The Roadmap

The injection fence is built and switched on: audited content is treated as data, never instruction. What is left is proving it costs nothing on the content side. Run a real content and website audit through the fenced path and check it against the pre-fence baseline: findings depth, every anchor still resolving, and the verbatim-copy contract surviving source fencing, with the spend bound set before it starts.

The same check on the code side already came back clean: three targets, about US$0.32 in spend, no quality regression. This content-path check was blocked behind hardcoded drive letters that broke the full test suite, now cleared. A shipped defence with one unverified path is a defence with an asterisk, and this row exists so the asterisk cannot be quietly forgotten.

A Studio chat tab under the same guardrails as everything else: explicit pick, vendor-pinned auto, or full Auto through a two-stage router, with metered API calls and subscription CLIs as parallel execution classes. The design is shipped and adversarially reviewed, with the build cut into four slices.

Push notifications and a read-only mobile triage page over the tailnet already work. The next step is the first off-machine write: approve or reject an inbox item from the phone, issuing the same grant through the same path as the desk.

The system runs scheduled work on its own: schedule, enqueue, auto-drain. Arming a schedule is a recorded act bound to its content hash, so any edit disarms it until it is re-approved, and a decision-debt cap stops it generating decisions faster than I can review them.

Several machines, each running its own copy, push what they are doing to one place I can watch. That place can only look: it never approves, never applies, and holds no authority channel back to a node, a fleet I can watch but never command. The design is shipped, after two external adversarial reviews, with the build cut into four rows behind it.

A five-model Ollama fleet, running on my own machine, costing nothing per use, observed and warmed from Studio > Models. The sequencing is the point: execution-class recording (metered, subscription, local) shipped before the fleet surface existed, so no local call could ever have gone unrecorded. Pipeline participation is refused outright in v1 and gated behind its own design row, rather than allowed by default just because it is free.

A browser page that can make changes, wrapped in the same freeze, simulate, approve, apply spine as everything else. Even localhost is treated as hostile-caller territory: a link opened off-machine can reach a read-only triage view at most, never the write API.

Mine run metrics, dispositions, and verifier verdicts for per-workflow signal, then feed it back into prompt, model, and route selection. Descriptive first: nothing changes agent behaviour without its own gated slice.

A code-owned registry of every user-state domain: settings, target registries, memories, skills, commands. Exports to a git-tracked repo with a fail-closed secret scan before anything leaves the machine. Config can narrow the export, never widen it.

Every audit gets the same server-owned slice of my working context: no default slice, no client-picked files, and every use of it traced in the report's evidence. It is the first concrete step towards the system remembering context between runs: memory informs, the spine still decides.

Quality per workflow measured on a fixed task set with bounded spend and a results ledger. Which model actually audits better, with receipts.