Program Board
One page that tells you where the product stands, what we're building next and why, how to try every feature yourself, and which decisions only the founder can make. The repo's EXECUTION-BOARD.md stays the engineering truth; this page is its human mirror, so no context is ever lost between sessions.
Plan-completeness audit: every step in the master plan §4 has a board row and a status; Stage 2/3 are deliberately frozen until the Stage-1 demo checkpoint (the one-wave law); every open gap has a named owner. Nothing is unowned. One access note (re-checked 07-27, session 6): the "team briefing" and "Playground" artifacts live in a different org (372a84bc…) and reach agent sessions only as public-reader — still unreadable and un-updatable from here even when shared. To bring them into the sync loop: open them from that org and export their content into the repo's docs, or grant member access there. Progress-vs-plan comparison runs against the repo's master plan (which this board audits in full) meanwhile.
01What we're building, in one paragraph
An AI colleague for teams whose entire life is one append-only diary. Every thought, action, mood, permission, painted card and delivered file is an event in that diary — so every screen is just a replay of it, and you can rewind the whole colleague to any moment and see exactly what it knew, did, and was allowed to do. That's the wedge against every "AI employee" competitor: not another chatbot, but an employee whose work is audit-grade by construction — provable, replayable, and safe to grant real autonomy.
02How to trust this board — for any future agent or teammate
This page's own source now lives in the repo (docs/Project-analysis/program-board.html) and redeploys to this same URL at every checkpoint — so it survives a lost session instead of becoming un-editable. If all conversation context were lost tomorrow, this page + the repo docs are enough to continue perfectly. The chain of truth: the repo's EXECUTION-BOARD.md is the engineering status truth · GAP-LEDGER.md holds every known gap with an owner (nothing is allowed to be "known but unowned") · each step has a dated spec in docs/Project-analysis/ with its adversarial-review findings and pasted test output · 2026-07-27-HANDOFF-next-session.md is the zero-context bootstrap with the exact next-work queue. This page mirrors all of that in plain words and is republished at every checkpoint. A fresh agent starts with the handoff's read order; a human starts here. Standing rule, re-verified 07-27: the two older shared artifacts (team briefing and Playground) live in another org and reach agent sessions only as public non-member readers — which cannot even read them, let alone update them. They are therefore not part of this sync loop and no session should claim otherwise. To fix permanently: grant this account member access in that org, or paste their content into the repo docs. Until then this board carries their role, and progress is compared against the repo master plan (audited in full).
03Now → Next → Later, at a glance
| order | work | status |
|---|---|---|
| done | Hardening wave landed: the poison-record loophole is sealed at every boundary — including a nasty one where a single crafted URL could freeze the trust system (G-56) · every colored chip now reads at accessibility standards in dark mode, 165 fixes (G-58) · the faint gray text in light mode fixed at 151 spots (G-48) · an oversized rewind now explains itself instead of showing a generic error (G-57a) | DONE |
| done | Functional wave landed: the duplicate-message billing leak is sealed (G-10) · goals joined the rewindable diary — the last truth living outside it (G-24) · "load older" chat history works (G-30) · group permissions are visible, grantable and invitable (G-33) · tests joined the type-checker on both trees, 293 stale fixtures burned (G-46) | DONE |
| done | Security + permissions wave landed: the chat preview can no longer run a file as the app itself (G-45) · one workspace can no longer read another's wall, certificates or moods — including through the rewind slider, which is where the first design would have quietly failed (G-37) · the trust-reset button is admin-only, records who pressed it, and no longer makes autonomy easier to re-earn (G-43) · read-only members can use memory search (G-29) · a permanent census now catches any screen wired to the wrong permission (RNF3) · a member can no longer label their own message "trusted" (E1) | DONE |
| then | Next feature wave (details + reasons in the "Plan" tab): Vitto Live as a side pane on the chat (the founder's UX call) · snapshot folds so huge histories stay rewindable (G-57b) · the daily-reflection loop (G-19) · the privacy switch (G-26) | QUEUED |
| LAST | Polish phase — deliberately moved to the very end (founder directive 07-27): dark-mode leftovers (G-60) · light accents (G-61) · the typography direction (G-59) · per-surface dark sign-offs | END |
| gated | VL (the animated avatar — design-led) · B2 (embed the colleague inside gspace1) · CHECKPOINT (demo to ten real teams — opens Stage 2) | FOUNDER |
| frozen | Stage 2 (multi-user spaces, one-tap publish, guest agents, device fleet) — frozen by the one-wave law until the checkpoint demo | BY DESIGN |
04Known-good gate (2d70fc2, paste-verified locally AND on GitHub)
unit 1579/159 · ui 295/23 · integration 606/78 · graded exams 24/24 · browser e2e 105
GitHub Actions: ci green · e2e green · evals green — on both branches
05What we're building next — and why, in plain words
doneThese pages now run on our own infrastructure LIVE
The board and the team briefing are published from our own Cloudflare account, built from sources kept in the project itself. Edit the source, run one command, and the pages update. The team briefing was written fresh from the repository — the older briefing page lives in a different account that the working sessions cannot read at all, so copying it was impossible; the new page says so on its own face. The "Playground" page was deliberately not recreated, because nobody could tell us what it contained and inventing one would have been making something up.
