436 rows. 331 done. 105 open, and every one says what it's waiting on.
The Hub's board is the backlog authority for the repo: every row has a status, a kind, an impact and a named blocker, and the agents work from the same file. This page is generated from it, with client names scrubbed out and nothing else changed.
Counted off the board, not typed in.
Board updated 2026-09-01. The percentages elsewhere on this site are the board's own measures, re-earned when the work moves and quoted with their date.
| Measure | Value | Basis | Measured |
|---|---|---|---|
| Design port | Counted off the board | measured | 2026-08-27 |
| Platform — the agent and automation half | Counted off the board | measured | 2026-08-29 |
| Core — the lane the app cannot open without | Counted off the board | measured | 2026-08-29 |
| Designed pages that exist | 24 of 24 | measured | 2026-08-27 |
| Design checks that hold | 26 of 27 | carried | 2026-08-19 |
| Test battery on main | 454 files / 10,021 passed / 0 failures | measured | 2026-08-31 |
The highest-weighted open risk on the board is not a defect. It is that nothing has ever run a job from start to finish through the new run ledger, and the board says so in those words. Treat that as the single most important sentence on this site.
Three gates. Two met. One is now a standing rule.
- The merge wordmetMET 2026-08-21: the surge merged (`defd1666`). Design and platform work now goes straight onto main — no port step, no transplant, nothing to wait for. Kept on the board as a record of a gate that closed, not as a gate.
- The schema sittingwaitingTHREE WINDOWS HAVE NOW RUN — the 2026-08-25/26 pair, the 2026-08-29 launch night, and the 2026-08-31→09-01 sitting (the ten held migrations, then the approvals doors 189000/190000, the validator restatement 197000 and the automations registry/heartbeats/grants 198000–200000; cloud levelled through 20260826200000 with the in-file post-condition gates passing; probe-approvals-rls 24/24 against cloud after the apply).…
- DeploymetMET — most recently the 2026-08-31→09-01 sitting: four production deploys in one night, final the deploy (portal flip live; rollback vercel promote the deploy), all from git-free copies with --archive=tgz, each finished on the headless render check.…
Declared capabilities, and what the board says about each.
Each area declares what it comprises and which parts exist. The percentage counts built capabilities against declared ones, partials at half. A declared denominator, not a measurement: the founder's judgement of what this project is, and his to correct.
| Area | Built | Partial | Missing | Rows | Done | Where it stands |
|---|---|---|---|---|---|---|
| Agents & workflows | 5 | 8 | 4 | 66 | 36 | Execution, gates, receipts, learning. THE SCHEMA ARRIVED (2026-08-31→09-01 sitting): the run ledger, run-origin doors, approvals permission floor with its registry data, approval mint, lifecycle-guard splice and plan-proposal writer are all cloud-applied (approvals probe 24/24), the worker fleet is deployed and enrolled on the ops machine — dispatcher armed and passing, executor enrolled with all spend refused until the founder’s cents ceilings — and the new automations registry is live behind its flag with the first automation ingested and awaiting his approval click. What separates this area from finished is no longer an apply: it is the RM-004 run driver — nothing yet creates a run and drives claim → run → settle end to end — plus one attended gated proof at the Approvals desk. |
| Projects & tasks | 10 | 2 | 2 | 61 | 54 | Work and ownership. The most finished product area, and its last automation defect closed on 2026-09-01: the two live n8n task-creation bodies were surgically corrected in the live store — client on the task, category — and the transition webhook is active, so THE RESET’s automation precondition is finally satisfied. The reset itself stays the founder’s own attended slot, with a read-only dry-run counter still to be built first and one spot-read owed on the first task each corrected body creates. |
