channel description carries, verbatim: *"STATUS UPDATE {04Oct2026} - This is @PLT P0 Priority to implement 1st week of #WeOwnSeason005 {2026-W41}"*. Today is **W42 D4** ⇒ the item is **past its own stated week** while still P0. Stated, not swept.
+
+---
+
+## 3 — WHY Baserow (vs the audited alternatives)
+
+**The gap it fills is NOT "a database."** Supabase is already the co-op's Postgres/DB-OAuth pillar. The gap named at origin is narrower and human:
+
+> **"Database with great UX/UI for non-techies"** — @GTM, verbatim.
+
+Division of labour across the three pillars: **① Supabase = the builder's DB/OAuth spine · ② ownCloud = files · ③ Baserow = the surface a non-technical owner/co-op member can actually operate.**
+
+### 3.1 Why Baserow specifically — the honest case
+
+| # | Reason | Receipt |
+|:-:|:--|:--|
+| 1 | **Named at origin** as the pillar-③ candidate for exactly the non-techie-UX gap | `aab18e9f` (§1) |
+| 2 | **MIT Expat core** — permissive, no licence paywall on the code we self-host | `LICENSE` read (W40 D3, 2,092 B) · only `premium/` + `enterprise/` are separately licensed |
+| 3 | **The agent seam is in CORE** — MCP server ships free, so an agent-addressable DB survives the paywall | source tree `backend/src/baserow/core/mcp/` (W41 D3) · MCP doc §5.1 |
+| 4 | **First-party Helm chart bundles the stack** (PostgreSQL · Redis · MinIO · Caddy) — one packaging path onto our DOKS | chart **1.1.1** / appVersion **2.4.1** (§5.1) |
+| 5 | **Already half-wired**: domain decision, DNS posture, SMTP interim path all settled in this channel | W41 D1 · W41 D4 (§6) |
+
+### 3.2 Why not one of the alternatives (licence floor only — no runtime test)
+
+The alternatives scan (W41 D3, own GitHub/LICENSE reads) verified **licence + liveness only**. None has been runtime-tested; the same free-tier feature-gating question must be checked per candidate before any adoption.
+
+| Project | Licence (own read) | vs Baserow |
+|:--|:--|:--|
+| `gristlabs/grist-core` | **Apache-2.0** (clean) | different product shape (spreadsheet-Python, not Airtable-parity) |
+| `appsmithorg/appsmith` | **Apache-2.0** (clean) | internal-tools builder, not the named UX gap |
+| `teableio/teable` | **AGPL-3.0** + MIT packages | closer shape; no origin mandate |
+| `Budibase/budibase` | GPLv3 overall, **BSL** for `/packages/pro` | paid tier under BSL |
+| `nocodb/nocodb` | **Sustainable Use License — NOT OSI** | licence-paywalled shape |
+| `directus/directus` | **MSCL-1.0-GPL — NOT OSI** | licence-paywalled shape |
+| `makeplane/plane` (CE) | **AGPL-3.0** (OSI) | Kanban free in CE, but **12-seat cap** + SSO/RBAC tiered → moved to **#POCList** (`8b3b5f7c`) |
+
+⇒ *"Open source no-code DB"* is **not a licence guarantee** — two of the biggest names have left OSI. Baserow's core stays MIT; its extraction is a **runtime** paywall, which is a different shape from a **licence** paywall (and the shape @GTM matched to n8n — §4.2).
+
+---
+
+## 4 — WHY it matters for #ResponsibleAgenticAI
+
+This is the core of the ask. The link is argued by **mechanism**, not asserted.
+
+### 4.1 The agent seam is NOT paywalled
+
+Baserow ships an **MCP server in the CORE package** (`backend/src/baserow/core/mcp/` + `contrib/database/mcp/`, W41 D3 source-tree read; doc live at `baserow.io/user-docs/mcp-server`, §5.1). Free tier ⇒ agents can list/create/update/delete rows conversationally against the free edition.