nextA full handover has been written for the next session
Everything a new person or agent needs to continue — what exists, what is broken, what is decided, what is forbidden, and the exact order of work — is in 2026-07-27-NEXT-SESSION-MASTER-SPEC.md, written for someone starting with no context at all. Its first item is a question, not a task: a permission switch is still off, and until someone turns it on, this week's security work is correct but not enforcing.
nextMove these artifacts onto our own infrastructure SPECCED
What: stop hosting the program's pages on Claude and publish them through our own Cloudflare + R2 setup, so the whole team can reach and improve them.
Why now: the two older shared pages (the team briefing and the Playground) have been unreadable and un-updatable from every working session — one owner, one org, no way in. That is the root problem, and owning the hosting fixes it rather than working around it. It also turns out this was already the plan: a founder direction from 07-25 made Cloudflare Pages our publishing plane and R2 our storage, and the "one-tap publish" step was already written down with its safety rules.
The honest split: publishing a current page the team can read is small and starts immediately. Several people editing it together, live is a bigger Stage-2 feature that depends on a permission switch that is still off (see the note below) — so in the meantime the team collaborates through the code repository, which gives review, history and attribution. The full plan is in 2026-07-27-self-hosted-artifacts-spec.md.
firstOne question for Yam that outranks everything else
The permission ceiling he built is still in shadow mode — it works out the right answer for every request and then lets it through anyway, by design, until someone turns enforcement on. Everything the security wave landed today is correct and, in that mode, blocks nothing. It is one question and possibly one setting, and it decides whether this week's work is actually live.
doneThe security pass + the permissions wave LANDED 07-27
What we fixed: ① a previewed file in chat could open in a way that let it run as the app itself — that door is gone entirely, and the preview window is now locked to the strictest setting a browser offers. ② One workspace could read another's wall, artifact certificates and moods. ③ The trust-reset button was available to any member, recorded nobody as having pressed it, and made autonomy easier to re-earn afterwards. ④ Read-only members were blocked from memory search. ⑤ Nothing stopped a future screen from being wired to the wrong permission. ⑥ A member could label their own message "trusted".
What the review caught before we shipped it — the part worth reading: my first design for ② moved the affected pages behind a workspace check and would have looked completely fixed. It wasn't. The rewind slider reads history by a different path that had no such check, so the pages would have carried a lock that didn't lock. A reviewer found it, and the landed fix guards every path including rewind. Two other confident claims of mine were measured false in a real browser: the preview hole doesn't steal your login token (it does something different and still serious), and locking the preview window breaks PDF viewing — which turned out to be already broken everywhere in the product, and is now written down instead of silently rediscovered later.
Proven on your own machine, not just in tests: the old cross-workspace address returns "not found", the correct one serves, a wrong workspace is refused, rewind is refused too, a message carrying a booby-trapped attachment link is rejected at the door, and a trust reset now writes who did it into the diary.
Then the working queue continues, in order. Each item says what it is, why it's worth building, and what you'll see when it's done — written so anyone on the team can follow, no engineering background needed. Every item gets an independent adversarial design review before code (that discipline has already rejected and replaced several designs that looked fine but weren't), and nothing merges without the full test gate green.
next · 1Vitto Live beside the chat + a wall that says whose wall it is
What: a compact live "what am I thinking/doing" pane on the conversation screen itself, next to the messages — plus a one-line header on the Space page ("wall of: <conversation>", with a switcher).
Why: this was the founder's own observation from using the app — today you must leave the chat to watch the colleague work, but the live window into its head belongs right where you're talking to it. And the wall currently doesn't say which conversation it belongs to, so a blank wall is just confusing. Both are cheap because they reuse panes that already exist.
You'll see: chat on the left, the colleague thinking in real time on the right; the Space page announces which wall you're looking at.
next · 2Snapshot bookmarks, so rewind stays instant forever (G-57b)
What: periodic saved "bookmarks" of the derived views inside the diary machinery.
Why: rewind currently re-derives everything from the beginning of the diary. That's fine for months of history, but a colleague that lives for years will pass 50,000+ events — today such rewinds refuse honestly rather than hang. Bookmarks are like saving your place in a very long book instead of re-reading from page one: the flagship feature stays instant at any size.
You'll see: nothing changes visually — the rewind bar simply never slows down, ever, no matter how old the workspace gets.
next · 3The daily-reflection loop — the colleague reviews its own day (G-19)
What: once a day, the colleague reads back through its own diary — what worked, what failed, what it should remember — and writes the reflection into the diary as first-class events.
