Credentials are hashed on this PC. Stripe handles card payments; entitlements stay local so you can work offline after activation.
Existing Admin / demo users still work. Your browser may offer to save the password after a successful sign-in.
Legal
Complete your plan
Review features and continue to secure checkout.
Administrator Master Console
Access & privileges only — this hub does not monitor how users work.
Loading ops summary…
Account types are shown side by side. Check or clear a feature to control what each account type can access.
Privilege changes only (create, tier, suspend, keys) — never product usage.
Live fleet nodes from /api/admin/console. This is a status view, not a control surface.
Audit projection from /api/admin/console: integrity, recent events, and chain metadata only.
Accounts in grace or past grace (billing cycle only). No prompt or usage analytics.
Registered agents
Active claims
Start fleet on this PC
.\scripts\run-builder-fleet.ps1
Exports are encrypted Flywheel backups, not plaintext databases. Restores are staged and run before the database starts on the next restart. Support bundles are redacted zips (versions/health) — they do not include prompts.
FLYWHEEL
ENGINE // PERFORMANCE MONITOR
Custom layoutNo saved custom layout.
Live actions only. System limits have not been refreshed this session.Live: executes durable queued work through installed local models.
…
Your wheel only
Checking local health…
Dashboard
Flywheel visualization workspace
ACTIVE ORBIT
Budget —
TPS—
ACTIVE—
RESIDENT—
QUEUE—
CPU—
LINKIDLE
Live fleet uses local Hub APIs only.
Choose a worker category, then select an available worker.
Local model inventory uses the Hub orbit API only.
3D Cognitive Map // TUCE projection
Interactive laboratory projection of the Trident Unified Core Engine (TUCE).
Rotate and explode the map, inspect the 21-node role preset, or Switch to Region shell with real installed models packed inside each 3-D boundary.
Anatomical names organize the engineering display. Complementary occupancy is nominated, not certified.
Opening 3D Cognitive Map…
Surface
Presets
Display
Interaction
Viewport
Flywheel orbit active. Open tools to tailor the canvas.
Tip: drag to move · pinch / scroll to zoom · double-tap to re-center · arrows/WASD pan · +/− zoom · 0 reset.
Agent Constellation
Loading durable agent states…
Constellation list / timeline
Accessible list
Timeline
Loading accessible constellation timeline…
Run Theatre
No measured events to scrub
No current event
Run Theatre loads measured route/load/generation/validator/repair/tool/artifact events only.
Latency Waterfall
Measured total: …
Accessible list
Loading latency waterfall…
RAM Choreography
Stack
Timeline
Loading RAM choreography samples…
Offload timeline
Provider support
Events
Loading offload timeline…
Context Pressure
Loading context pressure…
Model Residency
Carousel
Load-time savings: …
Timeline
Loading model residency timeline…
Live Model Residency
Unavailable
Loading provider residency…
Model Resource Facts
Unavailable
Loading live model resource facts…
KV-cache Estimate
No architecture input
Read-only estimate; no provider call or runtime mutation.
Context Cost Categories
No context inputs supplied
Prompt, image, tool, retrieval, output, and workflow costs stay separate; estimates disclose their sources.
Resource Preflight
No preflight run
Read-only estimate; no provider call or runtime mutation.
Resident-set Policy
Preview a model combination and concurrency policy. This never loads or unloads models.
No policy preview
Server-owned policy; no automatic unload or concurrency change.
Unload / Keep-alive Advice
Unavailable
Read-only advice; no provider action was taken.
Route Sankey
Loading route sankey…
Escalation Ladder
Loading escalation ladder…
Repair Tree
Loading repair tree…
Validation Shield
Loading validation shield…
Trust Report
Loading trust report…
Trust Report formula
Loading trust report formula…
Flywheel Momentum
Unavailable
Operational improvement index, not an intelligence score.
Loading measured momentum...
Momentum sample gate
Checking 20-outcome display gate…
Large Model Avoidance
Unavailable
Loading large model avoidance…
Cognitive Bridge Save
Unavailable
Loading cognitive bridge save…
Token Treasury
Unavailable
Loading token treasury…
Local Cost Equivalent
Unavailable
Loading local cost equivalent…
Quality per Minute
Unavailable
Loading quality per minute…
Quality per Watt/Joule
Unavailable
Loading quality per watt…
Context Efficiency
Unavailable
Loading context efficiency…
Recovery Efficiency
Unavailable
Loading recovery efficiency…
First-Pass Yield
Unavailable
Loading first-pass yield…
Time to First Validated Outcome
Unavailable
Loading time to first validated outcome…
Activation Completion Rate
Unavailable
Loading activation completion rate…
Setup Friction Events
Unavailable
Loading setup friction events…
Activation Analytics
Opt-in: off (default)
Unavailable
Loading user-controlled activation analytics…
Ready / Degraded Capability Counts
Unavailable
Loading ready and degraded capability counts…
Pack Health and Drift Status
Unavailable
Loading pack health and drift status…
Disk / Memory Actual vs Planned
Unavailable
Loading disk and memory actual vs planned…
Download / Install Time vs Estimate
Unavailable
Loading download and install time versus estimate…
Privacy Posture Indicators
Unavailable
Loading privacy posture indicators…
Model / Tool Health Freshness
Unavailable
Loading model and tool health freshness…
Capability Coverage Map
Unavailable
Loading capability coverage map…
Recommended vs Customized Components
Unavailable
Loading recommended vs customized component comparison…
System Uniqueness Map
Opt-in: off (default)
Unavailable
Loading optional System Uniqueness map…
Repair Success / Mean Time to Readiness
Unavailable
Loading repair success and mean time to readiness…
Sample-Task First-Pass Yield
Unavailable
Loading sample-task first-pass yield…
Metric Tables & Exports
Unavailable
Loading accessible metric tables and exports…
Stability Streak
Unavailable
Loading stability streak…
Model Specialty Cards
Unavailable
Loading model specialty cards…
Model XP / Badges
Unavailable
Loading model XP/badges…
Agent Contribution Map
Unavailable
Loading agent contribution map…
Council Diversity
Unavailable
Loading council diversity…
Council Consensus
Unavailable
Loading council consensus…
Project Knowledge Map
Unavailable
Loading project knowledge map…
Citation Coverage
Unavailable
Loading citation coverage…
Tool Activity
Unavailable
Loading tool activity…
Thermal / Power
Unavailable
Loading thermal/power strip…
Hardware Headroom
Unavailable
Loading hardware headroom…
Usable Memory
Unavailable
Loading usable memory…
Memory Pressure & Processes
Unavailable
Loading memory pressure and process usage…
GPU & VRAM
Unavailable
Loading GPU and VRAM resources…
Storage Throughput
Unavailable
Loading storage throughput…
Host Responsiveness
Unavailable
Loading host responsiveness…
Model Load Heatmap
Unavailable
Loading model load heatmap…
Task Galaxy
Unavailable
Loading task galaxy…
Prompt-to-Artifact Funnel
Unavailable
Loading prompt-to-artifact funnel…
Before / After
Unavailable
Loading before/after comparison…
Benchmark Leaderboards
Unavailable
Loading benchmark leaderboards…
What changed this run?
Unavailable
Loading what-changed diff…
Presentation / Ambient
Unavailable
Loading presentation/ambient…
Visualization alternatives
Unavailable
Loading visualization a11y alternatives…
Timeline annotations
Unavailable
Loading timeline annotations…
Compare two
Unavailable
Loading compare-two…
Alert thresholds / goals
Unavailable
Loading alert thresholds…
Chart quality gates
Unavailable
Loading chart quality gates…
Metric/event schema
Unavailable
Loading metric/event schema…
Hub↔spoke pulses
Unavailable
Loading durable hub↔spoke pulses…
Visual research gates
Unavailable
Loading visual research gates…
Metric registry
Formulas load from the server registry only.
Model node badges
Loading measured model badges…
Model list
Timeline
Run view
Model list
HUB VOICE
resize
Hub idle — Start MoA Cycle to queue work.
TASKS QUEUED
MoA stages appear here when a cycle is active.
←Activity
↑Tasks
↑MoA
↑Activity
MoA→
Control Center
New here? Flywheel checks your PC, skips what you already have, and guides you to working AI agents — no terminal expertise required.
Local readiness overview
Activation Center
Loading your local activation status…
Your goal
Loading…
Ready now
Scanning local capabilities…
Recommended next packs
Loading reviewed options…
Blockers
Checking required capabilities…
Review-then-start · no auto-run
Sample-task launcher
One reviewable sample-task plan per activated capability. Plans never auto-execute,
never invent readiness or latency metrics, and never grant tool authority.
Live durable start uses GET /api/activation-preflight then
POST /api/workflows/runs with require_preflight=true when
ready. When preflight is ready=false, durable Hub/MoA/sample start
stays blocked. Beginner can still open the no-download fake-provider demo path —
that is not Hub/MoA success.
Loading activation preflight…
Building sample-task plans…
Waiting for activated capabilities. Nothing has started.
Server catalog - Flywheel add-ons
Add-ons / Activation
Control and Verify stay included as non-removable safety foundations.
Optional add-ons (Mesh, Company Operations, Sales/Marketing/CS, Finance/Legal/Ops, Agent Foundry, WordPress)
resolve from the server catalog with SKU, price, dependencies, and evidence state.
Preview never grants entitlements.
Loading foundations…
Loading server add-on catalog…
Measured observations only — not capability proof
Component readiness matrix
Review readiness across infrastructure, models, tools, workflows, validators, integrations, safety, and project data. Each cell needs an explicit status label plus evidence label and source kind from caller-supplied observations. Unobserved dimensions stay unknown — Flywheel does not invent ready, degraded, missing, TTFT, savings, or health metrics here. Reviewing this panel does not grant permissions, start probes, or mutate local state.
Eight matrix dimensions with explicit status and evidence labels
Dimension
Status
Evidence
Source
infrastructure
unknown
no_observation
none
models
unknown
no_observation
none
tools
unknown
no_observation
none
workflows
unknown
no_observation
none
validators
unknown
no_observation
none
integrations
unknown
no_observation
none
safety
unknown
no_observation
none
project_data
unknown
no_observation
none
Advisory readiness matrix explanation only (FW3-RS-METRS-001). Existing activation and metric controls are unchanged.
Planning validation only — not benchmark execution
Benchmark claim linkage
Review whether readiness or capability claims reference an actual certified benchmark run id, or are explicitly labeled unlinked or not_certified. Flywheel does not invent TTFT, scores, token savings, or other benchmark metrics on this panel. Metrics appear only when a claim links to a caller-supplied certified run record. Reviewing this panel does not queue benchmarks, grant permissions, or mutate local state.
Claim linkage statuses require certified run evidence or explicit unlinked / not_certified labels
Claim
Kind
Linkage
Run id
Metrics
No claims loaded — linkage withheld until caller-supplied evidence arrives.
Advisory benchmark linkage explanation only (FW3-RS-METRS-019). Existing activation, metric, and benchmark controls are unchanged.
Opt-in customization inventory — not a quality score
System Uniqueness map
Opt-in: off (default — map hidden)
Review how your setup diverges from recommended defaults across routing, models, packs, plugins, UI, privacy, automation, memory, training, integrations, safety, workflows, and profiles. Each row needs a measured setting key, divergence label, evidence label, and source kind from caller-supplied observations. This is a planning catalog only — Flywheel does not invent uniqueness scores, grades, rankings, or percentiles here. Reviewing this panel does not grant permissions or mutate local state.
Opt-in off — enable System Uniqueness to catalog measured customizations.
Advisory customization inventory only (FW3-RS-METRS-013). Existing activation and metric controls are unchanged.
Declared relationships, not installed-state evidence
Capability dependency graph
Loading declared capability relationships…
How the parts depend on each other
Brain + Nervous System
Think of Flywheel like a body: the Brain is your open-source models
(thinking), and the Nervous System is the tools they use to act
(search, code, files, browsers, vector DBs). Watch system performance on the Dashboard;
install brains and tools here so agents can actually finish tasks.
Brain → Open-Source Catalog / Installed Locally — models on the flywheel.
Nervous System → Open-Source Tools — installers the hub and agents can call.
When both are present, tasking models can use tooling instead of only writing text.
More detail: docs/BRAIN_AND_NERVOUS_SYSTEM.md (also summarized under Help / Directory).
Scanning system…
You can use Flywheel now
Usable capabilities
Next to unlock
Need a hand?
Localization
User-visible strings resolve through localization keys with pluralization and locale number/date formatting.
Live localization — loading…
Right-to-left layout
Sets document dir and mirrors navigation/forms with logical CSS. Live resolves direction from locale or preference; Demo forces an Arabic RTL preview and never pretends to be a full translation.
Live layout direction — loading…
Repair Center (Control diagnostics)
Typed DiagnosticCode / RepairAction / RepairPlan contracts. Additive only — existing Fix it and health controls stay put. One-click remedies require server authorization and checkpoint restore on failure.
diagnostics.v1
Repair Center — loading…
Fix it preview & rollback
Turn system recommendations into previewable one-click Fix it actions. Default is Live evidence; Demo is illustration only.
Live uses advisor recommendations. Demo never replaces Live.
Live Fix it — loading…
Expert details
Read-only setup evidence. Sensitive-looking fields are redacted and long values are bounded.
Commands
Run a scan to load commands.
Detected paths
Run a scan to load paths.
Versions
Run a scan to load versions.
Manifests
Run a scan to load manifests.
Raw health results
Run a scan to load health results.
What do you want to do first?
Pick a starting point and Flywheel will open the matching workspace. You can change views anytime.
Choose one goal to get started.
Browse all goal cards
Selecting a card only saves the goal and opens its existing workspace. It does not install, download, connect, read files, or grant permissions.
Chat with a local model using privacy-first defaults.
Plan, edit, test, and review code with Cursor-compatible tools.
Draft, revise, and extract structured information from documents.
Investigate questions with sources and reviewable evidence.
Create structured lessons, content plans, and validation checks.
Analyze images and visual interfaces with compatible models.
Create images with an approved local or connected backend.
Plan speech-to-text, text-to-speech, and audio workflows.
Explore tables, analysis, notebooks, and local ML workflows.
Use proof, solver, and high-precision numeric toolchains.
Design reviewable workflows, schedules, and integrations.
Connect a custom model, tool, client, or workflow.
What counts as an action-agent capability in Flywheel?
Ready State defines action-agent capability as planning plus typed tools, policies, observations, validators, and approvals — not chat-only autonomy. Reviewing this help does not grant permissions, never starts agents or invokes tools, and never treats bare LAM or generic agent labels as sufficient. Approvals cannot be self-granted; tools remain deny-by-default.
Six required dimensions: planning, typed tools, policies, observations, validators, approvals
Bare LAM / chat / agent labels are insufficient capability proof
Capability definition is not runtime execution authority
Composes toward the Automation pack and action-plan schema tasks
Advisory action-agent capability catalog only (FW3-RS-AUTO-001). Existing automation controls are unchanged.
Which typed automation connectors are available as optional plugins?
Ready State lists optional typed connector plugins for local files, Git, webhooks, email, calendars, databases, and n8n. All connectors are deny-by-default and disabled until explicit consent; network connectors also require egress consent and an approved opaque destination ref. Reviewing this help does not grant permissions, never opens the network, never fires webhooks or email, and forbids silent connector enablement.
Connectors: local_files, git, webhook, email, calendar, database, n8n
Optional plugins only — empty allowlists fail closed
Network connectors require egress consent plus destination allowlist entries
Enablement plans stay dry-run until an authorized executor runs
Advisory typed connector catalog only (FW3-RS-AUTO-005). Existing automation controls are unchanged.
How do I select an integration connector and plan credential setup?
Ready State lists closed integration connectors for the Custom integration goal — OpenAI-compatible SDKs, Cursor, MCP clients, Continue, Aider, Open WebUI, AnythingLLM, n8n, and internal apps. Connector selection and credential setup are planning-only and deny-by-default. Reviewing this help does not grant permissions, never opens the network, never writes or returns secrets, and never invokes integrations. Raw tokens and passwords are rejected; scopes must stay within each connector ceiling.
Closed connector catalog with setup mode and credential requirements
Opaque credential_ref / secret_store_ref only — no plaintext secret storage in plans
Storage and revoke plans stay dry-run until an authorized executor runs
Advisory custom integration connector selector only (FW3-RS-CUSTOM-013). Existing Hub controls are unchanged.
How do I version Customization Studio profiles with notes, tags, and rollback?
Ready State captures Customization Studio profile revisions as secret-stripped snapshots with operator notes and tags. History is append-only: metadata can be updated without rewriting a snapshot, and rollback restores a prior revision as a new head after confirmation. Reviewing this help does not grant permissions, never opens the network, never writes the host filesystem, and never stores plaintext secrets.
