Forge user stories

As a user, I can move among every Forge domain without losing my current identity or confusing domain hierarchy.

Where it lives

App shell, desktop navigation, mobile navigation, route catalog.

Current evidence and next check

the Action Bar now searches all 29 primary routes; complete every destination, active-state, back-path, and permission-state check.

As a user, I can scroll into content while the authored top bar compresses smoothly, retains its primary controls, and fully reopens at the top.

Where it lives

Desktop and mobile app shell plus the top-bar collapse controller.

Current evidence and next check

124 px desktop and 96 px mobile ranges, measured forward/reverse curves, stable expanded content, and clean 41-frame stress passes at both viewports.

As a user, I can complete the same core workflow on phone and desktop without overflow, occlusion, or a desktop-only control.

Where it lives

All web routes and guided dialogs.

Current evidence and next check

maintain a route-by-route 390 x 844 and desktop matrix.

As a user, I can choose any supported theme and every surface, image, graph, map, menu, and dialog updates coherently.

Where it lives

Theme system, CSS semantic tokens, canvas/map/graph renderers, theme settings.

Current evidence and next check

full light/dark route matrices pass; complete accessibility contrast sampling remains.

As a user, I see an immediate, truthful route-loading state and then useful primary content without a blank or artificial wait.

Where it lives

Route Suspense boundaries, API query scheduling, page states.

Current evidence and next check

Overview no longer holds compact health and movement reads behind a fixed delay; Home routes settle in 0.44-1.19 s after warm-route navigation. Continue the full route matrix.

As a user, I can scroll long or visually rich views without flashes, disappearing content, unstable images, or layout shifts.

Where it lives

Virtualized lists, graphs, timelines, image fallbacks, sticky/fixed shell elements.

Current evidence and next check

shell, graph, and the 100-event Activity archive pass bidirectional stress checks; continue the remaining long-route matrix.

As a user, I receive useful loading, empty, partial, offline, and error states instead of broken pages or silent controls.

Where it lives

Shared page-state components, mutation feedback, API error envelopes.

Current evidence and next check

shared loading, empty, and error states expose truthful live-region semantics; complete partial/offline and route-wide failure fixtures.

As a user, I can create or act on the relevant record from the global Action Bar without navigating through unrelated pages.

Where it lives

Action Bar, entity create registry, global commands.

Current evidence and next check

explicit mobile/desktop close and all-primary-route discovery pass; complete per-entity permission, create, and return-path checks.

As a user, I create or edit complex records through the established ModalBase guided flow, with only missing or ambiguous questions shown.

Where it lives

Guided dynamic modal forms, question-flow dialogs, domain-specific steps.

Current evidence and next check

guided flows can now keep a user on the current step with visible missing-answer guidance, and goal/project identity checks use it before later optional steps. Complete every create/edit contract comparison; side-panel replacement forms remain regressions.

As a keyboard user, I can search routes and records, run commands, and return to my previous context.

Where it lives

Command palette, global search, focus restoration.

Current evidence and next check

close restores focus to the exact shell trigger and all primary routes are searchable; complete ranking, shortcut, record, and mobile-alternative checks.

As a multi-user operator, I can see and change the active user scope and understand whose records I am viewing or editing.

Where it lives

User scope selectors, ownership fields, API scope policy.

Current evidence and next check

the shell selector names the active scope, exposes pressed states and a labeled option group, meets the phone tap target, and avoids duplicate category/user choices. Normal user lists and new-owner resolution now exclude inactive identities, while the operator directory retains their history separately. Complete the remaining cross-domain empty-scope and token matrices plus live desktop and phone checks.

As a user, I can link any compatible Forge entity to another through the general relationship model and inspect the connection from both sides.

Where it lives

General entity links, link pickers, backlinks, Knowledge Graph.

Current evidence and next check

batch linkedTo search includes indexed general relationships in both directions while preserving ownership filters and response bounds. Full and relationship-scoped replacements now reject a source linked to itself with a stable 400 before deleting any valid prior relationship. Complete every entity family, duplicate prevention, unlink, permission, deleted-target, and retained live desktop/phone matrix.

As a user, I can pin important records and return to recently viewed records without unbounded lists.

Where it lives

Action Bar pins, recent records, entity_navigation.

Current evidence and next check

recent resolution scans 250-row batches within a hard 1,000-row budget, so a stale first batch no longer hides valid recents; the 5,000-row bound remains fast. Soft-deleted pins retain a Bin return path, while genuinely missing pins stay visible and removable without exposing a false destination or closing the Action Bar on keyboard selection. Complete cross-actor, touch-restriction, and retained live desktop/phone return-path verification.

As a keyboard or assistive-technology user, I can operate navigation, dialogs, boards, graphs, lists, and status updates.

Where it lives

Focus system, ARIA names/live regions, reduced motion.

Current evidence and next check

named compact controls, Action Bar focus return, page-state announcements, and reduced-motion reward receipts pass; complete the remaining workflow matrix.

As a returning user, I keep the visual identity, information density, motion, mascot, trophies, and authored conveniences that make Forge recognizable.

Where it lives

Shell animation, Smith imagery, Trophy Hall, transitions, dense work surfaces.

Current evidence and next check

regression tests now cover the mobile shell and trophy visibility; extend feature-retention fixtures.

As a user, I can save a cross-domain search, scope, and filter combination as a named view and return to the same bounded result later.

Where it lives

Action Bar, route filters, user-scoped saved-view contract.

Current evidence and next check

operators can create, apply, and delete up to 20 owner-scoped named views; applying a view restores its query, filters, and explicit all-or-selected people scope while reporting removed filters or users without silently widening scope. Complete live desktop, phone, and keyboard verification.

As a user, I can create a related record from my current context with the valid relationship prefilled and return to the exact place I started.

Where it lives

Action Bar, guided create flows, general entity links, return-state contract.

Current evidence and next check

contextual Note creation accepts exactly one live authorized goal, project, task, strategy, habit, or wiki source, writes the Note and relationship atomically, and returns to the unchanged route, query, hash, scroll position, and originating focus target. Ambiguous, unauthorized, deleted, and stale sources fail without a partial Note. Complete live desktop and phone verification.

As a user, I can undo a recent reversible change through a bounded receipt without hiding changes that cannot be safely reversed.

Where it lives

Mutation receipts, soft delete, board moves, dismissals, metadata edits.

Current evidence and next check

reversible task moves, metadata edits, soft deletes, and Attention changes now return expiring principal-scoped receipts with idempotent Undo; stale source revisions refuse unsafe reversal, the banner expires live and keeps one retry key, and permanent deletion returns a truthful terminal reason. Complete live desktop, phone, and keyboard verification.

As a user, I can see when important derived information was updated, where it came from, and whether it is partial or stale.

Where it lives

Shared provenance presentation, Overview, Health, Movement, Life Force, Watch snapshots.

Current evidence and next check

the shared provenance contract now separates source evidence from computation time, reports missing, partial, stale, and unknown states truthfully, and adapts Movement provenance to day, month, and all-time views. Focused API and web tests, TypeScript checks, Watch build, OpenAPI parity, and latency gates pass; complete live desktop and 390 x 844 visual, keyboard, and accessibility verification.

As a user, I can review suggested relationships between records, understand why each link was proposed, and accept or reject it before Forge writes anything.

Where it lives

General entity links, Knowledge Graph, relationship proposal and explanation contract.

Current evidence and next check

operators can generate owner-scoped, expiring relationship proposals with directional evidence, source links, confidence, generator provenance, and an explicit no-write-before-confirmation boundary. Accept and reject decisions use immutable terminal receipts with same-action idempotent replay; stale, unauthorized, or opposite decisions cannot create or corrupt a link. Retrieval is bounded to 750 authorized documents, 3 MiB of indexable text, 2,000 comparisons, 120 pending proposals, and 20 displayed results. The sealed held-out fixture achieved 1.0 precision, recall, and coverage for every enabled relationship kind with zero unauthorized results. Complete live desktop, phone, keyboard, and accessibility verification.

As a user, I can queue supported web changes while temporarily offline and later see whether each change was accepted, conflicted, or needs my decision.

Where it lives

Web shell, mutation outbox, idempotency keys, conflict receipts.

Current evidence and next check

task moves among Backlog, Focus, Ongoing, and Blocked use a session-bound IndexedDB outbox with stable idempotency keys, expected-revision conflict checks, bounded replay receipts, and explicit discard or apply-against-current decisions. Done moves and unsupported writes remain truthfully online-only. Focused reconnect, duplicate, stale, multi-session, capacity, retention, TypeScript, build, and OpenAPI checks pass; complete live desktop, phone, keyboard, and accessibility verification.

As a user, I can capture text, links, files, or dictation in one place, review the record type and relationships Forge proposes, and confirm the result before it is stored.

Where it lives

Global capture, Artifact Store, notes, local search, Action Bar.

Current evidence and next check

the global Capture dialog keeps drafts in the browser, proposes a Note or Artifact without writing, limits relationships to authorized local records, requires confirmation, rechecks file bytes, and returns an idempotent receipt. Complete live keyboard, screen-reader, ambiguous-language, and unsafe-file review.

As a user, I can resolve imports, agent approvals, relationship proposals, offline conflicts, and Artifact enrichment from one human review queue.

Where it lives

Launchpad Review Queue, relationship proposals, agent approvals, offline outbox, Artifact enrichment.

Current evidence and next check

the queue combines the five decision sources, uses source revisions for conflict detection, and routes import conflicts back to the complete import preview. Complete live multi-actor conflict, long-queue, keyboard, and screen-reader review.

As a user, I can open Forge and immediately understand today's priorities, active work, health context, recent evidence, and momentum.

Where it lives

overview, operator overview/context APIs.

Current evidence and next check

isolated first-use and active-work fixtures plus the live data-rich store pass at 390 x 844 and 1280 x 720; empty health is truthful and optional reward setup does not block entry.

As a user, I can arrange the overview around the signals I care about without losing required modules after upgrades.

Where it lives

Overview layout registry and persisted layout.

Current evidence and next check

migration, required-widget restoration, breakpoint scaling, persisted route round-trip, reset, and compact control naming pass; complete direct drag/reorder QA.

As a user, I see Smith, current progression, streak pressure, and a real earned or next trophy in the first overview viewport.

Where it lives

Overview gamification widget and asset route.

Current evidence and next check

trophy request is primary, sprite route is independent of web-dist discovery, and fallback catalog is non-empty.

As a user, I can review a bounded queue of decisions, blocks, failed syncs, and runtime problems, then snooze, dismiss, restore, or follow the valid action.

Where it lives

attention-index, dedicated attention_inbox routes.

Current evidence and next check

empty and 12-item live states, allowed-action rendering, snooze/dismiss/restore, actor scope, stale-evidence invalidation, and bounded pagination pass.

As a user, I can inspect a chronological audit trail of meaningful entity, task, agent, and sync activity.

Where it lives

activity-index, activity/event APIs.

Current evidence and next check

empty and 100-event live states, source attribution, correction hiding, and a 44-frame full-list mobile traversal pass remain available. Selected-owner scope is applied in SQL before the result limit, so newer out-of-scope rows cannot hide an older permitted event and invalid out-of-scope payloads are never mapped. Credential-shaped title, description, actor, and metadata values are redacted at read time while the stored audit evidence remains unchanged. Focused source, entity, date, correction, owner, and secret-pattern filters pass; Activity-owned checkbox, title, open, remove, and recovery controls meet the 44 px target. Complete live filter-comprehension and assistive-technology verification.

As a user or trusted agent, I can store an evidence-backed insight and connect it to the records it explains.

Where it lives

insights-index, insight, general entity links.

Current evidence and next check

the three-step guided flow, read model, provenance, linked-record lifecycle, feedback, and read-back remain available. Creation normalizes Unicode, case, and whitespace, resolves the final owner before writing, checks every same-owner/same-link active candidate, and serializes duplicate detection plus Insight, owner, Activity, and event writes inside BEGIN IMMEDIATE. Concurrent creators collapse to one Insight and one truthful 409; active matches take precedence over Bin matches, Bin-only duplicates return insight_duplicate_in_bin with the existing ID, and dismissed, expired, or different-owner records remain allowed. Complete live retry and user-comprehension verification.

As a user, I can close a week by reviewing outcomes and evidence, then choose the next execution focus.

Where it lives

weekly-review, planning/health summaries.

Current evidence and next check

empty and data-rich responsive states plus idempotent finalization and one-time reward evidence remain available. Weekly outcomes now select work by its completedAt instant, not a later unrelated updatedAt, using exact UTC start and end-exclusive instants derived from the selected IANA timezone's Monday-through-Sunday local week. Activity evidence receives those bounds before its four-row limit. Focused Europe/Zurich fixtures cover immediately before and exactly at both week boundaries, in-week completion updated outside the week, and out-of-week completion updated inside it. Complete live desktop, phone, keyboard, and finalization-comprehension verification.