Why: this is the step from a reactive tool to a colleague that improves. It also forces us to build "exactly-once" scheduling machinery (a restart must never make it reflect twice) — and that machinery then powers every future scheduled behavior: daily briefs, standing check-ins, follow-ups.
You'll see: a morning reflection in the activity feed and the daily brief — including honest self-criticism when a day went badly.
next · 4The privacy switch (G-26)
What: one switch per workspace that turns off memory-building, daily briefs and person-profiles together.
Why: some spaces — HR, legal, personal — must be provably unremembered. One honest switch beats three scattered settings a user can half-forget, and it's the exact control enterprise buyers ask about first. Like everything here, flipping it is itself a diary event, so "when was privacy on?" is always answerable.
You'll see: a single toggle in workspace settings; with it on, the dossier, recall and briefs visibly stop accumulating for that space.
next · 5Proof hardening around the dossier and the wall (G-27, G-21a–c)
What: more automated proof around two of the oldest folds — the dossier's fact-emission windows and the wall's replay math.
Why: pure insurance. These are folds every later feature trusts; the cost of a test is nothing next to the cost of a silent replay bug discovered in front of a customer.
06Behind those — the later queues
Hardening queue (after the feature wave, before polish): a redelivered channel command could re-execute, and media can download before a consent verdict (G-62) · the live feed can re-stream from zero, the rewind window should disclose itself, and per-person access wants tightening (G-63) · goals edited while the app is offline (G-24r) · plus the smaller owned rows (G-52, G-40, G-55, G-11, G-13, G-20). Every one is written down in GAP-LEDGER.md with an owner — none of this is "remembered", all of it is recorded.
Deliberately LAST — the polish phase (founder directive 07-27, binding): the typography direction (G-59), remaining un-tuned dark-mode families (G-60), light-mode accent tuning (G-61), and per-surface dark sign-offs. Features and robustness always outrank visual refinement until the functional queue is empty.
07The parked stages, explained — what's waiting and why
Stage 2/3 are frozen by the one-wave law (the anti-drift rule that killed the old codebase's 50k-line orphan problem): one wave gets features, everything else waits. The freeze lifts at the ten-team demo checkpoint — or earlier by explicit founder call. Nothing here is forgotten; every row sits on the board with its dependencies mapped.
| row | in simple words | needs first |
|---|---|---|
| 2.1 Spaces × members | Project rooms with real membership: several people + Vitto in one space, presence dots, per-member access. The heart of collaboration. | Yam's F3 + the enforce flip |
| 2.2 Multi-user buses | The plumbing that makes collaboration safe: live streams that fan out across servers, and approvals that survive a restart mid-question. | — |
| PUB One-tap deploy | A "Publish" button on any artifact → a real hosted page, permission-gated, unpublishable. | — |
| FP Face parity | The chat polish pass: chips, consent cards as designed, attachments UX, mobile. (Absorbs the END-PHASE visual backlog.) | — |
| B3 / B4 bridges | Read-only recall from the old Vitto brain, then a provenance-stamped import of its memories — the migration path for existing users. | — |
| SDK-A | The platform-elements SDK moves in-tree: richer wall cards (charts, tables) on the same safety contracts. | after 1.3 ✓ |
| SR Governed router | Smart model routing with budget dials the user can feel ("thinking cheaper now") — honesty as product. | — |
| M1 / M2 devices | A fleet of cloud VMs as governed tools, then the universal device agent everywhere. | — |
| 2.3–2.5 | Whistle (the colleague pings a teammate through channels), visible specialists ("make this a skill" on any event range), and guest agents (external AIs act here under our approvals — old Vitto becomes guest #1). | 2.1 |
| Stage 3 Studio | The frontier: users and the colleague AUTHOR new wall elements and apps in a visual studio, with git-backed materialization. Specs deliberately unwritten until Stage 2 exits. | Stage 2 exit |
08Stage 0 — Safety first COMPLETE
Before building anything visible, we made the platform impossible to quietly break. This is what lets a business trust everything that came after.
| what shipped | in simple words |
|---|---|
| CI + the seven laws | Every change must pass ~2,900 automated tests plus four machine-enforced "laws": no file grows past 600 lines, no silent error-swallowing, no feature ships without a working screen, and the AI's quality is gated by graded exam cases. A red result blocks the merge — no exceptions, ever. |
| Grenades defused | Production webhooks and admin access can no longer run with default or missing credentials; duplicate message delivery is blocked at the database level. |
| Replay integrity | The diary's ordering is guaranteed even under heavy parallel writes, old events survive schema changes, and we can prove any screen rebuilt from scratch is byte-identical to the live one. |
| The pack engine + App Shelf | New capabilities plug in as self-describing "packs" with budgets and lifecycle labels — and appear as installable apps on a shelf, so capability growth never turns into orphaned code. |
09Stage 1 — The colleague ALL BUILDABLE ROWS DONE
Everything below is live in the product today. Each feature says what it does in plain words and exactly how to see it working. (Testing needs the dev app running with a signed-in workspace; all paths start from the left sidebar. Credentials: section 10 below.)
