State of the product · 2026-09-11
A digital chain of custody for physical work.
An AI-native quality-assurance operating system. Every asset, inspection, signature, and approval is tracked from delivery to retirement — and the record is tamper-evident end to end. Here is everything built so far, down to the navigation, the price, and what we say is not there yet.
Prove the work, don't just record it
The agent layer is part of the architecture, not a feature bolted on. Ten AI employees run the back office; humans do the QA on iPads.
A work case physically cannot close while a required step lacks evidence — enforced by database triggers, proven unbypassable even as a superuser.
Records are amended, never overwritten. Every event is SHA-256 hash-chained to the one before it, so the whole trail is tamper-evident and can be re-verified independently.
Row-level security is the boundary. A stolen token hitting the database directly gets the same answers as the app — app checks are only friendly refusals.
A person is one row forever. A client of two firms signs in once and sees both, each isolated. No duplicate accounts.
35 modules, 31 removable. Adding or removing one cannot break the core — enforced by an automated architecture test.
Levels of Commissioning, as a live color tag
The industry L0–L5 progression (CSI 01 91 00), per component. A machine advances one gated, attested, immutable step at a time — the digital equivalent of a technician hanging the next color tag. It shows on the asset, the register, and the printed QR sticker.
Every role sees only its own work
The sidebar, dashboards, and every page are computed from the person's relationship and role. The same lines are enforced at the database, so a direct URL refuses just as the nav hides.
| Role | Home | What they can reach |
|---|---|---|
| Platform admin | Platform overview | Tenants, leads, platform stats. No tenant work content. |
| Company head | Org KPI dashboard | Everything: Operate · Records · Business · Portals · Settings & admin. |
| Manager / supervisor | Org KPI dashboard | Operate · Records · Approvals · HR & crew. No org config or billing. |
| Technician | Org KPI dashboard | Field tools (Operate + Records) and their own account only. |
| Client / vendor / sub | Their portal | Only their own portal (facility / equipment / assignments). |
Every screen carries a ⌘K global search over all tools, a notifications bell for items awaiting approval, an attendance clock, and breadcrumbs. The sidebar collapses to an icon rail; phones get a drawer.
From sign-up to a running QA company
Ten steps from your first login to a company where the field runs on gated evidence, the paperwork writes itself, the AI staff chase what's missing, and the invoice comes from proof.
A single generator, specified to its next life
Twelve stages, one QR code. Each stage: who acts, what the AI employees do on their own, and the proof-gate that must be satisfied before the record can move. Arrival is enforced, and so is leaving — nothing can be skipped at either end. The whole trail is SHA-256 hash-chained, so it is not just complete, it is verifiable.
What's actually in the app
Operate
/dashboard— role-aware KPIs, quick actions, project cards/design— design-phase QA: requirements, discipline sign-offs, deviation catalog/assets— the register: create, amend, search + filters (incl. Cx level) + pagination/assets/[id]— profile, commissioning ladder, QR, timeline, amend-with-note/cases·/cases/[id]— the evidence-gated case runner/inspections— discipline catalog + searchable register/drawings— pin issues straight on the plan; each can spawn a deficiency/deficiencies— aging log, evidence-gated closure/schedule· gantt · exchange — the truth-telling plan/time·/pending— clock in/out, offline field queue
Records
/logs— 7 logs generated from the record (torque, NCR, RFI, tests…)/forms— the no-code inspection builder + recurrence/orders— POs, shipments, tracking, ETAs/closeout— the always-assembled binder + exact missing list/reports— printable, QR-stamped daily/weekly reports/exports— audit · COBie · payroll · billing · schedule CSVs
Business & portals
/billing— rate cards on proven work + QuickBooks bridge/approvals· policy — the human gate for AI actions/portal/client— owner's facility view + accept turnover/portal/sub·/portal/vendor— what they owe
Settings & admin
/access·/access/mfa— profile, audit, two-factor/hr— crew, clearances, per-diem; add crew member/security— the Sentinel's signals & alerts/organization— people, projects, branding, thresholds/transfer— move a machine + its sealed history/platform· leads — provision tenants (platform)
The product, running
Real screens from the live build — not mockups.
Ten AI employees, with first names
The back office is run by ten AI employees — first-class identities, audited like people, no login. Each reasons with a real model, runs on a schedule and on live events, and stops at the human approval gate for anything with a blast radius. They carry a first name and a job so the field can talk about them like coworkers ("Nora chased it"). They hold no surnames, no personas and no credentials — software holds no licence, and a database constraint refuses one. Everything they draft carries an "assisted" tag naming who drafted and who decided.
Workforce Coordinator — checks that every other agent did its job, and escalates what a person needs to see.
