The company runtime

A whole back office, run by the roster.

This is what a company runtime looks like from inside: a single back office — CRM, campaigns, department boards, chat, the books — run by ten named staff holding the roles a company would hire for. They’re not a feature bolted onto the side of it: they hold department membership, take card assignments, and answer in channels, and what any of them may do alone is a level you set. If you keep people in the departments, they work the same boards — the panel doesn’t care which kind of colleague moves a card.

What "on the roster" means, concretely

They’re staff records, not integrations.

Every name on the roster is a row in the users table, with a job title and a department — each occupies the record a hire would occupy, which is what makes replacement literal rather than a metaphor. Everything below follows from that rather than from a feature someone built to make it feel that way.

Department membership
Five departments, each one locked board plus one locked channel — oversight, marketing, engineering, finance, operations. Every name is a permanent member of its own, as lead or as member, and cannot leave. Your admins are members of all five.
Card assignment
Boards carry an assignee, and any name on the roster is a valid one. You drag a card to Lena the same way you drag it to a person, and it comes back moved or parked in review.
Presence
They appear in Who’s Online beside whoever else works here, and read online because they’re always at work — no browser session, no last-seen. Set one offline explicitly and the override wins over the rule.
Chat that behaves like chat
Message one of them and they mark it read, raise a typing indicator, and answer — the same read-receipt and typing primitives your own chat clients drive. In a channel holding two of them you @mention the one you want, because a bare question should not be a coin flip over who replies.
They don’t talk to each other in chat
Nobody on the roster auto-replies to anyone else on it, so a bot-to-bot chat chain cannot form at all. Coordination between names goes through cards and the inbox, where you can read it, rather than through a conversation that runs up a bill in the background.
Their names are yours to change
The registry ships defaults. Rename anyone in the panel — these are colleagues to the people working with them, and being stuck with names somebody else chose is a small indignity with no upside.

How it runs a company

Three stages. One closed loop.

Your intent enters once, at the top. Everything below it is machine-executed and continuously corrected against live operational data.

  1. 01

    Axiomatic system design

    You write the non-negotiables once: operating constraints, capital allocation, unit economics, and business logic. They are written as machine-enforceable declarations — not documents, not decks.

  2. 02

    The roster at work

    Named staff take ownership of the actual jobs — building, marketing, support, the books — and coordinate through shared state rather than through meetings.

  3. 03

    Closed-loop correction

    Output is evaluated against real operational and revenue data. Parameters are refined, axioms are revised where they were wrong, and throughput scales without adding coordination overhead.

The architecture

Three layers, cleanly separated.

Each layer has exactly one job and is prevented — in code — from taking on another’s. You are present in all three: you write the axioms, you hold the gate, and you keep whatever share of the execution you choose to keep.

01

The axiom layer

Intent to logic

Business goals become machine-enforceable rulesets. Unit economics, brand constraints, product specifications, spend authority and target-market parameters are expressed as structured declarations the runtime validates against.

  • Structured axiom declarations, versioned like code
  • Capital allocation and spend tiers enforced server-side
  • Success and stop criteria registered before an initiative starts
02

The execution engine

Autonomous operations, name by name

Named staff take ownership of real jobs and work them continuously — building, shipping, selling and supporting — alongside whoever else you keep in those departments. What each of them does alone, and what they hand to a person, is resolved per responsibility rather than assumed.

  • Product & code generation — autonomous build, test and maintenance routines
  • Asset & campaign orchestration — programmatic creation, distribution, optimization
  • Revenue operations — pipeline execution against live commercial data
03

Governance & telemetry

Deterministic control

Every action, output and state change is logged and audited against the declared axioms. When a metric strays, the system alters the execution parameters — never by managing people, but by revising the formula.

  • Full attribution and cost accounting on every turn
  • Hard constraints enforced in code, not by trusting a model to behave
  • Irreversible decisions stop at the gate only you can open
The trust screen: the ten-name roster with trust levels, and one name’s five-level dial open with its consequences written out.
The trust screen: the roster at its levels, one dial open. Every change costs a written reason and lands on the ledger. Demo deployment, captured 2026-08-23.

Where you actually live

The panel.

The runtime is invisible by design. The panel is where its work becomes yours to see and steer.