Version capture with document digest and optional label
Bounded operator notes and casefolded unique tags for filter/review
Confirmation-gated rollback plans; apply appends a rollback head only on a caller-owned store
Advisory profile versioning only (FW3-RS-CUSTOM-016). Existing Hub controls are unchanged.
How do I export and import Customization Studio profiles with signatures and secret exclusion?
Ready State exports Customization Studio profiles as secret-stripped, Ed25519-signed envelopes. Import verifies the signature and digests, refuses residual secrets, and stays dry-run until confirmation. Reviewing this help does not grant permissions, never opens the network, never writes the host filesystem, and never stores plaintext secrets. Signatures prove authenticity only—not quality.
Ed25519 signatures bind the export body for integrity and authenticity checks
Import plans list conflicts against a current document and require confirmation before apply
Optional capture onto a caller-owned profile version store; no host filesystem mutation by helpers
Advisory signed profile export/import only (FW3-RS-CUSTOM-017). Existing Hub controls are unchanged.
How does Flywheel store connector credentials with least-privilege scopes?
Ready State binds each typed automation connector to a closed least-privilege scope ceiling and plans opaque credential storage references. Reviewing this help does not grant permissions, never opens the network, never writes or returns secrets, and never invokes connectors. Raw tokens and passwords are rejected; scopes outside each connector ceiling fail closed. Default effect is deny.
Per-connector scope ceilings (for example webhook: network:egress + secrets:read)
Opaque credential_ref / secret_store_ref only — no plaintext secret storage in plans
Admin, wildcard, and unrelated platform scopes are forbidden
Storage and revoke plans stay dry-run until an authorized executor runs
Advisory connector credential scope catalog only (FW3-RS-AUTO-006). Existing automation controls are unchanged.
How does Flywheel bind per-tool network domains and data fields?
Ready State binds each automation tool to an explicit network mode (deny, local-only, or concrete domain allowlist) and a closed data-field read/write policy. Reviewing this help does not grant permissions, never opens the network or invokes tools, and forbids wildcard domains. Default network mode is deny; fields default to none.
Network modes: deny (default), local_only, allowlist (no wildcards)
Data fields: explicit allowed read/write lists plus forbidden fields
Empty allowlists and overlapping forbidden fields fail closed
Plans stay dry-run until an authorized executor runs
Advisory per-tool policy catalog only (FW3-RS-AUTO-007). Existing automation controls are unchanged.
Why must automation discover read-only before write actions?
Ready State requires a completed side-effect-free read-only discovery pass before any automation write action can be enabled. Reviewing this help does not grant permissions, never opens the network or invokes tools, and never mutates resources. Discovery alone never enables writes; explicit write consent is required after valid discovery.
Discovery mode is always read_only (list, inspect, probe, sample metadata)
Write actions stay disabled until discovery completes
Discovery alone never enables writes
Explicit write consent is required after a valid discovery result
Advisory read-only discovery gate only (FW3-RS-AUTO-008). Existing automation controls are unchanged.
How does Flywheel prevent duplicate automation actions?
Ready State requires owner-scoped idempotency keys for mutating automation actions. Identical retries replay the prior result reference; key reuse with a different fingerprint is rejected. Reviewing this help does not grant permissions, never opens the network or invokes tools, and never mutates resources.
Mutating actions require an idempotency key (create, update, delete, send, and related kinds)
Identical retries with the same fingerprint replay without re-executing
Key reuse with a different fingerprint is rejected as a conflict
Raw payloads, secrets, prompts, and credentials are never accepted — opaque refs only
Advisory action idempotency gate only (FW3-RS-AUTO-010). Existing automation controls are unchanged.
Which automation actions always need human approval?
Ready State requires an explicit human decision for financial, destructive, external-message, credential, and account automation actions. Models and agents cannot self-approve. Reviewing this help does not grant permissions, never opens the network or invokes tools, never stores secrets, and never executes actions.
Financial: payments, charges, refunds, transfers, purchases, and related kinds
Destructive: delete, purge, wipe, destroy, hard reset, and related kinds
External message: send, publish, email, webhook delivery, and external notify
Credential and account changes require admin-class human approval
Digest-bound approve-once only — batch self-approve is forbidden
Advisory sensitive-action human approval gate only (FW3-RS-AUTO-013). Existing automation controls are unchanged.
How do reversible automation actions declare compensation and rollback?
Ready State plans saga-style compensating steps for reversible automation actions (undo, restore checkpoint, or compensating call) in reverse forward order. Optional action kinds auto-classify reversibility; irreversible kinds such as send, hard delete, and publish never receive silent automatic compensation. Reviewing this help does not execute rollback, restore checkpoints, open the network, mutate files or Git, or grant approvals.
Reversible actions require compensating steps or checkpoint restore refs
Compensation order unwinds forward steps last-in-first-out
action_kind may auto-classify reversibility when omitted
Integrates with action-plan rollback strategies from AUTO-003
Distinct from SAFE-017 automatic rollback policy after file modification
Planning only — helpers never execute compensation
Advisory compensation/rollback planning only (FW3-RS-AUTO-012). Existing automation controls are unchanged.
How does Flywheel retry automation connector failures?
Ready State maps each connector failure to a closed error type and a bounded retry policy. Reviewing this help does not grant permissions, never opens the network, never invokes connectors, and never starts retries. Auth, policy, validation, conflict, and configuration failures are terminal; transient network, timeout, unavailable, and rate-limited failures may retry with bounded backoff. Unknown codes fail closed as unclassified and non-retryable.
Closed error types drive retry vs terminal decisions
Bounded attempts with exponential backoff and jitter for retryable types
Auth, policy, conflict, and configuration never auto-retry
Plans stay dry-run until an authorized executor runs
Advisory connector retry policy catalog only (FW3-RS-AUTO-011). Existing automation controls are unchanged.
How do automation notification connectors alert on completion, approval, failure, and resources?
Ready State defines notification connectors for completion, approval, failure, and resource alerts. Reviewing this help does not grant permissions, never delivers notifications, never opens the network, and never grants approvals. Local channels stay on-device; webhook and email require explicit consent, egress consent, and opaque destination allowlisting. Resource alerts accept measured evidence only and never invent metrics. Silent delivery is forbidden.
Closed alert kinds: completion, approval, failure, and resource_alert
Local channels: notification center and desktop; network channels stay deny-by-default
Approval connectors never grant approvals
Plans stay dry-run until an authorized dispatcher runs
Advisory automation notification connector catalog only (FW3-RS-AUTO-016). Existing notification and automation controls are unchanged.
How are action plans previewed and approved before automation runs?
Ready State shows a digest-bound action plan preview with ordered steps, tools, risks, approvals, rollback, and completion criteria. Operators may edit allowlisted fields before approval; edits regenerate the digest and clear any prior approval. Approval needs explicit confirmation that matches the current digest. Reviewing this help does not grant permissions, never starts agents or invokes tools, and never opens the network.
Editable fields regenerate the preview digest and clear approval
Digest-bound operator confirmation required before authorized execution readiness
Self-approval is forbidden; preview never executes
Advisory action-plan preview explanation only (FW3-RS-AUTO-004). Existing automation controls are unchanged.
How does Flywheel simulate automation actions without executing them?
Ready State walks an action plan step-by-step in dry-run simulation mode and projects connector-level side effects (filesystem, webhook, email, schedule, n8n, and related kinds) without performing them. Results are explicitly labeled simulated; success metrics are never invented. Reviewing this help does not grant permissions, never fires webhooks, never writes files, never sends email, and never registers schedules.
Mode is dry_run_simulation with simulated=true and executed=false
Each step projects side-effect kinds only — no fabricated counts or delivery outcomes
Approval and read-only discovery gates compose fail-closed from related AUTO tasks
Blocked steps stop simulation without executing prior or later side effects
Advisory action dry-run simulation explanation only (FW3-RS-AUTO-009). Existing automation controls are unchanged.
What readiness tests cover automation dry run, approval, and rollback?
Ready State runs six harmless local probes for dry-run simulation, sensitive human approval, authorized-execution readiness, idempotency replay, compensation rollback planning, and revoked-credential deny paths. Reviewing this help does not execute tools, open the network, write or return secrets, grant permissions, or invent delivery metrics.
Dry run projects side effects without mutating files, webhooks, email, or schedules
Approval and execution readiness stay digest-bound; self-approval is forbidden
Idempotency and rollback probes prove structural gates without re-execution
Revoked credentials plan revoke and deny post-revoke bindings without secret I/O
Advisory automation readiness catalog only (FW3-RS-AUTO-021). Existing automation controls are unchanged.
What abuse tests block injected external content and tool escalation?
Ready State runs twelve harmless local abuse probes for prompt-injected webhook, file, RAG, and connector content plus unauthorized automation tool escalation. Reviewing this help does not execute tools, open the network, grant permissions, write or return secrets, or invent delivery metrics.
External instruction overrides must fail validation and stay untrusted
Webhook, email, and n8n plans stay blocked without scopes, consent, and confirmation
Wildcard scopes, unknown tools, and allowlist bypass attempts fail closed
guarded means every probe was blocked — never runtime execution proof
Advisory automation abuse-test catalog only (FW3-RS-AUTO-022). Existing automation controls are unchanged.
How does Flywheel build automation schedules without registering them?
Ready State builds typed schedule plans for one-time, recurring, quiet-hours, and overnight automation using opaque task refs and explicit windows. Reviewing this help does not grant permissions, never registers cron jobs, never starts tasks, and forbids inline cron expressions and silent schedule registration. Quiet hours and overnight windows must be declared explicitly; registration stays blocked until operator approval matches the plan digest.
Recurring intervals are closed (hourly, daily, weekly) — raw cron is forbidden
Quiet hours and overnight windows are explicit fields, not inferred silently
Approval matches a SHA-256 digest; helpers here still never register schedules
Advisory schedule builder explanation only (FW3-RS-AUTO-014). Existing automation controls are unchanged.
How does Flywheel check integration health and handle token expiry?
Ready State evaluates caller-supplied integration health observations and token-expiry metadata for typed automation connectors. Reviewing this help does not grant permissions, never opens the network, never probes connectors, never refreshes tokens, and never invents health metrics. Expired tokens block until an explicit operator re-auth plan; silent token refresh is forbidden.
Health statuses are closed (healthy, degraded, unhealthy, unknown, not_configured, token_expired, token_expiring_soon)
Token states use opaque token_ref plus expires_at — raw secrets are rejected
Expired tokens require operator re-auth; expiring-soon tokens are advisory
Plans stay dry-run; probes and token refresh never start here
Advisory integration health and token-expiry explanation only (FW3-RS-AUTO-017). Existing automation controls are unchanged.
How does Flywheel run offline / local-only automation?
Ready State defines an offline/local-only automation variant that keeps planning on-device. Reviewing this help does not grant permissions, never opens the network, never enables connectors, and never starts automation. While the variant is active, only local files and Git connectors are eligible; webhooks, email, calendars, databases, and n8n stay denied. Local actions remain plan-only until operator consent outside this help.
Variant facets: offline and local_only — both required when enabled
Allowed connectors: local_files, git (consent still required)
Denied connectors: webhook, email, calendar, database, n8n
Plans stay dry-run; network actions and silent enablement are forbidden
Advisory offline/local-only automation explanation only (FW3-RS-AUTO-019). Existing automation controls are unchanged.
What safe starter recipes can automation plan?
Ready State ships five plan-only starter recipes: organize project files, run backups, generate report, execute tests, and notify. Reviewing this help does not grant permissions, never opens the network, never moves files, never writes backups, never runs tests, and never delivers notifications. Recipes stay local-first; webhook and email notify channels are denied for starter recipes. Confirmation only marks a plan ready — execution stays outside this help.
Local action kinds aligned with offline/local variant; network connectors denied
Mutating and test recipes require discovery and operator approval outside the helper
Notify allows notification center / desktop only — no webhook or email from starters
Advisory safe starter recipe explanation only (FW3-RS-AUTO-020). Existing automation controls are unchanged.
How does Flywheel audit automation actions and artifact lineage?
Ready State builds an append-only action audit timeline and binds opaque artifact lineage from each automation action to inputs, tools, approvals, validators, and produced artifacts. Reviewing this help does not grant permissions, never opens the network or invokes tools, never loads artifacts, and never invents wall-clock completion or success metrics. Timestamps are caller-supplied only.
Sequences are monotonic per action; timelines are append-only
Lineage digests bind plan digests and opaque refs without loading artifacts
Plans stay dry-run until an authorized auditor persists events
Advisory action audit and lineage explanation only (FW3-RS-AUTO-018). Existing automation controls are unchanged.
How does Flywheel debounce event-triggered workflows and stop loops?
Ready State builds plan-only event-triggered workflow plans with explicit debounce/coalesce windows and fail-closed loop protection. Reviewing this help does not grant permissions, never starts workflows, never registers watchers, never opens the network, and never invents fire-count metrics. Self-triggers, chain cycles, excessive chain depth, and rate-limit breaches are blocked before any authorized executor may fire.
Debounce coalesces bursts under an opaque coalesce_key until debounce_ms elapses
Loop protection blocks self-triggers, chain cycles, depth over the plan max, and rate windows
Plans stay dry-run; silent fire and raw payloads/secrets are forbidden
Advisory event-triggered workflow explanation only (FW3-RS-AUTO-015). Existing automation controls are unchanged.
Which local adapters run classical ML and deep-learning inference?
Ready State lists approved local ML inference adapters behind a closed manifest: scikit-learn classical models, ONNX Runtime artifacts, and approved PyTorch/TensorFlow inference. Reviewing this catalog does not grant permissions, never loads artifacts or deserializes pickle/joblib, and does not download weights or open the network. Explicit consent is required before any inference plan; prefer ONNX for untrusted distribution.
Approved adapters only — unlisted cloud backends are denied
ONNX Runtime preferred when present; native weights need explicit trust
Capability probes use import presence only
Consent is required; planning consent is not runtime authority
Advisory ML-inference catalog only. Existing data-science controls are unchanged.
What metadata does a classical ML model artifact carry?
Ready State records model-card metadata for classical ML artifacts: features, labels, preprocessing, output schema, caller-supplied metrics, training provenance, and license. Reviewing this help does not grant permissions, never loads weights or deserializes pickle/joblib, and does not invent accuracy or training completion. Distinct from LLM registry identity fields.
Metrics and digests are caller-supplied only — never invented in the Hub control plane
License is required (unknown allowed with pending-review warning)
Content digest binds the canonical card (FW3-RS-DATA-003)
Advisory model-card metadata catalog only. Existing data-science controls are unchanged.
Where are classification, regression, clustering, anomaly, forecasting, and ranking workflow templates?
Ready State catalogs planning-only workflow scaffolds for six classical ML task types. Each template binds stage order to related DATA planners (ingest, split, preprocessing, evaluation validators, lineage). Reviewing this catalog never trains models, opens datasets, computes metrics, or invents accuracy — activation_ready stays false.
Six kinds: classification, regression, clustering, anomaly, forecasting, ranking
Stages bind to DATA-006/007/009/010/013/019 planners without execution
Primary metric hints align with DATA-010 — caller-supplied evidence only
Workflow plans require explicit consent and remain dry-run in Hub
Advisory ML workflow template catalog only (FW3-RS-DATA-008). Existing data-science controls are unchanged.
Where are data-science notebook, script, and starter project templates?
Ready State catalogs Jupyter notebook scaffolds (EDA, sklearn training, ONNX inference), Python scripts (tabular ingest, sklearn pipeline, DuckDB analytics, ONNX batch infer), and multi-file starter projects with content digests. Reviewing this catalog never writes files, installs packages, executes notebook cells, or starts training.
Six starter projects include README plus scaffold files with digests
Materialization plans relative paths only — no filesystem writes here
Advisory data-science template catalog only (FW3-RS-DATA-013). Existing data-science controls are unchanged.
How does Flywheel plan tabular ingestion, schema inference, cleaning, and preview?
Ready State plans CSV, TSV, Parquet, JSONL, and Feather ingestion from source descriptors and sample cell values you supply — inferring schema, applying deterministic type cleaning, and returning a bounded labeled preview. Reviewing this help does not grant permissions, never opens files or loads frames, and does not present sample-derived types as measured profiler output. Silent full-dataset materialization is forbidden.
Closed formats: csv, tsv, parquet, jsonl, feather
Schema inference from caller sample values only (bool, int64, float64, string, category, datetime64)
Type cleaning: trim, empty→null, bool aliases, numeric parse, ISO datetime, low-cardinality categories
Bounded preview rows/columns; plans stay dry-run until an authorized executor runs
Advisory tabular ingestion catalog only (FW3-RS-DATA-006). Existing data-science controls are unchanged.