As a user, I can follow one valid action from an attention item and see evidence that the underlying problem was resolved rather than merely dismissed.

Where it lives

Attention Inbox, authoritative action routes, resolution receipts, activity evidence.

Current evidence and next check

six authoritative Attention kinds expose one exhaustive primary action each. Operator-only, actor/source-version-bound attempts re-read the authoritative source and create an atomic durable receipt plus Activity evidence only after a positive resolution signal; denial, cancellation, deletion, reconnecting, snoozing, and stale evidence never count as success. Stable idempotency keys preserve uncertain retries, physical retention enforces 5,000 attempts/receipts/checks and 365 days, selected-user filters fail closed without user-existence oracles, and reusable source-return controls preserve exact URL state, offset, and focus across the four target surfaces. Complete live desktop, phone, keyboard, and first-pass comprehension verification.

As a user, I can open a concise daily briefing that explains what matters now using current work, schedule, health context, and recent evidence without inventing conclusions.

Where it lives

Overview, Today, calendar, Life Force context, activity, provenance.

Current evidence and next check

Today now leads with an owner-scoped, read-only daily briefing and Overview links directly to it. Four deterministic lanes cover current work, schedule, persisted same-day Life Force capacity, and recent evidence; every statement carries source and freshness evidence or is omitted with a reason. Permission-first bounded selectors, 23-hour and 25-hour local-day boundaries, stale and future evidence, conflicts, partial data, response-size limits, and no-write Life Force reads have focused coverage. Active runs with missing or older-than-24-hour heartbeats cannot become the headline or a current-work conflict. Complete live desktop, phone, keyboard, and first-pass comprehension verification.

As a user, I can create a goal that states the desired direction, why it matters, ownership, horizon, and relevant links.

Where it lives

goals-index, goal, guided create flow.

Current evidence and next check

the guided flow now blocks progression until the missing goal name is supplied, keeps defaults intact, and passes live 390 x 844 layout/error QA. Complete rich creation, agent questions, update, delete, restore, and link matrices.

As a user, I can inspect one goal's purpose, progress, strategies, projects, notes, links, and execution history.

Where it lives

goal-detail.

Current evidence and next check

goal detail mounts projects in eight-item batches with exact visible/total status and bounded expansion. Goal-targeted strategies now appear in a six-item expandable stack with current status, contract state, alignment, graph progress, owner, summary, and direct detail navigation; active strategies lead paused and completed strategies, then order by persisted update time. Goal, project, task, and linked task-run evidence is ordered newest-first before Forge selects the latest signal or renders the bounded history, with a stable identifier tie-break. Complete linked counts, stale-link truth, and the full mobile hierarchy matrix.

As a user, I can define and edit a strategy as an ordered graph of states, dependencies, and linked work.

Where it lives

strategies-index, strategy-detail, strategy, graph editor.

Current evidence and next check

graph validation rejects duplicate edges and cycles iteratively at large depth. The sequence editor supports keyboard sorting, bounded 50-state undo and redo histories, Ctrl/Cmd+Z undo, Ctrl/Cmd+Shift+Z or Ctrl+Y redo outside text fields, and clears redo after any new edit. Complete the full API round-trip, corrupted persisted graph, dense live-graph performance, and retained desktop/phone matrices.

As a user, I can create a project with a concrete outcome, PRD, ownership, lifecycle, scheduling rules, and links.

Where it lives

projects-index, project-detail, project.

Current evidence and next check

the guided flow blocks missing goal/title answers at the relevant step and replaces the mobile-hostile native assignee multi-select with bounded searchable checkboxes and a selected count. Complete PRD editing, scheduling, pause/restart/complete, and link matrices.

As a user, I can inspect the full execution hierarchy from goals through strategies, projects, issues, tasks, and subtasks.

Where it lives

project-hierarchy.

Current evidence and next check

hierarchy construction preserves every project work item exactly once across missing parents, cycles, cross-project references, and dense fixtures. One-pass indexes replace repeated global scans; the accepted 20,801-node fixture retained all 20,801 identities while median preparation improved from 202.39 ms to 23.74 ms, about 8.5 times faster. A bounded local open-state map survives reloads with corrupt-storage fallback and debounced writes; touched toggles meet the 44 px target and phone rows expose a direct detail link. Complete live desktop, phone, keyboard, and corrupted-storage verification.

As a user, I can move projects, issues, tasks, and subtasks through one Kanban board without losing type or hierarchy.

Where it lives

kanban-index, task/project status mutations.

Current evidence and next check

project, issue, task, and subtask moves share optimistic rollback and accessible failure receipts, support standard keyboard drag activation and sortable coordinates, and retain type identity even when a project and task share the same bare ID. One-pass goal, tag, lane, hierarchy, and parent indexes replace repeated dense scans; the accepted 12,600-record fixture preserved all identities while median preparation improved from 35.224 ms to 1.529 ms, about 23 times faster. Touched movement and action controls meet the 44 px target. Complete live desktop, phone, keyboard, and assistive-technology verification.

As a user, I can create and update a concrete task with instructions, owner, hierarchy, timing, status, evidence, tags, and links.

Where it lives

task-detail, task, guided task flow.

Current evidence and next check

task assignees now use the same bounded searchable checkbox control as projects, with explicit owner-versus-contributor copy and clear-all behavior. Complete all task kinds, parent rules, due-time zones, delete/restore, and agent read-back.

As a user or trusted agent, I can start, heartbeat, focus, complete, or release a real task run instead of pretending status means active work.

Where it lives

task_run action routes and task-run controls.

Current evidence and next check

bounded controls cover claim, heartbeat, focus, completion, release, stale leases, and offline errors. Timed-out runs stop credit at lease_expires_at, and any linked active timebox is cancelled at that same instant inside the timeout transaction, including startup recovery. Release stores a canonical handoff fingerprint: exact replay returns the existing run, while changed note or closeout content returns a 409 and cannot create duplicate handoff evidence. Complete live competing-run, offline, keyboard, and handoff verification.

As a user, I can record truthful signed time corrections when work occurred without a live run.

Where it lives

work_adjustment, operator context.

Current evidence and next check

the mutation submits the exact clamped signed delta shown to the user and stores one authority-scoped idempotency key, request fingerprint, adjustment, reward, Activity evidence, and exact response atomically. Exact retries replay without duplicate rows, changed payloads return 409, and user/project/tag scope is authorized before replay or mutation without exposing owner-wide XP. Complete live desktop and phone dialog verification.

As a user, I can plan a task into time, see its current pressure, and keep the calendar and task state connected.

Where it lives

task_timebox, calendar, task detail.

Current evidence and next check

the source package now covers bounded owner-scoped suggestions and manual placement, IANA timezone and DST handling, overlap and concurrent mutation control, provider projection and durable delete retries, bounded generic search, guided calendar flows, complete direct routes and OpenAPI, and aligned OpenClaw and Hermes helpers. API lifecycle tests are 12/12 and shared Psyche/Preferences delete regressions are 9/9; packaged migration 091 and authorized desktop/phone visual validation remain.

As a user, I can choose the next useful work for today using urgency, schedule, capacity, and active context.

Where it lives

today-index, operator context, Life Force and calendar reads.

Current evidence and next check

one deterministic owner-scoped decision now drives the Today page, direct API, and operator recommendation. Active work, schedule, urgency, AP capacity, overload, no-work, stale evidence, timezone/DST behavior, bounded candidates, explanatory reasons, and blocked-work suppression are covered; OpenClaw, Hermes, onboarding, question flows, and reference docs publish the exact read path. API tests are 28/28 and web/OpenClaw tests are 88/88; native parity, generated package parity, and authorized desktop/phone visual validation remain.

As a user, I can define a recurring positive habit, see due days and streaks, and record Done or Missed with optional evidence.

Where it lives

habits-index, habit, web and watch decisions.

Current evidence and next check

recurrence uses explicit fixed-home or travel-local day boundaries, including spring daylight-saving transitions, rejects future or unscheduled backfill, and deduplicates concurrent receipts across web and Watch. The API retains a bounded 14-entry visible history while calculating the true current daily or weekly streak from the full aligned history; a deterministic 40-week target-two fixture remains exact beyond that window and stops at the preceding gap. Two independent Forge processes released through a barrier collapse one outcome into exactly one check-in, reward, and Activity record. Complete live desktop, phone, watch, correction, and long-label verification.

As a user, I can track a negative habit using Resisted or Performed outcomes without misleading positive-habit language.

Where it lives

habits-index, habit, watch habit controls.

Current evidence and next check

web, API, iPhone relay, and Watch use Resisted/Performed copy, preserve private notes, resolve fixed-home or travel-local days, correct streaks and rewards idempotently, enforce owner scope, and retain durable receipts.

As a user, I can trust lifecycle side effects, including project completion updating unfinished linked tasks only when the contract says so.

Where it lives

Project/task services and batch update route.

Current evidence and next check

the complete status-transition matrix, exact cascaded task IDs, audit causality, idempotent retry, reward behavior, and injected mid-cascade rollback all pass.

As a user, I can assign and filter work by human or bot owner while preserving the actor that performed each change.

Where it lives

User settings, ownership fields, audit trail.

Current evidence and next check

board owner/assignee labels match their behavior; inactive users cannot receive new work, and the guided lifecycle flow previews then atomically transfers generic owners and assignments to an active replacement without rewriting historical attribution. Actor, source, counts, and the exact response are stored in an idempotent receipt. Complete entity-specific assignment adapters and live desktop and phone checks.

As a user, I can classify and find records with reusable tags without creating duplicate or case-variant taxonomies.

Where it lives

tag, tag selectors, search.

Current evidence and next check

board search includes tag names and descriptions. Tag creation and rename serialize normalized identity checks with their writes; Unicode compatibility forms, case differences, surrounding whitespace, and repeated internal whitespace resolve to one identity, including legacy rows. A colliding rename returns 409 and preserves the original tag. A Bin-only match now returns tag_duplicate_in_bin with its existing ID instead of falsely succeeding with an invisible tag; if a live legacy equivalent also exists, the live tag wins deterministically. Complete merge, hard-delete, cross-domain filter, and retained live desktop/phone verification.

As a user, I can close work with notes, links, artifacts, git references, and a completion summary that remains inspectable.

Where it lives

Task/project detail, Notes, Artifacts, Git reference picker.

Current evidence and next check

every closeout link is validated against the live, non-deleted, caller-visible target with one generic 404 boundary before mutation. Note reads omit currently unavailable link IDs and expose only unavailableLinkCount; direct and batch edits preserve stored links the caller could not see. Exact terminal replay is resolved before current-link validation, while changed replay remains a 409. Unsafe new Git URLs are rejected and unsafe legacy rawUrl values are redacted. Atomic closeout, permission-change, user/project/tag scope, ref integrity, replay, and UI unavailable-link evidence pass focused checks. Complete live desktop, phone, keyboard, and post-permission-change verification.

As a user, I can view provider events, Forge events, work blocks, task timeboxes, and Life Events in one readable calendar.

Where it lives

calendar-index, calendar overview.

Current evidence and next check

Month and Week now render unprojected Life Events alongside provider events, Forge events, recurring work blocks, and task timeboxes. A Life Event already represented by a visible calendar projection is shown once; if that projection is missing or inaccessible, the source Life Event remains visible. Life Event reads carry the selected-user scope, apply token user/project/tag scope before totals and pagination, redact unavailable links with a count, and show an explicit incomplete-calendar alert with retry instead of silently dropping the layer. Month keeps the stable view=month&date=YYYY-MM-DD 42-day URL and Week provides a 44 px route back to the canonical Life Event. Complete dense overlap, recurrence, keyboard, and retained desktop/phone matrices before promotion.

As a user, I can discover, connect, configure, sync, rediscover, and remove a calendar provider without guessing provider-specific setup.

Where it lives

settings-calendar, calendar_connection specialized CRUD.

Current evidence and next check

Google polling, read-only Exchange, macOS replacement, and writable-target reuse pass the 27-test calendar suite. Finish token-expiry and provider-outage recovery.

As a user, I can define recurring work or rest windows that influence scheduling without becoming ordinary events.

Where it lives

work_block_template, calendar.

Current evidence and next check

work blocks remain distinct records, recur by local wall time across DST, support bounded ranges, exclusions, overnight windows, legacy migration, editing/deletion, and capped expansion without repeated stored rows.

As a user, I can create and edit a calendar event and understand whether it is local, mirrored, or provider-backed.

Where it lives

calendar_event, calendar guided form.

