The Roadmap

Unattended operation is live. Schedules are committed config with no enabled field: enablement is a recorded act, hash-bound to everything the schedule references, so any edit disarms it. Nothing ticks until four spend caps are set by hand, because the caps file ships blank and unbounded is a state the code refuses. The decision cap counts what the night puts in front of me by morning, not what it spends, and every due tick ends as ran, skipped or capped, never silence.

The accountability sweep behind it just landed: a mistyped flag no longer buys a model call (it is refused, naming the near miss), a solo agent run finally writes a run record, and a census of all eighteen CLI entry points forces every path to declare where its spend lands. Three metered paths still record nothing, and closing them is the row in flight rather than a footnote.

A Studio chat tab under the same guardrails as everything else: explicit pick, vendor-pinned auto, or full Auto through a two-stage router, with metered API calls and subscription CLIs as parallel execution classes. The design is shipped and adversarially reviewed, with the build cut into four slices.

Push notifications and a read-only mobile triage page over the tailnet already work. The next step is the first off-machine write: approve or reject an inbox item from the phone, issuing the same grant through the same path as the desk.

Shipped in two increments: first the schedule and the arming act with nothing allowed to run, then the tick loop under four hand-set spend caps. A tick is keyed to a calendar date rather than an instant, so daylight saving cannot fire it twice or never, and a machine off for a week can name exactly which nights it missed. What remains is 5G.3: seeing and arming schedules from Studio rather than the CLI.

Several machines, each running its own copy, push what they are doing to one place I can watch. The foundation shipped in July: node identity, the push publisher, and a centre that can only look. It never approves, never applies, and holds no authority channel back to a node: a fleet I can watch but never command.

A five-model Ollama fleet, running on my own machine, costing nothing per use, observed and warmed from Studio > Models. Its first real job shipped: a local embeddings index over the project's own docs, searched from the assistants' tools at $0 a query, storing vectors and never corpus text. Pipeline participation stays refused: the stage-scope rule was ruled, and the answer is still no.

A browser page that can make changes, wrapped in the same freeze, simulate, approve, apply spine as everything else. The read surface shipped, and the write-session foundation shipped with zero verbs on it. Even localhost is treated as hostile-caller territory: the first real write verb is its own gated row.

Declarative workflow authoring, designed and adopted: behaviour is code, selection is data. A definition may choose which code runs and in what order; it can never determine what any code does, and every definition needs a live accept act binding its content hash. It is also the row that hardens the factory claim: once the production rules are data rather than prose, the word needs no qualifier.

A code-owned registry of every user-state domain: settings, target registries, memories, skills, commands. Exports to a git-tracked repo with a fail-closed secret scan before anything leaves the machine. Config can narrow the export, never widen it. The design is adopted; the build carries an external review before code.

Every audit now gets the same server-owned slice of my working context: no default slice, no client-picked files, and every use traced in the report's evidence. Shipped across the website audit, the code audit and its challenger, with a Studio panel showing what framed each run. Memory informs, the spine still decides.

A new track drawing one line around egress: adopt the rule that nothing leaves the machine except through named channels, census those channels with locks in both directions, teach the push tool to refuse a foreign remote, and give the client plane a deny set for shell egress. The boundary ruling comes first; the hygiene rows ride behind it.

Quality per workflow measured on a fixed task set with bounded spend and a results ledger, born display-only. Which model actually audits better, with receipts. The design is adopted; the harness waits until it earns its spend.