Fleet Architecture · Honest Answer

What actually needs a Mac

You asked a sharp question: of everything the fleet runs today, what is genuinely 100% locked to a Mac and could never move to a PC plus a browser? Here is the grounded answer, built from an actual inventory of what the fleet uses right now, split two ways: what locks you to a Mac, and what would lock a chiropractor you sell this to to a Mac.

Updated 2026-06-20 · Sage · grounded in a live scan of the fleet codebase
Bottom line
The business system is fully PC hostable. The Mac is required only for a small set of Apple personal conveniences, not for the core system you would sell. Almost everything the fleet does runs on any operating system: the agents, the Telegram comms, the browser automation, the clinic and content work, the schedulers, the credential storage. The only things that genuinely cannot leave a Mac are Apple account features: iMessage, iPhone Mirroring for big Instagram carousels, iCloud, and driving native Mac apps. Every one of those is either a personal convenience or has a non Apple replacement already in use. A chiropractor could run this entire system on a Windows PC plus a browser and need a Mac for nothing essential.

Everything sorts into three buckets

The trap is treating anything Apple flavored as Mac locked. Most of it is not. Here is the honest sort.

Bucket 1 · Truly Mac locked

Cannot move to PC plus browser, full stop

  • iMessage and blue bubble SMS — Messages.app plus the local chat.db plus AppleScript. Apple will not expose this off a logged in Mac.
  • iPhone Mirroring — needed for posting Instagram carousels over 10 slides. Requires a Mac, the same Apple ID, and a paired iPhone.
  • Driving native Mac apps — anytime the fleet has to click inside Messages, Keynote, System Settings, Photos, or Safari for an iCloud session. This needs a real logged in Mac screen (Apple Aqua) and macOS permission grants. It cannot run headless or over SSH.
  • iCloud and the rest of your Apple account — your personal lock in.
Bucket 2 · Looks locked, is not

Apple flavored but has a clean replacement

  • Text messaging — the iMessage lane is Mac only, but plain SMS is not. The TTC line already runs on OpenPhone, a pure web and API service that works on any machine.
  • Instagram posting up to 10 slides — works on the web from any browser. Only carousels over 10 slides force the phone.
  • Service auto start — the Mac uses launchd, but Linux has systemd and Windows has Task Scheduler. Same job, different name.
  • Credential storage — the Mac Keychain is a fallback, but the primary path is 1Password, which is cross platform. Linux has secret-tool, Windows has Credential Manager.
Bucket 3 · Fully portable already

The bulk of the fleet. Runs on any operating system, no Mac involved

  • Every Claude agent — each machine logs in with its own credential, so multiple machines on one account is fine (see the OAuth correction below). The agents are not tied to a Mac.
  • All Telegram comms — the fleet uses the public Telegram Bot API over plain web requests. No Telegram Desktop app, no iPhone. Works anywhere.
  • All browser automation — Chrome DevTools and the agent browser tooling drive Chrome over a standard protocol on any operating system. This is how the fleet touches GHL, ChiroHD, Brevo, SKED, Cloudflare, and Gmail web.
  • 1Password, Codex execution, transcoding, builds, file storage, the free and cheap remote APIs — all cross platform.

The full inventory, item by item

What the fleet uses today, whether it is Mac locked, and what replaces it if you leave the Mac.

What the fleet usesMac locked?Why / replacement
iMessage personal SMS lane
texts to you, blue bubble
Mac onlyMessages.app plus chat.db plus AppleScript. Replacement already in hand: OpenPhone for all SMS, which the TTC line already uses.
Instagram carousels over 10 slides
TTC and VE posts
Mac onlyiPhone Mirroring needs a Mac, the Apple ID, and a paired iPhone. Workaround: post 10 or fewer on the web, or do big carousels on any phone manually.
Driving native Mac apps
Messages, Keynote, System Settings, Photos, Safari for iCloud
Mac onlyNeeds a logged in Mac screen and macOS permission grants. Cannot run headless or off box. Note: most automation targets are web, which is not Mac locked.
iCloud and Apple accountMac onlyYour personal Apple ecosystem. A customer who is not on Apple does not need any of this.
Service auto start
Cloudflare tunnel, web terminal, daily exports, the daemon
MovableUses launchd on Mac. Equivalent on Linux is systemd, on Windows is Task Scheduler.
Credential storage fallbackMovableKeychain is only the fallback. Primary is 1Password, cross platform. Linux secret-tool, Windows Credential Manager cover the fallback.
All Claude agents
Sage, Apollo, Scribe, Forge, Athena and the rest
PortableEach machine has its own login. Runs on any operating system.
Telegram commsPortablePublic Bot API over plain web requests. No Apple anything.
Browser automation
GHL, ChiroHD, Brevo, SKED, Cloudflare, Gmail web
PortableChrome DevTools protocol on any operating system with Chrome.
Codex execution, transcoding, builds, storage, free and cheap APIsPortableAll cross platform binaries and web services.

