Workweaver
Goal in. Work out. — set the goal. It works until it's done.

00How to read this#

This document is a map, not the territory. The territory is the code and the live GitHub issue ledger.

• Single source of truth. docs/canonical/PRODUCT-CONTEXT.md is the canonical product spec; AGENTS.md is the canonical, harness-agnostic working contract; the skills/ registry holds procedures. This file distills them into one readable briefing — when they disagree, they win.
• Code-truth wins. If the code does not back a claim here or in any doc, fix the code or fix the claim — never both silently, never neither. Before you assert a capability is "done," prove it on a real path.
• Status lives in issues, not here. What is shipped vs in-flight is the live issue ledger. §09 gives the honest shape as of this writing; for your area, search the issues.
• You are an agent in a swarm. Read the operating mind (§10), the autonomy loop and gates (§11), and the playbooks (§15) before you touch anything. The bar for "done" is high and explicit (§10, §15-E).

01What Workweaver is#

Not AI bolted onto existing workflows — the substrate where memory, identity, permissions, tools, agents, time, evidence and policy are native primitives, organized as a company you chair.

Every current-generation AI product augments what users already do: better autocomplete, smarter search, a chat panel beside the real work. That is the co-pilot model, and its ceiling is structural — fragmented apps, per-tool context silos, human-mediated coordination all stay intact. Workweaver's premise is different: rebuild the company around intelligence, not augment old workflows with AI. The unit of capacity is no longer an employee-with-a-tool; it is a self-organizing autonomous swarm sized to the goal. Humans chair the org — they set goals, hold judgment, steer at the altitude of strategy. the agent runs it — she plans, coordinates, supervises, explains, and improves. The swarms are the army that executes the defined work end-to-end. The question is not "how do we give people AI superpowers?" — it is "what does a company look like when every operator has a CEO who never sleeps, and the work comes back with a replayable record?"

The two engines of the moat

1. Cross-system context. Records become entities become a cross-system graph the agent can traverse. "Regional sales in the CRM vs inventory in the ERP" is answered in one hop because crm:account same_as erp:account is a real edge, not a join a human writes.
2. The compounding loop. Every retrospection, steering correction, guardrail breach and decision writes back into skills and memory so the next run is better. Advantage accrues to whoever owns the harness, the context and the memory — not to the point tools.

02Primitives & canonical nouns#

Uniform names across code, UI, CLI, MCP and marketing. No translation tables, no internal-only aliases. A capability that cannot be discovered does not exist.

Durable contracts (the atom set)

Nine atoms exist in code with API+CLI+MCP surfaces and tests; no primitive may exist only as prose: WorkItem, TimeBlock, Pulse (liveness — no silent stall), Thread (durable cross-channel conversation), WorkMemory, Topology (who-sees-what graph), Variant (proposed improvement with baseline/metric/counter-metric/rollback), Entity (canonical identity across channels/time), Decision (auditable why). Supporting substrates: Evidence Ledger (append-only proof — what happened), Decision Trace (the inspectable proof surface — why it acted + what changed), Goal Graph (the projection every list/board/calendar/PM-writeback is a view over), CapabilityRegistry, PolicyDecisionEnvelope (the governance verdict).

03The Golden Journey#

Every coding task advances this journey or it is drift.

Intent → Context → Triage → Ready → Release to TimeBlock → Govern →
Execute → Evidence Review → Acceptance or Correction → Learn → Skillify → Reuse