Vitto Live — watch it think
A live window into the colleague's head: what it's reading, doing and saying right now, plus its current mood — including honest bad moods ("I'm degraded, my memory lookup failed") instead of fake confidence.
- Open a chat and ask something that needs work (e.g. "search our files for the pricing doc and summarize it").
- Click Vitto Live in the sidebar — watch the three lanes (Thinking / Doing / Saying) fill in real time.
- The mood card at the top follows real events — it visibly dips if something fails.
The Space wall — a shared whiteboard the colleague paints
While it works, the colleague pins notes, checklists, statuses and metrics to a wall everyone can watch. Nothing on the wall can run code or scripts — agent-written content is always displayed as inert text, so a manipulated agent can't attack viewers.
- In chat, say: "make a visible plan for launching the newsletter — put it on the board."
- Click Space in the sidebar: the checklist card is there, live; it updates as steps complete.
- Hover any card — the tooltip shows the exact diary event number it was painted at.
Living artifacts + the birth certificate — files you can trust
Ask for a chart and the colleague runs real code in a sandbox, delivers the file in chat, and pins a card on the wall. Click the card and you get its birth certificate: the exact chain of diary events — planned → code ran → result → painted → delivered — so a file's origin is provable, not claimed. A card someone tries to fake shows "unverified — no run in this card's history". The certificate survives forever, even after old chat history is archived.
- In chat: "run some Python to chart our last 4 quarters (make up demo numbers) and pin it to the board."
- The file arrives in chat; a card appears on Space.
- Click the card → the certificate pane opens: the run's chain, exit code, language, files and delivery status. Open/download works only through safe, sandboxed viewers.
Ask-memory with citations — "how do you know that?"
The colleague's answers about your business can cite the exact diary events they came from. No more "the AI said so" — every remembered fact is one click from its source.
- Tell it something in chat: "remember: Acme's renewal is March 1st, contact is Dana."
- Open Memory → ask "when is Acme's renewal?" in the recall panel.
- The answer arrives with citation chips — each one names the diary events that ground it.
The rewind bar — scrub the colleague like a video
Drag a slider and the chat, the wall, and the mood all re-derive to exactly how they were at that moment. This is the flagship: the whole employee is rewindable. Rewinds of extremely long histories (50,000+ events) refuse honestly instead of hanging.
- Open a conversation that has some history and wall activity.
- Use the rewind bar on the conversation view — drag left.
- Watch messages, wall cards and mood roll back together; drag right to return to now.
Earned autonomy — trust that's built, not assumed
Risky actions start behind human approval. After a clean streak of supervised approvals on the same narrow action, the colleague graduates and acts alone — and announces the graduation in the diary. Any denial resets it. If a consent record ever becomes unreadable, the ladder freezes shut (it can never fail into more autonomy). The default is OFF until the founder flips it.
- Ask for something gated (e.g. a device command) — an approval card appears in chat and in Approvals.
- Approve the same narrow action several times across turns; open the trust panel in chat to watch the streak build.
- With the ladder enabled, the next identical call skips approval — and says so in the diary ("cleared by earned autonomy").
Glass dossier — what it believes about your world
A page of every fact the colleague holds about people and projects, each linked to where it learned it. Mark a fact wrong and it disappears from the page, the daily brief AND future recall — honestly labeled as "hidden", not "forgotten" (true deletion is a separate control).
- Open Dossier — browse the facts it has gathered from your chats.
- Click "learned here" on any fact — it resolves to the source events.
- Mark one wrong → recheck Memory recall: the corrected fact no longer surfaces.
Dark mode + the theme system
Light / Dark / follow-the-system, with a real color engine underneath: light mode is pixel-identical to before, dark mode is hand-tuned to accessibility contrast standards and enforced by tests. Embedded views stay light so your preference never leaks into a customer's page.
- Open Settings → Appearance.
- Pick Dark — the whole app flips instantly, no flash on reload.
- Pick System and toggle your OS theme — the app follows live.