How does Flywheel plan DuckDB, CSV, Parquet, JSON, and Excel import/export?
Ready State plans bidirectional tabular interchange for CSV, JSON (always), Parquet and DuckDB (when optional local stacks are declared), and Excel only after an openpyxl-compatible license acknowledgement. Reviewing this help does not grant permissions, never opens or writes files, and never starts DuckDB. Missing dependencies or missing Excel acknowledgement fail closed. Planning-only catalog — not activation-ready.
License-gated Excel (`excel_openpyxl_or_compatible_stack`); optional deps for Parquet/DuckDB
Project-relative paths only; dry-run argv for authorized executors
Composes tabular ingestion (DATA-006) and resource limits (DATA-015)
Advisory tabular import/export catalog only (FW3-RS-DATA-014). Existing data-science controls are unchanged.
How does Flywheel split data and warn about leakage for user-built models?
Ready State plans train, validation, and test (holdout) partitions from row identities you supply — default 70/15/15 — and surfaces leakage warnings before any authorized training step. Reviewing this help does not grant permissions, never opens datasets or trains models, and does not invent accuracy metrics. A held-out test set is required; fit preprocessing on train only.
Deterministic train / validation / test assignment (group, stratify, or temporal modes)
Leakage checks: row overlap, group leakage, target-in-features, content duplicates, temporal order
Holdout required; plans stay dry-run until an authorized executor runs
Never loads frames in the Hub control plane or grants tool authority
Advisory split and leakage catalog only. Existing data-science controls are unchanged.
Where are classification, regression, clustering, anomaly, forecasting, and ranking workflow templates?
Ready State catalogs six classical-ML workflow templates — classification, regression, clustering, anomaly detection, forecasting, and ranking — each with required columns, holdout stages, and DATA-010 primary metrics. Reviewing this help does not grant permissions, never opens datasets or trains models, and does not invent accuracy. Planning consent is not runtime authority; objective libraries alone compute metrics under an authorized executor.
Forecasting requires a temporal split; ranking prefers query group-aware splits
Plans stay dry-run; Hub never loads frames or invents metrics in the control plane
Advisory classical-ML workflow template catalog only (FW3-RS-DATA-008). Existing data-science controls are unchanged.
How does Flywheel bound memory for large datasets and sampling previews?
Ready State assesses caller-supplied row, column, and dtype metadata against fail-closed resource limits and plans bounded sampling previews for large tabular datasets. Reviewing this help does not grant permissions, never opens files or loads frames, and does not present labeled memory estimates as measured meters. Silent full-dataset load is forbidden; full load requires an explicit discouraged acknowledgement.
Sample strategies: head, random seed, stratified key, reservoir plan
Memory figures are labeled estimates from dtype heuristics — not profiler output
Large datasets require sampling; hard limit violations block planning
Plans stay dry-run until an authorized executor runs
Advisory dataset resource-limit catalog only (FW3-RS-DATA-015). Existing data-science controls are unchanged.
How does Flywheel validate model evaluation metrics and baselines?
Ready State checks that measured metrics you supply are appropriate for the declared task type — classification, regression, clustering, anomaly, forecasting, or ranking — and meet explicit baselines. Reviewing this help does not grant permissions, never computes accuracy from predictions, and does not invent scores. Objective libraries alone compute metrics; evaluation must use validation, test, or holdout — never the training split.
Closed metric allowlists per task type (for example accuracy/f1 for classification, mae/rmse/r2 for regression)
Baselines and thresholds with higher-better / lower-better gates
Metrics must be attributed to approved objective libraries — never code-model invention
Advisory model-evaluation validator catalog only (FW3-RS-DATA-010). Existing data-science controls are unchanged.
How does Flywheel report data quality, missing values, outliers, duplicates, and drift?
Ready State summarizes caller-supplied column and row evidence into missing-value, outlier, duplicate, and drift reports — plus an aggregate data-quality rollup. Reviewing this help does not grant permissions, never opens datasets or profiles tables, and does not invent completeness or accuracy scores. Insufficient evidence withholds a section; drift requires an explicit baseline.
Missing-value rates from null_count / row_count you provide
Outliers via z-score and IQR fences on supplied numeric values
Duplicate row ids, content hashes, and composite keys
Drift via PSI and mean-shift against a required baseline — never invents one
Advisory data-quality catalog only (FW3-RS-DATA-011). Existing data-science controls are unchanged.
How does Flywheel plan model explainability with clear limitations?
Ready State lists approved local explainability adapters behind a closed manifest: scikit-learn permutation and tree importances, SHAP tree/kernel explainers, and LIME tabular surrogates. Reviewing this catalog does not grant permissions, never loads models or datasets, and never presents importance scores as ground truth. Explicit consent and a limitations acknowledgement are required before any explainability plan; all scores are estimates only.
Approved adapters only — unlisted cloud explainers are denied
Permutation importance preferred when sklearn is available
Tree importances, SHAP, and LIME each carry technique-specific bias warnings
Consent and limitations acknowledgement required; planning is not runtime authority
Advisory explainability catalog only (FW3-RS-DATA-012). Existing data-science controls are unchanged.
How does Flywheel separate encoder/MLM embedding and classification from chat?
Ready State binds encoder and masked-language (MLM) models into dedicated embedding and classification roles — never by reusing the generative chat model. Reviewing this help does not grant permissions, never loads models or trains heads, and does not invent accuracy metrics. MLM and encoder artifacts are feature and classification workers, not default chat models.
encoder_embedding — dense vectors / feature extraction from encoder or MLM artifacts
encoder_classification — sequence, token, NER, or fill-mask classification heads
Same-id generative chat reuse is rejected; generative-only candidates cannot fill encoder slots
Plans stay dry-run; objective libraries compute results later — chat may narrate but cannot own these roles
Advisory encoder/MLM role catalog only (FW3-RS-DATA-017). Existing data-science and chat controls are unchanged.
Which artifact formats are safe for untrusted model distribution?
Untrusted distribution should prefer ONNX or other safer portable formats. Native pickle, joblib, and framework weight formats require explicit trust acknowledgement before planning — the Hub never deserializes or silently loads artifacts. Planning trust is not runtime authority.
Safer portable: ONNX and Safetensors are preferred for untrusted artifacts
Native formats require explicit trust acknowledgement at plan time
Silent native loads are refused — use a trust-gated distribution plan
Distribution plans may bind a preferred ONNX alternative reference
Advisory format preference policy only (FW3-RS-DATA-005). Existing data-science controls are unchanged.
How does Flywheel safely import pickle or joblib models?
Pickle and joblib can execute arbitrary code when loaded. Ready State plans imports only after you acknowledge that risk and confirm an isolation adapter (container preferred, isolated process fallback). The Hub control plane never deserializes pickle/joblib itself. Prefer ONNX for untrusted distribution.
Explicit trust acknowledgement of the RCE warning is required
Isolation must be confirmed; Hub never starts containers or unpicklers
Artifacts must stay project-relative without path traversal
Trust at plan time is not runtime authority
Advisory safe-import policy only (FW3-RS-DATA-004). Existing data-science controls are unchanged.
How are preprocessing pipelines captured for reproducible transforms?
Ready State captures ordered tabular preprocessing steps (impute, scale, encode, clip, select/drop/rename) with frozen fit parameters and a content digest so the same pipeline and rows always produce the same outputs. Reviewing this help never starts training, imports sklearn/pandas for side effects, executes arbitrary code, or opens the network.
Closed transform catalog only — no eval or unlisted ops
Fitted params required for scale/impute/encode so apply is reproducible
SHA-256 content digest binds steps and parameters
Fit-on-train-only is advisory; leakage guards are separate (DATA-007)
Advisory preprocessing capture only (FW3-RS-DATA-009). Existing data-science controls are unchanged.
How is artifact lineage tracked from dataset hash to report?
Ready State binds caller-supplied SHA-256 digests into a directed lineage graph: dataset hash → preprocessing pipeline → model artifact → metrics artifact → report. Reviewing this help never opens datasets, loads models, computes hashes from bytes, invents metrics, or grants compute authority.
Every digest must be supplied explicitly by the caller — placeholders fail closed
Canonical stage order with no gaps when downstream stages are present
Graph content digest binds node ids and caller digests only
Composes with preprocessing capture (DATA-009) and objective compute (DATA-016)
Advisory artifact lineage planner only (FW3-RS-DATA-019). Existing data-science controls are unchanged.
What readiness tests cover classical ML and ONNX fixtures?
Ready State runs four harmless local probes for small classification, regression, anomaly, and ONNX fixtures. Reviewing this help does not open datasets, train or load models, start ONNX runtimes, invent accuracy, write files, or open the network.
Classification workflow plan plus measured metric baselines
Regression workflow plan plus measured metric baselines
Anomaly detection workflow plan plus measured metric baselines
ONNX Runtime plan binds preferred portable ONNX artifacts only
Advisory data readiness probes only (FW3-RS-DATA-021). Existing data-science controls are unchanged.
How does Flywheel check data benchmarks across Windows, Linux, and macOS?
Ready State compares caller-supplied measured metrics for synthetic classification, regression, anomaly, and ONNX fixtures across Windows, Linux, and macOS using declared tolerances and fixture digests. Reviewing this help never trains models, opens datasets, starts ONNX runtimes, or invents accuracy. Host OS labels are metadata only — not multi-OS proof.
Closed OS matrix: Windows, Linux, macOS
Synthetic fixture digests and seeds must match the catalog
Estimates and invented scores fail closed — measured evidence required
Cross-OS absolute deltas must stay within declared tolerances
Advisory cross-OS reproducibility compare only (FW3-RS-DATA-022). Existing data-science controls are unchanged.
How do code models help generate pipelines while libraries compute results?
Ready State lets a code model draft pipeline sketches, scikit-learn Pipeline outlines, transform suggestions, and repairs from library errors — while sklearn, NumPy, pandas, SciPy, and ONNX Runtime remain the only sources of computed metrics and fit/transform outputs. Reviewing this help does not grant permissions, never executes generated code, never invents accuracy scores, and never lets a model alter library results.
Objective libraries alone compute fit, predict, and evaluation metrics
Two-stage plans: assist draft, then authorized library compute
Consent required; planning is not runtime or compute authority (FW3-RS-DATA-016)
Advisory pipeline code-assist catalog only (FW3-RS-DATA-016). Existing data-science controls are unchanged.
How does the LLM explain results without changing metrics?
Ready State seals metrics from sklearn, NumPy, pandas, SciPy, or ONNX Runtime with a content digest, then lets a generative model summarize, interpret, caveat, or suggest next steps. Narration never recomputes, invents, or rewrites accuracy, F1, loss, or other library results. Reviewing this help does not grant permissions, start models, or mutate sealed metrics.
Objective libraries alone compute and seal metrics; digests detect mutation
Two-stage plans: seal immutable metrics, then authorized LLM narration
Consent required; planning is not runtime or compute authority (FW3-RS-DATA-018)
Advisory hybrid narration catalog only (FW3-RS-DATA-018). Existing data-science controls are unchanged.
Try Flywheel before downloading a model
Browse the recommended sample in Live mode. Switch to Demo explicitly before asking the fake provider. Fake output is always labeled and is not live inference; no model download or external network access is required.
What privacy posture should Flywheel plan for?
Choose one preference. Saving it only guides later recommendations; it does not change network policy, enable egress, or connect a server. Every network or server action requires separate review and consent.
Choose one privacy preference. No network policy is changed.
Privacy Beacon
Mode
Loading…
Current egress
—
Last egress
—
Domains
—
Bytes
Not measured
Feature
—
User consent
—
Loading Privacy Beacon…
Security Pulse
Open / classified total:Loading…
Loading Security Pulse…
Metric retention & privacy
Loading metric retention controls…
How would you like to work with Flywheel?
Choose one preference. This guides later recommendations; it does not start background work, use a microphone, or connect a client.
Choose one interaction preference. No action starts from this choice.
How much action should Flywheel propose?
Choose one preference. This guides later recommendations; it never grants permission or starts an action.
Choose one risk preference. Read-only remains the safe fallback.
What project size and broad file types do you expect?
Categories only. Do not enter file names, paths, or content. Flywheel does not open or scan files from this preference.
Choose a size band and at least one broad file-type category.
Do you already have local models or tools?
Choose a broad answer only. Do not enter model names, versions, paths, credentials, or project content. Nothing is scanned from this choice.
Before any probe, review exactly what local discovery would check. A separate privacy preview and consent are still required.
Local discovery privacy preview
This preview lists the only scopes a later consent-gated discovery pass may check. Opening it does not start discovery, contact the network, install assets, or grant permissions.
local_models — local model inventory candidates only, after separate consent.
local_tools — local tool inventory candidates only, after separate consent.
No discovery has run from this panel. Continue onboarding or open the separate discovery consent surface when you are ready.
Choose one broad answer. Nothing is scanned from this choice.
How would you like to choose models?
Automatic recommendations prepare a ranked plan for review; choosing this preference does not download or install models.
Choose a preference. Manual selection is the safe fallback.
Choose my own models
Use the existing model catalog and selection cards. This path does not select, download, install, or bind a model.
Review local hardware fit and available RAM evidence.
Browse the existing catalog; compare purpose, size, quantization, and declared speed evidence.
Preview backend compatibility, required capabilities, license, provenance, and RAM checks.
Review any compatible alternatives, then use separate acquisition controls only if you approve.
No model is selected. Compatibility evidence remains a review-only preview.
Minimum viable setup
Plans the smallest required, safety-approved stack (Minimal Foundation by default). Optional and advanced components stay out. This path does not download, install, or apply configuration; approve separately through existing install controls.
Review only required, safety-approved stack components.
Select the smallest safe set that covers requirements.
Plan install for missing pieces and reuse healthy installed ones.
Review downloads and install through existing approval controls.
Plan status
No sample selected.
Plan summary
This path does not download, install, or apply configuration.
Choose a sample stack to preview. Nothing is downloaded or installed from this panel.
Use what I already have
Immediate path for installed, healthy models, tools, and packs. It plans configuration without downloading, installing, or applying changes. Approve separately through existing activation controls.
Review installed inventory evidence (no automatic discovery).
Keep only installed, healthy components that meet requirements.
Plan role bindings, tool enablement, and pack reuse without downloads.
Review and approve configuration through existing activation controls.
Plan status
No sample selected.
Plan summary
This path does not download, install, or apply configuration.
Choose a sample inventory to preview. Nothing is scanned or changed from this panel.
Continue onboarding after a restart
Save a seven-day restart point. Its opaque bearer token is stored only on this device; the bounded server checkpoint does not include prompts, paths, credentials, or project content.
No restart point has been saved from this browser.
What impact should I review before approval?
Preview licenses, network access, administrator rights, restart needs, and expected time for a sample plan. This does not install, elevate, restart, or record approval.
Licenses
Choose a sample plan to review licenses.
Network access
Choose a sample plan to review network access.
Administrator rights
Choose a sample plan to review elevation needs.
Restart needs
Choose a sample plan to review restart needs.
Expected time
Choose a sample plan to review estimated time. Estimates are not guarantees.
Choose a sample plan. Showing the summary does not install, elevate, restart, or record approval.
Why is this recommendation needed?
Preview the one-sentence reason for a model or tool recommendation. Learn more stays closed until you open it. This does not download, install, bind, or grant permission.
Choose a reason to see the one-sentence explanation.
Learn more
Learn more about this recommendation
Recommendations stay advisory. Acquisition, binding, and tool grants remain separate, approval-gated steps with digests and policy checks.
This panel never invents speed, quality scores, or readiness. It only explains why a candidate may appear.
Choose a model or tool reason. Learn more stays closed until you open it.
Which project safety profile should apply?
Choose one profile. Selection is stored locally and does not grant permissions, open the network, or start actions. Detailed permission classes arrive in the next safety task.
Choose a safety profile. Read Only is the safe fallback. Selection does not grant permissions.
Which permission classes do safety profiles cover?
These thirteen classes are the vocabulary for safety profiles. Reviewing them does not grant permissions, open devices, or contact the network.
file_read — File read
file_write — File write
file_delete — File delete
command — Command
network — Network
package_install — Package install
git — Git
secrets — Secrets
clipboard — Clipboard
browser — Browser
microphone — Microphone
camera — Camera
external_service — External service
Advisory catalog only. Runtime enforcement and project defaults remain separate safety tasks.
What safety defaults apply to new projects?