1. Intent arrives in any channel — Slack/WhatsApp/Telegram/email/voice/dashboard/CLI/PM-ticket/ACP from an external agent.
2. The agent loads context from Operational Context + WorkMemory, scoped to Workspace + permitted Members.
3. The agent interviews / shapes the goal — extracts a measurable target with counter-metrics where measurable, qualitative success criteria where not. Forcing a loss function onto what cannot honestly be measured is how you optimize the wrong thing (Goodhart is real).
4. Raw intent enters triage, is enriched into backlog/ready work, and checks existing Skills first (reuse is mandatory).
5. Release to a TimeBlock is the execution control boundary — manual, or by an explicit, revocable, scoped, Decision-Traced autonomy policy. Governed execution starts only after release.
6. User steers in natural language; every steer is a Decision Trace entry.
7. Governed execution by swarms — live evidence per step, live metering visible, channel compliance preflight before any outbound side effect.
8. Outcome reported for review with Decision-Trace proof. Completion is provisional until the user accepts; a proof comment or local marker is not source-system completion.
9. User accepts, rejects, or reshapes. Acceptance finalizes productivity/OKR state + WorkMemory learning; rejection becomes correction/anti-pattern evidence.
10. Retrospective + Skillify process every execution, success or failure. User confirmation gates promotion into reusable precedent.

04The intellectual substrate#

The enduring asset is the execution-memory graph — and being in the write path at decision time.

WorkMemory — memory vs storage

Storage = bytes-on-disk, immutable evidence (DynamoDB/Postgres/SQLite + S3/GCS/Azure object lock or local file lock). WorkMemory = the epistemic layer: synthesized, scoped, versioned facts that carry source, confidence, layer, time, provenance, author. The boundary is the Fact — an atomic claim with confidence, layer (raw/calibrated/precedent/principle), source Evidence id, scope (member/team/department/workspace/shared/cross_workspace_via_permission), lifecycle (active/archived/superseded). A Fact without an Evidence link is not durable. WorkMemory may consolidate, supersede, archive, decay, restore — but may not silently overwrite; contradictions are surfaced through contradiction edges.

Unbounded storage, bounded recall. Hot recall returns ranked facts + provenance; callers may bound by max_tokens or request lossless source hydration. Recall runs a real embedding/hybrid stack (BM25 + KNN + RRF fusion, post-fusion graph/source signals, rerankers). Precedent is in the index, not a side tool: prior Decision Traces fuse into canonical recall as a first-class source_type="decision_trace" item, tenant-partitioned (cross-tenant precedent leakage is structurally impossible). The compiled knowledge layer nightly synthesizes raw captures into concept pages with source provenance + an integrity lint (the productized Karpathy-wiki loop). Capture fidelity bounds recall, so capture is lossless verbatim with compaction-as-producer.

The world-model test (an earned phrase)

Call it a "company world model" only when all four are true:

1. The model changes what the agent plans, not just what she recalls.
2. It changes which bottleneck is selected, not just which facts display.
3. It changes what is scheduled, executed, or escalated under policy.
4. User and source-system corrections update the model and measurably affect future plans, priorities, skills, or proofs.

The ingredients exist (WorkMemory, Decision Trace, relation store, graph expansion, entity schema registry, evidence envelopes, governed learning). The work is the load-bearing wiring between them. Until that lands fully, the honest phrase is durable execution-memory and context substrate.

The compounding flywheel

Better context → sharper bottleneck detection → better swarm composition → higher-fidelity precedent recall → higher success rates → denser traces and corrections from real work → a stronger graph and better skills → a better next execution. External agents and PM tools are accelerants because they increase write volume and correction signals. Judge every connector/integration/writeback by one question: did Workweaver capture the "why" at the moment the decision became binding? If yes, the graph compounds; if no, it is reading or commenting on someone else's workflow.

Substrate concept map — one stack, four layers, one name per layer

Read this before conflating WorkMemory, Operational Context, the graph, the ontology, Decision Trace, Evidence Ledger, WORM, GoalGraph, or "self-improving." It is one substrate of four layers, and every doc, surface, store, and capability row converges on one canonical name per layer. Status tags are code-truth: live renders real data, planned is designed with a named issue, and ghost is built but not running — a deploy-ghost or an unwired unifier. The canonical model is already written in docs/canonical/PRODUCT-CONTEXT.md § 8; the work is convergence plus a few load-bearing wires, not new substrate.