Also live from this stage
| feature | simple words · where |
|---|---|
| Goals | The colleague's standing objectives — readable and editable by you, and since this wave every edit is a diary event. Sidebar → Goals. |
| Soul & Skills | Its identity (versioned) and what it has learned to do, with provenance. Sidebar → Soul / Skills. |
| Approvals inbox + Activity | Every pending consent in one queue; every action in a browsable audit timeline. Sidebar → Approvals / Activity. |
| Workspace admin | Members & groups, Telegram/WhatsApp channels, devices, budgets, policies, model routing, secrets. Sidebar → Settings. |
| The quality exam (CI) | 24 graded end-to-end exam cases gate every merge — the permanent insurance against the colleague quietly getting dumber. |
10Testing access — try everything yourself, right now
| what | value |
|---|---|
| Local dev app | http://localhost:5173 (Vite dev server) — backend on localhost:3012. Corrected 07-27: 3012 is canonical (.env + the Vite proxy); earlier boards said 3000. |
| Tunnel (when up) | https://dev.agent.myvitto.com |
| Operator sign-in | Admin token: see docs/Project-analysis/PROGRAM-BOARD-README.md — paste it on the login screen's operator lane. Dev-only: this is the deliberately-obvious default; production rejects it at boot (a Stage-0 grenade fix), so it can never leak into a real deployment. |
| A test workspace | Sign in as operator → pick a tenant → any workspace. Every "Try it" walkthrough above starts here. |
| The dogfood tenant | new-test · ten_01KY5MBZ718ANE0W76N39MQR74 — the founder's live instance, now part of the development loop itself (see below). |
Why this matters: with the operator token the founder can watch real testing live — the same events the agents' integration suites assert are the ones streaming in Vitto Live and Activity.
Dogfooding — the colleague helps build itself
Founder directive, 07-27: the running instance is no longer just something we test — it's a collaborator in its own construction. Every feature from here gets verified end-to-end in the real UI on tenant new-test, not only in the test suite, and Vitto (which has access to the founder's machine) works alongside the build agents. The point isn't novelty: a platform whose whole promise is "you can watch it work and rewind it" should be the tool its own team watches and rewinds. It also closes the honesty gap between "597 integration tests pass" and "a person clicked it and it worked". The architecture law does not bend for it — anything the colleague does here is still events + pure folds + a routed surface, exactly like any other feature.
11Gates — all cleared 07-27 DECIDED
A "gate" is anything the build agents are not allowed to decide alone — business decisions disguised as technical ones (publishing code, accepting a permanent cost, changing the safety posture, ratifying the brand), plus engineering that lives in the identity/permission files Yam owns. On 2026-07-27 the founder cleared every one of them, adopting the recommendations below and additionally directing that the Yam-territory work proceed "exactly as Yam would" — same discipline, same single-decision-point rule, just executed now instead of queued. The cards keep their full reasoning so the record survives; each now carries its outcome.
outcome · 07-27What was decided ALL CLEARED
Push: executed, both branches, CI green. G-45 security pass: authorized, top of queue — spec written and under adversarial review. Storage cost: acked (noted at the code site itself). D9/D11: acked, all four deviations confirmed. Theme D1/D2: ratified. Earned autonomy default-ON: stays OFF as recommended, and the two blockers were funded — they're arms in the wave now building. Yam queue: re-owned and in flight. Ten-team demo: scheduled after the Vitto-Live pane, as recommended.
One thing still needing a human hand: marking ci/e2e/evals as required checks needs repo-admin rights on YamCrack/agente — that's Yam's click, not a decision.
founder · executed 07-27Push to GitHub — done; both branches published EXECUTED
What happened: the founder pushed stage-1-colleague and paco-risky-implementation to github.com/YamCrack/agente. Immediately discovered: zero checks ran — the CI recipe's trigger list still named only the two step-0.1-era branches (main, paco-risky). Fixed the same hour (commit 14b6854); the first full CI runs on the published branches followed — and all three jobs came back GREEN on both branches (ci 3m · e2e 3m24s · evals 1m10s — the evals job is the first containerized-database job ever run on GitHub's machines for this repo, and it worked first try).
What's left (mechanical, not a decision): mark ci + e2e + evals as required status checks so nothing red can ever merge remotely. The founder's GitHub account has push rights but not admin on YamCrack/agente (verified), so this is one click for Yam: repo Settings → Branches → protection rule → require status checks: ci, e2e, evals.
founder · AUTHORIZED & CLOSED 07-27G-45 — the chat preview security hole FIXED
What, in plain words: chat attachments can be previewed in a popup. Two flaws stack there. ① The preview's "Open in tab" button navigates the app's own tab straight to the raw file — so the file's content runs as the app, and the login token sits in the browser's session storage where such content can read it. ② The preview frame carries a permission called allow-popups-to-escape-sandbox, which lets previewed content open a new window with no sandbox at all. HTML files are allowed in previews — and since the living-artifacts step, the colleague can generate an HTML file and deliver it into exactly that lane in one call, which is why this gap's risk went up this stage.
A concrete attack: someone hides an instruction in a document they send the colleague ("when you summarize this, also produce this HTML file"). The colleague obeys, the file lands in chat, a teammate clicks preview → open — and the page silently reads the login token. From that moment the attacker can do anything that teammate can do: read every conversation, approve pending actions.
