Build
Small and bounded first: the two runner-parser siblings (5S.9, 5S.14), the absolute-anchor fix (5M.5), then the spend surface (5Z.17). And 5G.3, the schedule controls, is cut-ready now that the night it renders exists.
Roadmap
A steering board, not a wish list.
Every piece of intended work is a register row with an ID, a role, a risk score and its prerequisites. Nothing is built without a row, and a shipped row leaves the table at closeout.
41
Live rows
128
Shipped slices
12
Decision gates
18
Guardrails
Shipped this week
The night now runs, inside bounds.
- 09/08/20265S.10, 5S.12 and 5S.13 · Every way of spending on a model now writes a run record: the census of unrecorded spend reads zero.
- 08/08/20265G.2 · Unattended operation shipped: nothing launches without a committed schedule, a live arming grant and a configured cap, and every due tick ends as a launch, a skip or a cap-stop, on the ledger.
- 07/08/20265M.2 · Studio gains Signals: ten deterministic signals over this machine's own ledgers, computed fresh on every read, refusing to say more than the evidence allows.
- 06/08/20265C.5 and 5C.6 · Studio gains Projects: every enrolled repository as a card with counted readiness, and a guided, propose-only enrolment that composes a fenced opening prompt for your own AI tool.
- 05/08/20265M.1, 5R.1 and 5T.1 · Three designs adopted in one day, clearing the design shelf 5G.1 opened the day before.
- 04/08/20265X.9 and 5X.10 · A local docs index and search, at $0: no corpus text stored, and every answer states its denominator.
Up next
Picked, not promised.
The Next queue is ranked and grouped by kind. A row leaves it by being kicked off, not by being wished for.
Design
5J.1, the Studio-wide UX review, is the row every new surface has been deferring to: Signals, Projects and the coming schedule controls all want its answer. Then the backup build (5T.2), whose risk class demands an external adversarial pass before code.
The tracks
Where the register is heading.
Ten open tracks, each a family of register rows. The status word is where the track stands; rows here are intentions, not shipped features.
5M
Self-study of runs
Mine run history for per-workflow signal; display and proposal evidence only, never behaviour.
signals shipped5C
Projects and enrolment
Every enrolled repository as a card with counted readiness, and a guided, propose-only enrolment.
first build shipped5G
Unattended operation
Schedule, enqueue and auto-drain, armed only by an explicit recorded act, never by config, inside caps that fail closed.
shipped5R
Declarative authoring
Workflows composed from a code-owned stage catalogue; narrowing only, gates non-expressible.
design adopted5T
User-state backup
Every user-facing registry exported to a git-tracked, secret-scanned format.
design adopted5X
Local models
A local model fleet surface, and a docs index and search that run at $0; pipeline participation stays refused by rule.
search shipped5S
Portfolio context serve
The gateway serves per-consumer context slices instead of every consumer re-reading files.
core shipped5W
Chat with real routing
A Studio chat tab that goes through the same model routing, metering and provenance as pipeline calls.
design shipped5V
Approvals from the phone
Read-only triage over a private network today; the remote approval act is its own gated design.
read-only shipped5EG
Egress governance
A census of every way anything leaves the machine, each entry naming its authority; banned channels locked as absences.
rowedThe register
Every live row.
The full backlog register, as it stands. A row's role says why it exists: boundary, keystone, unlock, hygiene, validation or polish. A prerequisite you cannot find below has already shipped.