| Clients & CRM | 9 | 2 | 0 | 42 | 30 | Relationships and commitments. The directory, record, pipeline, interactions and people surfaces are live; the journey engine’s two live automations now write the corrected task model (2026-09-01) with the transition webhook active for the first time. Open here: the proposal send stays an arming act on the founder’s word, call-ingest is down on an expired Google credential until it is re-issued, and the brief-cover photo question is still his. |
| Client portal | 9 | 5 | 1 | 22 | 17 | What the client sees. THE HOLD IS LIFTED (2026-09-01): PORTAL_ALLOWLIST_ENABLED is true in production after the gate greened — the invite-redemption red was proven environmental, auth-matrix ran 58/58, and client logins now seat on the portal store with RLS as the fence. The held-preview banner is retired. One verify is still owed before the front-door rows close: a real client login walked against production (instrument built; first runs rate-limited, retry scheduled). The booking page is published at its own address pending the founder’s Cal.com availability. |
| Signals & evidence | 5 | 4 | 2 | 21 | 8 | Performance numbers and where they came from. The full worker fleet was deployed and restarted at the sitting (13/13 byte-parity; brain-import-sync enrolled and ran its first pass since July: +81 sessions, +169 outcomes). The honesty guards are live in the running workers with their counters reading zero — vacuous until a real gap, or a seeded one, exercises them (the founder’s call, RM-472). Dead spots named honestly: mail-sweep is down on an expired Google credential, the weekly-recap engine has never been given a client list, and the month-close snapshot insert is refused by RLS on every pass. |
| Knowledge & skills | 4 | 2 | 4 | 20 | 16 | Reusable methods and operating instructions. The docs half remains the most finished thing here, and the skills half moved on 2026-09-01: the automations round’s skills bridge reads and writes skill bodies over the wiki store with byte-faithful write-back, and a locked Skills space is live in cloud Docs with its first synced page. Release control is enrolled and running dark. What has not changed: nothing a running job reads — the leased-source caller is still unwired. |
| Security & access | 10 | 4 | 0 | 34 | 27 | Who may do what, and what a worker can reach. The approvals permission floor is REAL and applied — agents mint and humans decide is enforced in the database (probe 24/24 against cloud) — the master-key cutover is live (19 scoped agent identities, every ops machine worker env off the master key since 2026-08-29, re-proven by the 2026-09-01 parity redeploy), and the automations tables landed with fenced agent-insert grants. Standing open: the anon-grant posture re-measure, the service-role function-grant matrix, storage probes against cloud, and the worker-sandbox stages that need the founder at the machine. |
| Platform & estate | 7 | 5 | 0 | 170 | 143 | The build, the tests, the deploy path, the backups. Reported separately on the founder’s word: no Hub user touches most of it. The deploy path was exercised hard on 2026-08-31→09-01 — cloud DDL levelled through the automations grants, four production deploys, all 13 registered Ops-machine workers deployed with parity checks, two never-bootstrapped jobs found and enrolled — so the lag this section used to describe is spent. Alerting is the honest sore spot: the watchers fire real alarms and nobody is subscribed to hear them. Backups cover the databases; logins and files still have none. |
The whole board. Open a row for its summary.
Open rows first. Titles are written as the defect or the want, not the fix, which is how the board reads internally too.