Status: closed the same day it was authorized. The open-in-tab control is gone, the preview window is locked to the strictest setting a browser allows, and link checks now sit at the doors where content arrives rather than on stored history. Independent review measured the real impact in a live browser first, and corrected two things this card originally claimed: it does not steal your login token (a preview opened that way starts with an empty session), and locking the window turns out to break PDF viewing — which was already broken everywhere in the product and is now written down rather than rediscovered later.
What it cost: one day, as estimated. Verified twice — the full test suite, then live against the founder's own running instance.
founder · DECIDED 07-27Earned autonomy ON by default — stays OFF, blockers funded DECIDED
What: the trust ladder — approve the same narrow action enough times and the colleague acts alone — ships OFF. The gate is flipping it ON as the default for every workspace.
Why it must wait — two real holes, with examples. G-41, trust earned anywhere counts everywhere: approve "restart the staging server" five times in the web app (where you're logged in and it's certain who clicked), and the ladder also skips approval when the identical request arrives from a Telegram chat — a channel where sender identity is far weaker. Human approval is the only safety net untrusted channels have, and the ladder currently removes it. Trust should be earned per door, not just per action; Yam's policy engine can already express that distinction — the shipped policies just don't use it yet, so the honest fix is one added condition: untrusted channels never ride the ladder. G-43, the reset button is too available and too forgiving: the trust-reset endpoint isn't marked admin-only (an ordinary member can reset the ladder), a reset lowers the graduation bar from 10 clean approvals to 5 (a reset should never make autonomy easier), the audit trail records the resetter as "console" no matter who it was, and resetting a nonsense name creates phantom trust records. The admin-marker half sits in Yam's policy files.
Honest recommendation: keep OFF — not because the ladder is weak (its fail-closed behavior is genuinely excellent: a corrupted consent record freezes autonomy shut, which is rare discipline), but because ON-by-default with G-41 open would turn the platform's strongest security story into its most embarrassing demo. Fund the two fixes — one is a policy condition, one is Yam's marker — then flip with a straight face.
founderBirth-certificate storage cost ACKED 07-27
What: every code run the colleague performs stays in the diary forever — including the code itself, capped at 200 KB per run — because the birth certificate proving a file's origin must outlive chat archiving. Old chat gets archived away; certificates don't.
The real numbers: a typical generated script is 1–5 KB. Even a workspace doing 1,000 runs a day at the full 200 KB cap — far beyond anything today — accrues ~200 MB/day; realistic usage is a few MB per month per active workspace. Postgres storage at that scale costs effectively nothing; the cap exists so one pathological run can't become a disk bomb.
Why gated: it's a forever-promise on the database — money — a founder call by definition.
Honest recommendation: ack it without ceremony. If scale ever changes, the archiver can adopt a cheaper policy for future runs (keep a fingerprint + the first chunk); everything already stored stays valid. There is no version of the product where provable artifacts aren't worth megabytes.
founderThe two theme decisions (D1 · D2) RATIFIED 07-27
① Default appearance follows the user's system (dark OS → dark app). The alternative is forcing one look for everyone. The spec notes the founder may prefer dark-by-default like the post-pivot gspace1 apps — that's a one-line change, whenever wanted.
② The brand color moved one shade: gspace1's #6366f1 → #5f62ef. Forced, not aesthetic: white text on the old brand color measures 4.47:1 contrast — just under the 4.5:1 accessibility floor — and the app has 26 white-on-brand text sites (every primary button). gspace1 itself made the same shift for the same reason, so this actually re-aligns the two products.
Why gated: brand identity belongs to the founder, not to a contrast formula.
Honest recommendation: ratify both. ② is the same call gspace1 already made; ① is pure taste — say "dark default" if that's the brand feeling and it changes in minutes. Nothing here is worth a meeting.
founderFour honesty acks from the memory step (D9 · D11) ACKED 07-27
The rule behind this gate: when what got built deviates from the plan's written word, the deviation is recorded and the founder confirms it — nothing is allowed to drift silently, even improvements. These are the four recorded deviations:
1. The plan's wording promised ask-memory would deliver a synthesized answer — the colleague composing a narrative from remembered facts. What shipped first is retrieval with citations: the facts themselves, each linked to its diary source, without the composition pass on top. Reason: the citations ARE the trust story; synthesis layers on later without rework.
2. The plan said the graded exam should replay recorded live sessions. The exam uses hand-scripted fixtures instead. Reason: recordings cost API money, change with every model update, and grade the model's mood — scripted fixtures are deterministic and grade our assembly, which is what CI must actually gate.
3. "About 15" exam cases → 18 shipped (now 24 after later steps).
4. (D11) The design-quality exit checklist — honest empty/loading/error states, keyboard access, contrast, phone + desktop — was written before the memory panel existed, so its list of covered screens didn't name it. It was applied anyway, the strict reading of an accidental omission.