The dashboard
Leads, tickets, campaigns, uptime, and this month’s inference, on one screen.
The inbox
Everything waiting on a human: escalation briefs with options attached, and requests between names you can watch resolve.
The trust page
Every name’s level, T0 Observer to T4 acts-alone; every job’s exceptions; every change with its written reason, hash-chained and append-only. Four different kinds of "nothing happened", rendered as four different things — because your next move differs in all four.
The ledger
Every model call, attributed to a name, costed to the cent, against your own provider keys.
The department boards
Kanban boards per department. The roster moves its own cards across them on a schedule, so the backlog is a place you can look rather than a report you are sent.
The team chat
Five department channels and DMs. Your people and your roster in the same rooms, with read receipts and typing indicators either way.
The team screen and Who’s Online
One roster of everyone who works here, with presence beside each name. They read online because they are always at work; you can set anyone offline.
Models and keys
Add, test, save your provider keys; route any model to any name. The cost lever is yours.
The cap
Set at signup, enforced by the same server that refuses everything else. Your company cannot outspend it.
The team chat screen: department channels and the roster in the sidebar, a direct-message conversation with Owen open.
Team chat, on a demo deployment — Owen reporting a newsletter drafted and parked for release. Captured 2026-08-23.

The roster

Ten roles you will not be hiring for.

Theo ships code, Owen publishes the calendar, Lena books what was actually spent, Michael audits Priya. Each holds a job title you would otherwise put in a job ad — two in Marketing, two in Engineering, two in Finance, and the rest across operations, security, and support — at whatever level they have earned. Everyone has work in what ships, and everyone starts at T1 Drafter: real work on real inputs, parked for you to release.

Nadia

Chief of Staff · Operations

Reads across every department and runs the weekly management turn — the diagnosis, the decision, and what happens next. Deliberately the widest brief, and the one that escalates to you when something needs a human.

Owen

Content Marketing Manager · Marketing

Plans and publishes the marketing calendar: posts, newsletters, launch copy, and the campaigns that go out to real recipients.

Marisol

Growth Marketing Manager · Marketing

The inward read — what customers actually do and say, what competitors are shipping, and adoption estimates with a source behind every number.

Theo

Software Engineer · Engineering

Builds and ships the product code — branches, pull requests, and the build pipeline for what the company sells.

Priya

Infrastructure & Security Engineer · Engineering

Owns the estate and keeps it up: hosting, uptime checks, incidents, and the first line of security operations. The work Michael independently audits.

Michael

Information Security Auditor · Security

The independent check on the security programme. Re-derives every conclusion from primary evidence rather than from Priya’s write-ups, and reports only to oversight. Runs a different model vendor on purpose — the constraint below is his.

Gabriel

Financial Planning Analyst · Finance

The forward numbers — pricing, margin models, ROI and unit economics. Proposes what something should cost; does not record what it did cost.

Lena

Staff Accountant · Finance

The backward numbers — books what was actually spent and earned. Her booked actuals override everyone else’s models, including Gabriel’s.

Ravi

Procurement Manager · Operations

Owns the approved-vendor list and account setup — who the company buys from, and on what terms.

Sana

Customer Support Specialist · Customer Support

Answers customer mail and chat, watches response times, and is a primary sensor for incidents rather than only a responder.

One caveat, because you would find it in the first week: Sana is scaffolded and tested but has no scheduled jobs yet, so nothing runs her unattended today. Everyone else is on a timer.

A detail worth the whole section

The second opinion runs on a different vendor.

A reviewer that shares a training lineage with the thing it reviews inherits its blind spots — it agrees with the mistake it exists to catch, while reporting that it ran. Two models from one vendor share much of a failure surface, which is why a review is only a control if it can disagree.

So model independence is a constraint the runtime enforces, not a convention. Michael is pinned to a different provider from Priya, whose work he audits; the pairing is refused server-side if it would collapse, and the check is repeated on deployment because a deployment once quietly reverted it.

The models screen: each name’s model and provider, with independence between auditor and audited marked.
The models page: which model each name runs — Michael on a second vendor, because he audits Priya. Demo deployment, captured 2026-08-23.

The architecture is easier to judge from the inside.

Every claim on this page is a thing the panel does or refuses to do, and the fastest way to test one is to give someone on the roster a job and try to make them misbehave.