Security Monitoring — watches every actor, the other agents included, for anything off baseline; drafts containment for a human to approve.
Document Control — chases every missing document the day it falls due.
Quality Inspection — classifies every deficiency and tracks it against its clock.
Reporting — drafts the daily and weekly reports from the live record.
Closeout — keeps the turnover package current as the work lands.
Asset Lifecycle — tracks each machine from delivery to retirement; flags ETAs and warranties.
Commissioning — runs the L1–L5 sequence and schedules the retests.
Subcontractor Liaison — chases subcontractors for records and keeps the scorecards current.
Compliance — runs NCR and CAPA, and keeps the project audit-ready.
What cannot be faked
Every claim here has an automated test that would fail if it were untrue.
/security.Two numbers, one definition of active, five doors
Published on the site since 2026-09-10 and enforced in the database, not in a spreadsheet beside it.
The platform. Unlimited people — office, crews, subs, the owner. Every module. Closed projects archived and readable. $4,950 a year, two months free.
Per project, per month with an open check. On hold with nothing open: nothing that month. Closed: archived free. The database counts it; nobody estimates it.
Owners and white-label are priced under an agreement — projects, firms, sites, years, an MSA and a DPA. The firm price is the floor, never the number.
Trial — every feature, no card, no cap, and nothing leaves: no exports, downloads, API or QuickBooks push. Expired — read-only, kept 90 days, an upgrade restores everything in place. Active — everything. Lapsed — read-only with the 90-day export window open. Closed — access and files removed; the append-only spine stays sealed. Read-only is a trigger on every org-scoped table; every exit asks the database.
When the builders leave, the record stays. The firm offers a finished site inside the platform; the owner accepts under named terms; the site — machines, cases, evidence, warranties, maintenance routines — moves to the owner's own tenant (created on the spot if they had none) and the owner becomes its customer. The firm keeps its sealed era. Frozen evidence stays frozen in either hand.
One archive: every record as CSV, the audit spine with its hash-chain formula in the README, every uploaded file — streamed as a store-only ZIP the platform writes itself. Imports for rooms, people and machines with a preview and a re-checked write, so a workspace rebuilds from its own export.
A trial agrees to the terms on behalf of the firm and the acceptance is written down under its version; a handover records the site terms the owner ticked. Append-only. The terms of service, privacy policy and the buying page (support, invoicing, DPA, SLA) are public.
Proven, built, opt-in, or not yet
The public readiness register uses four states and no fifth. It mirrors the internal audit dossier and may never be stronger than the code. SOC 2, a penetration test, point-in-time recovery, an incident runbook and an SLA are listed as not yet — in those words.
Tenant isolation · the audit trail and hash chain · evidence integrity · plan enforcement. Each row names the suite that would fail if it were untrue.
RBAC · TLS + HSTS · encryption at rest · CSP and database-backed rate limits · the security sentinel · US residency (AWS us-east-2) · export and deletion.
TOTP MFA (built, not enforced org-wide). Not yet: backups/PITR, IR runbook, dependency scanning, pen test, SOC 2, SLA.
Around it, the pages a buyer's engineer and a procurement reviewer ask for: /technical (eight pages naming the functions, tables and tests), /glossary (44 terms), /faq (47 answers in eight groups), /guides (commissioning, turnover package and punch list software — each with a "where we are thinner" block), /how-it-works as a forward walk, and /trust/buying for the contract questions. Subprocessors are listed: Supabase, Vercel, Google (Gemini), Intuit if connected.
Where to push to become the best
Honest, high-leverage bets — candidates to weigh together, not a committed roadmap.
Developer portal
The public API works today (org-scoped keys; read, plus deficiency creation) and switches on for customers. Next: a signed-in developer console with keys, docs, and webhooks so integrators self-serve.
Auto-gate levels to evidence
Today advancing a level is an attested step. Next: tie each level to its closed case so the gate is automatic, not just attested.
Batch tag operations
Advance and print color tags for a whole delivery or system at once — the field workflow at scale.
Deeper mobile field capture
Grow the offline queue into a true PWA / native flow for gloves-on iPad work with spotty signal — and a walk-mode screen for punch lists.
The go-live list
Operational, not code: email delivery (Resend + domain records), a security@ mailbox, Supabase point-in-time recovery with a rehearsed restore, the CI workflows back into GitHub, an attorney's read of the terms, card processing. Each flips a "not yet" on the register.
Cross-project analytics
Trends, predictive slippage, and benchmark scorecards across every job — the executive lens.
Decommissioning QA
The removal/retire workflow exists; next is auto-generated teardown checklists from the design spec, salvage inventory, and environmental closeout — another phase nobody else owns.