Same or different? (the jargon-collision table)

The pairs agents conflate, with the honest verdict. "Layered" means different roles in one stack, not rivals.

05The three pillars — the token-capital thesis#

The veteran compounds; the model is fungible. Price the loop, not the tokens.

06Architecture & governance#

Thin runtime, fat skills, fat evidence. The agent is the sole cognitive orchestrator — always-on is dumb infra (a liveness tick), never a second reasoning brain.

The agent & the kernel

The agent orchestrates, schedules, follows up, prunes — she does not directly execute business workflows; workers, deterministic tools and providers do. A small set of immutable, owner=system KernelSkills keep her self-aware: process inventory, skill audit, memory consolidation, capacity check, connector health, routing audit — each runs on the agent's identity, emits a Decision Trace, and is governed by the same PolicyDecisionEnvelope as tenant skills. Every prompt-bound segment that originates outside the trusted kernel (user text, connector fields, inbound email, recalled memory) enters context through an UntrustedContextEnvelope — treated as data, never instructions. Dashboard actions are derived exclusively from validated LLM tool calls, never from raw message text.

Governance — the PolicyDecisionEnvelope

Every governed action collapses sub-gates (identity, tool scope, connector scope, budget, risk tier, approval, evolution, tenant pause, side-effect proof) into one verdict: ALLOW · REQUIRE_APPROVAL · DENY · DRAFT. Outbound communication additionally runs ComplianceGuard.evaluate(...) before any provider call (platform terms, warmup, consent, opt-out, rate limits, identity alignment) — a blocking verdict, never best-effort. Approval is authority, not ceremony. The non-negotiables: external text is hostile until proven otherwise; system prompts are not security boundaries; every tool call validated server-side; every side effect has identity/scope/idempotency/audit; payment + chain-write are deny-by-default; evidence is immutable; rollback or compensation required; no silent failure.

Levels of evolution

Tenant isolation (non-negotiable)

Every data surface enforces Workspace isolation at the storage layer — not a flag, not an option. Adversarial tests (apps/backend/tests/adversarial/) are a required CI gate; any failure is a P0 security regression. RLS is forced on the WorkMemory/pgvector tables; the core store relies on tenant-partition-keyed access. Cross-Function isolation inside a Workspace is the next layer of the same invariant.

Capability rollout state — never auto-claim on commit

A capability registry row landing on main is a declaration, not a claim. Each row carries a state (candidate → scaffolded → tenant_ready → e2e_verified → degraded → deprecated); only tenant_ready/e2e_verified translate to "ready" in the agent's awareness. Every user-or-agent-invocable side-effecting capability ships with full surface parity (REST + CLI + MCP + UI + registry + Decision Trace + tests), enforced by CI gates. Capability-built-but-not-exposed — or named-as-if-wired — is unacceptable (§09).

Enterprise-harness thesis & surface discipline (the long-arc moat)

Workweaver is built to be the operating harness any enterprise takes and runs as its own — their models, their sandbox, their eval flywheel, their tacit knowledge, every token visible. The wedge (wiring-gated): “your models, our flywheel, every token visible.” Four principles keep the surface small while the capability set grows without bound:

• Operating-surface / skill separation. A small stable operating surface (To-Do intake, Plan Card, work calendar, Decision Trace) plus an unbounded set of tenant- and agent-authored skills. A new capability is either a skill, an internal substrate, or rejected — it never earns its own persistent destination.
• Surface-count discipline (registry-enforced). A capability that does not bind to exactly one canonical surface is rejected at registry validation (CI), not by guideline. This is the anti-clutter invariant.
• Token-value-per-watt. The harness maximizes outcome-value per unit cost and latency — not token count. Sustainability comes from better defaults, routing, caching, and visibility; exponential usage made cheap, not suppressed.
• General, never hardwired. No business vertical is hardwired into the runtime. Every vertical capability is a skill that descends its own loss on the generic loop substrate; the runtime runs any skill, including skills that carry deterministic code.