The full register 41 rows
| ID | Title | Role | Prereq | Status |
|---|---|---|---|---|
| 5A.2 | Webview render harness: pure state-to-HTML snapshot tests | hygiene | 5A.1 | proposed |
| 5A.3 | Tier 1 sensitive pure helpers | hygiene | 5A.1 | proposed |
| 5A.4 | Tier 3 _getWebviewContent() decomposition | hygiene | 5A.2, 5A.3 | proposed |
| 5M.5 | A code-audit report may store an absolute anchor path | hygiene | none | proposed |
| 5C.2 | Development methodology as data: per-project descriptor | unlock | none | proposed |
| 5C.3 | Roadmap-authoring interview: design | unlock | 5C.2 | proposed |
| 5C.7 | Website machinery to config: the enrolment path's last code edit | unlock | none | proposed |
| 5D.1 | Outbound notifications design | unlock | none | proposed |
| 5E.1 | Goals interface design | unlock | none | proposed |
| I2w | Public website flip to Fulltrace (separate Showcase repo) | hygiene | none | proposed |
| 5G.3 | Schedule controls in Studio | unlock | 5G.2 | proposed |
| 5I.2 | Register drift check | hygiene | none | proposed |
| 5J.1 | Studio UX review and IA redesign | unlock | none | proposed |
| 5J.2 | IA restructure implementation | unlock | 5J.1 | proposed |
| 5J.3 | Run-completion notifications in the IDE | polish | none | proposed |
| 5J.5 | Open-source jump in the content/website audit panel | polish | none | proposed |
| 5O.4 | Injection fence red-team eval corpus | validation | none | proposed |
| 5S.6 | The website audit's challenger is the last unvoiced model call | polish | 5S.3 | proposed |
| 5U.2 | The launch press owns the in-progress flip | unlock | 5U.1 | proposed |
| 5U.6 | Four of the seven closeout steps can never tick, so the group is finished by hand or not at all | unlock | 5U.4 | proposed |
| 5EG.1 | Adopt G19 and the outside definition (the egress rule doc flip) | boundary | none | proposed |
| 5EG.2 | The egress census and its both-directions locks | boundary | 5EG.1 | proposed |
| 5EG.3 | The push tool refuses a foreign remote | hygiene | 5EG.2 | proposed |
| 5EG.4 | Client-plane deny set for shell egress | hygiene | 5EG.1 | proposed |
| 5S.14 | A pipeline that dies part-way records nothing, and its finished stages die with it | hygiene | 5S.13 | proposed |
| 5S.9 | A flag that takes a value swallows the next flag | hygiene | 5S.8 | proposed |
| 5S.5 | The context serve cannot name the run it framed | hygiene | 5S.2 | proposed |
| 5T.2 | Backup implementation and Settings tab controls | unlock | 5T.1 | proposed |
| 5V.4 | Remote decision surface: design gate | boundary | 5V.2, 5V.3 shipped + demonstrated demand | proposed |
| 5W.2 | Chat tab v1: explicit pick, metered class | unlock | 5W.1 | proposed |
| 5W.3 | Subscription execution class for chat | unlock | 5W.2 | proposed |
| 5W.5 | MS-2 provenance in authority-plane records | boundary | none | proposed |
| 5W.4 | Tiers and Auto routing for chat | boundary | 5W.3, 5W.5 | proposed |
| 5X.5 | Chat local execution class | unlock | 5W.2, 5X.4 | proposed |
| 5Z.2 | Wall-clock term in the graph budget | boundary | 5Z.1 | proposed |
| 5Y.6 | Tool-call subject on the trace: re-open the path half of the G10 args exclusion | boundary | none | proposed |
| 5Z.16 | Filter the Runs page by model | unlock | 5Z.15 | proposed |
| 5Z.17 | A spend surface: what did the runs cost | unlock | none | proposed |
| 5M.6 | Findings over time: new, persisting, resolved per target | unlock | none | proposed |
| 5V.5 | A weekly digest: the week in counts | unlock | 5EG.1 | proposed |
| 5Z.18 | Run comparison: two runs of the same workflow side by side | unlock | none | proposed |
Recently shipped the last 12 of 128
| ID | What landed | Shipped |
|---|---|---|
| 5S.13 | The last three ways of spending without a record, closed: the unrecorded-spend census reads zero. | 09/08/2026 |
| 5S.12 | Three signal checks stop assuming this machine has run history; a bare node now reaches the end. | 09/08/2026 |
| 5S.10 | A bought agent run finally writes a run record, locked by a census of all 18 entry points. | 09/08/2026 |
| 5S.11 | A smoke check stops reporting this machine's own history: fixture-built counts replace live reads. | 08/08/2026 |
| 5S.8 | A mistyped runner flag is refused, naming the nearest real flag, instead of buying a model call. | 08/08/2026 |
| 5U.5 | The cockpit's restart step says exactly what to do, chosen from the commit's own file list. | 08/08/2026 |
| 5U.4 | The cockpit stops dropping a slice mid-closeout: each closeout step ticks on its own evidence. | 08/08/2026 |
| 5G.2 | Unattended operation: schedules, arming grants and fail-closed caps; every due tick ends as a launch, a skip or a cap-stop. | 08/08/2026 |
| 5H.4 | The two judgement stores converge in the reading: one view, with expiry belonging to the filter. | 08/08/2026 |
| 5M.2 | The Signals pill: ten deterministic signals over this machine's own ledgers, refusing to overstate. | 07/08/2026 |
| 5O.6 | Prompts composed in the dashboard registered and completeness-checked, plane by plane. | 07/08/2026 |
| 5C.6 | The enrolment funnel: a guided, propose-only interview that composes a fenced opening prompt. | 06/08/2026 |
The method
How the board is run.
Roles
Every row declares why it exists: boundary, keystone, unlock, hygiene, validation or polish. A row that cannot say is not rowed.
Decision gates
Twelve standing conditions that bind named rows at kickoff. They constrain what a slice may do; they never rank the queue.
Guardrails
Eighteen invariants every kickoff re-reads. A slice that would cross one is redesigned or refused, not excused.
Hand-carried from the system's own steering board, correct as at 09/08/2026.