Current evidence and next check

guided local create/edit preserves wall time, duration, timezone, and all-day state; provider occurrences are explicitly read-only, and projection failures preserve the Forge record with a structured warning. Whole-series provider edits remain delegated to the provider calendar.

As a user, I can review important past, current, and future events as a linear chronology centered on now.

Where it lives

life-events-index, dedicated Life Events timeline read.

Current evidence and next check

server-side search, archive-wide past/now/future counts, bounded pages, and measured window virtualization pass; a temporary 10,000-event store returned a deep page in 93.2 ms and exact search in 83.7 ms. Cursor pagination remains open.

As a user, I can create a Life Event that lasts minutes, days, or months, including stays and festivals.

Where it lives

life_event, guided modal.

Current evidence and next check

live stay and six-day festival cards retain range copy, and calendar overlap logic covers timed and all-day multi-day spans. Finish open-ended and multi-month cases.

As a user, I can choose a well-crafted event type such as flight, train, road travel, stay, concert, cinema, date, family visit, festival, or important work, or define a custom type.

Where it lives

Life Event type catalog and custom metadata.

Current evidence and next check

all 39 supported event types are available in the guided flow, and Custom events require and retain a human-readable label through save, edit, and card display. Unknown legacy event_type values no longer crash the read model: they map to Custom while preserving the original raw type as source metadata for truthful migration and diagnosis. Complete live desktop, phone, keyboard, and migration verification.

As a user, I can reconcile a Life Event with an existing calendar event or create the missing calendar projection without duplicates.

Where it lives

life_event, calendar_event, Life Events calendarSync.

Current evidence and next check

batch create/update/link/calendar-sync and idempotent server coverage pass. Finish fuzzy-match confirmation, provider-write failure, and unlink recovery.

As a user, I can mark an existing calendar event as a Life Event and preserve its source and calendar link.

Where it lives

Life Events fromCalendarEvent, Calendar success receipt and return action.

Current evidence and next check

recurring external-provider occurrences now create or reuse exactly one canonical Life Event and one bidirectional relation without rewriting provider content, source identity, ownership, or unrelated links. The internal reverse-link insertion remains idempotent and does not weaken recurring-provider edit restrictions. Calendar distinguishes “created and linked” from “already linked,” invalidates the Life Events read, and exposes a 44 px /life-events?focus=<id> return action. Complete live desktop, phone, keyboard, and provider-sync verification.

As a user, I can attach a trusted ticket, let an enabled LLM propose travel details, review them, and create a draft without automatic file execution.

Where it lives

Artifact Store, Life Events importTicket, model settings.

Current evidence and next check

ticket files are scanned and prepared as per-file previews before any Life Event is created. The review shows route, dates, times, and explicit warnings; preserves successful previews when another file is unreadable; and requires the user to select proposals before confirmation. Missing dates use a stable Artifact timestamp instead of the current clock. Confirmation is bound to the reviewed preview by a SHA-256 fingerprint, rejects a changed proposal, Artifact, or owner, inherits the Artifact owner, returns the existing Life Event on an exact retry, and never creates a Calendar event automatically. Complete approved model-backed extraction and live desktop and phone verification.

As a traveler, I can see origin, destination, departure, arrival, local time zones, when to leave, booking context, and current travel status.

Where it lives

Travel Life Event cards, travelStatus, map/status integrations.

Current evidence and next check

live GVA-ZRH-LAX and LAX-ZRH-GVA cards show route, booking description, duration, and correct local dates. Finish stale live-status, missing-coordinate, train, and car matrices.

As a user, I can link a Life Event to goals, Psyche records, people, notes, artifacts, and any other compatible Forge record.

Where it lives

General entity links and chronology cards.

Current evidence and next check

general link create/search coverage remains green and no artifact-specific relationship model was introduced. Finish backlinks for deleted and private targets.

As a user, I can trust that imported and displayed event times preserve the source instant, source time zone, local display zone, and date.

Where it lives

Calendar/Life Event normalization and ticket extraction.

Current evidence and next check

offset instants, IANA source zones, date-line crossings, Zurich and Los Angeles DST gaps/folds, exclusive all-day ends, en-US/de-CH display, ambiguous abbreviations, and the live Sep 12/Sep 13 return flight all pass.

As a user, I can create, edit, search, tag, date, and link Markdown notes as durable prose beside structured records.

Where it lives

notes-index, note, general links.

Current evidence and next check

the coordinated correction package now closes all seven prior findings together. Free-form authors cannot choose owners or audit actors; scoped summaries and activity remain inaccessible outside their authorized scope and complete even after newer hidden events; direct routes authenticate before parsing or record disclosure; hard deletion and expiry clear live ownership while retaining redacted historical visibility; link anchors are canonicalized and collision-safely deduplicated; live and deleted searches share exact ID and normalized-query rules; and batch mutation/search responses use distinct exact OpenAPI contracts, including truthful atomic rollback results. The combined backend contract is 18/18 and root TypeScript passes. Complete one retained live desktop and 390-pixel phone pass over Note creation, search, editing, linking, soft delete, restore, and activity before promotion to Verified.

As a user, I can browse and search KarpaWiki pages as durable structured-memory documents.

Where it lives

wiki-index, wiki_page specialized CRUD and search.

Current evidence and next check

the bounded index and ranked search cover title, alias, content, hybrid, semantic, empty, warning, retry, and paginated result states. Search query, mode, and applicable embedding profile now live in the page URL, so a search survives reload, browser history, and sharing. Closing clears only the search parameters and restores keyboard focus. Focused Wiki tests pass. Complete retained live desktop and 390-pixel phone verification before promotion.

As a user, I can create, read, edit, and delete a wiki page while preserving metadata, links, and history.

Where it lives

wiki-new, wiki-page-detail, wiki-edit.

Current evidence and next check

drafts persist, and edits now use one atomic revision compare-and-swap so stale clients receive a 409 before links, search data, or activity change. Finish slug-collision, backlink, and soft-delete matrices.

As a user, I can follow backlinks, citations, related pages, and general entity links from a wiki page.

Where it lives

Wiki detail, backlinks, entity relationships.

Current evidence and next check

page detail now has separate directed views for outbound Links from this page and inbound Linked here citations. Outbound cards preserve labels, raw targets, and embed intent; available targets navigate canonically, while missing, access-unavailable, and self-link targets remain truthful and non-destructive. A two-way marker appears only when both stored directions exist, and bounded truncation stays visible. Existing Forge entity links retain selected-user scope behavior. Focused Wiki relationship tests pass. Complete the retained permission/deleted-target and live desktop/phone promotion matrix.

As a user, I can ingest supported source material into KarpaWiki and inspect every job's source, mapping, status, and errors.

Where it lives

Wiki ingest modal, wiki-ingest-history, ingest APIs.

Current evidence and next check

persisted totals, loaded-match counts, terminal source errors, refresh/delete failures, URL redirect validation, DNS pinning, timeouts, content types, and byte limits pass. Finish larger batch, retry, and duplicate-source matrices.

As an operator, I can inspect wiki health, sync, reindex, and configure optional model-backed processing.

Where it lives

settings-wiki, wiki health/sync/reindex, model settings.

Current evidence and next check

no-model maintenance remains available, and reindexing is disabled unless an enabled embedding profile exists. Finish interrupted reindex, progress, and rollback.

As a user, I can explore Forge records and their relationships as a filterable Knowledge Graph.

Where it lives

knowledge-graph-index, entity graph API.

Current evidence and next check

2,000-node framing, theme repaint, and spatial arrow-key navigation pass; complete assistive-technology narration and additional dense-graph interaction checks.

As a user, I can inspect a large graph without blank frames, runaway simulation, illegible framing, or a desktop-only toolbar.

Where it lives

Graph renderer, worker/layout model, compact toolbar.

Current evidence and next check

representative 2,000-node and mobile checks pass; retain benchmark fixtures.

As a user, I can find meaningfully related local records across Forge and see the exact source evidence behind every result.

Where it lives

Local lexical and structural search, Action Bar, Knowledge Graph, permission and provenance filters.

Current evidence and next check

operator-only local search covers all 31 eligible record families, removes deleted and out-of-scope records before tokenization, and returns exact raw-text or one-hop relationship evidence with canonical source links. The transient index refuses more than 750 records, 750 relationships, or 3 MiB of text; it uses no embeddings and makes no hidden semantic claim. Complete live desktop, phone, and keyboard verification.

As a user, I can browse, search, filter, and page through a large Artifact Store without loading every record or crowding the UI.

Where it lives

artifacts-index, GET /api/v1/artifacts.

Current evidence and next check

metadata-only 50-record pages, indexed full-text search, exact linked-record and state/danger/format filters, filter-aware states, and bounded UI controls pass on 10,000 mixed records; measured first/deep/search pages were 3.72/4.13/2.85 ms and the first response was 29,148 bytes.

As a trusted user or scoped trusted agent, I can add one or several supported files and see one stable upload queue.

Where it lives

Artifact guided modal, POST /api/v1/artifacts.

Current evidence and next check

the guided queue accepts up to 25 files; complete per-file progress, cancellation, retry, duplicate-byte, and partial-failure checks.

As a user, I can give each queued file a short description quickly or open a detailed guided step and return without losing other files.

Where it lives

Artifact ModalBase flow and upload queue.

Current evidence and next check

per-file descriptions and relationship drafts survive detail navigation; complete bulk-default, keyboard, and phone checks.

As a user, I can inspect precise artifact metadata: title, short and full description, source path/name, format, size, checksum, provenance, ownership, timestamps, version, links, and protection state.

Where it lives

Artifact detail/list metadata and GET/PATCH /api/v1/artifacts/:id.

Current evidence and next check

the detail view now exposes canonical file identity, source, ownership, MIME, size, original/stored checksums, storage path/key, timestamps, links, protection, structured metadata, and version facts; guided metadata edits preserve immutable evidence. Desktop and 390 x 844 live QA passed without overflow or application errors. Finish stored-row/adapter field fixtures.

As a user, I receive a static safety scan and explainable danger level before deciding whether to trust a file.

Where it lives

Artifact scan, danger score/level, findings.

Current evidence and next check

missing, completed, and failed scan states are explicit. Parsed Office archives must contain [Content_Types].xml and the extension-specific Word, PowerPoint, or Excel primary part; disguised or malformed packages receive an explainable high-severity office_structure_invalid finding and quarantine, while structurally valid macro and unsafe-compression fixtures retain their dedicated findings. Unsafe entry counts, uncompressed sizes, or compression ratios now stop the Office scan after header and entry-name checks, before any entry body is decompressed or text is extracted. YAML, YML, and JSON inputs receive parser-backed syntax checks only when the bounded 80,000-byte sample contains the complete file; larger valid inputs are truthfully marked yaml_validation_incomplete or json_validation_incomplete instead of receiving false parse errors. PDF, PNG, JPEG, and WebP extensions must match their detected byte signatures; PNG now requires its complete eight-byte signature instead of accepting the ambiguous four-byte prefix. Mismatches receive high-severity pdf_header_invalid or image_header_invalid findings and quarantine. CSV and TSV formula-like content uses a bounded, quote-aware cell scan with format-specific delimiters, detecting quoted or padded formula cells without flagging delimiter-adjacent prose inside a quoted field. A failed rescan preserves the previous valid scan evidence; its alert remains bound to the artifact that failed and distinguishes retained evidence from a first scan with no prior evidence. Complete remaining signature fixtures.

As a user with an enabled LLM, I can request missing title, descriptions, provenance hints, format details, and danger interpretation, then review the proposal before applying it.

Where it lives

POST /api/v1/artifacts/:id/enrich, model settings.

Current evidence and next check

enrichment now stores a bounded proposal without changing artifact metadata. Artifact text is explicitly isolated as untrusted data; oversized fields, excessive lists and links, and long verbatim source spans are excluded. The Artifact Store compares every proposed description and safety interpretation with current evidence before an operator-only apply action. Agent credentials can request a proposal but cannot apply one. Apply is atomic and proposal-bound: changed metadata, stored content identity, protection or trust state, scan evidence, deletion state, or a newer proposal returns a stable conflict without partial metadata or audit writes. Slow or competing model completions retain the same compare-and-set protection, and genuine failures persist only sanitized diagnostics. Complete live configured-provider review on desktop and phone.

As an operator, I can change trust state, rescan, inspect versions and audit history, update metadata, delete, restore, and deliberately hard-delete metadata.

Where it lives

Artifact trust/scan/version/audit routes plus batch metadata actions.