Honesty note (wiring-gated): the model/harness/sandbox/tacit-knowledge pillars are real and wired; the eval flywheel is wiring-gated (the production skill-eval judge still defaults to a content-length heuristic; the resolver rubric judge shipped-but-unwired; eval rows are not persisted — #7819/#8717/#8722), and token-value-per-watt is wiring-gated (metering exists, no runtime objective yet — #8896). The inference control plane is tenant-self-managed at the API/vault layer; the Token Capital compatibility certificate / admin-governed model-change gate (#7821) is shipped. Tenant web UI + full UI/CLI/MCP parity for provider config remains the open surface (#7834). Do not present-tense a closed eval flywheel or full wedge line while the skill-eval judge stays wiring-gated.

07Surfaces#

Every UI / CLI / MCP / API surface is a projection over the same primitive registry. They are not separate products. Progressive disclosure is packaging, not removal.

• Tenant product UI: four permanent homes — Mission, Skills, Members, Settings — plus Rooms/More for Voice & phone and WorkMemory, a Meetings launcher in Mission, Connections inside Settings, and chat/Cmd+K as the long-tail spine. Per-Card overlay state is canonical URL state (?card=<block_id>). Settings keeps one canonical tab vocabulary: account, workspace, identity, voice, wallet, connectors, trust, safety, residency, billing, functions, experiments.
• ww CLI & standalone: the same substrate as a local-first command surface; pip install workweaver; offline edge memory cache.
• MCP / ACP / A2A: the agent-facing surface — WorkMemory recall/remember/status + governance tools installable into Claude Desktop, Claude Code, Codex, Cursor, Gemini, OpenCode, OpenClaw, Hermes and generic MCP clients without giving up their native model UX. An OpenAI-compatible facade lets any OpenAI-client tool drive a governed agent turn.
• founder.workweaver.ai — the founder/operator control plane. Gated by an exact founder-email allowlist (not Workspace role). This is where operator configuration lives: pricing catalog, signup policy, embedding/inference policy, cost ceilings, capacity, and feature flags. Every number, price, or limit is a global default plus per-tenant override, never a hardcoded constant. Founder-admin rows keep REST/CLI/MCP/UI parity.

07·Meeting & voice intelligence#

One primitive, four verbs: The agent attends, remembers, proves, and acts. Competitors stop at one verb — Fireflies and Otter transcribe and search; Granola captures bot-free notes. Workweaver chains capture into memory, proof, and action. The full pillar lives in MEETING-INTELLIGENCE.md; this is the honest summary. Status tags are load-bearing.

Disclosed Agent Identity — the anti-impersonation moat

The agent joins as a named, cryptographically-bound distinct agent — the bot self-names as a Workweaver agent at its dedicated agents.workweaver.ai address, with a signed Ed25519 identity assertion bound to a dedicated meeting-join OAuth principal. The join boundary structurally prevents impersonation: a calendar token can never reach the join dispatch. There is no supported mode in which the agent joins as the human user. This is enforced by Workweaver, not left to tenant choice, and is the single biggest meeting differentiator — none of Fireflies, Otter, or Granola solve impersonation.

Capture, transport & participation

The consent / disclosure moat

• Disclosure enforced by default. A recording-enabled join is blocked unless participants are notified; the target is an announcement stating what is recorded, how it is used, who can access it, and retention. A visible bot is not legally sufficient notice.
• Jurisdiction-aware consent — built but unwired. A consent engine modelling all-party vs one-party across 13 jurisdictions, retention disclosure, and opt-out exists in code but has no production caller on the join path; runtime today enforces only a binary confirmed-consent flag (false safety in an all-party state). Wiring it into the join gate is tracked.
• Legal basis: CA Penal Code section 632 (recording a confidential communication without all-party consent) — not AB 2905.
• Explicit per-meeting jurisdiction declaration is the primary signal; auto-detection is risk augmentation only, never the sole basis to proceed.
• Prove everything. Every capture, disclosure, utterance, and post-meeting action carries a Decision Trace, a WORM consent artifact, and an Ed25519 identity assertion — the enterprise and legal moat no competitor matches.