105 rows · sorted ready → planned → built-dark → blocked → deferred → done, then by impact
Each --once worker performs a fresh GoTrue login on every pass, so limiter pressure scales with the fleet: mass-kicking the 13 workers at the sitting burned the shared login window for about an hour, half the passes failed on “rate limit reached”, and the executor’s first enrolled passes died the same way.…
The automations registry is live on cloud and the section is live in production, but the Library view still falls back to fixtures: the automations and automation_heartbeats tables are not registered in the browser store, so the one swap seam the components read through never sees a live array.…
Operate as if the Australian Privacy Principles and the Notifiable Data Breaches scheme fully apply — the small-business exemption is dying and donor data through paid AI pipelines may void it anyway.…
Write the pilot partner the document that shapes the whole relationship: a staged capability calendar (month one, two, three — derived from scoped-role-first sequencing, with the Salesforce replacement dated as Phase Two, never 'soon') and the four-rung graduation ladder — we host and operate; we host, their admins run it; they own…
Four delivery laws from the red-team pass, adopted as standing practice: a work-in-progress cap of at most two built-dark clusters awaiting a sitting, with anything that would create a third refused at staffing time; a standing fortnightly 90-minute daytime sitting on the calendar, batching as the default; every the founder
The run driver’s probe mode detects a door by posting an empty body — but PostgREST answers PGRST202 both for a function that does not exist and for one that exists with required arguments, so the probe reads present as absent. The sitting had to prove the doors by hand with schema reads instead.…
The ops brief page fetches an optional daily verse from an external service that the browser now CORS-blocks, and the failure reds the real-browser boot smoke on every run — a pre-existing red every deploy has to explain away. Proxy the fetch or drop the verse; either ends the standing noise.…
Uncommitted proposal-gen vendor changes from an earlier seat rode the automations landing train byte-identically and are now on main with a green battery over them — but no owner has reviewed the diff, and the ops machine’s proposal-gen deploy was deliberately held until one does.…
Every established area of the app carries a real-browser smoke harness; the new automations section has none, so its gate today is unit suites plus the one-off render checks from the landing night.…
REMAINDER after sw156 904494e4c: the planner, the predicates and the dark bill-next-stage pass are on main, approvals-gated and idempotent by database key.…
The automations contract gives repo-side hooks a HUB_HEARTBEAT_URL to POST liveness to, and the heartbeats table is applied — but no endpoint exists to receive the POST and write the row, so heartbeats are a no-op end to end and the silence alarm can only watch what workers write directly.…
Before the Salesforce replacement (Phase Two) or any second client: a master services agreement with best-efforts uptime (no percentage SLA), business-hours support tiers, a liability cap at twelve months' fees, a consequential-loss exclusion, a data-processing schedule, a quarterly restore test, and a 30-day full-expo…
REMAINDER after sw373 115c8604e: the maintenance-field consolidation is closed as declined (the README's three reasons are the decision) and drive-sync's incremental mode has a live tripwire that re-measures its own condition each pass.…
Filed from RM-169 (ledger triage), 2026-08-29 ruling: the team-chat gate item. Scope from RM-169's note at staffing.
REMAINDER after sw426 65a9f776c: The mention escalation trigger is drafted whole in docs/audits/2026-08-29-rm-002.md and needs no new preference table (notification_prefs already exists and the drain honours it), but it is not a file under supabase/migrations/; an integrator must reserve a stamp and create it, and the
REMAINDER after sw147 255a10f4f: increments 1, 3, 4 built; increment 2 = the apply of supabase/migrations/20260826144000_write_run_recap.sql at the sitting; the agent-api edge deploy rides the deploy word; increment 5 deferred by rider; RM-357's caller and filing question unchanged.
The website-performance panel's read-model wiring has been on main since 2026-08-18, spec-conformant and tested — the board had this as unwired, which was false.…
REMAINDER after sw149 fb400526f: the proposal contract, the assembler and the task-page section are built; nothing drafts a proposal because no planning-pass caller exists.…
REMAINDER after sw149 fb400526f: the gate ladder, the recorded low-stakes skip and the desk card are built.…
REMAINDER after sw423 0c48268e9: The migration 20260826172000_run_origin_rpcs.sql is authored in full and proven on the scratch stack but is not in the repo, because sw423's owns cell carries no supabase/migrations/ path and no stamp was granted; it is parked at ~/surge-briefs/pending-grants/sw423--supabase-migrations-
REMAINDER after sw425 5f5bc070d: The applied materialise_jobs does not insert id, so Postgres allocates task_run_jobs.id from the column default while the landed materialisation trigger rebuilds the expected binding envelope with new.id — every agent, action and transform job therefore raises 23514 whatever a caller se
REMAINDER after sw005 b3cd28936: The two one-line seams sitting 5 named and left for orch's word are DONE and mutation-proved, both in executor/lib/executor.mjs.…
The panel is back on the branch and each person's own-key slot is built and tested. The server piece that decides whose request uses whose key is written and tested but not deployed, and no real provider call has ever been made.
