The Roadmap

A safety barrier so anything the system reads can never be mistaken for instructions telling it what to do. It warns rather than blocks, so work keeps moving.

Audited content is data, never instruction. The shipped fence design becomes code: run-scoped nonce boundaries around every untrusted block, tool results fenced at the executor loop, and authority-flavoured framing demoted. The fence warns and demotes; it never gates.

Every audit already pushes raw file bodies and website HTML into prompts unfenced, and one target-writable file is currently framed as judging authority. It is the highest-value safety work in the queue, and it is deterministic code only: no model spend, no new authority.

A chat screen that picks the right AI model for each request, under the same safety rules as everything else. The design is shipped and reviewed, with the build cut into slices.

A Studio chat tab riding the same guardrails: explicit pick, vendor-pinned auto, or full Auto through a pure two-stage router, with metered API calls and subscription CLIs as parallel execution classes. Design shipped and adversarially reviewed; four build slices cut.

Alerts and a read-only status page on my phone over a private secure network already work. The next step is approving or rejecting an item from the phone, with the same checks as at my desk.

Push notifications and a read-only mobile triage page over the tailnet already shipped. The gated next step is the first off-machine write: approve or reject an inbox item from the phone, issuing the same grant object through the same path as the desk.

The system runs scheduled work on its own. Approval is tied to the exact schedule I approved, so any edit switches it off until it is re-approved, and it can never queue up decisions faster than I review them.

Schedule, enqueue, auto-drain. Arming a schedule is a recorded act bound to its content hash, so any edit disarms it, and a decision-debt cap stops the machine generating decisions faster than the human reviews them.

Self-sovereign nodes pushing observability to a read-only centre. The centre never approves, never applies, and holds no authority channel back to a node: a fleet you can watch, not one you command.

A browser page that can make changes, wrapped in the same approval steps as everything else. Even software running on the same computer is treated as untrusted, and anything opened away from the machine can only look, never change.

An authenticated local write API terminating in the existing freeze, simulate, approve, apply spine. Localhost is treated as hostile-caller territory, and a link opened off-machine may reach a triage read at most, never the write API.

Mine run metrics, dispositions, and verifier verdicts for per-workflow signal, then feed it back into prompt, model, and route selection. Descriptive first: nothing changes agent behaviour without its own gated slice.

A code-owned registry of every user-state domain: settings, target registries, memories, skills, commands. Exports to a git-tracked repo with a fail-closed secret scan before anything leaves the machine. Config can narrow the export, never widen it.

Every audit gets the same controlled slice of my working context, and every use of it is traced in the report. It is the first step towards the system remembering context between runs.

The gateway serves a server-owned slice of operator context to every audit workflow: no default slice, no client-picked files, every injection traced in the report's evidence. The first concrete memory-over-MCP step: memory informs, the spine decides.

Quality per workflow measured on a fixed task set with bounded spend and a results ledger. Which model actually audits better, with receipts.