Act — post-meeting follow-through (shipped) & the BYO-notetaker onramp

After a meeting ends, the post-meeting agent does more than list action items: it creates tasks, writes back to the connected CRM (Zoho / Salesforce / HubSpot), drafts and sends follow-up email, schedules a follow-up, and writes to WorkMemory — all auth-gated and Decision-Traced. Status: shipped.

08Deployment models#

One product, three forms, and one substrate. Product capability and deployment topology stay distinct from public commercial terms.

Three forms

1. Workweaver (managed) — multi-Workspace, Stripe-billed, Workspace Admin portal, SLA. The agent runs your operations end-to-end with full Decision-Trace proof.
2. Workweaver (open core) — single-Workspace self-host (Docker/Helm) + standalone ww CLI, AGPL-3.0.
3. Substrate SDK — embed Operational Context + WorkMemory + Skills into any agent runtime via ACP/A2A/MCP. Bidirectional: Workweaver as component AND orchestrator.

Managed billing gates service entitlement, not feature presence — a new managed Workspace lands in trial with the full surface; payment state controls renewal, capacity, SLA, throttle, abuse intervention. Live metering is always visible; dollar-budget enforcement is explicit and off-by-default for self-host. Deployment profiles: managed_saas, self_host_production, standalone, local_native. Cloud-neutral storage classes throughout.

09Current code truth#

Read this honestly. The substrate is real and deep; the gap is wiring density, surface activation, and proof — not primitives.

The blockbuster path (highest-leverage order)

1. Prove it: a required live full-loop acceptance gate + a deploy-truth canary (synthetic-invoke background Lambdas + zip-packaging contract) — kill the false-greens.
2. Activate and validate it: admin-configurable policy → first win on connect → public proof → export surface.
3. Show the moat: the calibration / learning-delta surface (the veteran measurably sharper at day 90 than day 14) + own-&-export (no lock-in). These two are what no closed competitor can copy.
4. Get the user: admit a real design partner, fix the no-op/phantom paths, record the loop, take the first dollar.

09·Blockbuster review & competitive standing#

The honest answer to "is this a blockbuster CEO-and-substrate that beats the field?" — distilled from a 154-agent ghost/competitive/idiot-index audit, a 113-agent UI-completeness/redundancy audit, a 4-model LLM council (grok/glm/gemini/cursor) and a Codex adversarial review (2026-06-19). This section also absorbs the former full-potential strategy doc (moat thesis, scoreboard, positioning kit, failure modes).

Competitive standing (where each rival wins, and what closes it)

The three deciders (the keystone work)

End state status model (so this doc never lies and never needs re-revision)

Every customer-visible capability carries one honest status, sourced from the capability rollout-state ladder (§06), not prose: live (e2e-verified), simulated (works on a fixture/sandbox, labeled), planned (designed; delivering issue named), or hidden (not surfaced until real). The product UI must render this label — never mock-success as if live (issue #8181 makes it a CI-enforced rule). This is why the design below stays accurate the moment each issue lands: a planned · #NNNN tag simply becomes historical provenance.

The blockbuster issue map (end state design vs about-to-land)

Launch is one governed epic — #8177 — with native sub-issue children. The keystone-first spine is #7943 (real ECR/deploy package) → #8161 + #8298 (first value) → #8179 + #8163 (real moat) → #8178 (truthful loop gate) → #8180 (Motion loop). #8178 is the live-loop acceptance gate, not a blanket blocker for every activation or commercial slice.