Current evidence and next check

a guided trust flow requires a reason and uses the dedicated audited route while preserving scanner evidence; version/audit cards expose ordering facts, checksums, actors, timestamps, protection, and event metadata; shared soft delete remains restore-compatible. Rescan completion now uses an atomic scan-start snapshot covering storage, protection, trust state, download policy, danger evidence, scan evidence, and deletion liveness, so a stale scan returns a stable conflict without overwriting a newer human restriction, resurrecting a deleted Artifact, or appending false audit evidence. Finish explicit restore and deliberate hard-delete UI matrices.

As a user, I can link an artifact to any compatible entity through the general relationship model and embed its human-download anchor in notes or wiki pages.

Where it lives

POST /api/v1/artifacts/:id/links, general links, wiki renderer.

Current evidence and next check

structured general links are bounded to 100, validate every supported target family against live non-deleted records before replacement, and preserve existing links and audit state on missing, deleted, or unsupported targets. Ordinary Note and Wiki references open canonical Artifact detail; embedded references preserve their embed intent and open the named human-download region. After asynchronous detail loading, that region receives focus and scrolls into view without triggering a download. Focused Note, Wiki, and Artifact Store tests pass. Complete backlink rendering and retained desktop and phone visual verification.

As a human operator, I can download an artifact deliberately; an agent cannot autonomously download, open, execute, decrypt, or transform its bytes.

Where it lives

Human-only download/password/encrypt routes and adapter exclusions.

Current evidence and next check

human-only and disabled download states plus blocked explanations pass; complete the full actor/scope matrix and byte-integrity failures.

As a human operator, I can use supported content protection and a password hint without exposing the password to Forge agents.

Where it lives

Human encryption/download flow and protected metadata.

Current evidence and next check

password/encryption flows remain human-only and explicit, and concurrent encryption transitions now serialize so exactly one coherent password, encrypted version, and audit trail wins without orphaning ciphertext. Complete the remaining wrong-password, hint, version, and secret-log checks.

As a user, I can create, search, edit, link, archive, and restore a Person without turning that person into a Forge user or peer identity.

Where it lives

people-index, person, shared batch CRUD, general entity links.

Current evidence and next check

Person identity, aliases, contacts, facts, dates, notes, ownership, optimistic versions, soft deletion, restoration, and links use the shared entity contract and remain separate from peer keys, grants, and devices.

As a user, I can browse a large People collection and open one person's local details, current context, shared information, devices, and security history without loading every record.

Where it lives

People collection/detail workspace, GET /api/v1/people, Person context read model.

Current evidence and next check

signed revision-bound cursors, bounded sections, deliberate retry, 10,000-person virtualization, desktop and phone layouts, and field-level redaction pass; the full release gate remains.

As a user, I can add or edit a Person through a guided modal that asks only for the relationship context and missing details that matter.

Where it lives

People ModalBase flows and Person batch mutations.

Current evidence and next check

create/edit flows preserve drafts, optional details, general links, focus, keyboard behavior, and sensitive-field review. Complete publication evidence is pending with the aggregate release.

As a user with existing People pages in KarpaWiki, I can review candidates and explicitly associate, create, or skip each one without destructive conversion or guessed matches.

Where it lives

Wiki candidate scan, preview/apply actions, profile_page entity links.

Current evidence and next check

bounded candidate paging, ambiguity handling, version-bound preview, atomic idempotent apply, and existing-page preservation pass focused tests.

As a user, I can pair two independently operated Forge installations by scanning a short-lived QR invitation and confirming the same peer identity before either side shares data.

Where it lives

People pairing flow, iPhone scanner, peer invitation and confirmation routes.

Current evidence and next check

one-use invitations, signed transcript/state/evidence binding, explicit verification, replay handling, rollback, expiration, and owner isolation pass across Node, Rust, web, and native tests.

As a user, I can inspect and manage peer relationships and approved devices without confusing a local Person, remote principal, device certificate, or companion credential.

Where it lives

People relationship/device/security views, peer identity and revocation routes.

Current evidence and next check

certified device identity, rotation, revocation, companion v2 enrollment, current-user presence, recovery boundaries, and multi-owner routing are fail-closed and audited.

As a user, I can propose, counter, review, accept, and revoke directional sharing rules that state which projection, fields, precision, time span, cache policy, and approved devices apply.

Where it lives

Sharing preview and grant flows, signed grant versions, projection registry.

Current evidence and next check

grants require human review and both parties' verified signatures; broad sharing excludes protected domains; counterproposals cannot silently widen access; current-device approval and revocation are enforced before projection delivery.

As a user, I can ask bounded questions such as another person's calendar availability, current goal horizon, or cycling aggregate and receive only information that person allowed to be shared.

Where it lives

Person question interpret/execute/history routes, registered peer projections.

Current evidence and next check

relative dates, time zones, interpretation hashes, schema validation, grant intersection, source preference, result limits, audit, and the initial Rust query round trips pass. Arbitrary prompts, SQL, raw samples, and generic peer HTTP are not exposed.

As a user, I can tell whether shared information is local or remote, fresh, stale, incomplete, revoked, offline, or waiting for resynchronization.

Where it lives

Remote projection cache, freshness UI, query history, revocation and resync actions.

Current evidence and next check

authenticated encrypted caches, expiry, key loss, device attribution, withdrawal, quarantine, stale display, bounded retry, and explicit resync states pass focused tests.

As a self-hosting user, I can communicate directly when peers overlap online and optionally use a replaceable mailbox or relay without depending on a Forge-operated account service.

Where it lives

Forge Peer daemon, Iroh, Tor, transport abstraction, reference connectivity service.

Current evidence and next check

transport-independent encrypted envelopes, OpenMLS state, durable outbox/inbox delivery, direct Iroh, Tor, optional mailbox, restart recovery, and provider trust boundaries pass integration tests. The reference service remains optional and replaceable.

As a trusted agent, I can use scoped People reads and typed questions while pairing, device, grant, presence, download, and other human decisions remain unavailable to agent tools.

Where it lives

OpenAPI, onboarding, OpenClaw, Hermes, Codex MCP, Forge Memory.

Current evidence and next check

source and packaged tool allowlists, scopes, strict schemas, human-only exclusions, and conversational People guidance are byte-aligned across adapters.

As an iPhone or Watch user, I can review People context, scan pairing material, approve protected actions with deliberate presence, and choose which People appear on Watch without exposing private fields.

Where it lives

iPhone companion, Watch People selection, Entity Navigation pins, companion v2 routes.

Current evidence and next check

native enrollment, Secure Enclave request signing, pairing, protected approvals, retry, accessible pin/unpin confirmation, bounded Watch selection, and source freshness have focused unit/UI evidence; final signed archive and TestFlight publication remain release gates.

As a user, I can create a preference catalog that defines one decision domain and its provenance.

Where it lives

preferences-index, preference_catalog.

Current evidence and next check

guided catalog creation now covers purpose and boundaries, one owner/domain, stamped provenance, normalized duplicates, generic links, bounded lists, retry-safe create, concurrent uniqueness, reversible archive/restore, and direct/batch authorization. Link writes validate target read access without distinguishing missing from inaccessible. Source tests pass; browser visual QA and held contract generation remain.

As a user, I can maintain reusable catalog concepts and concrete preference items without confusing the two.

Where it lives

preference_catalog_item, preference_item.

Current evidence and next check

linked concepts have one atomic identity with deterministic duplicate repair and evidence remapping, while direct same-label records remain distinct and receive a non-blocking warning. Deleting a concrete scored item now removes its judgments, signals, ownership, links, and projections and recomputes every affected context inside one transaction; a failed recomputation preserves the complete prior state. Complete catalog-membership transitions and retained live desktop and phone verification.

As a user, I can describe the context in which a preference applies and merge contexts without losing evidence.

Where it lives

preference_context, Preferences merge action.

Current evidence and next check

ordinary context definition uses shared batch CRUD; live onboarding and every adapter require both contexts to be read before forge_merge_preferences_contexts, with one source, one target, an explained evidence move, source deactivation, target recomputation, and explicit merge intent. The server rejects a self-merge with a stable 400 before any state changes. After a valid merge, an exact idempotent signal retry follows the retained signal into the target context, returns its authoritative recomputed score, and cannot create duplicate evidence. Complete overlapping-evidence resolution and retained live desktop and phone verification.

As a user, I can compare two items and record a pairwise judgment with strength and context.

Where it lives

preference_judgment action route.

Current evidence and next check

card, button, and keyboard submissions share an immediate per-pair lock and one stable idempotency key. An ambiguous failure retains the exact pair, outcome, strength, and key behind a 44-pixel retry action. Every accepted judgment now returns an actor-scoped ten-minute mutation receipt; Undo atomically marks that evidence inactive, recomputes the affected preference context, records one audit event, and replays exactly without recreating the judgment. Ties and skips remain explicit. Complete retained live desktop and phone promotion evidence.

As a user, I can mark a direct signal such as favorite or veto and understand how it affects the model.

Where it lives

preference_signal action route.

Current evidence and next check

any selected item now opens the guided dialog with current mark, owner/domain/context, provenance, replacement, conflicts, and exact model effect. Writes return recomputed score and effectiveSignal; neutral preserves history but adds no direct weight, evidence, or confidence. Backend, web, OpenAPI, bounded-history, concurrency, and agent tests pass; browser visual QA and held contract generation remain.

As a user, I can inspect inferred scores and their supporting judgments/signals instead of receiving an unexplained ranking.

Where it lives

Preferences workspace/read model.

Current evidence and next check

live onboarding and all adapter playbooks define an evidence-first read flow through GET /api/v1/preferences/workspace, explaining judgments, signals, overrides, evidence count, and uncertainty before a follow-up action. The bounded history window now includes labels for exactly its referenced items, so evidence outside the current score page remains readable; an unavailable historical item is described without exposing an opaque internal identifier. Complete recalculation edge cases and retained live desktop and phone verification.

As a user, I can add an existing Forge entity to a preference workspace without duplicating its identity.

Where it lives

Preferences enqueue-from-entity action and general links.

Current evidence and next check

enqueue uses a partial unique linked-identity index and atomic upsert, including deterministic repair of legacy duplicates. Missing, deleted, or out-of-scope sources are rejected before any item or link is written, including through shared batch routes. A linked candidate has exactly one general source backlink; replay reuses it, relinking updates it atomically, and deletion removes it. The workspace uses Forge's canonical entity routes and a keyboard-focusable 44-pixel source link instead of exposing only a raw identifier. Complete the retained live desktop and phone promotion gate.

As a user, I can compare selected records across time without exporting them or losing their type, source, units, and provenance.

Where it lives

Preferences, insights, Health, Psyche, Knowledge, comparison read model.

Current evidence and next check

the Comparison workspace aligns up to eight authorized records across a bounded date window, preserves each original unit by default, marks missing evidence instead of substituting zero, exposes exact source links, and withholds metadata for deleted or inaccessible selections. Shared-axis display requires compatible numeric units; current-only records do not invent history. Complete live desktop, phone, and keyboard verification.

As a user, I can enter Psyche and understand the available reflective records and recent context.

Where it lives

psyche-index.

Current evidence and next check

the overview now gives first-time and returning users a non-removable record guide with live counts and canonical routes for values, patterns, behaviors, beliefs, modes, reports, flashcards, and questionnaires. It distinguishes stored reports, questionnaire runs, linked notes, and linked insights; states the active-scope privacy boundary; explains that opening the guide writes nothing; and clearly frames reflection as self-observation rather than diagnosis. Focused first-use and dense-state navigation tests pass. Complete retained desktop and 390-by-844-pixel visual and keyboard verification.

As a user, I can articulate a value as a lived direction and connect it to actions, goals, beliefs, and reports.

Where it lives

psyche-values, psyche_value.

Current evidence and next check

the guided flow preserves rough/conflicted user wording, reveals the lived-direction question only after a value is named, blocks only missing required meaning, moves optional ownership/links later, and preserves typed action wording while dropping blank lines on save. Complete already-clear, competing-value, edit, correction, and relationship simulations.

As a user, I can map a behavior pattern through cue/context, visible response, short-term payoff, long-term cost, and preferred alternative.

Where it lives

psyche-patterns, behavior_pattern.

Current evidence and next check

the five-step guided flow progressively separates concrete cue, observable response, immediate protective function, later cost, and preferred alternative with non-blaming blockers; optional ownership and links come last. Complete already-clear, mixed-function, edit, and correction simulations.

As a user, I can record one observable behavior or urge as away, committed, or recovery behavior and link its evidence.

Where it lives

psyche-behaviors, behavior.

Current evidence and next check

the five-step guided flow distinguishes observable action from belief, pattern, goal, and trigger report; preserves authored wording during edits; progressively asks for cues, urge, immediate function, later cost, or repair action by behavior kind; and moves optional ownership to final links. Complete committed-action edge cases, correction/withdrawal, linked evidence, and live edit matrices.

