Product · Console

Every decision, the rung that made it, and the confirm behind it.

You cannot revoke what you cannot see. The console is the reference implementation of the kernel: one queue for the work that needs you, one inspector for why anything happened, one page where authority is granted and taken back, and one dashboard that shows what stopped needing the model.

See it on your traffic Quickstart

The tour

Eight pages. Nothing you cannot explain.

The console does not seed demo data and does not phone home. What you see is your SQLite file, read through the same functions the CLI uses.

Today

One item at a time: a staged draft with its source, or a decision waiting on you. Confirm, edit, or park.

Queue

One button per work type. Take the next item, resolve it, and confirm each staged row on its own.

Decisions

Every Decision with its rung, the rule or pattern version, tokens, and verdict. Click one and replay it.

Patterns

Proposed with evidence, promoted through the gate, revalidated, or retired for good.

Usage

Conversion rate, tokens avoided, interrupts, demotions, unsafe fires. Same numbers as the CLI report.

Connect

Models, Gmail or IMAP, and connector YAML. Credentials land in the encrypted store and are never printed.

Agents

Drafts from a plain-language interview, a doctor verdict, and a simulated week before go-live.

Blockers

Work that stopped: dead-lettered jobs, unrouted mail, and judgment the ladder could not resolve.

Queue

One click per work type. One confirm per staged row.

Each agent declares its work types and the button that takes the next one. The queue packs the context, walks the ladder, and shows you only the residual. Staged actions sit beside the item with their own Confirm. Nothing on this page executes until you press it.

Take the next item for a work type, or open a specific one. The packed context is what the model would have seen.
Resolve with a choice. The choice is recorded against you as evidence for the learned rung.
Confirm each staged action separately. Confirm is execution: it enqueues the outbox job in the same transaction.
Delegate to a teammate from the same panel. The delegation is itself a staged action.

console · queueillustrative

Work types

Incoming contract4
Signature request2
Expiry review7

Northgate Pty Ltd · services agreementincoming_contract

Counterparty: Northgate Pty Ltd · known
Signature: counterparty signed · ours missing
Value: 18,500 money_legal
Resolved by: rule · missing-signature · 0 tokens

Staged

request_signature
Send signature request to legal@northgate.example
Confirm
escalate_review
Route to the value reviewer
Confirm

ParkResolve

Decisions

One screen answers why anything happened.

Every Decision carries the winning rung, the versions of the rule and pattern sets it ran against, the tokens it cost, and the human verdict if there was one. A learned fire also carries the pattern id and version, the replay that certified it, and the envelope it fired inside.

Replay re-walks the ladder at the stored evaluation context. It writes nothing and never calls a model. Match, or the name of the dependency that changed.
Was this wrong? records a counterexample. The pattern stops firing and the work returns to judgment.
Historical rows never change. A pattern edited after promotion is replayed against the WHEN and THEN captured at promotion, not the current one.

console · decisionsillustrative

d_41c…9e0qualify
0structured
d_9f3…c21triage
0learned
d_a02…77benrich
1,140llm
d_b7e…d13decide
0judgment

Rung: learned
Pattern: renewal-note · version valid
Replay: certified against your history
Envelope: action · request_signature
Rule sets: rules valid · patterns valid
Tokens: 0 · input 0 / output 0
Human verdict: none

Replay: match · same rung and artifacts at the stored contextWas this wrong?

Patterns

Authority is granted here, and only here.

A proposed pattern shows the WHEN it mined, the THEN it would take, and how far through the replay gate it is. Promote is disabled until replay against your own history certifies it. Retire is permanent. Revalidate re-runs the gate and, on a pass, leaves the pattern verified but inert until you promote it again.

proposed · never firesactive · fires inside its envelopesuspended · skippedretired · permanent

Induction runs when you ask it to (engine induce), never on a schedule. Promotion goes through one function in the kernel. The CLI refuses to bypass it, and an imported agent starts with no active patterns.

console · patternsillustrative

proposed
WHEN signature_status = counterparty_signed · counterparty_known = true
THEN stage request_signature
replay in progress · not yet certified
Promote
proposed
WHEN expiry_within_days ≤ 30 · renewal_clause = present
THEN verdict flag · draft renewal note
certified by replay · ready to promote
Promote
active
WHEN checklist_complete = true · signature_status = fully_signed
THEN verdict allow · file
fired 212 times · binding valid
Retire
suspended
WHEN signature_status = fully_signed · expiry_within_days > 90
THEN verdict allow
revoked on counterexample · skipped at fire time
Revalidate

proposed never fires · promote after replay certifies it · retire is permanent

Usage and conversion

The dashboard and the CLI report are the same function.

There is no summary table and no hand-maintained number. Every figure is recomputed from the decision log as of the evaluation clock, per ISO week. What the dashboard shows is what engine report prints.

Conversion rate

Of decisions in episodes that once needed a model, the share now resolved at the learned or structured rung, per week. A week with no eligible decisions is n/a, not zero.

Tokens and cost avoided

The measured average tokens of model rows for the same skill, provider, and model, applied to each decision that no longer used one. List price, not an invoice. Not a projection.

Human interrupts

Judgment-rung decisions plus staged actions still pending. Not time spent, not every time someone opened the queue.

Demotion events

Skips because something the rule depends on changed, and revocations on counterexample. Counted separately because they are separate log rows.

Unsafe fires

An executed action whose work item later received a reject or override. Always shown, including when it is zero. Zero is not a safety proof.

Time to first conversion

Weeks from the first model or judgment decision in an episode to its first learned fire. Episodes that never converted are omitted, not averaged in.

definitions from docs/conversion-metrics.md · every metric lists what it does not claim

Connect

Credentials in, never out.

Model keys, the Gmail refresh token or IMAP password, and every connector secret are written to the encrypted store with AES-256-GCM and read by key name at execution time. The console never prints a secret and a connector YAML that inlines one fails doctor. Connector calls are HTTPS only, resolved against a private-address guard, with bounded bodies.

GmailIMAPOpenAI and Anthropic surfacesConnector YAMLMicrosoft 365

Agents

Describe the work. Approve the simulated week.

An agent is a folder of YAML, but you never have to read it. The interview writes a draft, doctor validates it and names the file and the fix when it is wrong, and simulate replays synthetic history with the model mocked to produce the report you would have received on a Tuesday. You approve the simulation. Local SQLite is go-live.

interviewengine doctorengine simulateengine upgrade with drift check

The console runs on a single-tenant appliance behind your network, or embedded via the SDK. OIDC login through your identity provider gates every route, with viewer, approver, and admin roles, and every confirm, dismiss, promotion, and retirement is attributed to a named user. Hosted instances for the small tiers are on the launch plan.

shipped

Bring the traffic. We will show you the queue.

Design partners run the console against their own decision stream. The patterns page fills with proposals from your own decisions, and the conversion line is computed from the same log.

Apply How the kernel decides