Honest claims (the marketing discipline)

True today: "governed execution with proof" (every side effect carries a PolicyDecisionEnvelope verdict + immutable Decision Trace); "one connector contract across CLI/API/MCP + an OpenAPI compiler"; "skills that improve from accepted outcomes, with canary rollback." Allowed only after the wires land: "ask one question across every system" (cross-system graph); "compounding intelligence that gets better every week, automatically" (gated on the real proposer #8179); "company world model" (the four-condition test, §04); "millions of skill runs/tenant/day" (a roadmap target). Never say: "zero humans" / "the company that runs itself"; "finished world model"; "reversible" as a blanket promise; any benchmark whose run predates the last embedding/pipeline change.

10The operating mind#

How the operator thinks. Internalize this before you write code — it is the difference between progress and motion.

The idiot index

The ratio of accidental complexity (drift, dead code, misleading names, duplicate impls, phantom surfaces, theatrics) to load-bearing substance. Local = within a change; global = across the product. Every change should drive it down. Removing drift, deleting dead code, fixing a misleading name, consolidating duplicates — these are first-class work, not chores.

Make the requirements less dumb · delete the part or process · simplify or optimize · accelerate cycle time · automate. In that order — and the most common mistake is to optimize or automate a thing that should not exist.

— Elon's algorithm, the operator's way of working

11Autonomy, the role pipeline & gates#

Commits, PRs, merges and cleanup are autonomous defaults. Do not wait for approval at those gates.

The autonomous commit → PR → merge → cleanup loop

1. When an edit set is ready (tests green, lints clean, e2e clean where applicable), commit immediately with a type(scope): subject message. Never amend — each fix is a new commit so history shows iteration.
2. Do your own structural self-audit against the issue's acceptance criteria (code-truth, idiot-index). External council review is manual-only — never auto-run it.
3. Push the branch; open a PR with a Summary + Test plan; monitor CI; address review comments automatically; merge to main when green.
4. Clean up immediately after merge: delete the remote + local branch, remove the worktree. Then git checkout main && git pull --ff-only.

The role pipeline

Router → Planner → Developer → Reviewer → Deployer. The router sends every request to the right role-agent with zero prompting; the developer is TDD-first; the reviewer runs parallel P1 (critical, incl. the code-truth audit against the closing issue) and P2 (quality, incl. the idiot-index audit); the deployer owns commit/PR/CI/merge/cleanup; the optional learner compounds patterns and anti-patterns into the knowledge store when invoked.

Worktree & branch discipline

Concurrent agents share the main checkout. Work only in your own worktree with absolute paths; never cd into another agent's checkout; verify your pushes landed on origin. If on the default branch, branch first. Leave the repo clean at the end of every unit: on main at latest origin (or a fresh branch), no untracked/unstaged files, no in-flight rebase/merge, no stale worktrees, no orphan merged branches.

12The harness fleet & council#

Workweaver is built by a self-organizing fleet of coding agents, steered at the goal level. You are one of them.

13CI / infra hard-won lessons#

Distilled from sleepless nights optimizing the wrong layer. The fleet was routing-bound, not capacity-bound.

• Generic runners beat clever overflow. Any runner can take any job, OOM-capped by count; dead-simple onboarding. CodeBuild-style pinned overflow strands jobs (pins a label then idle-exits while local runners sit idle). GitHub-hosted stays the burst tier.
• The drain is gated by deterministic main-level test failures, not capacity. Docs-only PRs pass via scoped CI and mask a deterministic failure; the fix is to run the failing test on main HEAD and fix the one deterministic failure to unblock all code PRs. Admin-merging past a gate is the poison.
• Branch-protection over theatrics. Prevent structurally (rulesets, required checks); never rely on a self-healing auto-revert robot. Merge-queue is overkill at low volume.
• Capacity = config + one invariant test, not a daemon. Subtract before adding; one-off ≠ root cause.
• Drain gradually (~6-8 active PRs) to avoid load-flakes; gh pr update-branch (not rerun) pulls merged fixes into a PR's CI; gh run rerun replays a stale trace-cache — use a fresh push to verify routing changes.
• Hosted-minutes & packaging traps are the classic silent forever-queue / dead-on-deploy causes — never corrupt routing config to "fix" them; fix the real binding.