+
+| MCP capability (doc verbatim) | |
+|:--|:--|
+| Create rows · Delete rows · Get table schema · List databases · List table rows · List tables · Update rows | clients: any MCP-spec client (Claude Desktop · Cursor · Windsurf …) |
+
+### 4.2 Baserow's MCP design independently encodes our #ResponsibleAgenticAI pattern
+
+From the MCP doc's own Security best practices + FAQ (§5.1 receipt):
+
+- one **unique URL per endpoint** = a credential scoped to a workspace; *"Treat this URL as a password."*
+- *"Create separate endpoints for different use cases"* · *"Use descriptive endpoint names to track usage"*
+- *"Each team member must generate their own unique MCP endpoint"* — no shared endpoints
+- multiple endpoints per workspace, each with **independent access controls**
+- **revocation = delete the endpoint; the old URL stops working**
+
+⇒ **least-privilege · per-use-case credential · attributable · revocable.** The same enforcement shape this ecosystem already applies (per-agent keys, revoke-not-rotate). Named as *convergent*, not as our requirement being met by accident.
+
+### 4.3 Self-hosting the AI path = infrastructure sovereignty
+
+`baserow-ai-security` (own pull, §5.1) carries a **Self-Hosted Environment** section: direct-to-provider connection · air-gapped & local AI (Ollama) · granular retention control · abuse monitoring · API key safety (*"infrastructure sovereignty"*); plus **BYOK architecture** and **no training on customer data** (their provider APIs).
+
+⇒ For a co-op that must own its data: **BYOK + optional local model = the AI path can stay inside our boundary.**
+
+### 4.4 ⚠️ The honest counterweights — the real tension of this POC
+
+| # | Counterweight | Consequence |
+|:-:|:--|:--|
+| 1 | **MCP grants destructive power by default** — the capability list includes **Delete rows**; Baserow's own limitation text: AI interpretation is probabilistic, *"Always verify critical operations, especially bulk updates or deletions."* | An agent-addressable DB is an **agent-destructive** DB unless the governance layer is present |
+| 2 | **The governance layer is `Advanced`, not free** — RBAC · field/view permissions · teams · **SSO (OAuth2/SAML)** · audit log all sit behind a licence | The part #ResponsibleAgenticAI most needs is exactly what "always free" removes |
+| 3 | **§7.2 "no training" does not transfer to us** — those commitments describe **Baserow's own** provider APIs. Under **self-host + BYOK** the provider relationship is **ours** | Do not claim Baserow guarantees no-training for our self-hosted traffic; that becomes **our** contract with the provider |
+| 4 | **No instance is deployed.** Every claim in this doc is a document/source/registry read | Nothing here is a runtime result (§7) |
+
+**State the tension; do not resolve it in this revision.** Resolution is the POC's job (§8).
+
+### 4.5 Build the PIPELINE + #ZeroTo100
+
+| Thread | How this POC serves it |
+|:--|:--|
+| **Build the PIPELINE** | Pillar ③ completes the #SharedBrain data triangle (Supabase DB/OAuth · ownCloud files · **Baserow non-techie DB UX**), which the AOP.biz/WeOwn.Dev agent pipeline writes into. A POC de-risks one of the three legs before the pipeline depends on it. |
+| **#ZeroTo100** | Zero → a verified, running, self-hosted Baserow on our DOKS with our DNS and our email posture — measured against the free-tier ceiling. The POC is the 0→1 leg; production hardening is the 1→100 leg, gated on the exit decision (§8.4). |
+| **#ResponsibleAgenticAI** | The data pillar an agent can address (MCP, §4.1) **and** a human can operate (UX, §3) — with the governance cost of doing so honestly named (§4.4). |
+
+---
+
+## 5 — Verified facts (receipts)
+
+### 5.1 Upstream pin — DOCUMENT version vs PRODUCT version
+
+| Field | Value | Receipt |
+|:--|:--|:--|
+| **This document** | `v5.42.4-r1` = WeOwnVer (S005 · W42 · D4 · r1) | `GUIDES/WEOWNVER_DAILY_ROUTINE.md` slot legend |
+| **Upstream product** | **Baserow `2.4.1`** | GitLab tags (own pull 09:31:28Z): newest `2.4.1`, commit created_at `2026-10-13T17:10:59+02:00` · sha256 `f4af549e…302f` |
+| **Helm chart** | **`1.1.1`** / appVersion **`2.4.1`** · index generated `2026-10-13T15:25:39Z` | 🐝 pull 09:28Z (`d3c6fbf7…7e98`) · corroborated by GitHub releases `2.4.1` published `2026-10-13T15:39:27Z` (own pull, sha `2f153eae…dee`) |
+| Running version on `baserow.weown.tools` | **not probed** | scoped negative (§7) |
+
+⚠️ Treating `5.42.4` as a Baserow release is a **fail** — it is the document stamp only.
