Proof path visual
One compact visual map of the supplied requirement-to-decision flow. It explains the current state; it never executes a graph action.
Intent0 requirements
Verifier0 receipts
PolicyNo dossier
Human decisionReview required
Factory Studio / Graph Ops
Follow the proof path.
A bounded control plane for Product, Mission, Proof, Gate, Trace, semantic lineage, and verified counterfactual repair. Follow the failure, compare every candidate, and understand the winning proof without executing it.
Live Factory telemetry
Connecting to the local workspace.
Current stage, elapsed time, completed stages, and measured telemetry will appear here. Unknown token, cost, and productivity values stay unknown.
Memory Spine · proof-aware briefing
Loading local factsTurn the diff into the next safe proof.
See what changed, why it affects evidence, the smallest next step, and who local Git history observed on the selected work. It is explanatory and read-only: it does not run a proof, recall memory bodies, or authorize a person.
1 · What changedLoading local change facts.
2 · Evidence stateLoading proof state.
3 · Do this nextLoading next action.
4 · Team contributionLoading local Git attribution.
Observed project contributors
Loading bounded local Git history.
Brief refreshes no more than once every five seconds. Live assembly telemetry refreshes separately.
Proof Review · team inbox
LoadingReview the riskiest item first.
Current, stale, and invalid proof reviews stay separate. This queue never infers productivity and never approves work.
Current0
Stale0
Invalid0
Learned regressions0
No current review itemCreate a proof review from a confirmed intent contract.
Revenue · evidence before action
No bundleSee exactly where purchase reality diverges.
Build the monetization lane, replay the observed lifecycle, challenge every failure path, and invalidate only conclusions touched by policy drift.
Build contractNo hash-bound bundle
Purchase replayNo build-bound replay
Failure matrixNo negative-path evidence
Policy watchNo source comparison
TestFlight inboxNo authorized local export
Human decisionUnknowns and mismatches block green; provider writes remain locked.
No generated bundle yet. App Store writes, pricing, offers, experiments, and publication remain locked.
SaaS Reality · provider neutral
No receiptDid login, payment, and permission agree?
Trace an observed OAuth/OIDC identity through tenant authorization, checkout, verified webhook, entitlement, feature access, and revocation. Clerk, Auth0, Okta, Entra, Cognito, Supabase, Firebase, and other compliant providers use the same evidence contract.
IdentityIssuer, audience, active token, and PKCE contract
AuthorizationSubject, tenant, and role binding
EntitlementPromise, SKU, webhook, and access order
RevocationCancel, refund, and expiry must remove access
No hash-valid receipt. Unknown evidence stays blocked; no provider is contacted or mutated.
AppForge + SaaS · mission control
Init + 4 evidence lanesImprove your app before Apple finds the gap.
Start with one plain-English mission and one exact build. AppForge binds user design input, strict UI and accessibility evidence, SaaS reality, policy applicability, and current-build media without placing secrets in Code Factory. A supervised agent may prepare the packet; only a named human can authorize the final Apple handoff.
1 · MissionWho the app serves and what they need to accomplish.
2 · TensionWhich design, policy, or runtime gap could delay review.
3 · GuidanceThe smallest exact evidence needed to resolve it.
4 · AgencyYou choose human-controlled or supervised preparation.
5 · TransformationUnknowns become verified facts or visible blockers.
6 · Ready handoffA sealed receipt and named approval unlock one exact next step.
Use a keychain item or environment-variable name. Raw keys and passwords are refused.
Your review pathConnect references
Classify every policy
Import current-build evidence
Resolve every blocker
Review what changed
Authorize one exact handoff
Classify every policy
Import current-build evidence
Resolve every blocker
Review what changed
Authorize one exact handoff
Locked: App Review, Store media, SaaS lifecycle, and strict quality-audit receipts must match the same candidate before AppForge issues the final Markdown/PDF dossier. A separate named, expiring human authorization is still required for any Apple handoff. This page never receives raw credentials or silently submits an app.
Journey Proof · repair supervision
Loading receiptsChoose who may attempt the repair—not who may approve it.
Human-controlled mode only verifies a prepared repair. Supervised-auto mode permits one bounded local agent command, then independently audits its identity, command, workspace delta, scope, positive proof, and negative mutation. Neither mode grants final approval.
0 verified receiptsNo Journey Proof receipts are loaded. The controls create an inert template only; they never start an agent or approve a repair.
Final approval is always withheld. Run the copied manifest through factory journey heal-verify in a separately reviewed terminal.
External runtime · observed evidence
Loading observationsWhat did the runtime runner actually observe?
Inspect imported TestSprite-shaped or other provider evidence beside local proof. This view separates observed facts from hypotheses and keeps every execution, repair, merge, and release control locked.
Next local review
Review before repair
Inspect the first failed step and hypothesis before admitting a bounded local proof. No automatic repair is available.
review_external_runtime_failureObserved-only boundary. No external runtime evidence is loaded.