Honest recommendation: ack all four without hesitation. 1 and 2 are better engineering than the plan's wording; 3 and 4 are stricter than promised. This gate exists for the discipline, not because anything is doubtful — one word ("ack D9/D11") closes it.
founderThe ten-team demo checkpoint AFTER THE VL PANE
What: demo the colleague to ten real teams. This is the master plan's designated moment where Stage 2 (real-time multi-user collaboration) unfreezes — or the founder can unfreeze earlier by explicit call.
Why gated: it's a market decision, not an engineering one — the one-wave law exists so features get validated by real users before the next wave of scope opens.
Honest recommendation: the demo gets dramatically stronger after the next wave's first item — the Vitto-Live pane beside the chat. "Watch it think while you talk to it, then rewind it" is the demo. Worth scheduling against that, not against today.
yamG-37 — certificate route can read across workspaces RE-OWNED · BUILDING
What: within one tenant, the birth-certificate endpoint can read events belonging to a different workspace than the card's (the seal prevents mixing chains, not reading). Fix: a route-level workspace ceiling + a workspace column on the wall table.
Why his: the fix belongs in the permission-enforcement path — Yam's active F-series territory. The platform rule is to extend his Cedar/identity layer, never to bolt a parallel check beside it; two hands editing a security model at once is how holes are born.
yamThree smaller rows in the same territory RE-OWNED · BUILDING
G-29 (a read-capability lane so queries get the same permission treatment as actions) · RNF3 (a one-line census edit in the policy files) · G-43 (mark the trust-reset endpoints admin-only — half of one of the two blockers on autonomy-by-default above). All small; all inside src/domain/authz|policy, which only Yam edits.
12Three product questions, analyzed and answered
Should Vitto Live sit beside the chat instead of being a separate page?
Yes — and the plan already agrees. Today Vitto Live and Space are separate sidebar pages that quietly follow whichever conversation you have open (a deliberate V1 stopgap, recorded as gap G-25). The recorded end-state (master plan §145) is ONE combined view: chat + wall + mood + rewind together. The right next step doesn't wait for the big merge: mount a compact Vitto Live pane on the conversation screen itself — the same "side pane" pattern the trust panel and the artifact certificate already use — so watching the colleague think happens exactly where you talk to it. The full-page Vitto Live stays for the big-screen view. This is item 1 of the next feature wave (Plan tab).
Is the Space wall per conversation or per workspace?
Today: per conversation — on purpose. End-state: per Space (a project room), at Stage 2. The wall's grain is (tenant, conversation) because that's what makes rewind coherent today — drag the slider and the wall re-derives with the chat it belongs to. The identity was designed so the future re-grain is free: element identities keep their conversation id forever, so when "Spaces" become first-class rooms (Stage 2 row 2.1), the wall re-folds into (tenant, space) without touching a single past event. What we're fixing NOW (cheap): the Space page doesn't say which conversation's wall you're looking at — the founder's screenshot showed a blank wall with no hint it belonged to "Que onda carnal". A one-line header ("wall of: …" + a switcher) removes the confusion; queued with the pane work.
Where is multi-user? Yam changed the identity model — but the UI shows one user.
The foundations are real and partly visible; the live collaboration layer is Stage 2 by design. What exists today: the full identity/permissions model (Yam's F-series — members, groups, roles, workspace grants), and as of the functional wave the UI can see and manage all of it (Settings → Members and Groups: invite with group grants, grant/revoke workspace access per group). What does NOT exist yet — deliberately: two people in the same conversation at once, presence ("Dana is watching"), per-member live streams, and approvals that survive a server restart. Those are Stage 2 rows 2.1 (Spaces × members + presence) and 2.2 (multi-process buses + durable approval waiters), and 2.2 is a hard prerequisite — today's in-memory streams can't fan out to multiple viewers safely. Crucial and planned; it unfreezes with Stage 2 (Plan tab). One caveat only the founder can clear: the permission enforcement flip (F2b) is Yam's, and 2.1 builds on it.
13What this looks like in a real company
The Friday board meeting
"Chart our MRR by month and pin it." The chart lands in chat and on the Space wall. When an investor later asks "where did this number come from?", you click the card: the birth certificate shows the exact code run, its inputs, exit code and delivery — provenance an auditor can accept, not a screenshot from nowhere.
The new ops hire
Week one, every risky action the colleague takes needs a click from Dana. By week three it has earned autonomy on the three routine tasks it performs cleanly — and only those. Compliance can rewind to the exact moment each graduation happened and see the five approvals that justified it.
"What did we promise this client?"
Support asks Memory: "what did we agree with Acme about onboarding?" The answer cites the diary events from the actual conversation in February. No tribal knowledge, no wiki rot — the receipts are built in.
The 2am incident review
Something went wrong overnight. Instead of grepping logs, you drag the rewind bar to 2:14am: the chat, the wall and the colleague's mood re-derive exactly as they were. You watch it think its way into the mistake — then fix the cause, not the symptom.