+
+### 5.2 What "Always Free" actually gives (W41 D3, pricing grid + source split)
+
+| ✅ INCLUDED (free, self-host) | ⛔ GATED |
+|:--|:--|
+| Unlimited DBs · rows · storage · row-change history · **automation credits** · **no self-host rate limit** · **unlimited users** | **Premium**: Kanban · Survey · Calendar · Timeline · personal views · AI field · row comments/coloring |
+| Views: **Grid · Form · Gallery** · custom dashboards · public sharing | **Advanced**: **RBAC** · field/view permissions · teams · **SSO (OAuth2/SAML)** · audit log · data sync |
+| 2FA · snapshots · CSV/Excel/XML/JSON import · 20+ field types | **Enterprise**: co-branding · data scanner · secure file serving · custom scripts |
+| **MCP server · Kuma AI · AI agent node (all CORE)** | — |
+
+Vendor FAQ verbatim: *"The self-hosted version will never have row, storage, or API request limitations. It will always be unlimited and free."*
+
+⇒ **What "always free" removes is exactly the governance layer (SSO/RBAC/audit) plus view variety.** For a #ResponsibleAgenticAI DB, governance is the part we would most likely want. **This is a cost of the free tier, stated, not resolved (G8).**
+
+### 5.3 The open-core / n8n tension (named, not minimized)
+
+@PLT (`4329065b`, 2026-10-07): *"Baserow's self-hosted open-source edition paywalls SSO and Kanban and some other stuff such as role-based access control (RBAC) … With our anti-extractive SaaS model we probably need to rethink Baserow."* — **verified true**: Kanban lives entirely in `premium/` (zero Kanban code in core); SSO/RBAC live in `enterprise/`, runtime-gated by licence key.
+
+@GTM (`9be98eaa`): *"similar pricing model to n8n.io … I personally am MOST INTERESTED to see how much VALUE we can get out of the 'Always Free' open source tier."* — the n8n precedent (same open-core pattern ⇒ de-prioritized) is why **this is a POC with an exit decision, not an adoption**.
+
+---
+
+## 6 — Settled decisions folded (W40 D3 → W41 D4 — do not re-derive)
+
+| # | Decision | State | Source |
+|:-:|:--|:--|:--|
+| 1 | **Domain = `baserow.weown.tools`** (Cloudflare `weown.tools` PRO zone) — supersedes origin's `Baserow.WeOwn.app` (DO DNS) | **decided** | GTM `9972eff6` (2026-10-05) · W41 D1 |
+| 2 | **3 hostnames, DNS-only** — `baserow` (domain) · `api.baserow` (backendDomain) · `objects.baserow` (objectsDomain, gated on `minio.enabled`); proxying breaks the chart's DO-LB TLS-passthrough + Caddy ACME; records must resolve **before** `helm install` | **decided** | W41 D1 · chart recipe |
+| 3 | **Kanban goal → 🪽 Hermes Agent**, NOT Premium Kanban | **decided** | GTM `8b3b5f7c` (2026-10-07) |
+| 4 | **plane.so → #POCList (S005)** | **decided** | GTM `8b3b5f7c` |
+| 5 | **AOP.biz will NOT use SSO** | **decided** | GTM `8b3b5f7c` |
+| 6 | **"sign up" removed → invite-only** — *"we are the gatekeeper for every account"* | **directive — NOT verified done** | GTM `a3b4179b` |
+| 7 | **SMTP: Proton interim → Twilio (SendGrid) target** — `weown.net` is already SendGrid-domain-authenticated (`s1/s2._domainkey` → `u111720651.wl152`), DMARC `p=quarantine` | **decided; wiring open** | GTM `cc34d339` (2026-10-08) · W41 D4 |
+| 8 | **Chart pin `--version 1.1.1`** (app 2.4.1) — and the traps **persist** in 1.1.1: `bitnamilegacy/*` frozen images (ImagePullBackOff risk) + `mc anonymous set download` on the `baserow` bucket | **decided + traps named** | W40 D7 · 🐝 §5.2 |