As a user, I can name a belief in my own words, estimate confidence, examine evidence, connect an optional schema, and propose a more flexible alternative.

Where it lives

psyche-schemas-beliefs, belief_entry.

Current evidence and next check

the guided flow preserves exact user wording, distinguishes experiences and interpretations from facts, welcomes contradictory evidence, frames alternatives tentatively, and requires renewed consent whenever the formulation changes. Complete schema-link, update, withdrawal, and ambiguous-evidence simulations.

As a user, I can describe a recurring mode with cues, needs, fears, burdens, protective function, risks, and preferred responses.

Where it lives

psyche-modes, mode_profile.

Current evidence and next check

mode creation now requires a tentative recognizable name and a correctable protective-function hypothesis, explicitly avoids diagnostic certainty, keeps legacy sparse profiles editable, and moves optional ownership to final links. Complete explicit needs/risks/preferred-response fields, episode links, family correction, and live edit matrices.

As a user, I can complete a guided mode session that helps name the active part and choose a next response without prematurely creating a durable profile.

Where it lives

psyche-mode-guide, mode_guide_session.

Current evidence and next check

the one-question flow develops functional hypotheses and a next response without premature profile creation; complete resume and candidate ambiguity checks.

As a user, I can create and retrieve a concise therapeutic flashcard for a trigger, urge, value pivot, or recovery move.

Where it lives

psyche-flashcards, flashcard.

Current evidence and next check

authored and changed messages now have a 600-character retrieval-focused limit while legacy longer cards remain readable and allow unrelated edits. Long and unbroken messages preserve all text with adaptive typography and safe wrapping; both the urge/cue and situation remain visible; images retain their accessible description; and owner-filtered value, behavior, pattern, belief, mode, and recent-report relationships can be edited and opened from the card. Unavailable relationships remain attached and are counted without exposing their identifiers. Focused API and web acceptance tests, the full TypeScript check, and live route reachability pass. Complete native Watch presentation and fresh desktop/390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can maintain reusable event and emotion vocabularies for reports without losing the option to use my own words.

Where it lives

psyche-reports, event_type, emotion_definition, shared batch CRUD.

Current evidence and next check

owner-scoped custom entries, immutable built-ins, normalized duplicate checks, retry-safe create, exact API contracts, and guided ModalBase management are complete. Reports retain their own event and emotion words across preset changes, renames, restoration, and hard deletion. Canonical Psyche scope includes both vocabularies and mode_guide_session. Source gates are green; generated copies are held and browser QA is pending by instruction.

As a user, I can build a trigger report for one episode across situation, emotions, thoughts, body cues, behaviors, consequences, modes, schemas, and next moves.

Where it lives

psyche-reports, trigger_report.

Current evidence and next check

the complete source package now covers progressive guided intake, incomplete-memory defaults, interpretation consent and correction, owner-scoped deep search, stable keyset pagination, idempotent retry, revision conflict recovery, all five planning links, reversible deletion, generic-link hard deletion, Watch defaults, and aligned agent playbooks. Independent source review found no remaining defect; packaged migration 092, runtime, and OpenAPI parity remain held behind the People integration gate.

As a user, I can inspect one trigger report as a coherent chain and follow every linked record.

Where it lives

psyche-report-detail.

Current evidence and next check

report detail now opens with a read-only Spark-to-Pivot overview that preserves the eight-stage order, identifies unrecorded stages, keeps the user's hypothesis correction visible, and lets each stage open its full editor without losing whole-chain context. Available event type, emotion, pattern, value, goal, project, task, behavior, belief, and mode relationships open their canonical records; loading, failed, and genuinely unavailable link states remain distinct, and unavailable identifiers are never rendered. The overview is single-column on narrow screens and progressively expands without horizontal scrolling. Eleven focused report, vocabulary, conflict, deletion, and overview tests plus an exact-route test, the full TypeScript check, and live route reachability pass. Complete fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can create a reusable questionnaire with provenance, sections, questions, scoring rules, and instructions.

Where it lives

psyche-questionnaires, psyche-questionnaire-new, questionnaire_instrument.

Current evidence and next check

the draft builder now provides guided editors for participant instructions, presentation, sections, questions, common total scores, missing-answer rules, and provenance sources. Long instruments expose one section at a time; new questions receive stable identifiers and inherit the instrument's existing answer scale; advanced conditional flow, option values, imported definitions, score formulas, and interpretation bands remain available without being discarded. Malformed imported JSON is contained in its advanced editor instead of crashing the page. Six focused component and draft-flow tests, the full TypeScript check, and live route reachability pass. Complete direct file import, complex scoring assistance, draft/publish conflict matrices, and fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can inspect, edit, clone, version, and publish a questionnaire without changing historical runs.

Where it lives

psyche-questionnaire-detail, psyche-questionnaire-edit.

Current evidence and next check

every dedicated, direct, shared-entity, builder, and OpenClaw questionnaire write now requires the exact draft version and revision returned by the latest read. The builder saves the complete visible form before publishing that returned revision; stale saves and publishes return a stable conflict without changing the draft or recording success activity, and expose an explicit reload-and-discard choice rather than silently overwriting either editor. A focused scoring change proves the new version changes while the prior completed run retains its original definition and scoring. Four focused API cases, four builder cases, full TypeScript, generated OpenAPI parity, and live route reachability pass. Complete fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can answer a questionnaire one prompt at a time, pause safely, and complete it once.

Where it lives

psyche-questionnaire-run, questionnaire_run actions.

Current evidence and next check

questionnaire start, read, update, and completion enforce credential user scope before answer, scoring, completion-note, or Activity writes. Autosave now reports Not saved, restores the last server-acknowledged answers and place, blocks premature completion, and retains one exact retry instead of presenting an optimistic response as durable. A lost completion response keeps the saved draft visible, explains that completion was not confirmed, and safely retries the same idempotent run. Selected answers expose pressed state to assistive technology. Three focused guided-run cases, full TypeScript, and live route reachability pass. Complete required-versus-optional answer, multi-device resume, broader server idempotency, and fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can review a completed run's raw answers, computed scores, context, and instrument version.

Where it lives

psyche-questionnaire-run-detail.

Current evidence and next check

the completed-run page identifies the exact stored version and label, run timestamps, scoring notes, source class, retrieval date, safe provenance links, score rows, raw stored answers, and distinct not-shown versus unanswered states. It now downloads a versioned JSON evidence record containing the exact run, instrument context, immutable version definition and scoring, raw answers, and computed scores; a focused 90,000-character answer remains lossless. Credential-bearing legacy URLs are redacted from both version provenance and instrument summary fields with explicit availability status instead of leaking into the file. Two focused result-page cases, full TypeScript, and live route reachability pass. Complete corrupt-legacy containment and fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can log and review dated observations about emotions, thoughts, triggers, body state, movement, and context.

Where it lives

psyche-self-observation, note-backed self_observation.

Current evidence and next check

the weekly observation calendar combines dated human observations and Forge activity with explicit user, tag, entity, density, human-only, search, and export controls; observations retain their linked patterns, trigger reports, and other records. Editing a companion movement observation now preserves its movement and source-receipt provenance instead of replacing all stored frontmatter, while a changed observation time remains authoritative. Eight focused page cases, the full TypeScript check, and live route reachability pass. Complete calendar-boundary, stale-sync, sensitive-field, and fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can inspect device-use patterns beside mood, attention, and routines.

Where it lives

psyche-screen-time, companion Screen Time sync.

Current evidence and next check

the Screen Time page now requests the companion's authoritative latest captured device-calendar day and matching month instead of silently asking the server for its UTC date. Approved, denied, unavailable, permission-needed, paused, waiting, fresh, and stale capture states have distinct explanations while previously synced history remains visible. A missing hourly snapshot is never presented as zero use, and omitted app or category detail is identified as partial rather than rendered as an unexplained blank. Three focused page cases, the full TypeScript check, and live route reachability pass. Complete permission-transition, category-change, companion-time-zone migration, and fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can review Psyche metrics such as mood, urges, self-regulation, and conversation-derived signals with clear provenance.

Where it lives

psyche-metrics.

Current evidence and next check

the metrics workspace distinguishes mood, urges, self-regulation, and conversation families; defines every available calculation, interpretation limit, confidence status, sample unit, missingness rule, owner scope, freshness state, and source; preserves measured zeroes while leaving absent days missing; and links attributable trigger-report readings to their records. Mixed-quality legacy emotion arrays now retain valid numeric 0-100 intensities while counting and disclosing every missing, non-numeric, or out-of-range entry as aggregate data-quality evidence rather than silently treating null as zero or presenting the metric as complete. The focused API case, all ten workspace cases, the full TypeScript check, and live route reachability pass. Complete calibrated-confidence research, scanner owner attribution, and fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user, I can see how values, goals, behaviors, beliefs, modes, and reports relate without mistaking correlation for causation.

Where it lives

psyche-goal-map.

Current evidence and next check

the Goal Map now requests the Psyche overview in the shell's server-enforced selected-user scope instead of combining a scoped goal snapshot with an unscoped relationship response. The page explicitly states that layout describes stored relationships, not correlation or causation; solid edges represent direct stored links, while dashed edges identify indirect associations through a shared value. Every edge has a named relationship in the accessibility tree, and the interactive SVG exposes goal, value, project, habit, behavior, belief, and report nodes as keyboard-focusable named controls instead of flattening them into one image. Four focused page, scene, and graph cases, the full TypeScript check, and live route reachability pass. Complete dense multi-goal performance and occlusion evidence plus fresh desktop and 390-by-844-pixel visual and keyboard verification before promotion.

As a user speaking naturally to an agent, I receive calm reflection, one well-sequenced question at a time, and useful hypotheses offered for discussion.

Where it lives

Onboarding questionFlow, plugin playbooks, MCP tools.

Current evidence and next check

the live onboarding contract now machine-publishes exactly one question per turn for every entity. Every Psyche flow additionally requires reflection before the question, permits at most one tentative functional non-diagnostic hypothesis, and requires one fit-or-correction check. OpenClaw, Hermes, and Codex enforce the same fields instead of relying on prose alone. Focused live-contract and adapter-parity checks pass; complete scored distressed-case simulations and retained live conversation verification before promotion.

As a user, I can correct, decline, defer, or keep an agent's interpretation before any sensitive record is written.

Where it lives

Agent readiness checks and mutation confirmation.

Current evidence and next check

Mode Guide defer remains mutation-free. Saving a declined, uncertain, or unreviewed reading now preserves the user's account and answers while persisting no generated interpretation; a partly accepted reading requires and preserves the user's correction but also persists no uncorrected result. Only one explicit fits decision may retain server-derived candidate interpretations, and duplicate decisions are rejected before a write. Focused server and web model cases cover keep, correct, decline, uncertainty, unreviewed input, duplicate decisions, missing correction, and defer. Complete crisis/refusal simulations and retained live conversation verification before promotion.

As a user, I can inspect sleep sessions, stages, recovery context, annotations, and trends by wake date.

Where it lives

sleep-index, sleep_overview, sleep_session.

Current evidence and next check

wake-date freshness, daylight-saving edits, circular after-midnight regularity, calendar trends, normalized stages, annotations, source records, and raw provider evidence are preserved. Same-day naps remain individually inspectable, while records overlapping at least half of the shorter interval are identified against one strongest calendar representative without merging or deleting their provider evidence.

As a user, I can review workouts with type, timing, distance/energy, route, effort, meaning, and linked evidence.

Where it lives

sports-index, sports_overview, workout_session.

Current evidence and next check

the 1,158-session history, filters, bounded summaries, full-by-id reads, and selected-user authorization preserve complete workout detail. Habit reconciliation now consumes only an awaiting placeholder: exact provider replays update the reconciled row, while a distinct nearby provider workout remains a separate standalone session instead of overwriting mixed-source evidence.

As a user, I can inspect one workout's heart-rate timeline, zones, route points, events, and preserved raw evidence.

Where it lives

sports-workout-detail.

Current evidence and next check

adaptive detail bounds dense heart-rate and route evidence while preserving first and final samples, missing sensors remain explicit instead of zero-filled, and the route fallback follows Forge theme tokens without sending map requests. Local tiles may load directly; external or malformed tile sources remain off behind an explicit 44 px consent action that names the route-area disclosure.

As a user, I can understand acute/chronic load, intensity mix, zone time, VO2max context, targets, and next-workout guidance.

Where it lives

training-load-index, read-only training_load.

Current evidence and next check

the full explanation model, compact phone summary, bounded bulk analytics read, decision thresholds, mixed-sport contribution, and evidence freshness are covered. Daily, weekly, and monthly comparison ratios now use the actual preceding 28 days, four weeks, or three calendar months, so a workout after a long gap cannot silently reuse months-old training as its recent baseline or next-week volume reference.