New projects start as read-only. Writes and commands stay denied until an explicit approval upgrades the project. This explanation does not create a project or grant permissions.
Default profile: read_only
File writes and deletes: deny until explicit approval
Commands: deny until explicit approval
No automatic elevation when another profile is requested
Advisory default plan only. Existing Create project controls are unchanged.
How does project-root path containment work?
Candidate paths are resolved against the approved project root. Symlinks and Windows junctions that escape the root are denied. Reviewing these rules does not grant permissions or open files.
Project root must be absolute and free of reparse-point ancestors
Resolved paths must stay under the project root
Symlink or junction targets outside the root are denied
Failures are closed without echoing caller paths
Advisory explanation only. Existing file and project controls are unchanged.
Which commands are allowlisted by pack and stack?
Each capability pack and project stack has a deny-by-default executable catalog. The effective allowlist is their intersection. Reviewing this catalog does not grant permissions and never starts a process.
Private Chat starts with an empty command allowlist
Advisory catalog only. Existing run/test controls are unchanged.
Why is shell=True banned for official tools?
Official tools must use argv arrays with shell disabled. Free-form shell strings and wrappers such as bash -c are denied. Reviewing this policy does not grant permissions or start commands.
shell=True is permanently denied
Free-form shell command strings are denied
Shell wrappers with -c /Command flags are denied
Policy checks never execute the planned command
Advisory policy explanation only. Existing tool controls are unchanged.
How are environment variables filtered and secrets redacted?
Tool runs use a deny-by-default environment allowlist. Secret-named keys are dropped, and secret-shaped values are redacted in evidence. Reviewing this policy does not grant permissions or start processes.
Only allowlisted keys pass through
Names containing TOKEN, PASSWORD, API_KEY, and similar markers are dropped
Evidence replaces secret-shaped values with [REDACTED]
Ambient secrets are never inherited by default
Advisory explanation only. Existing env and tool controls are unchanged.
What process resource limits apply to tools?
Official tools declare ceilings for time, output size, CPU, memory, child processes, and network. Network defaults to deny. Reviewing these limits does not grant permissions or start processes.
Time: hard timeout (default 120s)
Output: truncated at max characters
CPU / memory / children: bounded ceilings
Network: deny by default
Advisory limit catalog only. Existing run controls are unchanged.
Which isolation adapters are available?
Ready State detects Docker, Podman, Windows Sandbox, and isolated-process adapters by PATH presence. Reviewing this catalog does not grant permissions and never starts a container, sandbox, or subprocess.
Docker / Podman when the runtime is on PATH
Windows Sandbox on Windows hosts with the client present
Isolated process always available as a local planning adapter
Capability probes never launch runtimes or record host paths
Advisory adapter catalog only. Existing sandbox controls are unchanged.
What happens without containers?
When container and Windows Sandbox runtimes are unavailable, Ready State uses a restricted local isolated-process profile with deny-default network and tighter ceilings. Reviewing this profile does not grant permissions or start processes.
Selected only when no container runtime is available (or forced locally)
Project-root path containment and allowlist-only environment
Network deny; shell=True permanently denied
Tighter time, output, memory, and child-process ceilings
Advisory fallback explanation only. Existing run controls are unchanged.
How do network domain allowlists and offline mode work?
Ready State defaults to deny. Allowlists use exact hostnames only. Offline mode blocks every domain, including allowlisted ones. Reviewing this policy does not grant permissions or open the network.
Default mode: deny
Allowlist: exact hostname match only (no wildcards)
Offline mode overrides allowlists and blocks all domains
Policy checks never contact the network
Advisory network policy explanation only. Existing egress controls are unchanged.
How are package installs previewed and approved?
Package installs require an exact package, version, license, and source preview. Approval needs confirmation that matches the preview digest. Reviewing this flow does not grant permissions or install packages.
Exact package / version / license / source required
Digest-bound confirmation before installer readiness
Mismatch fails closed
Preview never installs or opens the network
Advisory approval explanation only. Existing install controls are unchanged.
How do plugin lifecycle transactions work?
Ready State plans digest-bound install, update, uninstall, and rollback transactions with ordered forward steps and compensating rollback steps. Operators confirm a matching digest before an authorized installer may proceed. Rollback planning fails closed when snapshots or compensating steps are missing. Reviewing this flow does not install, update, uninstall, roll back plugins, or open the network.
Artifact digests bind each plan; approval must match exactly
Update, uninstall, and rollback require snapshot identifiers
Rollback readiness is evaluated before approval; missing steps fail closed
Preview never installs plugins or mutates the filesystem
Advisory lifecycle-transaction explanation only (FW3-RS-PLUG-010). Existing plugin and install controls are unchanged.
How are plugin dependencies isolated?
Each plugin plans a unique dependency root with exact package/version/license pins. Shared mutable dependency state (global registries, module caches, shared site-packages) is denied by default. Operators confirm a digest-bound approval before an authorized installer may proceed. Reviewing this flow does not install packages, enable plugins, or open the network.
Unique isolation root per plugin version
Exact dependency pins required; no silent installs
Shared mutable state denied by default
Isolation-root collisions fail closed
Preview never installs packages or grants shared state
Advisory dependency-isolation explanation only. Existing plugin and install controls are unchanged.
What validator and tool example plugins ship for planning?
Ready State catalogs two deny-by-default example plugins: a validator scaffold with no permissions and a tool scaffold requesting project read only. Each includes an SDK-valid manifest and Python planning source. Reviewing this catalog does not install plugins, write scaffolds to disk, execute handlers, enable plugins, grant permissions, or open the network.
Examples: example.validator.schema_shape and example.tool.project_echo
Manifests validate against the closed plugin SDK contract (FW2-PACK-018)
Validator example: deny-by-default with no requested permissions
Tool example: project:read only; no network or process permissions
Scaffold plans stay dry-run until an authorized writer runs
Advisory validator/tool example catalog only (FW3-RS-PLUG-014). Existing plugin controls are unchanged.
How do offline marketplace plugin repositories work?
Ready State catalogs offline marketplace repositories for air-gapped planning: mirror roots, digest-bound package indexes, categories, and resolution plans that map package identifiers to local relative paths. Reviewing this catalog does not download packages, install plugins, open the network, verify removable media, or grant install authority.
Mirror roots are local relative paths — read-only and network-free
Package entries bind integrity digests and cross-reference marketplace listing IDs
Resolution plans are planning-only — operator must verify media separately
Embedded repositories compose with marketplace metadata (FW3-RS-PLUG-017)
Import preview offline-repository code sources reference these package IDs (FW3-RS-PLUG-021)
Advisory offline repository catalog only (FW3-RS-PLUG-022). Existing plugin and install controls are unchanged.
How do offline marketplace plugin repositories work?
Ready State supports air-gapped marketplace plugin repositories: a local repository.json lists digest-bound plugin artifacts. Import planning verifies path containment and digests (and optional PACK-018 manifests) under approved roots. Reviewing or planning from this panel does not install, enable, or load plugins, open the network, fetch remote catalogs, or grant install authority. Installer media ZIP packs are verify-only transfer formats.
Kind: marketplace_offline_repository with digest-bound plugin entries
Optional PACK-018 plugin manifests must match id, kind, version, and artifact digest
Trust levels on entries are advisory — never install authority
Installer media includes checksums.json; media does not grant execution or egress
Advisory offline marketplace repository guide only (FW3-RS-PLUG-022). Existing plugin and install controls are unchanged.
What plugin marketplace metadata is available locally?
Ready State catalogs local plugin marketplace metadata for discovery and planning: categories, illustrative screenshots, documentation links, labeled user-submitted reviews, and advisory compatibility notes. Reviewing this catalog does not install plugins, open the network, fetch remote assets, grant permissions, or present sample ratings as measured truth.
Local search across embedded listing titles, summaries, tags, and categories
Screenshots are illustrative previews only — not measured UI telemetry
Reviews carry explicit user-submitted labels — no invented aggregate ratings
Compatibility rows are advisory and labeled — not install guarantees
Advisory marketplace metadata catalog only (FW3-RS-PLUG-017). Existing plugin and install controls are unchanged.
How does Creator Studio package and publish cognitive assets safely?
Creator Studio lets creators import canonical assets, define compatibility, permissions, resources, provenance, license, pricing, support, and privacy commitments, run required validation, build reproducible creator-signed packages, preview listing policy, submit revisions, respond to findings, and issue recall or deprecation. Private drafts and signing keys stay isolated per creator. Publishing cannot self-certify, bypass quarantine, expand authority, or conceal dependencies. Offline, enterprise-private, and public workflows are supported with audit, rollback, and dispute evidence. Reviewing this panel does not publish packages, grant certificates, install assets, charge payment, or open the network.
Import canonical assets and define packaging metadata before build
Required validation covers provenance, license, permissions, dependencies, privacy, and support
Creator signatures prove origin only — never quality, safety, or install authority
Submit enters quarantine; independent verifier and publisher approval are required
Recall, deprecation, rollback, and audit trails retain dispute evidence
Additive Creator Studio guide only (COG-CREATOR-001). Existing marketplace and catalog controls are unchanged.
How do cognitive asset seller royalties, refunds, and disputes work?
Market operations sit on existing billing and entitlement authorities. Operators can record listing terms (price, tax evidence, fees, royalty splits), sales, partial refunds with seller clawback, disputes, chargebacks, payout holds, sanctions and jurisdiction checks, private negotiated catalogs, creator suspension, asset revocation, and support commitments. Financial records are append-only and reconcile with ordinary provider events. There is no in-memory wallet or custodial currency. Ranking stays commercially neutral; sponsorship must be disclosed. Reviewing this panel does not execute payments, grant entitlements, install assets, or open the network.
Uses OMEGA-SUP-004 metering and ordinary billing adapters — never crypto custody
Partial refunds claw back seller royalties proportionally; chargebacks revoke entitlements
Split changes apply to future sales only; replay is idempotent
Payout holds, tax failures, sanctions, recalls, and suspensions fail closed
Private negotiated catalogs stay out of public organic ranking
Additive cognitive marketops guide only (COG-MARKETOPS-001). Existing marketplace and catalog controls are unchanged.
How does certified cognitive asset marketplace discovery work?
Flywheel extends the existing marketplace for certified cognitive assets. Operators can filter by outcome, asset type, capability, compatibility, risk, price, offline availability, and certificate status, then review an install preview with exact dependency and resource totals, permissions, provenance, limitations, composition impact, and administrator policy. Equip, activation, update, rollback, revoke, refund, and recovery delegate to existing package-registry, entitlement, task, and audit authorities. Private, community, partner, and official channels remain distinct. Ratings never certify safety. Incompatible or high-risk assets fail closed or require explicit authorized review. Reviewing this panel does not install packages, grant entitlements, charge payment, or open the network.
Lifecycle ops use package registry, entitlement, task, and audit authorities — not a parallel installer
Channels stay distinct: private, community, partner, official
Ratings and signatures never certify safety; high-risk assets need authorized review
Additive cognitive marketplace guide only (COG-MARKET-001). Existing marketplace and catalog controls are unchanged.
Which developer SDKs and templates exist for plugins?
Ready State catalogs Python and TypeScript plugin developer SDK packages and scaffolds. Python is preferred for provider, validator, tool, vector, and workflow plugins; TypeScript is preferred for UI extensions. Reviewing this catalog does not install packages, write scaffolds to disk, enable plugins, grant permissions, or open the network. Scaffold plans stay dry-run until an authorized writer runs.
Languages: Python and TypeScript (where appropriate by plugin kind)
Includes SDK package, plugin scaffold, manifest stub, and conformance checklist templates
Permissions remain deny-by-default from the closed plugin SDK vocabulary
Inappropriate language for a plugin kind fails closed
Advisory developer SDK template catalog only (FW3-RS-PLUG-012). Existing plugin controls are unchanged.
What does a signed plugin manifest include?
Ready State plugin manifests declare identity and version, publisher, deny-by-default permissions, a relative entry point, dependencies, input/output schema refs, and compatibility (hub, SDK, OS/arch, Python). Detached Ed25519 signatures bind the canonical digest to a publisher key—they prove publisher identity and integrity only, never quality or safety, and never grant install or execution authority. Reviewing this help does not install, enable, load, or execute plugins, and does not open the network.
Compatibility: hub min version, SDK versions, platforms, Python 3.11+
Advisory signed-manifest contract only (FW3-RS-PLUG-002). Existing plugin controls are unchanged.
What plugin types does Flywheel define?
Ready State defines eleven closed plugin types: provider, model runtime, tool, validator, parser, vector store, workflow step, connector, notification, installer, and UI extension. Types are policy vocabulary only—they never grant install or execution authority. Reviewing this catalog does not install, enable, load, or execute plugins, and does not open the network.
Provider / model runtime: approved local backends and model launch surfaces
UI extension: additive Hub panels only—never removes established controls
Advisory plugin-type catalog only (FW3-RS-PLUG-001). Existing plugin controls are unchanged.
What plugin trust levels exist?
Marketplace plugins declare a closed trust level: official, verified, community-reviewed, unverified, quarantined, or revoked. Trust is policy metadata only—signatures prove publisher identity and integrity, never quality or safety, and never grant install or execution authority. Quarantine and revocation always override a higher declared level. Reviewing this catalog does not install, enable, or load plugins, and does not open the network.
Official: official key-ring signature required
Verified: publisher or official signature required
Quarantined / revoked: policy-blocked until cleared or forever disabled
Advisory trust-level catalog only (FW3-RS-PLUG-018). Existing plugin and marketplace controls are unchanged.
How are plugin signatures and publisher identity verified?
Ready State verifies signed plugin envelopes with detached Ed25519 signatures against caller-supplied publisher and official key rings. A valid publisher-ring signature yields publisher identity; an official-ring signature yields official identity. Unknown keys, bad signatures, and missing envelopes fail closed as none. Signatures prove publisher key possession and integrity only—never quality or safety—and never grant install or execution authority. Reviewing this help does not install, enable, load, or execute plugins, and does not open the network.
Ed25519 envelopes from the signed plugin manifest contract
Key rings: publisher and official (deny-by-default for unknown keys)
Inventory evidence: signature_valid plus publisher_identity for trust levels
Optional artifact digest binding when content hashes are supplied
Planning only—never installs plugins or grants execution authority
Advisory signature/identity verification explanation only (FW3-RS-PLUG-019). Existing plugin and marketplace controls are unchanged.
How do plugin revocation and emergency disable lists work?
Ready State evaluates locally supplied revocation and emergency-disable lists offline. Each entry binds a plugin id and artifact digest to a closed severity and reason code. Matching entries block install and enable planning and supply revocation_listed evidence for trust levels. Reviewing this catalog never fetches remote CRLs, never installs or enables plugins, and never mutates installed plugins.
Install/enable plans stay advisory until an authorized layer applies them
Advisory revocation/disable-list explanation only (FW3-RS-PLUG-024). Existing plugin and marketplace controls are unchanged.
What math-tool adapter and media-provider examples exist?
Ready State catalogs two example plugin scaffolds: a math-tool adapter (tool kind) for local formal-math tooling, and a media-provider (provider kind) for local-only multimodal media with network denied and transient media. Reviewing this catalog does not install packages, write scaffolds, enable plugins, spawn solvers, load codecs, grant permissions, or open the network. Scaffold plans stay dry-run until an authorized writer runs.
Math-tool adapter: deny-by-default tool surface; no solver import or process spawn in the scaffold
Media-provider: local execution, network egress denied, transient media, nonvoice alternative required
Embedded manifests validate against the closed plugin SDK contract
Examples are assistive planning artifacts — not runtime authority
Advisory math/media example catalog only (FW3-RS-PLUG-015). Existing plugin controls are unchanged.
How do local plugin conformance tests and the test harness work?
Ready State provides a local, in-process conformance suite for plugins: manifest schema, closed permissions, network egress gates, sandbox deny defaults, high-risk approval, and no-secret fields. Embedded known-good and known-bad fixtures self-prove the harness. Reviewing this flow does not load or execute plugins, install packages, open the network, grant permissions, or invent coverage metrics.
Closed conformance check catalog (local only; remote CI not required)
Known-good and known-bad fixtures for self-proof
Sandbox deny defaults and high-risk approval gates
Results are assistive evidence — not install authority
Harness never executes plugins or opens the network
Advisory plugin conformance harness explanation only (FW3-RS-PLUG-013). Existing plugin controls are unchanged.
When can revenue-sharing and OEM hooks activate?
Ready State keeps marketplace revenue-share and OEM commercial hooks disabled until security maturity and support maturity evidence both pass. Operators may declare accounting-only revenue-share basis points or OEM co-brand / attribution-preserving white-label / factory-pack hooks, but activation plans stay blocked when review, signature, trust, revocation, import preview, permission, crash/support bundle, or support-contact evidence is incomplete. Reviewing this catalog never executes payments, never grants entitlements, never installs plugins, and never opens the network.