+| 9 | **Object store:** MinIO → **AIStor** rename; `minio/minio` archived; frozen image still pullable | **known constraint** | W40 D3 |
+| 10 | **Region matrix:** ATL1 = full data plane (Spaces/Registry/Managed PG); **MEM1 = no Spaces / no Managed PG** ⇒ self-hosted PG + Redis + object store on Volumes/NFS | **architecture-shaping** | W38 D5 · W40 D7 |
+| 11 | **SME = @PLT** · **P0** · stated window = S005 W41 (now past — §2) | **standing** | channel description |
+| 12 | **Licence mix of the #SharedBrain stack:** Supabase Apache-2.0 · ownCloud **AGPL-3.0** · Baserow **MIT Expat** · MinIO **AGPL-3.0** — AGPL is already precedent via ownCloud | **known** | W40 D3 |
+
+---
+
+## 7 — Scoped negatives — what this doc does NOT claim
+
+| ❌ Not claimed | Why |
+|:--|:--|
+| "The POC is deployed / running" | No instance deployed in any record; all results are document/source/registry reads |
+| "Baserow guarantees no training on our data" | Their §7.2 covers **their** provider APIs; self-host + BYOK ⇒ the contract is **ours** (§4.4-3) |
+| "The free tier is enough" | Enough for **data + agent access**; **not** enough for **governance** (RBAC/SSO/audit = Advanced) |
+| "MCP is safe by default" | MCP includes **Delete rows**; Baserow's own guidance requires human verification of destructive ops |
+| "ATL1 == MEM1" | Different data-plane feature sets; region choice changes the architecture |
+| "Email works" | Proton is the **interim**, Twilio is the **target**; SMTP wiring + token mint are open items (§9) |
+| "Sign-up is disabled" | A **directive** (`a3b4179b`), not a verified state |
+| Any running-version claim for `baserow.weown.tools` | Not probed |
+| Any byte count on a rolling page | Pricing/docs pages move between reads; cited by sha + clock |
+| Any CCC-ID minted by this seat | CCC-ID = 🐳 lane (R-194); referenced only |
+
+---
+
+## 8 — POC charter — test plan, success criteria, exit decision
+
+### 8.1 POC question
+
+> **Can the Always-Free self-hosted Baserow OSE serve as #SharedBrain pillar ③ — a database a non-technical co-op member can operate AND an agent can responsibly address — running on our own v5 DOKS, inside our DNS/TLS/email posture, at a governance cost we accept?**
+
+### 8.2 Test plan
+
+| # | Test | Method | Answers |
+|:-:|:--|:--|:--|
+| T1 | **Deploy** | `helm install` pinned chart **1.1.1** on v5 DOKS (region per §6-10 decision) with `baserow.weown.tools` 3-hostname DNS-only recipe; decide BYO vs bundled (bitnamilegacy trap named) | W1 · Test A |
+| T2 | **Peer review** | Review @SHD's v5 DOKS deployment as the host platform (origin W2) | **W2** |
+| T3 | **Free-tier value** | Exercise Always Free against real co-op workloads for 2 weeks: databases, forms, dashboards, automations, portals | Test B · GTM's live question |
+| T4 | **Agent seam** | Connect one MCP client per endpoint (per §4.2 credential discipline); run list/create/update against a scratch database; **verify destructive-op gating manually** | §4.1 · §4.4-1 |
+| T5 | **Governance probe** | Attempt the collaboration patterns we actually need (read-only member, attributable edit history, invite flow) and record **exactly which fail behind Advanced** | §4.4-2 (the tension) |