The founder ruled 2026-08-20: history is never re-scored. Today both report hooks read the LIVE client_targets table, so moving a target silently rewrites every past report. Implementation ruled 2026-08-27: targets are FROZEN INTO the snapshot at capture — no target-history table.…
The two ceilings meant to stop overspend both read their inputs in a way that can only ever come out too low — an unbounded read that silently stops at a page limit, and blank charges counted as free. Both fail in the direction of letting more spend through, not less.
A single run has a time limit and a per-pass limit, but there is no ceiling on the total across a day. Metered spend is unreachable today by construction, but once it is switched on nothing bounds the cumulative cost except how much work is queued.
Agent-produced artefacts get reviewed in the existing Reviews surface: preview embedded, comments, the client optionally invited. Accepting there feeds the task gate’s single approvals record — never a second approval store.
Legs 1 and 2 are closed: the call-ingest cloud migration was found already applied at the 2026-08-31→09-01 sitting (push no-op, recorded) and its RLS probe ran 36/36 against cloud; the worker’s lead matching is live.…
The pure planner and its mention grammar shipped dark on 19 August — and the writer exists: startFromComment’s seam runs after every comment insert, dark behind the flag. The flag row is absent, cards are born pending, executor supply is off. Remaining work is the arming decisions, not a writer.
Every boot that lands on a /task/<id> address — deep link, legacy #task=, or a plain reload — rewrites the arrival entry to /projects/ and PUSHES the task on top: Back takes two presses to leave and reloading a task page grows the stack while corrupting the entry you were standing on.…
REMAINDER after sw337 f3d437ee4: Run one uncontaminated 25-battery before and after arm once the unowned deterministic RM-319 update-me test is re-pinned; neither voided arm is evidence.
REMAINDER after sw368 6b9707011: the door is built — the Drive page calls the deployed upload function through a narrow client that never sends a folder and never mints an operation id per retry — so the app can now reach the upload.…
REMAINDER after sw149 fb400526f: the filing row and the task page-link pointer are built; nothing calls them because the recap writer (RM-147's write_run_recap) is still paper DDL. The caller follows the sitting that applies it.…
REMAINDER after sw361 fe2dde71e: none in code — the three Forms sub-pages (submissions, content editor, preview embed) are built and reachable through the section-tail mechanism. They are client-facing and stay unreachable until the client gate (RM-366) flips with the deploy word.
Argued in the pitch prose as the alternative to an audit army. No code, no owning phase.
REMAINDER after sw236 7560237aa: RM-358 partial — the dark state now states itself, but seeding fleet_rollup_flags and pointing the page at real rows both remain (migration + RM-001).
REMAINDER after sw359 042acec78: REMAINDER is now the spine half ONLY — the 25 parked probes have landed as dispatcher/test/spawnledger.test.mjs (042acec78, suite 265->290 green), so that clause of the remainder is discharged.…
REMAINDER after sw437 50c12bd90: The link is built, validated and gated on config, but no address exists to put in it: book.agencyastro.com is NXDOMAIN and the ingress that would publish the self-hosted Cal.com on this ops machine (127.0.0.1:8460, alive but private) is deliberately commented out and gated on the founder because it c
REMAINDER after sw001 dfd6dc068: the offline half of the end-to-end harness exists and runs (22 checks) and its live half feature-detects and skips by name.…
Several background jobs turn “nothing was recorded” into a confident figure — a client’s weekly recap can show search-ranking gains that never happened, every client can be seeded “$0 owing” before their real balance is folded in, and spend and overdue figures can read $0 when the truth is unknown.…
When the accounting mirror has a gap and a balance comes back blank, the system reads blank as “zero owing”, marks the invoice paid, and advances the client’s lifecycle stage. A hole in the data becomes a real, wrong change to the client record.
The one working alert channel has zero devices subscribed, so real “your data went quiet” alarms fired on the morning of 20 August and reached nobody, while two workers sat failed and unnoticed. There is no watch on whether the Hub itself is up, and no report of front-end errors. The estate logs well and alerts no one.