As a user, I can review daily HealthKit vitals, recovery markers, cardio fitness, and trends with units and source quality.

Where it lives

vitals-index.

Current evidence and next check

the retained 20,288 px live phone route is readable, themed, and overflow-free; signed-sync fixtures now prove canonical unit conversion, atomic duplicate rejection, source-device provenance, inclusive quality boundaries, and visible outlier handling that cannot distort baselines or deltas.

As a user, I can compare sports by time, share, sessions, calories, energy rate, and heart-rate-backed load density without mistaking missing evidence for zero.

Where it lives

sports-index, GET /api/v1/health/fitness.

Current evidence and next check

all-time, 12-month, and 90-day aggregates expose per-metric coverage, exclude future plans, use readable compact chart labels with full tooltips, and stay readable across a 19-sport history on phone and desktop.

As a user with a large workout history, I can search exercise types from a visible keyboard-accessible autocomplete and scroll a bounded session browser without loading every row into the DOM.

Where it lives

sports-index, sessionDetail=summary&analysisDetail=compact, workout detail read.

Current evidence and next check

the real 1,158-session store mounts only 8-12 history rows at the first and final sessions, the portal autocomplete remains visible and keyboard accessible, and the browser contract transfers 33.7% fewer bytes than the prior summary response while preserving full-by-id reads.

As a user, I can log food quickly, search or create reusable foods, and preserve serving, nutrient, source, and confidence details.

Where it lives

weight-loss-index, dedicated nutrition actions.

Current evidence and next check

custom, search, ChatGPT, quantity conversion, edit, history, selected-day, and selected-user flows pass. The food-log form now preserves one idempotency key across an uncertain response; exact replay returns the original meal, item, and custom catalog food, while changed content conflicts instead of duplicating data. Finish semantically equivalent duplicate-catalog and fully offline queue cases.

As a user, I can compare intake with activity-aware calorie targets and see whether the evidence is reliable enough to guide a decision.

Where it lives

Read-only weight_loss overview.

Current evidence and next check

intake, target, remaining calories, historical balance, active-energy source, and arithmetic stay separate. Prior-day activity now reports selected-source coverage and sparse/partial/complete reliability; fewer than four measured days cannot replace a saved seven-day baseline, missing days never become zero, and signed HealthKit input proves pound preferences convert to the canonical kilogram model while energy remains explicit in kilocalories.

As a user, I can track weight, body composition, appearance, energy, cravings, gut comfort, and sport fueling without collapsing them into one score.

Where it lives

Weight Loss subviews and dedicated check-ins.

Current evidence and next check

body, appearance, subjective, gut, food-quality, training-fuel, and data-quality signals remain distinct, enforce one selected owner, reject cross-owner food links, and retry idempotently. The guided check-in now keeps body, subjective, gut, and appearance context in separate records; context without a matching signal is rejected instead of silently discarded. Summary cards expose per-metric values and coverage, note-only rows cannot satisfy evidence requirements, and absent metrics remain n/a rather than zero.

As a user, I can define and review an N-of-1 nutrition or body experiment with hypothesis, exposure, outcomes, confounders, and uncertainty.

Where it lives

Weight Loss experiments.

Current evidence and next check

the guided experiment flow preserves hypothesis, intervention, outcome, dates, confounders, adherence, and conclusion across web and API contracts. Baseline and intervention windows cannot overlap. Completion requires an explicit conclusion, planned and completed exposure counts, at least two intervention observations, and at least two baseline observations when a baseline was scheduled; partial adherence updates preserve existing evidence. These minimums support an honest review workflow but do not establish statistical or causal certainty.

As a user, I can review movement by day, month, all time, and arbitrary timeline range without treating mobility records as generic CRUD.

Where it lives

movement-index, dedicated movement reads.

Current evidence and next check

all four dedicated views remain available and the Life view uses one bounded timeline read. Timeline decoration now uses linear forward/reverse lane indexes instead of rescanning the full segment array for every box, and clean reads skip redundant override writes. The exact empty response and a 10,000-box fixture pass; its 360-segment page completed in 186.29-201.34 ms across three local samples under a 1,000 ms acceptance cap.

As a user, I can inspect stays, trips, gaps, and known places with clear source and confidence.

Where it lives

Movement timeline, places, box/trip detail.

Current evidence and next check

timeline detail remains explicit, the data-only invalid-box read is lazy, and 29 live places default to eight plus an intentional expansion. Known-place inference respects the exact configured radius instead of silently widening every smaller boundary to 100 m, while explicit companion source identity still wins when coordinates drift. Cards name source and personal/shared visibility; personal cards withhold exact overview coordinates, and the editor safely persists, cancels, or retains a failed visibility draft. Day reads now use the requested IANA timezone, true instant overlap, clipped local-midnight boundaries, and 23/25-hour DST fixtures. Boundary-crossing trips remain visible but unallocatable distance, calories, and Action Point estimates are omitted with partial provenance instead of duplicated. Every stay, trip, repaired gap, user-authored interval, and missing span now carries a visible high, medium, low, or unknown confidence label with the exact evidence basis: stay sample count and radius, trip point count and median reported accuracy, explicit user authorship, neighboring-box inference, or missing evidence. Invalid raw records are always low confidence, and user-authored confidence explicitly does not claim independent sensor verification. Complete live personal/shared card and keyboard/screen-reader verification before promotion.

As a user, I can select a period or places and receive bounded aggregate time and travel summaries.

Where it lives

Movement selection.

Current evidence and next check

the dedicated aggregate route now implements the advertised from/to aliases, canonical startedAt/endedAt, and place selection instead of silently discarding them. Every stay, trip, and place lookup is restricted to the authorized user scope, including an empty-scope fail-closed path for movement, task-run, and screen-time evidence. A request may select at most 120 stay/trip IDs, 20 places, a 366-day half-open time range, and 2,000 combined source records. Duplicate IDs, conflicting timestamp aliases, unbounded place requests, inverted ranges, and oversized results are rejected. Records that only touch the next or previous boundary are not double-counted; boundary-crossing trips remain counted, but their indivisible stored distance, energy, and speed aggregates are omitted with partial attribution. Responses name their time, distance, energy, and speed units and preserve canonical place labels plus aliases. Complete live desktop and 390-by-844-pixel selection interaction verification before promotion.

As a user, I can create or correct a place and preview whether a manual stay/trip repair would conflict before applying it.

Where it lives

Movement settings/place/user-box/preflight routes.

Current evidence and next check

place and preflight flows remain dedicated, place repair carries selected-user scope and refuses a different owner's record, exact source identifiers replay without a second place, overlapping same-label or alias radii are rejected before place or activity mutation, and impossible or half-specified preflight ranges fail before timeline analysis. Complete live create, correction, and conflict-comprehension checks.

As a user, I can update or delete a manual movement box, invalidate a wrong automatic box, and correct stay, trip, or route points with an audit trail.

Where it lives

Movement repair action routes.

Current evidence and next check

place, stay, trip, point, detail, and user-box repair routes enforce selected-user ownership and document it in OpenAPI. Stay and trip corrections now reject equal or inverted ranges before durable mutation, and each accepted correction commits its override, tombstone recovery, primary row, downstream overlap reconciliation, place learning, and Activity evidence in one transaction. Complete exact retry plus explicit undo/recovery cases.

As a user, I can see today's Action Point capacity, expected energy curve, drains, fatigue signals, recovery, and remaining capacity.

Where it lives

life-force-index, GET /api/v1/life-force.

Current evidence and next check

the complete live workspace remains compact while retaining capacity, curve, drains, warnings, recovery, and stats. The overview now requires one existing authorized owner; scoped read tokens cannot cross owners, ambiguous scopes must select one user, and project/tag-only tokens cannot read a user-wide model. Calendar drains include only events owned by or assigned to that user, preventing another user's titles, capacity effects, or derived ledger rows from leaking into the result. Complete first-use, overloaded-day, stale-profile, and retained phone checks.

As a user, I can update my Life Force profile without replacing the dedicated energy model with generic entity fields.

Where it lives

Life Force profile.

Current evidence and next check

dedicated partial updates now require exactly one existing, authorized Forge user; user-scoped write tokens cannot cross owners, ambiguous tokens must select an owner, and project/tag-only tokens cannot change a user-wide profile. Empty, unknown, fractional, and out-of-range fields are rejected while every inclusive bound is accepted. Profile persistence and current-snapshot invalidation are atomic, and the returned model is rebuilt from the accepted values. Complete one live guided profile edit and read-back before promotion.

As a user, I can define weekday energy templates that reflect recurring capacity patterns.

Where it lives

Life Force weekdayTemplate.

Current evidence and next check

guided curve editing remains dedicated, and every named weekday in the agent contract now maps to its stored Sunday-through-Saturday template instead of returning a false success. Numeric weekdays are restricted to 0 through 6, writes enforce one authorized owner, and editing today's UTC curve atomically invalidates its stale snapshot before the next overview rebuild. Complete local-time-zone interpretation and a deliberate persisted-default reset before promotion.

As a user, I can record a fatigue signal with intensity and context and see its effect on the current model.

Where it lives

Life Force fatigueSignal.

Current evidence and next check

the guided Life Force control records tiredness or recovery with intensity from 1 to 10 and optional context. The newest signal replaces the earlier short-term effect instead of stacking repeatedly, expires after four hours, preserves its audit row, normalizes offset-bearing timestamps to UTC, and rejects future observations. A failed save keeps the draft and exposes the error for retry.

As a user, I always have one Work area that explains my current jobs, how they are going, and what needs attention, even when I am not looking for another role.

Where it lives

work-index, GET /api/v1/work, compound Work context.

Current evidence and next check

all seven Work sections and their six detail routes passed the fixed 1440 by 1000 and 390 by 844 route matrix with no serious accessibility, overflow, occlusion, or runtime error. Complete the exact packed-release and retained-session live smoke before promotion.

As a user, I can represent several overlapping jobs, appointments, contracts, freelance engagements, shifts, and planned or past roles without forcing one primary job.

Where it lives

Work Engagement list/detail/create/edit/archive/restore.

Current evidence and next check

additive migration 138, typed APIs, revisions, compensation privacy, guided create/edit, and reversible lifecycle are implemented. A four-engagement fixture and create/edit/readback workflow pass; complete canonical import readback and the exact packed-release edit smoke.

As a user, I can connect a Work Engagement to goals, strategies, projects, tasks, people, organizations, locations, triggers, decisions, knowledge, and Artifacts without shadow copies.

Where it lives

General entity links plus Work relationship routes and deep links.

Current evidence and next check

owner-checked typed relationships are bidirectional, revision-guarded, searchable, and represented in the knowledge graph without shadow records. Complete the canonical relationship readback and final packed-runtime deep-link smoke.

As a user, I can record a fast confirmed Work check-in on mobile without an agent turning a suggestion into my reported experience.

Where it lives

Work Check-in dialog, metric definitions, /work/check-ins.

Current evidence and next check

versioned metric definitions, explicit source and confirmation, immutable observations, missing state, and quick entry are implemented. The 390 by 844 check-in and phone-navigation workflows pass with 44-pixel controls; complete the packed phone smoke and final critic.

As a user, I can see what changed in satisfaction, creativity, finances, growth, autonomy, meaning, sustainability, balance, relationships, energy, and other enabled metrics over time.

Where it lives

Check-ins section, trend windows, /work/metrics/trends.

Current evidence and next check

bounded raw points, moving summaries, evidence-backed change markers, context, sparse data, and concurrent-role comparison are implemented without one mutable aggregate score. The 100-observation release fixture passes; complete the exact packed-release trend readback and final critic.

As a user, I can turn Looking for opportunities on or off without losing paused or historical searches, applications, or outcomes.

Where it lives

Work overview/search setting and /work/settings/opportunity-search.

Current evidence and next check

revisioned setting changes foreground Job searches without mutating campaign history. The keyboard workflow changed the setting from off while preserving all three existing campaigns; complete update adoption with the retained paired browser.

As a user, I can run several materially different Opportunity Campaigns with independent dates, goals, targets, policies, and versioned structured criteria.

Where it lives

Job searches section, campaign detail, criteria editor, target and policy supporting records.

Current evidence and next check

concurrent campaigns, rich hard/soft constraints, weights, unknowns, criteria history, targets, sources, queries, and policies are implemented. Campaign creation and the advanced criteria-version workflow pass; complete the two-campaign canonical import and packed readback.

As a user or authorized agent, I can ingest sourced opportunities with provenance, freshness, explicit unknowns, and duplicate protection.

