Engineering

The hard part is making the pieces into one system.

Everything below runs on the same foundation, writes to the same record, and follows the same rules. This is Otto, the platform Pixelion runs its own company on.

If you need a system or platform built, start with services or get in touch.

The system, drawn as one board

Last updated 27 August 2026

Otto’s domains
each domain has its own workflows, built from the machine above plus whatever else it needs.
work arrives in Otto
⏰  a schedule fires
reports, syncs, sweeps, checks
📁  something changes
a file, a record, an inbox, a folder
👤  a person asks
in chat, by email, or in the app
🔗  another system calls
an event from another system, on its own schedule
what does this work actually need?
decided before anything runs
cheap + mechanical task,
or private data
real reasoning required
needs a human’s
sign-off
local model
Used where the work is mechanical rather than hard. Tasks like extraction, classification, scoring and summarising all land here, much of it on a schedule rather than from a person.
A bigger model would be identically correct and enormously more expensive.
It also takes anything whose data cannot leave the machine, where a cloud model is not an option at any price.
Small open models, SLMs like Qwen, DeepSeek and GLM, run on ordinary hardware. Give it a single GPU server and larger open models run here too, fully private.
cloud agents
Frontier models from Anthropic and OpenAI handle most of the work here.
Tasks include writing and refactoring code, research, drafting, and driving a browser.
Work lands here from any trigger, a schedule as readily as a person.
approval queue
Work that needs a signature waits here instead of running on its own, like emailing a customer, making a payment, finalizing a post, or deleting data. A person approves each one, and only then does it run on the cloud agents.
That gate belongs wherever a business already wants a person to decide. Spending over a threshold, anything a customer sees, anything that cannot be undone, anything that has to be signed off for the record.
a contract test fails the build if a feature module reaches a cloud client directly, so the cost routing holds without anyone policing it
approved
Capabilities
It can reach anything a person at a desk can reach.
what it can reach
The browser, a real Chrome on a real profile, so saved logins and sessions already work
The machine fleet, the same reach on other computers over a private mesh, so heavy work runs where the hardware is
The desktop, sees the screen and drives mouse and keyboard, so apps with no API still automate
Servers, its own hosting, so building it and running it are the same job
Accounts, Gmail, Calendar, Notion, Trello, Linear, LinkedIn, anything with a login, so nothing moves to a new system
The shell, runs commands on the machine, so existing scripts join in without a rewrite
Files, read and written directly, and a watched folder turns whatever lands in it into work
how it grows
MCP tools, new capabilities plug in without rewriting the system
The sandbox, third-party skills from marketplaces like ClawHub, contained so untrusted code is still useful
how people work with it
Messaging, Telegram and Slack, both ways, so alerts and replies land where people already look
The web app, each area of work gets its own pages, on the same store the agents use, so people and agents work on one thing
Voice, listens and speaks, so a spoken note or a recording can start work
what it remembers
Memory, past chats and projects stay searchable by meaning, so work picks up instead of being re-explained
what it can make
Media generation, images, video, music and voice
Documents, written from templates and the records already held
Data
Everything it does is written down in one place, on its own machines.
the work it holds
SQL, one source of truth rather than data scattered across a dozen tools
what it has written, every document, export and record it has produced, and the corpus RAG answers from
RAG, retrieval grounds every answer in real documents, cutting hallucination, re-indexed daily
practices
events, every run recorded, one start and one finish, so what happened is never a guess
logging, one format, one place, so finding what went wrong takes minutes
config, the same system runs unchanged in test and in production, settings injected rather than hardcoded
spine
Otto stands on spine, a foundation built once and shared by everything above it.
Everything a system needs before it can do real work lives there, from scheduling and messaging to the model routing, the sandbox, and the record of every run, so no workflow rebuilds any of it.
Guarantees
the same three hold for work nobody is watching
Finance and Admin
The bank, the books and the calendar all stay current on their own.
transaction pipeline
≈ Ramp
reads bank alerts, categorises and books each one, no hand entry
financial reporting
income, expenses, balances and runway, updated as the money moves
calendar + mail
schedules, and sweeps every inbox read-only so nothing is missed
bookkeeping + tax
≈ QuickBooks
receipts, ledgers, filings and year end, current to the last transaction
Content Operations
Music and film made end to end, research through to release.
music pipeline
research, hooks, verses and the finished track, so a song is written and produced, not just generated
film pipeline
characters, scripts, cinematic video and publishing, so a film goes from idea to released in one place
content intelligence
≈ Sprout Social
the topics, formats and timing that are working
brand design
the brand kept as one system, so every asset and template comes from it rather than being remade each time
Distribution
How everything published is performing, across every channel.
YouTube analytics
views, watch time, retention and subscribers, pulled into one view on a schedule
TikTok + Instagram watch
saves, shares, reach and post times from both platforms, in one place
SEO watch
≈ Ahrefs
monitors rankings and pages so a drop is seen the day it happens
publishing
≈ Ghost, Substack
drafts, scheduling, the send and the subscriber list, one article at a time
Sales
The whole path to a paying customer runs in one place.
CRM
≈ HubSpot
people, threads, interactions and follow-up dates, in one record
prospecting
≈ Apollo
a list of companies worth approaching, and the right person inside each one
proposals
incoming requests, the ones that fit, and the proposal written for each
Testing
A change is safe when the build says it is.
every change is tested
the suite runs on every push, before anything can deploy
the rules are enforced by tests
the build fails when code breaks them, so the architecture holds without depending on review
tests never touch real data
they generate their own, plus a disposable copy of the real thing when a run needs it, and a guard fails any test that tries
Security
Every part gets exactly the access its job needs.
passwords stay in a password manager
1Password, the browser, or whatever is already in use. The system signs in through it rather than keeping a copy, and only its own infrastructure credentials sit with it
access is separated by purpose
each integration has its own credentials and its own session
third-party code runs locked down
skills from a marketplace get dropped privileges and controlled egress, so code nobody here wrote can be useful without being trusted
Reliability
It keeps itself running, and speaks up when something needs a person.
stays up
catches problems
recovers
automatic restart
processes are watched and brought back the moment they die
safe releases
every deploy is checked the moment it lands, so a broken release is caught in seconds
nothing is silently skipped
a job due while the machine was down runs when it returns, and the same job never runs twice at once
health monitoring
databases, integrations, credentials and machines all checked continuously, so an expired token is caught before a workflow trips on it
alerts
problems and finished work go out over the messaging channels above, so there is no separate dashboard to check
self-tracking
the system files and closes its own issues as work completes
recovery
failed work is retried, long jobs keep partial results and resume where they stopped
backups
every store and output mirrored off the machine, nightly
the same shape fits
customer support, tickets triaged, answered from the documents already held, escalated when they need a person
people and hiring, applications screened, interviews scheduled, onboarding run to a checklist
legal and compliance, contracts drafted from templates, renewals tracked, records kept for audit
inventory and suppliers, stock watched, reorders raised, invoices matched against what arrived
invoicing and payments, invoices raised from the work recorded, chased when late, matched when paid
storefront and orders, the catalogue kept current, and what actually sold visible without hand entry

If you need a system or platform built, start with services or get in touch.