Architecture

System architecture and design patterns

The Triad

The Cloud

Role: Sync service only

Platform: Vercel + Neon + S3

Functions: Bot config sync, knowledge base distribution, conversation backup

Cost: $18-20/mo

The Nucleus

Role: Primary agent execution

Platform: Flutter + SQLite

Functions: Execute ReAct loop, call Gemini API, execute tools, control robot

Response: 200-500ms

The Body

Role: Physical robot platform

Platform: ESP32 (S3, C3, C6)

Communication: BLE GATT

Latency: <50ms

Local-First Agent Execution

1

USER INPUT

Voice, text, or vision input from user

2

CONTEXT PREPARATION (Local SQLite)

Load conversation history (FTS5), query knowledge base (vector search)

3

LLM INVOCATION (Direct Gemini API)

Send prompt + context, include tool definitions

4

TOOL EXECUTION (Local on mobile)

Blockly tools → BLE commands, MCP tools → JSON-RPC, Built-in tools → Local operations

5

RESPONSE GENERATION

Display text, play audio, update UI

6

MEMORY UPDATE (Local SQLite)

Save conversation, background sync to cloud

Communication Protocols

BLE GATT

Purpose: Flutter ↔ ESP32

Latency: 10-30ms

MTU: 512 bytes

Use: Low-latency motor control

HTTPS REST

Purpose: Flutter ↔ Next.js

Latency: 100-500ms

Format: JSON

Use: Cloud sync only

Performance Targets

Agent Execution

< 500ms total response time

BLE Latency

< 50ms command to motor

Telemetry Rate

10-100 Hz

Storage

< 100MB total app storage

Tool System

Blockly Tools

• Visual programming in web IDE

• Compiled to JSON commands

• Executed via BLE to robot

MCP Tools

• External servers via JSON-RPC

• Weather, calculator, web search

• Executed from mobile device

Built-in Tools

• Knowledge search (File Search API)

• Memory recall/store

• Robot control (BLE)

Security

BLE Security

Pairing: Numeric comparison with 6-digit passkey

Encryption: AES-128-CCM (mandatory)

Access Control: Whitelist mode, MAC filtering

API Security

Authentication: JWT token authentication

Rate Limiting: 100 req/min per user

Validation: Zod schemas, CORS restrictions