Default: commercial hooks disabled
Requires both security maturity and support maturity evidence
Revenue share: accounting-only settlement — never a payment rail
OEM: attribution and privacy-preserving reporting required
Ready plans remain advisory until an authorized commercial layer applies them
Advisory revenue-sharing/OEM maturity-gate explanation only (FW3-RS-PLUG-025). Existing plugin, marketplace, and billing controls are unchanged.
How are malware, static analysis, dependencies, licenses, and permissions reviewed together?
Operators review a digest-bound four-section card: malware/static findings (caller-supplied verdicts only), exact dependency pins and licenses, plugin license class, and closed permissions with high-risk flags. Malicious or inconclusive malware verdicts, critical findings, unpinned dependencies, and prohibited licenses block. Copyleft/commercial licenses and high-risk permissions require acknowledgement. This review never runs antivirus, unpacks artifacts, invents scan metrics, installs plugins, or opens the network.
Four sections: malware/static, dependency, license, permission
Caller-supplied structured findings only — no live AV or network lookups
Fail-closed on malicious/inconclusive, critical findings, unpinned deps, prohibited licenses
Digest-bound acknowledgement is not install or runtime authority
Produces static_scan / dependency_scan / license_review gate digests for PACK-018
Advisory security-analysis explanation only (FW3-RS-PLUG-020). Existing plugin and install controls are unchanged.
How are plugin permissions reviewed and approved?
Plugins request a closed permission set (project read/write, model invoke, vector access, network egress, process spawn, UI extend). Operators review each permission with risk labels, then confirm a digest-bound approval. High-risk grants (project write, network egress, process spawn) are flagged separately. Reviewing this flow does not grant permissions, install plugins, or open the network.
Deny-by-default closed permission vocabulary
Human-readable labels and high-risk flags per permission
Digest-bound confirmation before authorized enabler readiness
Security-review signatures are not user consent
Preview never installs, enables, or grants runtime authority
Advisory permission-review explanation only. Existing plugin and install controls are unchanged.
What does the plugin import preview show?
Before any authorized importer proceeds, operators review a digest-bound preview with five sections: code source (opaque reference only), requested permissions, network mode and domains, declared tool identifiers, and data-access scopes. Reviewing this preview does not import, install, enable, load, or execute plugins, and does not grant permissions or open the network.
Five sections always present: code source, permissions, network, tools, data access
Code source is an opaque reference (path/digest/kind) — no execution or remote fetch
network:egress required for non-deny network modes and domain lists
Tools are declared identifiers only; preview never starts tools
Data scopes derive from permissions and stay project-contained
Acknowledgement is digest-bound and is not install authority
Advisory import-preview explanation only. Existing plugin and install controls are unchanged.
How do plugin network domain policies work?
Each plugin is bound to a deny-by-default network mode (deny, local-only, exact-hostname allowlist, or offline). Non-deny modes require the network:egress permission. Plugin allowlists cannot expand beyond host offline/allowlist restrictions. Reviewing this policy does not grant permissions or open the network.
Default mode: deny
Allowlist: exact hostname match only (no wildcards)
network:egress required for allowlist and local-only
Host offline/deny blocks plugin egress plans
Policy checks never contact the network
Advisory plugin network policy explanation only. Existing egress and plugin controls are unchanged.
How do out-of-process plugin workers run?
Plugin workers may run in isolated subprocesses using a versioned JSON-RPC 2.0 contract over stdio, Unix socket, or named-pipe transports. Plans require the closed process:spawn permission, digest-bound operator approval, and healthy worker state before invoke envelopes are accepted. Reviewing this contract does not spawn subprocesses, open network connections, install plugins, or grant permissions.
Closed transports: stdio, Unix socket, and named-pipe JSON-RPC
Resource limits cap request/response/stdout/stderr bytes and invoke timeout
Advisory out-of-process contract explanation only (FW3-RS-PLUG-003). Existing plugin controls are unchanged.
What sandbox and resource limits apply per plugin?
Each plugin gets a deny-by-default sandbox (project-scoped filesystem/network/process, no secret inheritance) plus hard resource ceilings for time, memory, CPU, output, child processes, RPC byte sizes, and invoke timeout. Plans may only tighten within host ceilings; loosening the sandbox fails closed. Reviewing this catalog does not start processes, open the network, install plugins, or enforce OS cgroups.
Usage evaluation reports breaches without killing processes
Advisory sandbox/resource-limit explanation only (FW3-RS-PLUG-004). Existing plugin controls are unchanged.
What can UI extension plugins change in the Hub UI?
UI extension plugins may only add non-security-critical Help panels, status text, or noncritical buttons. They cannot replace, remove, rename, relocate, regroup, hide, or disable security-critical controls such as auth, permissions, secrets, network policy, billing, install authority, or emergency disable. Reviewing this catalog does not mutate the live UI, install plugins, or grant permissions.
Kind must be ui_extension with ui:extend permission
Security-critical control ids are a closed immutable set
Plans never mutate the live UI
Advisory UI-extension boundary explanation only (FW3-RS-PLUG-016). Existing plugin and navigation controls are unchanged.
How do plugin health, timeouts, crashes, restarts, and quarantine work?
Plugin workers report health observations. Invoke time has a hard timeout ceiling. Crashes may plan a bounded restart; exhausting the restart budget or repeating failures quarantines the plugin until an operator acknowledges clearance. Reviewing this policy does not start or restart processes, open the network, or grant permissions.
Closed health statuses with fail-closed invoke gates
Hard invoke timeout ceiling (caller-supplied elapsed time only)
Bounded restart budget; planning never executes process restarts
Quarantine after budget exhaustion, consecutive crashes/timeouts, or restart failure
Clearing quarantine requires operator acknowledgement and returns to stopped
Advisory health-runtime explanation only. Existing plugin and install controls are unchanged.
How do plugin crash and support bundles work?
When a plugin worker fails, operators can assemble a local redacted crash/support bundle with identity, crash kind, optional health counters, stderr tail, recent events, and host versions. Secrets are scanned and redacted before write. Creating a bundle never restarts the plugin, never uploads, never opens the network, never includes prompts or project files by default, and never grants install or enable authority.
Required sections always present, including secret scan and checksum
Optional health snapshot from plugin health runtime observations
Local zip only under a caller-approved directory — no automatic upload
Prompt-inclusive diagnostics stay on the general support-bundle path after review
Advisory crash/support-bundle explanation only (FW3-RS-PLUG-023). Existing plugin and support-bundle controls are unchanged.
What adversarial plugin probes cover escape, secrets, DoS, and event spoofing?
Ready State runs fifteen harmless local adversarial plugin probes for sandbox escape, plaintext or cross-plugin secret access, resource-ceiling denial of service, and hub event spoofing. Reviewing this help does not install, load, enable, or execute plugins; does not return secrets; does not open the network; and does not emit hub authority events.
Passing means every probe was blocked fail-closed — not runtime isolation proof
Advisory adversarial-plugin explanation only (FW3-RS-PLUG-026). Existing plugin and install controls are unchanged.
How do plugins access secrets through scoped handles?
Plugins receive opaque scoped handles (pluginsecrethandle:…) and backend secretref pointers only — never plaintext secrets or ambient environment inheritance. Each handle binds to one plugin, project, and secret alias with closed scopes (network_auth, connector_config, local_signing). Reviewing this gate does not return secret material, read the secret store, grant permissions, or open the network.
Opaque handles only — raw api_key/password/secret fields rejected
network:egress required for network_auth and connector_config scopes
Store/revoke plans are dry-run only for authorized executors
Preview never inherits ambient secrets or returns plaintext
Advisory secret-handle explanation only (FW3-RS-PLUG-009). Existing plugin and install controls are unchanged.
How are plugin data-access scopes project-contained?
Plugins bind closed data-access scopes (project files, vector index, project metadata) to one project root. File paths must stay under that root with optional relative prefixes; symlink or junction escape is denied. Reviewing this gate does not grant permissions, install plugins, read file contents, or open the network.
Scopes bound to a single project id and root digest
project:read / project:write and vector permissions map to closed scopes
Digest mismatch or widened permissions fail closed
Preview never grants runtime authority or mutates files
Advisory data-access-scope explanation only. Existing plugin and install controls are unchanged.
What does a plugin import preview show?
Before import, operators review five closed sections: code source (opaque local, marketplace, offline, signed, or scaffold reference), permissions with risk labels, deny-by-default network mode and exact-hostname domains, declared tool identifiers, and project-bound data-access scopes. Digest-bound acknowledgement marks readiness for an authorized importer only. Reviewing this preview does not grant permissions, install plugins, start tools, or open the network.
Five sections: code source, permissions, network, tools, data access
Opaque source references — no remote fetch or file content reads
network:egress required for non-deny modes and domain lists
Tools are declared identifiers only (never started by preview)
Acknowledgement is not install authority
Advisory import-preview explanation only (FW3-RS-PLUG-021). Existing plugin and install controls are unchanged.
How do lockfiles affect package-install approval?
Developer package installs combine exact package/version/license approval with project lockfile awareness. Locked managers are preferred when a lockfile is present. Reviewing this gate does not grant permissions or install packages.
Exact approval still required (SAFE-012)
Known lockfiles detected from project inventory only
Missing lockfile or version drift needs an explicit override
Planning never installs or opens the network
Advisory lockfile explanation only. Existing install controls are unchanged.
How are destructive actions re-authenticated?
Destructive actions require both a fresh re-authentication window and an expiring confirmation challenge. Reviewing this gate does not grant permissions or mutate resources.
Re-authentication must be recent (default 300s)
Confirmation must be unexpired and unused (default 180s TTL)
Both gates must pass before executor readiness
Evaluation never authenticates users or deletes data
Advisory gate explanation only. Existing confirmation controls are unchanged.
Review the transcript before creating a task?
By default, voice flows show an editable transcript after local transcription and before task creation. Correct the text, then confirm. This panel does not grant permissions, retain audio, or create tasks.
Language appears after transcription.
Confidence is labeled when the local engine provides it (not a statistical interval).
Advisory transcript review explanation only (FW3-RS-VOICE-005). Existing Hub Voice controls are unchanged.
When does voice need a clarity loop?
Low-confidence, ambiguous, or potentially destructive voice commands enter a bounded clarity loop before task creation. Review or edit the transcript, select among candidates, or type a clear intent. This panel does not grant permissions, retain audio, or start actions.
Intent candidates appear here when multiple actions match.
Clarity loop is advisory only until a host wires live voice flows.
High-risk actions from voice require a visible summary acknowledgment and an exact typed confirmation phrase. Spoken yes alone is never enough. Reviewing this gate does not grant permissions or start actions.
Visual summary must be acknowledged on screen
Typed phrase must match exactly (case-sensitive)
Spoken confirmation alone never authorizes high-risk actions
Confirmation expires (default 180s) and is single-use
Advisory confirmation explanation only. Existing Hub Voice controls are unchanged.
How do optional spoken summaries work?
Optional local TTS can speak short status, question, completion, and error summaries. TTS stays off by default. A text alternative is always available. Reviewing this panel does not start playback and does not synthesize audio.
Kinds: status, question, completion, error
Local offline TTS only; no audio egress by default
Visual/text twin is always present
Quiet mode blocks speech even when TTS is enabled
No invented latency or quality metrics
Summary text appears here when a voice flow produces a status, question, completion, or error.
Advisory TTS summary explanation only (FW3-RS-VOICE-011). Existing Hub Voice controls are unchanged.
How are speech metrics reported?
Speech metrics report mean transcription confidence and correction rate only from observed sessions. Raw audio is not retained by default. Empty samples never invent scores. Reviewing this panel does not open microphones or store audio.
Mean transcription confidence: insufficient samples until observations arrive.
Correction rate: insufficient samples until observations arrive.
Confidence uses caller/engine/heuristic scores only
Advisory speech metrics explanation only (FW3-RS-VOICE-020). Existing Hub Voice controls are unchanged.
What voice control commands are supported?
Voice Assistant recognizes voice-to-project, voice-to-run, cancel, pause, status, and approval commands from speech or typed text. Commands are plan-only until a host wires the durable Task engine. Approval never grants permissions alone. Reviewing this panel does not open the microphone or start actions.
Voice to project — create or open a project
Voice to run — create a durable run or task
Cancel — cancel the current or named run/task
Pause — pause the current or named run/task
Status — ask for status (read-only)
Approval — route to approval gates (never grants alone)
Command catalog is advisory only until a host wires live voice flows.
Advisory control-command explanation only (FW3-RS-VOICE-019). Existing Hub Voice controls are unchanged.
How do voice privacy and retention settings work?
Voice privacy controls how temporary recordings and transcripts are retained. Raw audio is not retained by default; temporary recordings delete after transcription unless you choose an explicit opt-in mode. Reviewing this panel does not open the microphone, retain raw audio, or delete data.
Audio retention default: temporary, then delete after transcription
Transcript retention default: user-controlled
External network and audio egress stay off
Export settings never includes raw audio
Delete requires confirmation and explicit scopes
Privacy settings are advisory until a host wires live voice flows.
Advisory privacy explanation only (FW3-RS-VOICE-013). Existing Hub Voice controls are unchanged.
When are temporary voice recordings deleted?
Temporary recordings delete by default after local transcription completes. Cleanup is plan-only until a host executor confirms; this panel does not open the microphone, retain raw audio, or delete files.
Default: delete temp audio after transcription
No raw audio retention by default
Host confirmation required before any filesystem unlink
Composes with voice privacy retention settings
Temporary recording cleanup is advisory until a host wires live voice flows.
Advisory temp cleanup explanation only (FW3-RS-VOICE-014). Existing Hub Voice controls are unchanged.
How does voice offline mode block audio egress?
Offline mode blocks cloud STT/TTS, network voice routes, and audio egress while keeping local-only capture, transcription, and TTS planning available. Reviewing this panel does not open the microphone, contact the network, or enable cloud voice.
Offline mode default: off (optional enable)
Audio egress stays off even when offline mode is disabled
Local STT/TTS and transcript planning remain allowed offline
Cloud and network voice actions are always denied by default
Voice offline mode is advisory until a host wires live voice flows. Audio egress remains blocked.
Advisory offline-mode explanation only (FW3-RS-VOICE-015). Existing Hub Voice controls are unchanged.
How does redacted voice command history work?
Optional local history can keep recent voice commands for review. Sensitive tokens and light PII are redacted before anything is retained. History stays off by default and does not retain raw audio. Reviewing this panel does not open the microphone or start capture.
History is opt-in and default off
Secrets and light PII become [redacted] before store
Raw transcripts and raw audio are never retained
Bounded list with clear and redacted export
No redacted history entries yet.
Advisory history explanation only (FW3-RS-VOICE-017). Existing Hub Voice controls are unchanged.
How do code-writing packs isolate Git writes?
Code-writing packs default to an isolated worktree (preferred) or AI branch before writes. Reviewing this default does not create worktrees or branches.
Worktree is the default isolation mode
AI branch is an allowed alternative
Primary-branch writes are blocked by default for code-writing packs
Planning never creates Git objects
Advisory Git default explanation only. Existing Git controls are unchanged.
When is a stable snapshot allowed?
A stable snapshot becomes ready for an authorized executor only after every required validator reports passed evidence. Reviewing this gate does not create snapshots or mark them stable.
Runtime snapshots remain owned by Git safety tools
Advisory snapshot-gate explanation only. Existing Git controls are unchanged.
How do preview, apply, revert, and rollback work?
Change actions are preview, apply, revert, and rollback. Apply needs a diff preview plus passed validation and confirmation; revert needs an applied change; rollback needs a stable snapshot reference. Reviewing this flow does not write files or mutate Git.
Preview is advisory and never mutates
Apply requires preview, validation, and confirmation
Revert requires an applied change
Rollback requires a stable snapshot reference
Advisory change-action explanation only. Existing apply/revert controls are unchanged.
When does automatic rollback run after a failed task?
Automatic rollback is policy-gated: it applies only after a task fails and files were modified, and only with a stable snapshot reference. Reviewing this policy does not restore files or mutate Git.
Default policy: always on failure (when snapshot exists)
Advisory rollback-policy explanation only. Existing recovery controls are unchanged.
Can Flywheel reset or clean my working tree?
git reset --hard and git clean against your existing working tree require an explicit loss preview and approval. Reviewing this gate does not run reset or clean.
Loss preview must list paths at risk
Operator must acknowledge the preview
Separate explicit approval is required
Planning never mutates the working tree
Advisory working-tree gate explanation only. Existing Git controls are unchanged.