14The research orbit#

The external sources that shape the thesis — useful when you need first-principles grounding or competitive bearing.

• moatFoundation Capital — context graphs & the compounding-loop essay: be in the write path at decision time; decision traces are the enduring asset.
• visionNotion — Steam, Steel & Infinite Minds: AI chat on old tools is the waterwheel phase; redesign the org around "infinite minds."
• orgBlock — From Hierarchy to Intelligence: hierarchy is an information-routing protocol; AI replaces the routing function; people move to the edge for high-stakes judgment.
• marketArora / All-In: three buckets (AI SaaS, agent-native infra, pick-and-shovel); the GUI is dying; the harness that compresses false-positives wins; autonomous systems emit ~10× the telemetry.
• memorygbrain & supermemory / memorybench — the OSS memory + MCP ease bar Workweaver must match (one-command install, scoped keys, graph-augmented retrieval).
• competitorsMotion (auto-scheduling/replanning), Lindy (proactive cross-app assistant), Viktor (agents-as-hires), Arrowhead AI (autonomous ops): PM/task/calendar intake + schedule repair are the minimum credible first loop, no longer differentiators — exceed them by capturing the decision trace, releasing governed agents, compounding memory + skills, and answering cross-system questions no single SaaS can.
• RFSYC "Software for Agents": agents need APIs/MCPs/CLIs, not brittle human UIs — supports the agent-facing stance.

15Operating playbooks#

Procedures live in skills, not this briefing. Use the canonical playbook for the task:

• Issue → PR → merge: skills/dev/workweaver-autonomous-delivery/SKILL.md
• PR/CI drain: skills/dev/workweaver-pr-ci-babysitter/SKILL.md
• Issue authoring: skills/dev/workweaver-github-issue-authoring/SKILL.md
• Done proof: skills/dev/execution-verification/SKILL.md

16Field notes & honest gaps#

Hard-won truths that are easy to forget and expensive to relearn.

• The systemic verdict: substrate-rich, surface-and-activation-thin. The repeated failure mode is "naming-as-if-wired" — a capability advertised in the registry/docs but whose composition root is never invoked. When you touch an area, check whether the thing is actually called, not just defined.
• Strategy reframes worth more than the roadmap: the wedge (import → schedule → writeback) must not become the whole story; it feeds the graph with real work so the substrate compounds. Writeback is copyable; the write path (the decision becoming binding inside Workweaver, with proof) is the moat.
• WorkMemory honest mechanics: recall runs the real hybrid stack today, but the background promotion during Sleep-Time Compute is still a deterministic heuristic consolidator (exact-string grouping + a fixed contradiction table) — model-grade semantic consolidation and embedding-based concept clustering are tracked follow-ups. Don't claim them as shipped.
• The agent self-awareness: bind, don't build. The KernelSkills + awareness registry exist; the work is wiring them into the live planning path, not inventing a second orchestrator. Always-on is a dumb liveness tick, never a reasoning "Conductor" agent (that raises the idiot index).
• Security & identity deep cuts: hire-time identity_mode (shared/dedicated) and action-time action_identity (zara_owned / delegated_human / draft_only / denied) must never be conflated. Payment + chain-write are deny-by-default with KeyCustody as a non-exportable signing oracle. The self-host no-password mode must be fenced behind an explicit insecure flag + non-loopback guard.
• The operator's voice (pushbacks distilled): don't add a structure per flake; subtract before adding; one logged-in stranger getting a felt outcome beats any amount of internal proof; numbers belong on founder.workweaver.ai, never hardcoded; deploy through the pipeline, never hand-deploy; never seek macOS Keychain access.

17Appendix & glossary#

Canonical file map (where truth lives)

Glossary