Where it lives

Discovery inbox, opportunity detail, /work/opportunities/upsert.

Current evidence and next check

canonical URL/source identity, substantial-description dedupe, exact replay, source claims, freshness, dispositions, filters, and history are implemented. Synthetic create/dedupe and 250-record discovery routes pass; complete the reviewed authoritative source import and duplicate readback.

As a user, I can compare one opportunity against several campaigns and retain every criteria-versioned evaluation, uncertainty, hard failure, and human override.

Where it lives

Opportunity comparison/detail and campaign evaluation route.

Current evidence and next check

campaign-specific evaluation history preserves criteria versions, evidence, scores, confidence, hard gates, gaps, failures, trade-offs, recommendations, and override reasons. Opportunity and campaign detail routes pass at both fixed viewports; complete the final release critic.

As a user, I can manage an application from planning through one evidence-backed terminal outcome without prepared documents being mistaken for submission.

Where it lives

Applications list/board/detail, guarded transitions, immutable events.

Current evidence and next check

duplicate prevention, guarded transitions, immutable events, dates, contacts, blockers, next actions, outcomes, and stable list/board filters are implemented. Application creation, exact-context loading, and a guarded transition pass; complete canonical history readback and packed runtime verification.

As a user, I can manage positioning profiles, document sets, reusable answers, interviews, offers, outreach, and exact submitted Artifact versions in one application context.

Where it lives

Documents section, application workspace, Work supporting records.

Current evidence and next check

versioned profiles, document sets, answers, interviews, offers, outreach, approval state, checksums, and submitted-use history are implemented. Document, application, interview, and offer routes pass on desktop and phone; complete canonical Artifact reference readback and packed download-policy smoke.

As a user, I can inspect saved queries, automation policy, and durable Search Run evidence, including changed, duplicate, stale, closed, failed, and known-cost results.

Where it lives

Job searches automation/run history and /work/search-runs.

Current evidence and next check

bounded sources, queries, cadence, rate/cost constraints, authority rules, exact replay, result counts, failures, and evidence are implemented. The scaled campaign surface passes; complete canonical source-history readback and the exact packed host call.

As a user, I see exactly what an application action will transmit and Forge records submission only after exact approval and direct completion evidence.

Where it lives

Transmission preview, approval request, verified submission routes.

Current evidence and next check

digest-bound recipient, route, fields, answers and Artifact versions, central approval, sender binding, unchanged context, direct receipt evidence, and one-time consumption are implemented. The preview-and-cancel workflow passes; complete one controlled local transmission sandbox through verified completion.

As an authorized agent, I can retrieve complete bounded Work context, evaluate opportunities, prepare workspaces, record verified events, and create linked actions without dozens of fragile calls.

Where it lives

forge_call_work_route, OpenClaw/Codex/Hermes playbook, Work OpenAPI.

Current evidence and next check

48 bounded route keys, compound context, strict schemas, path encoding, adapter parity, and explicit compensation/transmission scopes are implemented. Five 168,752-byte context reads passed at 39.79 milliseconds at the 95th percentile; complete packed installation and one host-level call.

As an operator, I can dry-run, apply, and exactly roll back authoritative private Work data without embedding personal information or invented subjective metrics in the public package.

Where it lives

Operator-only Work import routes and migration 138 receipts.

Current evidence and next check

digest-bound insert-only preview/apply, typed references, Artifact checksums, dedupe, rollback inventory, dependency conflicts, tombstones, and subjective-metric/secret rejection are implemented and pass isolated rollback coverage. Complete the reviewed authoritative dry run, canonical apply/readback, and exact rollback preview outside public source.

As a user, I can understand and use Work and Job searches on a phone or desktop without seeing internal names, every stored field at once, false empty relationships, or hidden-screen loading failures.

Where it lives

Responsive Work navigation and subviews, focused detail sections, pipeline, connection editor.

Current evidence and next check

the seven Work sections, four Job search views, three Documents views, all supported detail sections, and compact/desktop pipeline states use human labels and progressive disclosure. Empty connection groups are omitted, smart search shows named records with type badges, and exact identifiers stay under Technical details. Eighteen focused web tests, web and server type checks, three focused server flow tests, the production build, a bounded live responsive route matrix, and an independent findings-only review passed with no overflow, stuck loading, visible internal fallback, or browser error.

As a user, I can browse and search a bounded catalog of graph flows and reusable node boxes.

Where it lives

workbench, Workbench flow/box catalog reads.

Current evidence and next check

the complete source package now uses bounded SQL-backed summary pages, server search and facets, enabled/disabled endpoint state, lazy active-tab loading, URL-restored filters, incremental paging, retry-preserved results, full typed box disclosure, read-only catalog GETs, and aligned source OpenAPI/agent guidance. Large 600-flow and focused web/tool tests pass; generated tool documentation parity and authorized desktop/phone visual validation remain.

As a user, I can create, inspect, update, and delete a flow with stable input/output contracts.

Where it lives

workbench-flow, Workbench flow CRUD.

Current evidence and next check

guided creation, revision-bound save/delete, bounded version history, exact contract inspection, restore-as-new-revision, explicit restore confirmation, stale-write conflict handling, and exact-title deletion confirmation pass. Retain desktop/phone validation of version restore and finish any remaining graph-editor contract cases.

As a user, I can edit nodes and edges with understandable contracts, valid connections, undo, and no accidental graph loss.

Where it lives

Workbench graph editor.

Current evidence and next check

browser preflight and the server now reject cycles, missing or ambiguous ports, duplicate contract keys and identifiers, and graphs above 1,000 nodes or 4,000 edges without creating a revision. Edge deletion is explicit, keyboard deletion cannot bypass it, and the latest node or edge deletion can be undone. Next check: repeat connection, deletion, undo, and conflict handling in the live desktop and 390 × 844 layouts.

As a user or trusted agent, I can execute a saved or one-off flow and see truthful progress and failure state.

Where it lives

Workbench runFlow and runByPayload.

Current evidence and next check

durable per-flow/per-mode single-flight, stable idempotent replay, changed-payload conflict, stored-input retry, interrupted-run recovery, explicit authenticated cancellation, whole-flow deadlines, and completed-node evidence on failure, cancellation, or timeout are implemented. The web UI exposes one-, five-, and fifteen-minute deadlines plus Stop controls; authorized executor agents use the same terminal receipt contract. Complete one live long-running provider and machine-command exercise through both operator and agent access before promotion.

As a user, I can inspect run history, one run, its node list, and a node result without loading unbounded execution data.

Where it lives

Workbench run history/detail/node reads.

Current evidence and next check

paged summaries exclude full traces; exact run/node reads are separate and bounded; compound camelCase, snake-case, header, token, secret, cookie, password, and signing-key forms are redacted; and missing-run versus missing-node responses are truthful. Finish the old-version compatibility matrix and live desktop/phone inspection.

As a user, I can retrieve the stable published output and latest output for one node separately from raw run traces.

Where it lives

Workbench published/latest output reads.

Current evidence and next check

published and latest output reads remain bounded and separate from raw traces; completed-node evidence retained by a failed or interrupted run cannot replace the latest successfully published node output, while the latest failed attempt remains visible in summary metadata. Finish no-publish, stale-publish, and content-type cases plus live desktop/phone inspection.

As a user, I can continue a saved flow through a chat follow-up while preserving the flow and run context used.

Where it lives

Workbench chatFlow.

Current evidence and next check

mock chat preserves conversation continuity, validates required inputs, and persists bounded run evidence. Missing and foreign-flow conversation identifiers now fail identically before any run write, while exact completed idempotent replay remains stable. Finish no-model, long-context, retry attribution, and live desktop/phone cases.

As a learner, I can browse installed courses, inspect a syllabus and progress, and continue the correct lesson without reconstructing internal ids.

Where it lives

courses-index, course-detail, course-learn.

Current evidence and next check

package-backed catalog, exact detail, progress, and learner-safe sessions are implemented. New work advances only that learner's saved lesson, exact retries cannot rewind it, and a removed or completed stale pointer falls back to the first incomplete lesson. Focused empty-catalog, multi-user, exact-retry, and stale-resume checks pass; complete the retained desktop and phone evidence before promotion.

As a learner, I can submit one activity answer and receive truthful feedback, including an explicit withheld result when structured grading is unavailable.

Where it lives

course-learn, dedicated attempt action.

Current evidence and next check

deterministic multiple-choice and model-backed written assessment preserve attempts and mastery evidence, while unusable or unavailable model output explicitly withholds the grade. Browser submissions now keep one idempotency key across uncertain failure and refresh, rotate it after edits or success, and cannot duplicate an exact retry. Focused retry, unavailable-model, structured-output, and adversarial-answer checks pass; complete retained phone evidence before promotion.

As a user, I can find due concepts and inspect definition, prerequisites, cross-course evidence, and multidimensional mastery without treating a score as a verdict.

Where it lives

concepts-index, concept-detail.

Current evidence and next check

first-class concept reads and evidence-backed mastery are implemented. The review queue now orders the oldest due deadline first with deterministic title/id ties, remains isolated per learner, and excludes concepts that have no review evidence. Focused deadline-order, multi-user, and sparse-evidence checks pass; complete cross-course and retained browser evidence before promotion.

As an authorized operator, I can import a validated portable course package or export its canonical package without bypassing integrity and learner-evidence protections.

Where it lives

Course package import/export.

Current evidence and next check

the operator-only gateway protects canonical imports and exports without revealing whether a requested course exists. Imports verify canonical hashes, references, concept conflicts, and evidence-protected replacements before writing. The portable schema now bounds every top-level record family, individual lessons to 32 activities and 128 content blocks, and whole packages to 512 lessons, 4,096 activities, and 16,384 content blocks; an over-limit operator import writes no course row, while both shipped 330-lesson packages remain valid. Complete cross-install provenance-chain and live large-transfer verification.

As an agent, I can bootstrap against live Forge onboarding and learn the exact entity catalog, fields, question flows, scopes, and route families.

Where it lives

/api/v1/agents/onboarding, OpenAPI, adapter bootstrap.

Current evidence and next check

OpenClaw, Hermes, and Codex require a live-onboarding handshake and treat its 87-entry catalog and specialized route maps as authoritative. Generated agent documentation now records the exact catalog entry count, expanded tool count, and SHA-256 identity; the release gate compares every documented field and manifest tool, then proves both packaged OpenClaw and Codex server runtimes contain the byte-equivalent catalog. Existing contract tests reject missing playbooks, adapter drift, invalid issue/subtask entity types, and route-family guessing. Complete clean-install handshake verification against the published packages.

As a user, I can ask an agent to add or update a record through natural conversation that gathers only missing or unclear information.

Where it lives

Entity question flows and plugin playbooks.

Current evidence and next check

all adapters now compute a missing-information diff, skip optional/default polish, read before narrow updates, preserve omitted fields, and act when no blocking ambiguity remains. Finish create/update/review/navigation simulations for every catalog entry.

As a user in Psyche, I receive therapist-like active listening and discussable hypotheses; in other domains I receive concise, structured guidance.

Where it lives

Psyche coaching playbooks and general entity playbooks.

Current evidence and next check

shared Psyche playbooks now retain the concrete episode and accepted/rejected wording, reflect specifics, offer one grounded hypothesis after a visible function, accept correction without defending it, and stop after consent. Finish scored simulations across every Psyche entity and difficult/distressed cases.

As an agent, I use batch CRUD for ordinary stored entities, action routes for workflows, and dedicated families for specialized domains without route guessing.

Where it lives

Onboarding route model, OpenAPI, MCP/plugin tools.

Current evidence and next check

Hermes now publishes dedicated Workbench paths and exact fields; complete negative tests across every route family and adapter.

As an operator, I can issue scoped tokens or use a trusted local/Tailscale operator session, see live agent sessions, rotate credentials, and revoke access.

Where it lives

Agent settings, token/session APIs.