How does Flywheel stop repeating the same failing loop?
Anti-loop hashes cover outputs, patches, error signatures, and route states. When the same digest repeats at the limit, further attempts are blocked. Reviewing this detector does not execute tasks.
Kinds: output, patch, error signature, route state
Default repeat limit: 3
Deterministic SHA-256 digests
Evaluation never starts work
Advisory anti-loop explanation only. Existing run controls are unchanged.
What happens after a duplicate output or error signature?
When the same output or error signature repeats, Flywheel plans a progressive strategy shift (constrain, replan, swap tools, escalate route, compact context, request human, or stop) instead of free-repeating. Reviewing this planner never executes tasks or applies changes.
Signatures: output and error_signature digests
Default shift threshold: 2 identical digests
Progressive ladder ends in stop when exhausted
Optional failure-class bias; planning never applies changes
Advisory anti-repeat strategy explanation only. Existing run controls are unchanged.
How does code Plan-Execute-Test-Repair work?
Ready State plans a four-stage code loop: plan targeted edits, execute only through an authorized durable executor, run required tests, then repair within a hard attempt budget before success. Reviewing this help never applies patches, starts tools, or calls models.
Stages: plan → execute → test → repair
Execute and repair require an authorized durable executor
Code assist only — not authority to mutate without the Task engine
Advisory code PETR explanation only. Existing code and run controls are unchanged. FW3-RS-FLOW-003
How does document Retrieve-Synthesize-Cite-Validate work?
Ready State plans a four-stage document loop: retrieve local evidence, synthesize a draft, attach citations grounded in retrieved chunks, then validate citation and unsupported-claim checks before success. Reviewing this help never runs retrieval, calls models, or marks answers authoritative.
Stages: retrieve → synthesize → cite → validate
Citations must ground to retrieved chunk ids or paths
Document assist only — not authority over source truth
Advisory document RSCV explanation only. Existing document and run controls are unchanged.
How do MATLAB and Octave batch runs get planned?
Ready State plans MATLAB (matlab -batch) or GNU Octave (octave --no-gui) batch runs and classifies license, startup, and execution failures from captured output. MATLAB planning requires license detection plus explicit user action and proprietary-tool consent; Octave remains the ungated open alternative. Reviewing this help never starts MATLAB/Octave, probes license servers, or grants proof authority.
Choose MATLAB or Octave; engines are mutually exclusive per plan
Script-file or bounded batch-expression modes with path/expression guards
Hub plans and classifies only — no license-server probes from this panel
Advisory MATLAB/Octave batch explanation only. Existing run controls are unchanged.
How do Sage or MPFR numeric results hand off to Lean formal statements?
Ready State plans cross-check workflows where SageMath or MPFR-style numeric results inform — but never substitute for — a subsequent Lean formal statement. Numeric evidence must pass validators (and dual Sage+MPFR agreement when required) before the formal stage unblocks. Reviewing this help never starts Sage, MPFR, or Lean, and never grants proof authority from numeric assist.
Workflows: Sage→Lean, MPFR→Lean, Sage↔MPFR cross-check, and Sage+MPFR→Lean
Explicit numeric-to-formal handoff gate with advisory-only numeric authority
Discrepancies escalate; formal stages stay blocked until handoff validates
Lean compile success remains tool-scoped — not absolute math truth
Advisory cross-check workflow explanation only. Existing run controls are unchanged.
Where are formal proof and scientific script starter projects?
Ready State catalogs proof templates (Lean, SMT-LIB2, DIMACS), scientific script templates (Sage, MPFR, Arb, Octave, Python wrappers), and multi-file starter projects composed from those templates. Reviewing this catalog never writes files, installs tools, runs solvers, or grants proof authority.
Proof view: Lean / SMT / DIMACS templates from MATH-006
Starter projects include README plus scaffold files with digests
Materialization plans relative paths only — no filesystem writes here
Advisory proof/script starter explanation only. Existing project controls are unchanged.
How does formal math stop repeating the same proof, file, or error?
Formal-math anti-loop detection hashes proof artifacts, source files, and error signatures. After duplicate digests, Flywheel plans progressive strategy shifts (repair from feedback, replan proof, swap tool, escalate route, compact context, request human, or stop). A hard block applies at the repeat limit. Reviewing this detector never executes solvers or grants proof authority.
Kinds: proof, file, and error digests
Default shift threshold: 2; hard block at repeat limit 3
Math-specific strategy ladder with optional failure-class bias
Evaluation never starts tools or claims proof success
Advisory formal-math anti-loop explanation only. Existing run controls are unchanged.
How does overnight proof mode stay bounded and resume-safe?
Overnight proof mode bounds formal-math repair sessions with wall-time and attempt limits, a thermal exposure budget, checkpoint cadence, and quiet overnight notifications with critical escape and a morning digest. Reviewing this help never starts solvers, writes checkpoints, delivers notifications, or grants proof authority.
Default bounds: 8 h duration, 200 attempts, 4 h thermal budget, 15 min checkpoints
Safe halt on critical thermal/resource pressure, overdue or failed checkpoints, low battery
Advisory gate only — durable runner must authorize and persist independently
Advisory overnight proof mode explanation only. Existing run controls are unchanged.
How are generated math artifacts snapshotted and rolled back?
Formal-math generation defaults to worktree isolation. Flywheel records content-addressed snapshots of declared Lean/SMT/DIMACS/Sage/script artifacts under approved roots, then restores or removes them only with verified isolation and explicit consent. Planning never creates Git objects; rollback never writes the primary branch or grants proof authority.
Optional injected Git snapshot/revert certification only
Advisory math-artifact snapshot explanation only. Existing run controls are unchanged.
When is formal/math readiness certified?
Ready State math certification requires real captured tool exit codes and output plus task-specific validator classification matched to digest-bound benchmark expectations. Synthetic or simulated success cannot pass. Reviewing this gate never starts Lean, SAT solvers, Sage, MPFR, Arb, MATLAB, or Octave, and never grants proof authority.
Real exit code and captured stdout/stderr required per benchmark case
Negative cases pass when the expected failure outcome is observed
Certifier plans/evaluates only — no solver execution from this panel
Advisory math readiness certification explanation only. Existing run controls are unchanged.
What does a compiler exit of zero prove?
A successful compiler or checker exit (code 0) certifies only the checked artifact that was validated — for example that a Lean file typechecked. It does not prove every informal claim in chat, notes, or marketing copy, and never grants absolute mathematical truth or proof authority.
Exit zero + validator pass → checked artifact only
Informal, narrative, and unbound claims stay unproved
Sorry or incomplete proofs block support even when exit is 0
Overclaims that treat exit zero as full proof are rejected
Advisory proof-scope explanation only. Existing run controls are unchanged.
Is LCM a model family or an architecture profile?
Ready State treats Latent Consistency (LCM) as a generation architecture/acceleration profile only — never as a universal model category or model family. Bare “LCM” labels stay ambiguous until mapped. Reviewing this help does not start backends or invent metrics.
Allowed: architecture, acceleration, or sampling profile
Forbidden: model family / universal model category
Canonical profile id: latent_consistency
Composes VIS-007 provider interface and ONTO-014 ontology
Advisory policy only. Existing vision controls are unchanged.
How does the diffusion / LCM image generation provider work?
Ready State exposes a consent-gated provider interface with two architecture profiles — diffusion and latent_consistency (LCM acceleration). LCM is not a unique model family. Plans bind approved local backends only. Reviewing this help never starts a backend, downloads weights, invents generation metrics, or opens the network.
Diffusion profile for standard local sampling steps
Latent-consistency profile for fewer-step acceleration
Backends come from the approved image-backend adapter manifest
Ambiguous bare “LCM” labels fail closed until mapped
Advisory provider interface only. Existing vision controls are unchanged.
How do screenshot, document-image, and UI analysis workflows run?
Ready State plans three local Vision Understanding workflows: screenshot analysis, document-image analysis, and UI analysis. Each binds a route role, project-scoped image ref, checklist validators, and durable Task stages. Reviewing this help does not start a VLM, retain image bytes, invent visual metrics, or open the network.
Screenshot analysis prefers fast inspection with checklist notes
UI analysis prefers region annotations and accessibility notes
Observations must be explicit booleans — captions are not evidence
Advisory workflow catalog only. Existing vision controls are unchanged.
Which local adapters classify images or detect objects?
Ready State binds classification and object detection to local-only adapters: VLM structured labels, TorchVision/PIL classifiers, ONNX detectors, YOLO-compatible detectors, and OpenCV cascade tools. Reviewing this catalog does not grant permissions and never starts a model, downloads weights, or opens the network.
Classification via VLM structured JSON or a local classifier import
Detection via ONNX Runtime, YOLO/Ultralytics, or OpenCV when present
Capability probes use PATH/import presence only
Labels, scores, and boxes must be structured — captions are not evidence
Advisory adapter catalog only. Existing vision controls are unchanged.
How does Ready State plan SAM-compatible masks and metadata?
Ready State binds Segment-Anything-compatible local segmenters (sam-service, segment_anything, MobileSAM, SAM 2, ONNX SAM) and validates structured masks plus metadata. SAM is not a chat model. Reviewing this catalog does not grant permissions and never starts a model, downloads weights, or opens the network.
Point, box, auto, or mask prompts plan local-only argv without execution
Results require mask encodings (RLE, bitmap ref, or polygon) — captions are not masks
Capability probes use PATH/import presence only
Metadata stays closed-key and labels SAM as not a chat model
Advisory segmentation adapter only. Existing vision controls are unchanged.
How are segmentation masks previewed, edited, combined, and exported?
Ready State mask ops accept structured local masks (pixels, binary RLE, polygon, or bbox metadata). You can preview coverage, edit or combine occupancy, validate structure, and plan exports. Reviewing this catalog does not grant permissions and never starts a model, writes export files, or opens the network.
Preview returns occupancy, coverage, bbox, and an accessible text summary
Edit supports invert, clear, label/score, crop, dilate, and erode
Combine supports union, intersection, difference, and xor
Export plans stay local-only until an authorized executor applies them
Advisory mask-ops catalog only. Existing vision controls are unchanged.
How do OpenCV image transforms and measurements work?
Ready State plans local OpenCV-compatible transforms such as resize, crop, rotate, flip, color convert, blur, threshold, and morphology, and computes measurements from structured geometry or samples. Reviewing this catalog does not grant permissions and never imports OpenCV, writes image files, or opens the network.
Transform plans bind project-relative source and destination paths
Measurements cover dimensions, distances, contour area/perimeter, histograms, and centroids
Capability probes check for cv2 presence only — they do not start OpenCV
Geometry is never invented from captions; callers supply structured inputs
Advisory OpenCV-ops catalog only. Existing vision controls are unchanged.
How do FFmpeg media inspection, conversion, and assembly work?
Ready State plans local FFmpeg and ffprobe commands for media probe, transcode, remux, extract, scale, concat, mux, and slideshow assembly, and computes inspection summaries from structured stream/format descriptors. Reviewing this catalog does not grant permissions and never starts FFmpeg, writes media files, or opens the network.
Convert and assemble plans bind project-relative source and destination paths
Inspection covers streams, duration, format summary, and bitrate estimates from caller payloads
Capability probes check PATH for ffmpeg/ffprobe only — they do not start tools
Codecs and durations are never invented from captions; callers supply structured inputs
Advisory FFmpeg-ops catalog only. Existing media controls are unchanged.
Which local backends can generate images?
Ready State lists approved local image backends behind a closed manifest: ComfyUI, InvokeAI, Automatic1111/Forge, Diffusers local, and a generic image-backend binding. Reviewing this catalog does not grant permissions, never starts a backend, and does not download weights or open the network. Explicit consent is required before any generation plan.
Approved adapters only — unlisted cloud backends are denied
ComfyUI preferred when present; generic local fallback always plannable
Capability probes use PATH/import presence only
Consent is required; planning consent is not runtime authority
Advisory image-backend catalog only. Existing generation controls are unchanged.
How are image-generation settings recorded for provenance?
Ready State records prompt, seed, resolution, steps, and model identity for local image generation. Prompt text is digest-only unless you consent to retention. Reviewing this help does not start a backend, store image bytes, or open the network.
Required settings: prompt, seed, resolution, steps, and model
Canonical digests verify records were not tampered
Image bytes are never stored in the provenance ledger
Generation consent is required before recording
Advisory provenance explanation only. Existing vision controls are unchanged.
How are generated image outputs validated?
Ready State checks local image outputs for safety ceilings, allowed format, resolution, corruption, and bounded metadata. These are structural checks only — not a content-moderation oracle. Reviewing this help does not start a backend, retain image bytes, or open the network.
Allowed rasters: PNG, JPEG, WebP, and GIF
Resolution bounds and optional expected-size match
Truncation, trailer, and declared size mismatch detection
Metadata rejects secrets, paths, and remote URL schemes
Advisory format, resolution, corruption, and metadata validation only. Existing vision controls are unchanged.
How does visual comparison of vision artifacts work?
Ready State compares two vision artifacts with closed modes (side-by-side, overlay plan, difference summary, settings diff, metric table, mask overlap) using digests and metadata only. Reviewing this help does not store image bytes, invent SSIM/PSNR scores, start backends, or open the network.
Modes plan review layout and report digest/metadata diffs — never render pixels here
Numeric metric deltas require caller-supplied measured values and are labeled estimates
Project gallery rows hold digests, kinds, tags, and provenance links only
Product boundary: review-assist, not visual authority
Advisory visual comparison catalog only. Existing vision controls are unchanged.
How do visual comparison and the artifact gallery work?
Ready State compares vision and image-generation artifacts side-by-side using structured metadata (ids, digests, dimensions, provenance links) and keeps a project-scoped gallery of those references. Reviewing this help does not store image bytes, invent similarity scores, start backends, or open the network.
A/B comparison diffs measured fields only — never pixel similarity scores
Gallery rows store digests and project-relative refs, not image bytes
Remote URLs and absolute paths are denied for artifact and thumbnail refs
Accessible text summaries list each slot and gallery item
Advisory visual-compare and gallery catalog only. Existing vision controls are unchanged.
How are image-memory and vision context budgets planned?
Ready State allocates multimodal context capacity for image-memory digests/refs and visual tokens, then runs a labeled resource preflight for decode working memory and context fit. Reviewing this help does not decode pixels, start models, retain image bytes, or invent measured TTFT/TPS.
Sections reserve system policy, objective, image_memory, image_tokens, history, tools, and output
Image-memory holds digest/ref prior findings only — never raw bytes
Preflight composes VIS-002 ceilings with labeled RAM and context estimates
Fit outcomes are fits, tight, over_capacity, or blocked — never treated as live meters
Advisory image-memory/context budget only. Existing vision controls are unchanged.
How does batch thumbnail preview avoid loading full media?
Ready State plans bounded thumbnails and metadata preview cards for media batches so galleries can show small previews first. Reviewing this help does not decode pixels, start FFmpeg, write files, or invent measured transfer meters.
Default mode is full-on-demand: thumbnails first, full media only on selection
Images and videos plan scaled thumbs; audio uses a metadata-only card
Project-relative refs only — no remote URLs or path traversal
Byte-avoidance figures are labeled planning estimates, never live meters
Advisory batch thumbnail/preview only. Existing vision controls are unchanged.
What privacy rules apply to faces, media metadata, and external services?
Ready State applies a deny-by-default privacy policy for vision and media: face identification and biometric enrollment are off, EXIF/GPS strip on export, local media stays project-scoped without byte retention or training use, and external uploads require consent plus an allowlisted destination. Reviewing this help does not decode media, start models, open the network, or act as a moderation oracle.
Faces: presence detection and blur/redact allowed; identify, enroll, and unredacted export denied
Metadata: strip EXIF and GPS on export; technical dimensions only by default
Local media: local-only, project-scoped; no remote URL sources, byte retention, or training by default
External services: no silent upload; consent and opaque destination allowlist required
Advisory vision/media privacy policy only. Existing vision controls are unchanged.
Are avatar and media workflow packs separate plugins?
Ready State ships Avatar Workflow Plugin and Media Workflow Plugin Pack as optional plugins, not core dependencies of Vision Understanding, Segmentation, Image Generation, or Media Processing. They stay disabled until explicit project-scoped opt-in and plugin SDK review. Reviewing this help does not enable plugins, start backends, download models, or invent capability metrics.
Avatar Workflow Plugin: optional local avatar pose/expression/render planning
Media Workflow Plugin Pack: optional extended media chapterize/transform planning
Neither plugin is required by the four core vision ready-state packs
Enablement plans never install, activate, or grant authority by themselves
Advisory optional-plugin catalog only. Existing vision controls are unchanged.