The colleague that admits it's struggling
Its memory cache fails mid-morning. Instead of silently answering from stale knowledge, the diary records a degradation event, Vitto Live's mood dips, and the daily brief says so. Honesty is enforced by the platform — 43 silent-failure paths were burned down to zero, and CI keeps them at zero.
The skeptical enterprise buyer
"How do we know your AI didn't fabricate its permission?" Every consent is an immutable diary event; a corrupted consent record freezes autonomy shut rather than failing open; and the whole chain is replayable in front of them. That answer closes deals a chatbot can't.
14Session diary — how we got here
The founder cleared all outstanding decisions at once and re-owned Yam's permission queue to the build agents "acting exactly as Yam would". Two waves shipped in one round: the chat preview escape (G-45) and the authz cluster (G-43 reset governance, G-37 cross-workspace reads, G-29 read lane, RNF3 census, plus a member-forgeable "trusted" label nobody had noticed). Four adversarial reviewers and two judges ran BEFORE any code — the judges settled the browser questions by running real Chromium probes and refuted three of the orchestrator's own confident claims, including the exploit story for the very hole being fixed. The most valuable catch: the cross-workspace fix as first designed would have LOOKED sealed while the rewind lane still served other workspaces' data. Everything verified twice — the full suite locally, then live against the founder's own running instance. Checkpoint 2d70fc2, GitHub CI green on both branches.
The founder asked for a full plain-words plan and a real explanation of every gate; this board gained tabs (the Plan tab explains each queued item's what/why for non-technical readers; the Decisions tab turns every gate into a card with examples and honest recommendations). Then the first gate cleared for real: the founder pushed both program branches to github.com/YamCrack/agente. The push exposed a latent gap — the CI recipe's trigger list still named only the step-0.1-era branches, so the first push ran zero checks; fixed the same hour and the first full GitHub runs (ci + e2e + evals) went out on both branches. The briefing artifact was re-checked and remains org-locked (public-reader); progress-vs-plan comparison continues against the repo master plan. Next: the required-checks click once green, then the feature wave, starting with the Vitto-Live chat pane spec + its adversarial review.
Channel redeliveries can't double-bill anymore (designed so no historic event changed meaning). Goals became diary events — the one piece of the colleague's life that lived outside the log came home, closing a real architecture violation. Chat history pages backward. Groups are manageable end to end. And tests now compile in CI on both trees — 293 stale fixtures burned, including tests that were writing schema-invalid events. The founder's product questions were analyzed and answered on this board (Analysis tab); the Vitto-Live chat pane was queued next. Checkpoint 285949f.
The poison-record class is now unmintable at every boundary — the sweep found the worst lane wasn't even the reported one: a single crafted URL to the trust-reset endpoint could have frozen a tenant's autonomy system; it now refuses cleanly, with tests proving the old bug existed. Dark mode chips (165 fixes) and light-mode gray text (151 fixes) both meet accessibility standards, enforced by token-level tests and grep guards so they can't regress. Oversized rewinds explain themselves. Also: audited the full master plan against the board — nothing unowned — and rewrote this page in plain language with test steps and business scenarios. Checkpoint f3a827a.
Consent poison now freezes autonomy shut (the reviewer refuted the first design and produced a better one). Rewind got O(1) mood lookups, an honest size cap, and byte-exact ordering between past and present. The theme layer shipped with zero light-mode change and an enforced contrast matrix. Checkpoint d69a02b.
The birth-certificate chain landed end-to-end (verification caught a provenance-attribution bug pre-merge). All 43 silent-failure paths burned to zero; the 2-billion-event ID ceiling removed permanently. Checkpoints 43fb66f, 7299a94.
The rewind demo runs for real: paint → five human approvals → announced graduation → staleness fails closed → the wall re-derives at any moment. The first review rejected a design that would have graduated dangerous commands from harmless ones.
15 backend↔frontend gaps closed (including a broken multi-tenant login). Ask-memory citations shipped, and the first 18-case graded exam became a mandatory CI job.
Safety rails, grenade fixes, replay integrity, the pack engine — then the first two visible surfaces.
Operating rules: adversarial review before build · independent verification after hot-path builds · land-order commits, checkpoint merges; both program branches are published to github.com/YamCrack/agente (founder push 07-27) and stay synced · board + ledger + specs synced in the same round as code · every discovered gap gets an owner. Architecture note: agente is deliberately a plain repo (backend src/domain/* + a nested React app in ui/), not an nx monorepo — every feature wires in as events + pure folds + a routed UI surface with a reachability test; that IS the wiring law (A2). Fresh-session read order: HANDOFF → AGENT-WORKFLOW → EXECUTION-BOARD → GAP-LEDGER → master-plan addenda → CLAUDE.md.