+| T6 | **Email posture** | Invite delivery through Proton interim; prepare Twilio target (DKIM already live) | §6-7 |
+
+### 8.3 Success criteria
+
+| # | Criterion | Measure |
+|:-:|:--|:--|
+| S1 | Runs on our DOKS | Pinned chart healthy at `baserow.weown.tools`, TLS via Caddy ACME, DNS-only |
+| S2 | Non-techie operates it | @PLT (SME) + one co-op-level user complete a real task without SQL or a developer |
+| S3 | Agent addresses it safely | MCP client CRUD against a scratch DB, with per-endpoint credentials + one documented revocation |
+| S4 | Governance cost measured | T5 findings written up: every failed collaboration pattern named, with the licence row that gates it |
+| S5 | Email delivers | Invite lands in inbox via Proton interim (target Twilio prepared) |
+
+### 8.4 Exit decision (options — @GTM R-011 owns the pick)
+
+| Option | When it wins |
+|:--|:--|
+| **E1 — ADOPT on Always Free** | T5 shows the governance gap is tolerable for POC-phase collaboration (invite-only + gatekeeper accounts cover it) |
+| **E2 — ADOPT + buy Advanced** | RBAC/SSO/audit prove load-bearing and the per-user price is accepted against the anti-extractive posture |
+| **E3 — REPLACE** | T3/T5 fail and an audited alternative (Grist/Appsmith/Teable/plane-CE) passes the same tests — note none is runtime-tested yet (§3.2) |
+| **E4 — DROP pillar ③** | The non-techie UX gap is better served by staying on Supabase + ownCloud alone |
+
+---
+
+## 9 — Open items
+
+| # | Item | Owner | State |
+|:-:|:--|:--|:--|
+| 1 | **R-011 on this POC doc** (review → finalize → accept) | @GTM | ⬜ open |
+| 2 | **Deploy decision**: region (ATL1 vs MEM1) + bundled vs BYO object store | @GTM · @PLT · @SHD | ⬜ open |
+| 3 | **Sign-up-off implementation** (directive `a3b4179b` → verified state) | @PLT | ⬜ open |
+| 4 | **SMTP token mint** — Proton interim sender (`noreply@`/`baserow@weown.net`) + Twilio account alignment (`u111720651` vs `u112197143`) | @GTM · @PLT · @MWK | ⬜ open |
+| 5 | **Re-baseline the P0 window** (stated W41; today W42 D4) | @GTM · @PLT | ⬜ open |
+| 6 | **SOT path + target repo** for this doc (predecessors disagree: `WeOwnBuzz/s004 :: _CHANNELS_/` vs `WeOwnSeason005/pocs`) | @GTM | ⬜ ruling |
+
+---
+
+## 10 — Provenance & review status
+
+| Field | Value |
+|:--|:--|
+| Drafter | 🌾 CCC-MAIT-S004-GTM-MiMo (Xiaomi MiMo-V2.6-Pro) — lane **[1.1]** |
+| Backup pen | 🛡️ CCC-MAIT-S004-GTM-GLM — lane [1.2], activates only on declared unresolved errors |
+| Review panel | 🐝 + MC-BA-CCC-META + CCC-GTM-CORE6 (🐳 💻 🛡️ 🟩 🚀) — bar = 🐝 contract G1–G10 |
+| CCC-ID | 🐳 lane (R-194) — **this seat never mints** |
+| Review state | **DRAFT v0.1 posted for REVIEW** — gate ② open |
+| R-011 | ⛔ **NOT charged** (#127 — stage only) |
+
+<!-- CONTENT-HASH-BOUNDARY -->
+### ✅ BP-075 CANONICAL HASH — 🌾 DRAFT v0.1 [drafter-minted · bp075_canonical_v2 · stage-only, never push | #HITL by @yonks at 04:28 EDT on 15Oct2026]
+Content-SHA256: 97f8a5a507c522fad0f7dc57c50d3875de407c19984b65a8625644d4771dd72d
+FEDARCH-CANARY: 97f8a5a5
+CHARACTERS: 23723
+WORDS: 3711
+LINES: 313
+
+---
+
+**♾️ WeOwnNet 🌐 [DUNA][.OCA] Ecosystem** ● 🏡 Real Estate and 🤝 cooperative ownership for everyone ● An 🤗 inclusive community, *by 👥 invitation only*.