What if my hardware cannot run diffusion or video locally?
Ready State compares caller-supplied VRAM, system RAM, GPU presence, and local media-toolchain evidence to labeled planning floors for local diffusion and video. Missing evidence yields unavailable warnings — never invented VRAM figures or speed claims. Reviewing this help does not probe hardware, start backends, download models, or open the network.
Blocked when VRAM/RAM is below labeled floors or GPU/toolchain evidence fails
Unavailable when hardware evidence is incomplete — capability is withheld, not guessed
CPU-offload paths are labeled estimates only, never performance guarantees
Floors are planning estimates, not measured host benchmarks
Advisory honest-capability warnings only. Existing vision controls are unchanged.
What benchmark fixtures cover vision workflows?
Ready State catalogs synthetic fixtures for UI inspection, document images, object localization, segmentation, and visual consistency. Cases use expected observation checklists only — no real photos, faces, or PII. Reviewing this help does not start models, invent perceptual scores, or treat captions as visual authority.
UI inspection: button grids and error-banner layouts
Document image: form fields and table grids
Object localization and segmentation: shapes and mask regions
Visual consistency: A/B layout pairs with checklist match only
Advisory synthetic fixture catalog only. Existing vision controls are unchanged.
How do visual workflows provide text and nonvisual output?
Ready State converts structured vision-workflow results (analysis plans and checklists, detections, masks, region annotations, comparison reports, and gallery lists) into plain text, ordered lists, tables, HTML fragments, and screen-reader summaries. Reviewing this help does not load image bytes, invent visual scores, start models, or replace existing visual controls.
Analysis plans and checklist observations as ordered text tables
Detections and region annotations as label/bbox text rows
Mask and comparison summaries without rendering canvases
Gallery lists as keyboard- and screen-reader-friendly item text
Advisory nonvisual alternatives only. Existing vision controls are unchanged.
How do optional remote vision connectors get consent and egress?
Ready State is local-first: optional remote VLM, image-generation, media-analysis, and OCR connectors stay off until explicit user consent, separate egress consent, an opaque destination allowlist entry, redaction, and a declared egress budget. Reviewing this help does not enable connectors, open the network, upload media, or start backends.
Remote connectors are optional and never required by core vision packs
Silent enablement and empty destination allowlists are denied
Consent + egress consent are both required (dual gate)
Plans never perform egress or grant tool authority by themselves
Advisory remote-connector policy only. Existing vision controls are unchanged.
What readiness tests cover vision and media workflows?
Ready State runs five harmless local probes for image transport, segmentation masks, generation artifacts, FFmpeg conversion plans, and VLM reports. Reviewing this help does not start models or FFmpeg, write media files, open the network, or treat captions as visual authority.
Image transport validates registered VLM batch limits without fetching bytes
Segmentation mask and generation artifact checks are structural only
FFmpeg conversion is planned, never executed, during readiness
VLM reports require explicit checklist observations, not caption guesses
Advisory vision readiness catalog only. Existing vision controls are unchanged.
What readiness tests cover documents, research, and RAG?
Ready State runs six harmless local probes for indexing defaults, retrieval variant selection, citation inspection, retrieved-content isolation, deletion planning, and offline privacy gates. Reviewing this help does not start indexing or retrieval, purge files, open the network, or invent coverage metrics.
Indexing and retrieval probes plan defaults and stacks without starting jobs
Citation and isolation checks use caller fixtures only
Deletion is plannable with cascade flags; nothing is purged
Offline privacy denies cloud embed and egress by default
Advisory knowledge readiness catalog only. Existing knowledge controls are unchanged.
What readiness tests cover voice and speech-to-task workflows?
Ready State runs seven harmless local probes for recording controls, local transcription plans, transcript edit/review, typed-task intent extraction, clarity-loop resolution, cancellation planning, and optional TTS summaries. Reviewing this help does not open microphones or speakers, start STT/TTS backends, retain audio, submit tasks, or invent speech metrics.
Recording and cancellation plans never open the microphone or execute tools
Transcription is planned and normalized from fixtures — no live engine run
Edit and task-creation probes prove review gates without submitting work
TTS remains optional with a text twin; synthesis never starts during readiness
Ready State budgets cover attempts, wall-time, tokens, model loads, thermal pressure, and tool calls. Reviewing these ceilings does not start models or tools.
Six budget kinds with fail-closed ceilings
Observed usage must stay within limits
Missing observed kinds block evaluation
Evaluation never invents live metrics
Advisory budget explanation only. Existing run controls are unchanged.
When can context be compressed after errors?
After repeated errors, a compression plan may become ready only while preserving the current objective and evidence references. Reviewing this policy does not mutate conversation context.
Default threshold: 3 repeated errors
Current objective must be preserved
Evidence references must be preserved
Planning never mutates context
Advisory compression explanation only. Existing chat controls are unchanged.
How does context compaction change by workflow stage and model size?
Ready State plans compaction intensity from the current workflow stage and model size class. Smaller models and repair stages compact more aggressively; validate and finalize preserve evidence. Retention targets are labeled estimates. Reviewing this planner never mutates conversation context or invents measured token savings.
Planning never mutates context; existing controls unchanged
Advisory stage×size compaction explanation only (FW3-RS-FLOW-014). Existing chat and run controls are unchanged.
When do agent loops pause for human clarity or approval?
Ready State inserts clarity nodes for ambiguous goals and approval nodes for high-risk, destructive, egress, privilege, irreversible, or install actions. Models and agents cannot self-approve. Reviewing this planner never executes tasks, grants permissions, opens the network, or invents metrics.
Ambiguous tasks require a clarity node before continuation
High-risk tasks require an explicit human approval node
Ambiguous and high-risk tasks run clarity first, then approval
Existing Hub run, voice, and automation approval controls are unchanged
Advisory clarity/approval gate explanation only (FW3-RS-FLOW-016). Existing controls are unchanged.
What do the prebuilt workflow cards show?
Ready State visual workflow cards explain each prebuilt agent loop's stages, initial model role, deny-by-default tools, required validators, and limits (repair budgets, supreme thresholds, pack loop budgets). Reviewing these cards never starts workflows, grants permissions, binds providers, or invents metrics. Selection is advisory only.
Stages sense→plan→act→validate→finalize; role general; tools plan/observe; validators format/policy; bounded repair and pack budgets.
Stages action→observation; role code; tools tool_call/tool_result; validators tool_result/format; bounded repair.
Stages plan→execute→test→repair; role code; sandbox tools need approval; validators include test_pass and repair_budget.
Stages retrieve→synthesize→cite→validate; role general; citation and unsupported-claim validators required.
Stages extract→schema→validate→finalize; role general; json_schema and format validators; schema_rebind repair.
Stages vision→inspect→measure→report; role vision; consent/inspect/no_invented_scores validators.
Stages transcribe→clarify→act→confirm; role fast_chat; consent/clarify/confirm_before_act validators.
Stages formalize→solve→compile→prove; role reasoning; compile/prove/format validators.
Stages generate→render→inspect→refine; role general; inspect/format validators; refine_loop repair.
Stages plan→approve→execute→audit; role cognitive_hub; approval/audit/policy validators; human-gated.
Advisory visual workflow card catalog only (FW3-RS-FLOW-019). Existing run controls are unchanged.
How do overnight workflow variants stay permission-safe?
Ready State plans overnight-safe variants of prebuilt agent loops using the overnight_restricted profile, SAFE-022 blocked actions, narrowed tool allowlists, and quiet notifications with critical escape plus a morning digest. Supreme escalation is deferred to morning review. Speech loops that need a microphone are not overnight-eligible. Reviewing this planner never starts workflows, delivers alerts, or grants permissions.
Blocks new domains, package installs, destructive actions, and main-branch writes
Narrows tools (for example PETR keeps plan/test, denies sandbox execute overnight)
Advisory gate only — durable runner must authorize independently
Advisory safe overnight flow variant explanation only (FW3-RS-FLOW-017). Existing run controls are unchanged.
What does the morning digest include after overnight work?
The morning digest projects declared overnight outcomes into completed, failed, and blocked items plus resources, artifacts, validators, and next actions. Reviewing this help never executes tasks, delivers notifications, invents metrics, or expands overnight permissions. Results require evidence and artifacts when the durable runner declared them — not logs alone.
Partitions declared tasks into completed, failed (with reason), and blocked (with reason)
Surfaces measured resources only when provided (elapsed, thermal, battery, disk, memory, pauses)
Lists artifacts and validators with evidence refs; empty sections stay empty
Orders next actions as required, recommended, or optional follow-ups
Advisory morning digest explanation only (FW3-RS-NIGHT-015). Existing overnight and run controls are unchanged.
What is blocked overnight?
Overnight mode prohibits new network domains, package installs, destructive actions, and main-branch writes. Reviewing these restrictions does not grant permissions or start actions.
No new network domains
No package installs
No destructive actions
No main-branch writes
Advisory overnight explanation only. Existing policy controls are unchanged.
How do remote/mobile approval notifications work?
Approval notifications for remote or mobile review use a content-bounded summary only. Reviewing this flow does not send notifications, open the network, or grant approvals.
Channels: remote and mobile
Summary length is bounded
Obvious secret markers are rejected
Planning never sends or auto-approves
Advisory notification explanation only. Existing approval controls are unchanged.
How do safety audits and policy simulation work?
Safety events are structured records. The project-level policy simulator dry-runs outcomes for profiles such as read-only, ask-before-actions, and trusted-project. Reviewing this simulator does not mutate live policy.
Structured safety event types
Project-scoped dry-run simulation
Never mutates live policy
No invented metrics
Advisory audit/simulator explanation only. Existing policy controls are unchanged.
Which adversarial cases must fail closed?
Ready State adversarial coverage includes path traversal, empty variables, command injection, symlink escape, plugin abuse, and rollback failure. Reviewing this catalog does not execute attacks or mutate resources.
Path traversal probes must fail closed
Empty variables must fail closed
Command injection and plugin abuse must fail closed
Symlink escape and rollback failure must fail closed
Advisory adversarial catalog only. Existing security controls are unchanged.
Express Setup — 3 steps
Choose goals. Use the goal buttons above. Choosing a goal does not install or download anything.
Express Setup links existing review and verification controls; it never auto-approves, installs, downloads, or claims readiness.
Projects workspace
Create a project, review recent workspaces, validation commands, memory index status, and activity. Existing menus stay unchanged.
Starter project gallery
Browse committed guides. Availability means the guide files exist; requirements and runtime readiness are not checked.
Choose Browse starter projects to load the local catalog.
Review only; nothing is created, installed, downloaded, or run.
Optional project indexing
Lightweight FTS is the default. Embeddings/vector and graph are checked only after you select one and are offered only when the Hub's current measured hardware meets the documented minimums. Checking does not start indexing.
Select a mode and check availability. No index work starts here.
Open this section to load recent projects.
Developer workflow (git / tests)
Project-aware branch, status, diff, and validation/test projection from supplied evidence. Existing Projects controls stay unchanged.
Evidence-only; no invented metrics or repository mutation.
Searchable settings
Search Hub settings, switch basic/advanced mode, and restore defaults per section. Existing Settings chrome stays unchanged.
No invented metrics; section reset restores catalog defaults only.
Demo sample project (fake provider)
Demo samples use fake output, not live inference. No model download or external network access is required. Live lists the committed scenarios only; Demo runs the offline in-process fake provider.
The scenario uses only text you enter. It reads no project files, retains no prompt, and starts no download.
Live lists the sample. Switch to Demo to ask the fake provider (no download).
Guided tours
Optional product tours. Skip anytime, restart anytime. When a tour version changes, progress is marked outdated and re-offered. Existing menus stay unchanged.
Tours are optional. Progress stays on this browser; catalog versions re-offer after bumps.
Action undo
Record and undo reversible settings, model, profile, and project changes. Destructive actions are not recorded. Existing controls stay unchanged.
Undo restores bounded before snapshots only; stack stays on this browser.
Setup plan
Loading plan…
Setup estimates will appear after the scan.
Loading official Ollama guidance…
Quick actions
Lite Starter pack
Recommended one-click pack for Lite / 16 GB class machines.
Exact disk
Available after signed-manifest review
Download time
Estimated after network assumption review
Peak RAM
Available with matching measured profile
Expected speed
Available with matching local benchmark
Privacy
Local inference after an approved network download
Limitations
Review evidence and caveats before download
First validated task
Review the install, pull, setup, connection test, and first-task evidence path.
Review path not loaded.
Studio Dev pack
Coding-intent one-click pack for Studio / 32 GB class machines.
Tools: scanning…
Beginner path
Brain
Open-source models that think. Organize by type, size, usage, age, or recommendation. Click the body of a compact card for researched details; installed-model delete sliders remain separate controls.
Good hardware fitMarginal fit / speed warningPoor hardware fitFit unknownSuperseded / redundantInstalled on this PCSelected for download
Press slash to focus the catalog filter when this tab is open.
Slots —
Model not in the catalog? Discover and add unlisted models — available on Pro tiers and above (Lite & Studio see this message).
Select 2–5 models, then compare side by side in GoogleOnly up to 5 models can be compared
Nervous System
Open-source tools that let brains act — search, code, containers, RAG, automation. Flywheel detects what you already have so you don’t reinstall.
Live Tool Center — loading…
AI tool access
Scan lists tools only — it never grants access. AI use requires Accept or Deny per tool fingerprint.
Missing license shows a warning; it does not auto-deny. Revoke clears a prior grant.
Coding agent repo scope
Limit autonomous file writes to approved paths under the selected repo root.
Dataset scope
Declare allowed data roots before analysis prompts. Paths outside these roots are rejected.
SQL sandbox
Analytics SQL defaults to read-only. Enable write queries only when you need mutating statements.
Mode: read_only
On this PCMissing deps or disk spaceHigher install riskSelected for downloadAvailable to install
0 tools selected - 0 GBSelected download estimate
Reasoning Layer
Open-Source SAT/UNSAT Solvers
Boolean SAT/UNSAT work can run through StrataX (coordinated harness + relearning) or direct open-source solvers. The catalog below never silently installs binaries.
Choose how you run SAT / UNSAT work
Recommended · coordinated path
StrataX
Check status
Multi-engine routing + relearning loops
Training-lab handoff from SAT outcomes
Connect a StrataX API or activate the local harness
Checking StrataX…
OS
Open source · no paywall
Direct solvers
Always available
Run catalog solvers with accept / deny evidence
Local DPLL fallback when offline
Never blocked by StrataX setup
StrataX opens the app when connected; otherwise the API setup panel appears so you can add it.
StrataX API setupConnect a remote endpoint or activate the local harness
Paste your StrataX API base URL to install the remote connection. Prefer the local harness when you want the in-Hub app without an external service.
StrataX workspaceRelearning loops · SAT harness · training reportsChecking…
StrataX relearning & routing
Run coordinated SAT/UNSAT loops and report outcomes into Training Lab. Local fallback stays available when the remote API is offline.
Need the remote service? Use StrataX API setup to add your endpoint.
Start relearn loop
SAT probe
Send CNF clauses to StrataX or the local DPLL fallback.
Loop history & training reports
Completed loops can be reported into Training Lab.
Open-source SAT pathDirect solve · accept / deny · retry
Always available without StrataX. Results require accept/deny before they become evidence.
No run yet. Results require your accept / deny before they become evidence.
Downloadable open-source solvers
Use a SAT solver for DIMACS CNF, a MaxSAT solver for weighted clauses, an SMT solver for theories such as integers or bit-vectors, and a proof checker when you need an independent UNSAT certificate check.
0 selectedSelect entries to compare the download set; source and release sizes vary.
Optional capabilities
Turn on focused capability plugins when you want the AI to use them. Each plugin is a small, isolated microkernel contract that activates its declared dependencies; it does not grant permissions or bypass existing safety checks.
Loading optional capability plugins…
Hardware packs match your RAM band and edition. Workflow packs group models and tools by job — coding, visual effects, documents, vision, and more.
Models on this PC. Orchestrator score picks the default hub agent — change preset or pick manually below.
Trashed models
Models moved to trash remain recoverable during their grace period. Permanent purge is irreversible and requires typed confirmation, password re-authentication, and a one-time server challenge.
Trashed models have not been loaded.
Durable download queue with pause/resume/cancel, schedule, bandwidth, logs, error repair, and labeled disk projection. Progress rates/ETAs are estimates when shown.
Cloudflare receives normal network metadata/IP during the bounded connection test.
Planning only: Ollama traffic shaping is unavailable.
Default is Live queue from durable pull jobs. Demo is illustration only.
