How it works
What the product will and will not say.
Every claim below is enforced somewhere a screen cannot reach — a constraint, a policy, or a trigger — because a rule that lives only in a component is a rule until someone is in a hurry.
The binding ladder — six ordered rungs, two of them empty
Declared as a database enum, so declaration order is the order. Two rungs are declared and nothing issues them. That is not an omission; it is the ladder refusing to be filled in by something weaker than its own definition.
- unbound
- The floor. Nothing has been claimed for this requirement at all.
- cited-only
- Produced by register import. A reference, unchecked.
- file-resolved
- Produced by the resolver against a pin. The path exists in that tree.
- route-resolved
- Issued by nothing today. A citation that resolves to a route the application actually serves is a stronger claim than a file that exists, and until an adapter produces it the rung stays empty rather than being approximated.
- test-executed
- Produced by test-result ingestion. A skipped test binds nothing. A failing test still binds — at this rung, with the failure as its outcome — because this is a record, not a dashboard.
- runtime-probed
- Deliberately not issued. An HTTP 200 from a front door is not an observation of a requirement, and issuing the top rung for it would be the exact overclaim the ladder exists to prevent.
Six closed finding classes
Exactly one class per finding, each carrying the cited text, the resolved-or-absent target, the adapter that produced it and the pin it was resolved against. An unresolvable reference is a finding, never a blank cell. The nearest thing to this in any other category is a static analyzer — it is a linter for a portfolio register.
- RESOLVED
- The citation was found in the pinned tree.
- STALE_PATH
- The citation points somewhere that no longer exists at this pin. Usually one renamed directory, appearing nine times.
- OUT_OF_SYSTEM_SCOPE
- The reference resolves, but not inside the system under reconciliation.
- CLAIM_WITHOUT_EVIDENCE
- The register asserts something and cites nothing that could support it.
- UNCITED_REQUIREMENT
- A requirement carries no citation at all, so no rung above the floor is reachable.
- SUMMARY_ROW_DISAGREEMENT
- A rollup and its own source rows do not agree. Other tools display the rollup; this raises the disagreement and makes a person dispose of it.
The set is a database enum, not a picklist. A seventh class is a schema change reviewed as a change to the product’s claims — not a configuration option a tenant can add on a Tuesday.
The agent proposes. A named human accepts.
Not a policy, and not a convention written into a style guide. It is a database constraint, and it is demonstrable in five minutes.
Two columns of two different types
The columns recording who proposed a binding are text. The columns recording who accepted or dispositioned it are foreign keys into the authentication system’s user table. An agent has no row there and cannot acquire one, so there is no value that lets an agent occupy the human column.
A signature is not a parameter
The accepting identity is stamped by the database from the session, not sent by the client. A request that supplies a different identity is refused rather than trusted.
The trail refuses deletion
The governance trail is append-only for everyone — owners included, and the database superuser included. That was verified by attempting the delete, which is the only way to know it.
A failed gate creates work, not a verdict
It produces remediation assigned to a person. It never transfers accountability to an agent, and no machine writes a completion verdict by rolling up its children.
Your name on it. Not your definition of done.
Branding is configuration. A tenant supplies an organization name, a wordmark and optionally an accent color, and the workspace carries them.
What a tenant may configure
The name, the wordmark and the accent. An accent that does not parse is dropped rather than rendered, and a wordmark URL that is not plain http(s) is not markup we will emit — a tenant string never reaches the stylesheet unchecked.
What no tenant may configure
The binding ladder and its order. The six finding classes. The status palette, which is validated for contrast and for color vision. Who may accept a binding. The absence of a blended score. These are product guarantees, and there is no column, field or override for any of them.
A health plan will ask in week three, phrased as “our UAT sign-off is our verification”. A settings screen that could grant that would defeat the product in one click.
Isolation is not a paid tier
Every domain row carries its organization, every policy is written against it, and the boundary is enforced in the database rather than by a filter in a screen. An application bug must not be able to reach another tenant’s register — which is why the boundary is not in the application.
What this is not
Four things it would be easy to sell this as, and is not. Reading this section should make it obvious whether you already have the problem this solves.
Not a task tracker
No sprint, no board column meaning “in progress”, no assignee on a unit of work, no velocity, no estimate, no burndown. Jira is genuinely excellent at work tracking and we are not going to beat it. This sits above the tracker and consumes it.
Not a compliance product
Compliance gating withholds release of an evidence package and answers to a compliance reviewer. This decides whether a requirement is done and answers to a delivery lead. Same traversal, different authority — which by our own definition makes it a different check. Nothing here issues a compliance assurance or calls anything certified.
Not an observability product
Observability records what happened; it never halts anything. We consume that signal and label it as detection. Presenting monitoring as enforcement is the substitution this product exists to refuse.
Not a requirements-authoring tool
Nobody is asked to rewrite their requirements in our format. It reconciles whatever register, specification or agent instruction file already exists against a pinned commit.