Everyone is building you a business brain. Which part should you own?

List the recurring tasks in my business system. For each task, mark: does it touch personal or client data, does it need hard reasoning, and how often does it run. Then propose which tasks a local model on my own computer or VPS should do, which should go to a frontier model, and what must be masked before anything leaves my machine.

1. List the recurring tasks in your business system with the prompt above.
2. Start local with one private, repetitive task such as document summaries. Qwen3.8-27B on a 128 GB Mac or one RTX 5090 is the realistic single-machine option today.
3. Set reasoning to low or medium for routine work, and do not compress models below 4-bit.
4. Keep planning and complex tool work on Claude or ChatGPT, and mask personal data before it leaves your machine.

How popular open models are

Downloads and token share are not the same as business adoption.

What stays local, what goes to the frontier

What if I buy a new computer now?

Checked 26 Oct 2026. Complete computer prices from Apple US, before tax, without monitor or peripherals. These are representative purchase tiers, not a claim that Macs are the only option. The monthly column is purchase price / 36 plus assumed 24/7 electricity at $0.20/kWh and 35/100/180 W respectively. It is an ownership-cost illustration, not a finance or lease payment; EU shop prices and VAT differ. Model sizes below are memory-sizing examples at 4-bit, not measured performance on these configurations.

Linux on a VPS: where is the model actually running?

A CPU VPS can run the agent, memory and scheduling while an API supplies the model; add the API bill below. Small models can also run on a CPU if they fit, but installing Linux or Ollama does not add GPU hardware. Hetzner's catalog price excludes IPv4 and VAT; its public CX23 page was marked unavailable. GPU rows use Runpod Secure Cloud on-demand Pods: no upfront hardware purchase, provider power included. Each total adds 50 GB standard network storage at $3.50/month and 20 GB container disk at $2/month prorated to running time, following the storage rules. GPU allocation must stop outside the 60-hour schedule; an idle running Pod still costs money. Capacity is not reserved.

ChatGPT and Claude subscriptions: what the monthly price buys

Web USD prices checked 26 Oct. These buy included usage with limits, not a dedicated GPU or a guaranteed token quantity. ChatGPT Plus and Pro tiers; Claude pricing and Max details. Taxes and mobile prices may differ.

Metered APIs: three monthly usage examples

A token is a piece of text, not a whole message. M means one million billable tokens; input and output are charged separately. Standard uncached text rates from OpenAI and Anthropic, checked 26 Oct. Short context; excludes batch/cache discounts, tool fees, regional surcharges and subscription credits. Include billable reasoning in output. The same token count does not mean the same result, speed or capability; it also does not tell us how many GPU hours a local model would need.

Check which parts of my business need action for the current PHP2Shell advisories. Use your available MCP tools, saved infrastructure inventory and the business website URLs you already know. Start the checks now with existing authorized read access.

1. Find our websites, self-hosted applications, hosting accounts and relevant connected services. Include containers, bundled PHP and administrative interfaces. Separate systems we maintain from services maintained by a provider. A list of MCP connections is a starting point, not the result.
2. Read the latest official PHP advisories and applicable vendor notices, including the separate 23 October session issue. For each relevant asset, use available hosting, deployment or runtime evidence to establish whether it serves web requests with PHP and whether the running build is fixed. An application's version, HTTPS, a 200 response or a PHP CLI version alone is not proof about the web workers. Verify vendor backports and rollout/restart evidence where applicable.
3. Inspect the relevant settings and available web/WAF, error or process logs through existing authorized tools. Where exposure makes it relevant, review available activity from 17 October 2026 onward and state the actual log coverage. Distinguish probes, blocked or failed attempts and evidence of a successful intrusion. Missing evidence does not prove either a breach or safety.
4. Classify each checked asset as Needs action, Verified patched, Verified not applicable, or Not verified, with the observation, source and check time. Do not classify an unknown provider backend as safe or vulnerable by guessing its technology.