The always-on machine holds worker settings, the accounting-connector token and a network credential that exist in no backup, there is no written “rebuild from zero” procedure, and its disk encryption is switched off — so physical theft exposes the keys in plain text.
REMAINDER after sw149 defc24452: Planning seal increment 3a waits on a trusted dispatcher-visible task and planning-facts contract.
REMAINDER after sw158 a84d4a96e: Switching outgoing proposal send on is a live n8n arming act held by the founder until the client portal opens, and its artefacts are outside this repository.
Capture 17 section 13: all existing tasks (Asana imports included) deleted; real tasks created new under the corrected model (client on the task, the nine, the five, the seven). Archive-schema snapshot first (the 170000 pattern); time_entries and comments/activity cascades noted.
REMAINDER after sw426 64a8cbadf: The ruling is given and both RM-426 files are now stamped on the branch (20260826182000_mint_action_approval and 20260826185000_guard_job_lifecycle_scope_splice, WRITTEN-NOT-APPLIED), so what is still owed is the founder's apply of the two files after 20260826170000, and D1 (decide_workflow_
One lane for the three solidification sweeps that need the building to have stopped, because each one measures or removes things the fleet is still editing.…
The RM-269 fix is live and read back — both n8n task-creation bodies carry client_id and category_id — but the one FIXED-IF clause not yet observed is a task actually created by each body carrying both. When the first real transition and the first real stall land, spot-read the created tasks.…
The pilot partner's pilot cohort uses the Hub on an extended version of the contractor-style scoped role — staff who can work their own records and can never see Agency Astro's clients — instead of waiting for full multi-tenancy.…
Design and first build of the generic records engine: shared records with typed, reportable columns for the fields that matter, loaded per record type when a screen opens rather than all at boot, so the pilot partner's non-agency records (donors, teams, missions) land greenfield without touching legacy CRM data.…
Where every class of credential lives, ruled once: the tiered placement map (money and email behind mandatory human approval gates; write-action keys in a vault; OAuth tokens with a token-lifecycle service; read-only analytics keys where they are used; platform secrets in a separate compartment nothing client-facing ca…
Pitch law says the IP schedule is signed before day one of the the pilot partner engagement, and it is still unsigned with the fortnight targeted at 05 September.…
REMAINDER after sw008 7af071cb0: The census now reads 20 stamped of 21 and the one named remainder, src/components/crm/portal/reports/reportSnapshots.js, is B2's path, so this row closes only after B2; F-1 (the source_pull table and the freshness views) is B4's file-only cell and F-2 (the worker writers that record pul
REMAINDER after sw078 d5e3ab78f: The private runner transport, live publication broker, hostile default-broker tests, attended credential and arming acts, and a live end-to-end proof are still owed.
A few background jobs read growable tables without paging, so past a hidden limit they quietly stop seeing rows — deleted client-library files never get cleared, imported records get orphaned, and a mailbox scan can miss messages because it pages with no stable order.
REMAINDER after sw368 e82a6e1bf: INC-4/5 still owe two things this cell could not reach: the open-month opt-in (one line in monthlyModel.js, measured to red 23 assertions in tests/mockupHubMonthlyReport.test.js whose fixtures are hard-dated to the month containing now) and the hook's client_monthly_snapshots read in us
REMAINDER after sw209 aa9cc2c2c: The photo now reaches the client's Google Drive folder through the one existing door, but the Brief hero still paints its frozen gradient — making an uploaded Drive photo BE the cover needs one durable client-to-Drive-file link, and clients.cover_url was deliberately retired by a net-ze
The new write fence stops new task/project client disagreements and hides the 29 existing ones from clients, but they are still wrong facts: a task carrying one client while sitting on another client’s project. Each needs a per-row call — move the task or fix its client — proposed by a lane, applied in a seat window.
REMAINDER after sw385 8ff221f4f: The ruled hunk is built and live and the smoke's static leg — the leg this row was filed on — is green, but two things outside this owns cell remain.…