No blank canvas. You adopt it, you don't assemble it.
One cockpit: work, topics, goals, pages, the ledger, and a copilot that runs all of it by chat.
REGISTER
waiting on a person
2 blocked · 1 open
COPILOT
waiting on a click
Nothing destructive runs without that click.
Work is a spine. Everything else hangs off it.
They all point at the same task. Nothing here is a separate product with its own copy of your company.
SPINE
The work spine
Topic, goal, task. A task can sit in many topics at once, and blockers run task to task.
Nobody typed "blocked". It is derived, and it clears itself when the last blocker closes.
Work, topics, goals, pages. Same records, different doors.
Statuses lie. Edges don't.
A status is what somebody last remembered to set. Blocked is computed, live, from the dependencies you actually drew.
EDGE
Close the last one and the person waiting gets told.
The work logs its own journey.
Team-neutral stations, one append-only row per visit, written by the events themselves: status flipped, assignment picked up, a pull request merged. Every number is plain arithmetic over those rows. No model estimates any of it.
LEDGER
three visits, one task
- Waiting and working, separately
- Waiting is arrival to first activity. Working is first activity to exit. A week in review is not a week of review.
- It says when it does not know
- Under 5 closed visits a station reports insufficient data rather than a confident number. The ledger publishes its own coverage.
- It records which door
- Every visit is stamped human, agent or system. You can see what your AI did and what your people did.
It measures the work, never the people. There is no per-person ranking to turn on, because there is no query for one.
WALL
Same powers as your clicks.
Four architectural facts, not promises. Each one is a line of code you could go and read.
-
01
No special powers
The copilot calls the same functions your clicks do, under your scope, against the same write capabilities. It gets the same refusal you would.
-
02
Two doors, one gate
In chat, destruction waits for your click. Over MCP it is refused outright, because nobody is watching. Only a person in the app can destroy.
-
03
Locked means absent
A locked page answers exactly like a page that never existed. No badge, no teaser, and no read bypass for anybody, an admin included.
-
04
Your data behind its own wall
One Postgres schema per company. Bring your own AI key and it never quietly falls back to ours. Outbound webhooks carry ids and labels, never your prose. Export any time.
PORTS
Two ways in from outside.
- Your agents, over MCP
-
claude ▸ create_task("Rotate DNS") created
- Minted, expirable tokens. The same tools, minus the destructive ones.
- GitHub aware
-
git merge wr-42-wire-stripe-keys → done
- Branch names carrying a task ref drive the task, and the ledger.
Skip the blank canvas.
Describe the company. Get a working plan. Run tomorrow from one place, measured, with an AI that waits for your click.