Live Download Center — loading…
Disk projection —
Paid feature (Studio+). Build your own spoke combination and save a user config. Resource guards still apply. Admin/testing unlocks this now.
Feature Atlas
Feature implementation status for this topic. States are read from the canonical feature matrix.
Bundled explanations, not capability evidence
Contextual glossary
Loading bundled glossary…
Offline troubleshooting
These guides are bundled with Flywheel; opening one does not require network access.
Report a problem // local draft
Prepare a secret-redacted report tied to an error correlation ID. This does not upload, email, persist, or create a ticket. Review the draft again before sharing it.
Accessibility statement
Flywheel aims to keep the Hub usable with keyboard navigation, screen readers, zoom, reduced motion, high contrast, and left-to-right or right-to-left layouts.
Known limitations: some visual telemetry and the canonical three-dimensional canvas still need an external browser and assistive-technology review. Use the text summaries and keyboard alternatives when a non-visual path is needed.
Feedback channel:Configure this deployment with your established project support or issue-reporting path. Use the local report draft below to prepare the report. Include the task, browser, assistive technology or input method, and expected result. Do not include passwords, API keys, or private prompts.
Remediation policy: barriers that prevent task completion are prioritized and rechecked with the relevant keyboard, screen-reader, visual, and automated checks before release when those checks are available.
No report prepared.
Knowledge Map // Research preset
Project memory
Review, edit, pin, archive, export, or permanently delete project memory with typed confirmation. Live data only — Demo samples stay behind the Demo switch.
Enter a project id to review its memory.
Task memory bank // skills + blockers
Save what an agent learned after a completed task, or record a blocker separately so it can be loaded later for better routing, tool discovery, and training review. The two exports are intentionally separate.
Working memory / skills
Blocked tasks / tool gaps
Memory index console
Live source/index status, ingest errors, reindex, search traces, and accepted-interaction privacy. Counts and traces are stored values only — nothing invented. Demo fixtures stay behind the Demo switch.
Live monitoring for active campaigns, last route, and export bundles. Demo mode is illustration only.
Live marketing dashboard idle.
Enterprise super-system — interconnect up to 20 Flywheel nodes. Seed demos are ephemeral previews (computers + local model orbits). Refresh restores your real connected machines.
—
Fleet controls ready. Seed demos preview only — Refresh returns to your live setup.
Ctrl+scroll to zoom
Connect spokes to expand the ring.
Topology
Every computer keeps its own local AI downloads. Fleet coordinates tasks between them.
Selective connections
Links are one-way. Add the reverse link when both computers or departments should send work.
Connect a computer
Use a one-time link instead of copying a permanent node password. The link expires after 10 minutes and works once.
On the computer being added, install and open Flywheel Hub, then paste the master's secure address and the one-time link here.
Register spoke
Cross-node routing
—
Nodes
Micro-updates → master
300-agent fleet map
Enterprise max scale 20×15. Live loads reported Fleet nodes/agents; Demo shows a labeled fixture only. No invented metrics.
Live uses connected fleet nodes. Demo illustrates max 20×15 scale only.
Live by default. Demo is optional fixture inventory. Refresh / seed / topology controls stay available.
Builder Control Plane — Cursor/human agents implement upgrades. Local Ollama analysis runs via the Agents tab + flywheel-worker.cmd.
Planning only. Local-only is the default. Marking a task or agent eligible for an approved cloud/API provider
shows preflight identity, destination, redaction, consent, budget, and provider rate estimates —
it does not grant egress authority or execute cloud calls. Private task material stays local unless you change policy.
Select local-only or an approved provider, then Build preflight. Estimates only — no cloud execution.
Current task
Claim a task to see prompt…
Launch instructions
Run .\scripts\agent-next-task.ps1 or click Claim next
Open Cursor Agent in this repo; paste prompt
After tests pass: .\scripts\agent-complete-task.ps1 -TestsPassed
Restart hub if prompted (.\scripts\start.ps1)
Full guide: tasks/BUILDER_AGENT_LAUNCH.md
Active claims
Recent events
Start a local agent from Flywheel — no PowerShell needed. Pick an agent (or use Hub Start for a mid-tier default),
add tasks, and click Play. Flywheel routes work to your Ollama spokes using the built-in rules.
Stopped
Current task
No pending tasks — add one below or sync builder backlog.
—
Agent output will appear here…
Run Center — queue, leases, attempts, artifacts
Compose a run
Describe the outcome first. This review step does not queue or execute work, read files, grant tools, or enable network access.
Local review only. Nothing has been queued, persisted, read, or authorized.
Preflight summary
Estimates are labeled; nothing invents TTFT or savings.
Route Inspector
Why selected, rejected alternatives, expected escalation, and evidence. Existing Run Center controls stay unchanged.
Evidence-only; no invented TTFT, savings, or trust scores.
Responsive layouts
Desktop, laptop, tablet, and narrow remote status/approval. Existing menus, tabs, and approval actions stay available at every width.
Layout mode follows viewport width; no controls are removed.
Mobile companion
Optional metadata-only status, alerts, approval, and cancellation. Off by default. Approve/cancel use the secure device-bound companion API; no prompt content.
Companion is optional and off by default. Existing Hub controls stay available.
Validate and Update
Run a local content validation check and inspect server-owned model updates. These controls are read-only and never install, apply, or mutate provider state.
No validation run yet.
No update check run yet.
Asset gallery
Portfolio of generated assets with model and prompt metadata. Image bytes stay in artifacts; prompts require consent to retain.
Gallery is metadata-only. Existing Hub controls stay available.
Product analytics
Optional onboarding, activation, error, and feature-discovery events. Off by default. Demo sample events do not flip the live opt-in. Never includes prompts or completions.
Analytics are optional and off by default. Existing Hub controls stay available.
No plan variants loaded. Two variants are shown as Before and After.
Plan feedback
Select feedback to update the plan projection. No install or download is started.
Task list — click to select · delete to remove
Recent events
Your account type controls slots and features. Use ← → to browse tiers; Enter or click Get this plan to purchase.
← → browse tiers · Enter to purchase · click a tier to select
Selected for viewingCurrent or previewed accessRecommended
—
—Your plan
Secondary planning material — provider usage rates are estimates, not Flywheel prices.
Executive Summary // procurement & trust
ROI assumptions are estimates based on provider rates — not Flywheel pricing — and are not measured from your deployment. Provider usage-price calculations remain secondary planning inputs only.
Trust Center // data flows - retention - egress
Data flows
Retention
Egress
Privacy defaults
Telemetry controls & privacy preview
Additive user-controlled categories. Existing ping, chart, and export controls are unchanged.
Live Privacy and Trust Center — loading…
Model trust card // registry provenance - digests - health booleans
Facts only — no invented TTFT, trust scores, or synthetic savings. Select a registered artifact to inspect.
Model Center // trust - health - digest - license - storage - usage
Administrative control center — enable or disable features per account type, manage users, and run time-limited promotions. Routing and CPU/GPU controls are marked proprietary.
Model registry admin
Inventory diff, digest approvals, and measured health probes. No invented scores.
Approval inbox
Review destructive operations, significant installs, and tool runs. Requests expire and approvals remain bound to the original action digest.
Feature matrix
Checkboxes grant access for that account type. Live promotions can add temporary extras.
Users
Promotions
Grant higher-tier features for a limited window (launch / holiday trials).
Train locally: pick a base model, recipe, and dataset, then start a durable job.
Fake dry-run completes immediately for CI; local stub stays running until you cancel or a trainer finishes.
Metrics are never invented — status and artifact paths only.
Full fine-tune creates a verified pre-train backup before mutating staged base weights.
Prefer LoRA/QLoRA when you only need adapters.
Offline training catalog
Jobs
Selected job
Optional Labs research (does not block train)
Tesseract / SAT-UNSAT geometry ideas can inform future formal-training tooling; they stay Labs-optional.
How do training operator support bundles work?
When a training job needs operator diagnostics, Flywheel can assemble a local redacted support bundle with job identity, run manifest digests, sanitized stage/step/warning/checkpoint/evaluation/resource/failure events, and environment state (framework versions, hardware profile, runtime context). Secrets are scanned and redacted before checksum binding. Creating a bundle is planning-only and sanitize-only — it never starts trainers, never uploads, never opens the network, never includes prompts or project files by default, and never grants execution authority.
Manifest summaries are digest-only — no dataset paths or raw configuration blobs
Event detail text is bounded and redacted; prompt-inclusive exports stay on the general support-bundle path after review
Optional zip write stays under a caller-approved directory with a bound SHA-256 checksum
Advisory operator-support-bundle explanation only (FW8-TRAINCORE-025). Existing Training Lab controls are unchanged.
Adapter deeper view
List weight-adapter sidecars for a base model — not orbit pipeline MoA combos.
Local observations only; refresh does not download, train, hotswap, or open the network.
Optional folder scan reads adapter JSON metadata under approved project/data roots only.
Adapter inventory from local observations
Name
Base model
Status
Source
Loading…
AdapterForge panels (measured or labeled estimates)
Compilation / method preview
VRAM / resource guard
IPC & telemetry
Adapter ring (PDF-030)
MoA hub-spoke (PDF-029)
VRAM steal defender (PDF-034)
Emergency recovery
MoA active blend
Swap latency (PDF-031)
Cloud GPU broker (PDF-028)
Runtime executors
Local adapter catalog (offline mirror)
Digest-bound offline adapter repository entries for air-gapped browsing.
Plan-only resolution — no download, hotswap, HF egress, or activation this pass.
Offline adapter catalog entries from local repository mirrors
Title
Base model
Kind
Mirror
Loading offline catalog…
T3 Hugging Face registry browse is policy-gated (ADMIN-019/ADMIN-020) — preview only, no download.
HF registry browse (policy-gated preview)
Policy-gated Hugging Face registry preview entries
Title
Base model
Kind
Mode
Loading HF browse preview…
Advanced (planned — text only)
Optional future panels: piano-key ring WebGL (opt-in), AdapterForge IPC telemetry,
MoA active blend preview, VRAM defender estimates. List/table remains canonical;
reduced motion shows no mandatory orbit animation.
Pipeline combo (orbit MoA) ≠ weight adapter (PEFT sidecar). See
docs/ready_state/TRAINING_ADAPTER_FLYWHEEL_DEEPER_VIEW.md and DEC-20260720-114.
Import versioned external training-run manifests for inspection.
Loss and reward are optimization signals only — never product quality.
Pause / cancel / train stay read-only unless a separately authorized execution task exists.
Manifest import
Run detail
Metrics (measured - unit - sample - freshness - confidence)
Selected view
Additive Studio workbench for imported datasets, external runs, adapters, and certificate prep.
Dry-run inventory never writes or executes; unsafe files never render; training stays off.
Labels: imported - measured - simulated only.
Dry-run import
Schema mapping
Provenance draft
Holdout warnings
Adapter inspection
External run comparison
Certification prep
Package handoff
Row ledger
TUCE Lab is the behavior-modulation research surface for the Trident Unified Core Engine.
Its labels are engineering proxies, never clinical facts. Stream uses the local Hub behavior-modulation API.
MOA Cockpit
// 19 anatomical + optional PP shards (=21)
Read-only visualization of the MOA anatomical piece map (21 sections: 19 base plus 2 PP shards when active). Each piece corresponds to a bound model/adapter
from /api/moa-cockpit/nodes. Selecting a piece shows its binding status; the explode slider
separates pieces for inspection and never changes runtime state. Empty and error states appear inline
when the cockpit API is unavailable.
Pipeline Graph
// classify & ground · single-row plan
Enter a task or prompt; the MOA pipeline classifies it, selects a path across the 21 pieces, and returns
node bindings and provenance. This surface only previews the plan through POST /api/moa-pipeline/run;
it does not execute or route real work. Badges surface residual drift, SAT lock state, and speculative
look-ahead/look-back checks when the API returns them. An optional read-only valuation snapshot
(GET /api/moa-cockpit/valuation/dashboard) is available below the results — every field it
marks illustrative is a placeholder estimate, not real accounting.
Epic Catalog
// onion-layer taxonomy
Browse the MOA epic index and its onion-layer taxonomy. Each row expands to show layer, description,
related pieces, and topic links. Search filters titles and summaries locally after the initial fetch
from /api/moa-epics. Registration and validation happen in a separate governed surface.
"Cross-validate roles" runs a heuristic Boolean-SAT constraint check over the epic's tags via
POST /api/moa-cockpit/epic/sat/resolve — not a certified safety authority.
Cockpit Roles
// 18 review roles · not Dashboard MoA cycle
Documentation roster for the 18 MOA Cockpit review roles (A/B subroles).
This does not launch the Dashboard MoA work-cycle (/api/moa/*).
If /api/moa-help/topic/agent_roles is available the roster is enriched from that topic.
Marketplace
// compute market · read-only Marketplace view
Read-only view of the MOA Cockpit compute marketplace (listings, bids, matches, settlements).
Data comes from /api/moa-cockpit/market/stats and
/api/moa-cockpit/market/listings. Posting bids, matching, and settlement remain
governed API operations — this tab does not mutate market state.
Read-only governance preview of the labs.tuce-labs module: explicit proposal scoring
(/api/tuce-labs/gov/catalog), formula-versioned handoff metrics from validated
traces (/api/tuce-labs/metrics/catalog), and advisory-only research artifacts.
Missing evidence always defers; nothing here is marketed as intelligence, and artifacts never
grant runtime permissions.
Additive guided composer for certified brain / asset / tool / workflow stacks.
Auto selects the smallest valid certified stack; Advanced exposes only bounded settings.
Preview compatibility, authority, egress, resources, entitlements, certificates,
unresolved evidence, failure paths, and rollback before transactional activation.
Arbitrary adapter stacking and cross-project assets fail closed.
Registry records JSON
Preview
No preview yet. Load registry JSON and compose.
Expert graph
Expert graph appears after a successful compose preview.
LOCAL-FIRST WORKSPACE
Context Box
Choose what local AI can see, keep evidence beside the work, and opt into remote providers only for tasks you explicitly route there.
Connection: status not queriedRoute draft:Local onlyModel: not selectedApprovals: check Approval Inbox before execution
Auditor presentation is read-only in this browser. The link does not grant authorization; server permissions still control all data access.
Session recovery is ready.
Conversation & artifacts
Flywheel: Start locally. You decide if a bounded task may use an approved remote provider.
Draft text is persisted only after you enable recovery and save. Remote execution is never selected automatically.
YOUR DURABLE TASK QUEUE
All Tasks
These are your tasks. Administrators also see the installation migration backlog. The Dashboard queue is only the active execution window assigned to local models.
User tasks continue while the admin backlog is paused.
Task
Epic
Priority
State
Protection
Worker
Open this page to load the full task backlog.
Unload agent?
Quick stop is off. Confirm before unloading — from RAM.
Slide all the way right to enable Unload
Stop Hub agents?
Quick stop is off. Slide to confirm — this prevents accidental shutdown of running agents.
Slide all the way right to enable Stop Hub
Organization invitation
Checking invitation…
A copied invitation is a temporary bearer credential. Accept it only if you trust its sender.
Allow tool access?
Accept grants only the listed low-risk capabilities for this tool version.
Downloads, installs, elevation, secrets, new network destinations, and
destructive actions always need a separate approval.
Agent needs a tool
Open Open-Source Tools to install or grant the specific capability. Nothing is installed automatically.
Authorize local action
This starts local agents on your PC using your signed-in account.
Confirm model deletion
You are about to permanently remove — from disk. Large models can take a long time to re-download.
Confirmation text does not match yet.
Re-authentication is required before the server issues the confirmation.
The server issues a short-lived, single-use confirmation after the text matches.
Confirm Builder task deletion
You are about to permanently remove Builder task —.
Confirmation text does not match yet.
Re-authentication is required before the server issues the confirmation.
The server issues a short-lived, single-use confirmation after the text matches.
Confirm access-key revocation
This permanently revokes the selected administrator-issued access key. Existing redemptions are not changed.
Target: —
Confirmation text does not match yet.
Re-authentication is required before the server issues the one-time confirmation.
Confirm promotion deletion
This permanently removes — from the administrator promotion catalog.
Target: promotion:—
Confirmation text does not match yet.
Re-authentication is required before the server issues the one-time confirmation.
The server issues a short-lived, single-use confirmation after the text matches.
Stage database restore
The current database and WAL files will be preserved. The selected encrypted backup will be restored before database startup after a restart.
Confirmation text does not match yet.
Accept download?
—
Keyboard: Tab moves between Deny and Accept; Escape denies and returns focus to the download control.
Confirm download
—
Review size, license, and dependencies, then Approve anyway or Deny.