Forge receipt · intent trace
Loading traceabilityDid the shipped work honor the sealed intent?
This is a local, read-only projection of the newest Forge ship receipt. It shows the intent hash and obligation result without treating a receipt as execution or approval authority.
Fail-closed boundary. No local Forge ship receipt has been projected; intent traceability is unverified.
Nodes
—Edges
—Evidenced
—Lineage runs
—Forensic findings
—Repair candidates
—Graph status
LoadingLocal facts
Evidence health
Deterministic ratios from this bounded graph result, not estimated productivity or a quality score.
—evidenced
Requirements—
Policy drift—
Blocked gates—
Portfolio planning · read only
LoadingPortfolio Flight Plan
See the structural critical path, safe parallel waves, shared-proof candidates, and blocker chains before selecting a separate, approved harness.
Critical path—
Safe waves—
Blocker chains—
Shared candidates—
TimingNot measured
Sequenced workset
Blocks propagate visibly; every runnable item still requires independent verification.
Safe parallel waves
These are proposal-only groups. They do not start work or authorize proof reuse.
Shared proof candidates
Sealed admission posture
No sealed admission packet has been projected from this workspace.
Locked: export and re-verify a time-bounded packet with a separate harness. Graph Ops cannot execute a wave, approve, repair, merge, publish, deploy, sign, message, access credentials, or grant a connector.
ProofSearch · Counterfactual Arena
Winner verified · apply lockedWhich repair is smallest and actually proven?
Every candidate is hash-bound, scope-checked, independently proven, mutation-tested, and ranked by one deterministic ordering.
Winner rationale
No evaluation loaded.
Execution controls
Inspect, export, and validate the decision here. Applying code, merging, publishing, and deploying require separate authority.
Locked: ProofSearch has no workspace-mutation, approval, merge, publication, or deployment authority.
Evidence Frontier · proof-guided loop
Next evidence · execution lockedWhat should you prove next?
Rank supplied, non-executing experiments by exactly how many viable repair pairs they separate. Predictions are hypotheses, never proof or execution authority.
Evidence decision
No sealed Evidence Frontier loaded.
Execution controls
Copy, export, and validate the plan. A separate approved runner is required before any experiment may run.
Locked: Graph Ops ranks evidence only; it cannot execute a command, mutate a workspace, or grant approval.
Factory Continuity · Decision Replay
Recall, but verifyWhat prior work is safe to reuse?
Only independently promoted, exact-scope, purpose-bound, non-expired references can influence a future decision. This panel redacts memory references and summaries by design.
Eligibility boundary
No local continuity records loaded.
Human promotion required
Graph Ops can inspect local metadata. It cannot store memory content, promote a lesson, sign evidence, or grant an agent access to a record.
Locked: promotion requires a separate identity, exact purpose, evidence references, and an explicit local CLI action.
Engineering Judgment · human-promoted contracts
Loading decisionsStop rediscovering the same design decision.
Judgment Capsules preserve a scoped engineering decision with an owner, review date, and hash-bound proof obligations. Proposals are not active until an independent human promotes them.
Safety-case boundary
No tracked Judgment Capsules were projected.
Decision controls
Use this board to inspect local decision metadata. A Change Safety Case routes a scoped diff to the named owner only when its proof obligations are bound and verified. Add a human-declared Change Profile to make novelty and attention explicit—this UI never guesses from source code.
Locked: this UI cannot infer intent, promote or waive a decision, execute a repair, approve code, merge, publish, deploy, sign, message, or access credentials.
Earned Autonomy · proof before permission
Loading evidenceAgent supervision board
Each declared agent earns a local, expiring tier from governed run evidence. A severe hollow-test, hollow-validator, or scope-escape result demotes it automatically. Identity remains declared unless an external harness proves it.
Permission boundary
No governed agent evidence has been projected.
Supervision controls
Inspect and verify local evidence here. This screen cannot issue a license, raise autonomy, start a candidate, or grant execution authority.
Locked: licenses are derived from independently verified governed events. Use the explicit local CLI after recording evidence; Graph Ops does not promote an agent.
Verified semantic time travel
Review only · never executes
Why did this graph run change?
Compare sealed state lineage, isolate the first semantic divergence, and preview the smallest recovery branch.
No deterministic concurrency or state anomalies detected.
Changed state
Causal path
Rerun only
Evidence to refresh
Guarded Action Dock
Prepare and validate the recovery locally. Workspace mutation stays locked until a separate signed approval is supplied.
Locked: no named, expiring, signed approval is bound. Graph Ops cannot grant one.
Graph lanes
Loading the authenticated local graph result.
No local evidence path exists yet. Start by compiling a Product Graph, then inspect this view again.
Graph data is read from /api/graph-ops. A separate token-bound local request can record one named authorization or consume one Reality Check authorization. Labels are rendered as text nodes.