Give me a short verdict, the three most important concrete next actions, and a compact asset/evidence/action/owner table. Complete every reachable read before asking for help. For a blocked check, name exactly which access or observation is missing and who can provide it. Ask one question at a time only when it is necessary to proceed. Do not stop at a document inventory or automatically draft a provider email.

Keep private evidence and credentials out of public outputs. This is a read-only review: do not run exploit tests, change settings, install or update software, or send messages. State precisely what you checked and what remains unverified; do not give an overall safety percentage.

1. Run the prompt in the business brain that already knows your infrastructure and has read access to the relevant tools.
2. Review the evidence for each PHP service, including containers, third-party products and administrative interfaces. Keep unknowns separate from confirmed findings.
3. Prioritize exposed services with missing fixes or credible incident evidence. Assign a specific owner and next action; make any changes through your normal approval process.
4. After an approved fix, check the actual web-serving build, worker rollout and the separate session advisory again. Keep patch evidence and incident findings distinct.

Result: I tried the earlier prompt and got an asset table and a provider-email draft. That is a document-review result, not a live infrastructure check. The revised prompt has not yet been run against my infrastructure.

What happened, and what is actually established?

Checked 26 October against the current primary reports. Dates below follow the source notices; the Sophos correction time is explicitly UTC. A laboratory demonstration, an attack attempt and a confirmed customer intrusion are different kinds of evidence.

Using the work context I have already shared, draft a morning brief with three sections: decisions that need me, work you can prepare, and things that can wait. Give a source for each item. Draft only; ask before any external action.

1. Run the morning brief prompt in a Claude project that already holds your business context.
2. Check every item against its source and keep only what saved you time.
3. In the desktop app, save one environment for your business brain folder and one for your VPS.
4. If your own scripts call the Claude API, look for temperature, top_p or top_k before you upgrade the SDK.

@Google Business Profile Summarize the three most common themes in my recent customer reviews and show my top search keywords for the last month. Separate what the profile data shows from your interpretation. Suggest three improvements and draft one review reply for me to review.

1. Use the personal Google account that manages your one verified Business Profile. In Gemini on the web, type @Google Business Profile and follow the connection prompt.
2. Ask for recent review themes and last month's search keywords. Compare the answer with the actual Business Profile data.
3. Draft one reply or profile improvement. Review it before making a live change.
4. Check the new business landing page and brand tools separately. Connecting Business Profile does not prove the whole hub is available.

Result: 23 October: I enabled the Google Business Profile app in my account in Latvia. The screenshot records its permission step. I have not yet tested its review analysis, performance answers or profile changes, and have not confirmed the broader new business landing page.

Split this question into three parallel tracks: what customers say, what competitors do, and what my own notes say. For each track, return findings with a source and a confidence level. Then merge them into one page: the decisions I need to make, and where the tracks disagree.

1. Keep one long Codex or Work thread per project and return to it, instead of starting fresh with the same context.
2. Move client, HR and finance conversations into locked chats so they stay out of history, search and regular memory.
3. If you try ChatGPT in Chrome, start with read-only questions about open tabs. Hidden instructions in web pages are a known risk when it acts for you.
4. On Pro, run the three-track prompt and check which agent actually finished its part.

Using only the selected sources, create a slide-deck outline for [audience] that teaches [method] in [N] slides. For every claim, cite the source. Then list: (1) statements in my sources that conflict, (2) questions a client would ask that my sources cannot answer, (3) three decisions I need to make. Format the last part as a "Handback" block I can paste into my business system.

1. Let your business brain gather 5 to 20 clean files: the method, FAQs and an anonymised case. Leave sensitive data out.
2. Load them into one notebook. Generate slides or a video with Review on, and paste your style rules in as feedback.
3. Share the notebook with named people, not a public link.
4. Bring client questions, gaps and decisions back into the business brain's log and FAQ.

Where it fits in a business brain

My proposal for dividing the work, not a vendor recommendation.