For you, personally

What actually keeps you on a Mac.

Strip it down and your Mac requirement is almost entirely your own Apple lock in, not the business system:

The honest read

None of those three are the business system. They are personal conveniences. If you were willing to run all SMS through OpenPhone and cap or hand post the rare big carousel, even you could run the whole fleet on a PC and keep the Mac only as an Apple side device. You probably will not want to give up iMessage, and that is fine. The point is that the requirement is a preference, not a technical wall.

For a chiropractor you sell to

This is the question that matters for scaling. The answer is strong.

A chiropractor buying your system is not buying your Apple account. They get the clinic operations, the content engine, the web automation, the agents, the comms. Every piece of that runs on a Windows PC plus a browser. Walk the list:

What a customer would truly need a Mac for: almost nothing

  • Instagram carousels over 10 slides — and even this is solved with any phone, not specifically a Mac.
  • iMessage — only if that specific customer personally wants their own iMessage wired in. Most will not ask.

That is the whole list. This is a selling point, not a problem. You can tell a chiropractor: run it on the PC you already have. No Apple tax, no Mac to buy.

The pattern that scales: agents on the PC, Mac as a remote controlled hands appliance

You do not move the agents onto the Mac. You reach into the Mac from the PC. This is the key unlock.

The old framing said the agents that touch the Mac must live on the Mac. That is not quite right, and your instinct was better. What must happen on the Mac is the execution of an Apple only action, not the brain that decides it. So the architecture is:

The PC

Where every agent lives and scales

Hosts the entire agent fleet with its own Claude login, plus heavy compute: browser workers, transcode, builds, free API helper jobs, bulk files. Headroom for parallel processing, many agents at once, and even running multiple operating systems side by side for experiments or for selling whole setups to other clinics. This is the product.

The Mac mini

A remote controlled hands appliance

No reasoning agent lives here. It just keeps a logged in session awake with a thin hands process: a Claude Code or Codex session sitting in the desktop session, holding the screen and accessibility permissions. A PC agent tunnels in over Tailscale and tells it what to do. That hands process can then do anything on the Mac, the GUI, native apps, the iCloud Drive files, reading the iMessage history file.

How an Apple only task actually runs in this model

An agent on the PC decides it needs something Apple only. It opens a tunnel to the Mac mini over Tailscale and hands the instruction to the persistent hands session already running in the Mac desktop session. That session executes it on the real Mac screen and reports back. The brain scaled on the PC, the hands stayed on the Mac, and you never had to host an agent there.

The one catch to get right

You cannot cold SSH into the Mac and fire GUI clicks. macOS blocks any process that is not inside a real logged in desktop session with screen recording and accessibility permission granted. So two requirements: the Mac stays logged in and awake, and the hands process runs inside that session rather than being freshly spawned over plain SSH. A persistent session that PC agents talk to satisfies both. The fleet already proved this exact pattern with the Argus operator.

After your changes, the Mac is optional day to day

  • Carousels over 10 slides: I deliver the images plus the caption, you paste them in. No Mirroring, no Mac.
  • iMessage: you do not use it. History is still readable by tunneling into the Mac if ever needed. Note: iCloud.com in a browser does not include Messages, but does include Mail, Photos, and Drive.
  • iCloud Drive files: reachable two ways, icloud.com in any browser, or the Mac tunnel.

What is left that truly pins you to a Mac, day to day, is essentially nothing. The Mac becomes a box you reach into only for the rare genuinely Apple only task.

The OAuth correction that unlocks this

You were right and I was wrong, so this is on the record.

I had told you one Anthropic account could only run on one machine. That was wrong, and you caught it. You already run Claude Code across many computers on one account without trouble, because each machine holds its own login credential. They do not share one file, so they do not fight.

The two hour lockout this morning was a same machine problem: about ten agents on the one Mac all sharing the one stored credential, racing to refresh a one time use token. First one wins, the rest get locked out. That is a single file collision on one box, not a multi machine issue.

What this changes

  • The PC can be a real, full agent host with its own login. This is what lets the fleet scale onto the powerhouse and what makes it sellable.
  • Each machine still needs a single writer refresh keeper so the same file race never repeats locally on either box.
  • One open verify before we lock the plan: confirm that two machines refreshing on the same account never rotate each other out. My strong belief is they do not, based on your real world experience and how per device OAuth works.