Current evidence and next check

review-first tokens are genuinely read-only, mutation scopes are stripped at submission, and model credential tests require an operator session. Remote browser pairing offers an optional owner-created master password that is unset by default, locally administered, Argon2id-protected, rate-limited, and restricted to sender-bound non-operator browser credentials. Browser recovery now tries a surviving HttpOnly refresh cookie without depending on disposable browser storage, automatically tries discoverable passkey restoration before another pairing request, and requests one device-passkey verification immediately after the single approved pairing. A stalled post-pairing device-enrollment ceremony is bounded to fifteen seconds, and the already-approved browser-session fallback remains available throughout the attempt. Choosing the session-only fallback or leaving the pairing view invalidates that exact trust attempt, including while the registration-begin request is still pending, so a late response cannot start or complete durable device trust. Trusted-personal-assistant browsers carry ordinary work.read and work.write; existing generic read/write sessions derive only those non-sensitive scopes without re-pairing. Compatible browsers using the same credential provider and exact HTTPS relying party can restore only the original non-operator client, profile, scopes, installation, data-root binding, key, and security epochs; every restore requires user verification, authority drift revokes trust, and declining WebAuthn keeps the paired session usable. npx forge-memory ui also attempts the verified rollback-protected OpenClaw runtime transfer automatically when the live API lacks the current local-browser handler, while managed configuration drift still fails closed. A packaged OpenClaw-started server now derives its own package identity from the installed manifest, so Forge Memory can verify and adopt that recovered runtime without accepting an unverified process; source and development launches do not claim the packaged identity. Master-password setup now enforces only a transparent 15-to-128-character length boundary and matching confirmation. The settings card shows a non-blocking strength estimate, but does not reject a password because of its symbols, character mix, repeated text, product wording, or predictable sequences. The 45 focused browser/API checks, 31 runtime-ownership checks, packed-runtime identity regression, TypeScript check, and Strict Mode recheck pass; finish live same-device two-browser passkey acceptance plus the remaining bootstrap-budget, heartbeat, reconnect, rotation, and revocation matrices before marking the broader story Verified.

As an operator, I can install Forge Memory and connect OpenClaw, Hermes, Codex MCP, and Claude Code MCP to the same runtime.

Where it lives

forge-memory, OpenClaw, Hermes, Codex, Claude adapters.

Current evidence and next check

Forge Memory doctor now verifies the data root is a readable/writable directory without modifying existing contents, preservation markers survive doctor/update/uninstall smoke, and Hermes packages both conversation playbooks. Finish clean-host and current released OpenClaw/Hermes/Codex/Claude install matrix.

As a user, I can trust agent writes because the adapter reads back affected records and reports partial failure, generated IDs, and side effects.

Where it lives

Batch/action tools, operation results, verification paths.

Current evidence and next check

Hermes mutations report verification, partial failure, and unavailable read-back; complete mixed, conflict, stale-ID, and normalized-field checks.

As an operator, I can distinguish human and bot identity, ownership, source, session, and trust for every sensitive mutation.

Where it lives

User/agent settings, audit trail, auth headers.

Current evidence and next check

the operator directory now distinguishes humans, linked and unlinked bots, active and inactive lifecycle states, configured identities, fresh verified runtime sessions, actor labels, providers, and session counts. Deactivation disconnects approved primary-agent sessions, revokes their tokens, and blocks registration, heartbeat, event append, or reconnect until deliberate reactivation. Complete the remaining artifact, Psyche, and movement authorization matrix plus live runtime verification.

As a user, I can send slow asynchronous text, voice, or combined work to a default or selected connected agent and receive durable progress, acknowledgement, result, failure, or forwarding history without double execution.

Where it lives

messages-index, Agent Messages API/OpenAPI, OpenClaw/Codex/Hermes tools, sensitive voice Artifacts.

Current evidence and next check

owner-scoped inbox/outbox/detail and default routing, strict container-and-codec activation, first-class original voice Artifacts, atomic lease claims, generation fencing, actor-bound exact replay receipts, reassignment with lease revocation, complete forwarding/retry chains, box-specific keyset cursors with newest-unread Inbox activity and a frozen traversal horizon, reference-aware retention, and scoped agent tools are released at e0b1c3958b98a6f0c63f872639c51acf55c13dd1 under v0.3.64, hermes-v0.3.64, and ios-testflight-v1.0.174. Exact-SHA publication workflows, npm and PyPI provenance, isolated package installs, and TestFlight processing all passed.

As an operator, I can find runtime, data, user, calendar, mobile, model, agent, reward, wiki, log, and bin settings from one coherent index.

Where it lives

settings-index.

Current evidence and next check

all 11 settings destinations expose their exact names, descriptions, and routes; isolated desktop, 390 x 844 phone, and 200%-equivalent reflow checks pass with zero horizontal overflow, 44-pixel controls, and focus returning to the correct settings trigger after navigation.

As an operator, I can identify the active data root, create a backup, export data, and inspect recovery state without risking live data.

Where it lives

settings-data, Forge Memory export/doctor.

Current evidence and next check

backup archives/manifests use owner-only permissions, disclose credential-bearing sensitivity, publish atomically with the manifest last, clean partial failures, stream a SHA-256 checksum during creation, and verify that checksum before restore. The Settings Data page exposes the digest and explains reduced verification for legacy backups without one; mismatches stop before live data changes. Finish the disk-full matrix.

As an operator, I can review soft-deleted records and restore them before any deliberate permanent cleanup.

Where it lives

settings-bin, batch restore/hard-delete.

Current evidence and next check

Bin rendering and bulk restore or permanent-delete payloads are capped at 40, destructive confirmation copy matches the actual payload, entity filters expose their selected state and reconcile when records disappear, mutation failures remain visible, and successful mutations restore focus to the results summary. Complete the remaining entity and authorization matrices before verification.

As an operator, I can inspect bounded diagnostic logs and errors with enough context to recover without exposing secrets.

Where it lives

settings-logs.

Current evidence and next check

diagnostic reads are operator-only and redact credential-shaped values from every displayed context field, including legacy rows; storage enforces the published 14-day and 5,000-record limits, and the accessible export downloads only the currently loaded matching redacted rows with truthful partial-result feedback.

As an operator, I can manage human and bot users, relationships, ownership defaults, and visibility.

Where it lives

settings-users.

Current evidence and next check

Settings Users now separates active humans, active bots, and inactive identities; exposes trust, live sessions, ownership, experience, and default-owner routing; and provides a guided preview, transfer, deactivation, and reactivation flow. Lifecycle mutations are operator-only, atomic, audited, and exactly idempotent; inactive identities remain in history but cannot receive new work. Complete duplicate-identity reconciliation, relationship-direction edge cases, and live desktop and phone checks.

As an operator, I can configure available local or remote model providers, defaults, reasoning settings, and health checks.

Where it lives

settings-models.

Current evidence and next check

stored credentials are bound to their saved provider, base URL, and model; caller overrides require a fresh key, and health checks require an operator session. The settings page now explains missing-key and blank-model states, requires a fresh key after the stored target changes, clears stale health results after an update, and reports local-offline failure without claiming Forge switched connections. Complete the live provider and fallback integration matrix.

As an operator, I can inspect and repair iPhone/watch pairing and sync from the web app.

Where it lives

settings-mobile, settings-mobile-lab.

Current evidence and next check

ready/unavailable transports, expired codes, source reconciliation, bulk revoke, ambiguous response guidance, and atomic replacement rollback pass. Finish wrong-runtime, reused-code, reconnect, movement, and phone-sized matrices.

As a user, I earn XP and streak progress from truthful Forge activity and can understand the current progression state.

Where it lives

Overview, rewards APIs, settings-rewards.

Current evidence and next check

the complete package now covers owner-scoped payload idempotency, atomic ledger writes, bounded incremental reconciliation, canonical local-day rules, authorized asset installation, durable imagery, and acknowledgement-safe accessible celebrations. Focused API, migration, web, asset, typecheck, build, formatting, and live-health gates pass; independent post-implementation adversarial validation remains.

As a user, I can browse earned and locked trophies in a bounded Trophy Hall with visible real artwork.

Where it lives

rewards, gamification asset API.

Current evidence and next check

first-viewport featured shelf, locked fallback, bounded catalogs, and direct sprite serving are covered.

As a user, I can see Smith's current state, equipment, and progression imagery without broken or disappearing assets.

Where it lives

Overview Smith widget, Trophy Hall, armory assets.

Current evidence and next check

current overview and Trophy Hall paths pass. Trophy cards now fall back from the sprite to the preview and then to embedded, non-network forge artwork, preserving the real trophy name, description, unlock state, and theme styling when assets are unavailable. Complete the retained live desktop and phone promotion gate across themes.

As a user who prefers reduced motion, I retain the information and visual state without forced decorative animation.

Where it lives

Shell, signal deck, reward celebrations.

Current evidence and next check

reduced-motion rewards use zero-duration visual receipts, live announcements, safe timers, and a 44-pixel manual-dismiss control. Celebration, XP, and failure feedback now subscribe to live prefers-reduced-motion changes, including the legacy listener fallback, so an open animation becomes static immediately when the preference changes. Complete the retained live desktop and phone promotion gate.

As a user, I can pair the iPhone by QR and understand which runtime and transport I am authorizing.

Where it lives

Companion pairing, settings-mobile, Forge Memory pair-ios.

Current evidence and next check

fresh and expired code guidance, explicit Iroh/manual transport state, one-time payload copy, long-lived verification, revoke, and atomic replacement pass. Finish reused, wrong-runtime, and revoked-payload device checks.

As a user, I can connect over secure Tailscale/HTTPS or Forge's Iroh path, with manual HTTP only as an explicit choice.

Where it lives

URLSession, Rust Iroh bridge, discovery.

Current evidence and next check

test route separation, fallback, relay, timeout, captive network, and reconnection.

As a user, my pairing credentials remain in Keychain and are not exposed in logs, screenshots, or shared defaults.

Where it lives

iOS credential store and diagnostics.

Current evidence and next check

current and legacy diagnostics redact credentials during logging, decode, copy, and export; complete migration, reinstall, lock, and rotation checks.

As a user, I can grant or deny HealthKit, location, Screen Time, and background permissions individually and see what each enables.

Where it lives

Native permission onboarding and settings.

Current evidence and next check

test partial denial, later enablement, revocation, and explanatory copy.

As a user, I can import sleep, workouts, recovery, and vitals without duplicates and see backend acceptance/progress.

Where it lives

HealthKit sync and health APIs.

Current evidence and next check

test incremental anchors, overlapping sources, large history, retry, and date zones.

As a user with a large workout history, I can upload compressed, resumable chunks and continue after interruption without replaying accepted data.

Where it lives

Mobile upload session/chunk/progress APIs.

Current evidence and next check

benchmark large archives; test raw/zlib formats, resume, corruption, and partial ingest.

As a user, I can publish movement evidence with clear permission, retention, draft/review, and repair behavior.

Where it lives

CoreLocation, Movement sync, dedicated Movement API.

Current evidence and next check

test background gaps, low-power mode, privacy modes, travel, and duplicates.

As a user, I can sync Screen Time observations into Psyche only after the required Apple authorization.

Where it lives

Screen Time report extension and self-observation.

Current evidence and next check

test extension availability, denied access, category changes, and stale reports.

As a user, foreground and background sync are idempotent, resumable, observable, and battery-conscious.

Where it lives

BackgroundTasks, sync queue, backend receipts.

Current evidence and next check

direct uploads use a three-request window and background uploads remain serial. Content-addressed chunks, authoritative status reconciliation, a negotiated 24-hour replay-protected background proof, recoverable SQLite completion, pairing-bound sessions, and immutable completion receipts now cover delayed delivery, cancellation cascades, response loss, and duplicate finalization. Focused API and iOS tests pass, including a competing SQLite writer. Complete physical-device kill/relaunch, long suspension, battery, and network-transition evidence before promotion to Verified.

As a user, I can open the full Forge web experience in the companion and use native sync/settings controls without the two layers fighting for space.

Where it lives

Embedded web app and floating native control center.

Current evidence and next check

test safe areas, keyboard, rotation, theme, navigation, and offline behavior.

As a user or support operator, I can inspect pairing, transport, permission, freshness, and sync diagnostics and take a valid recovery action.

Where it lives

Native settings/diagnostics and web mobile settings.

Current evidence and next check

support diagnostics now redact current and legacy credential formats; complete each failure, recovery, and export scenario.

As an iPhone user, I can record and securely queue an Agent Message while offline, then let Forge retry it when connectivity and iOS execution time return without exposing notification content or promising an Apple background deadline.

Where it lives

Native Agent Messages inbox/outbox/detail/composer, CryptoKit queue, BackgroundTasks, Network, notifications.

Current evidence and next check

the AES-GCM queue, device-only Keychain key, stable retry identities, text fallback, immediate recording, status filters and opaque cursor paging, complete message chains, cellular policy, foreground/connectivity/background-task drain, generic notifications, and truthful waiting states are implemented. Eight focused tests cover queue/encryption failure, every ambiguous response phase, interruption/relaunch, protected-data and network truth, cursor queries, and notification privacy; the supported iPhone simulator build passes, and TestFlight accepted and processed Forge Companion 1.0.174 build 54. Complete physical-device suspension, termination, and long-transfer evidence before promotion to Verified.

As an iPhone user, I can install the public companion through a normal distribution channel after its sync, permission, privacy, and recovery contracts are verified.

Where it lives

App Store distribution, release metadata, iPhone verification gates.

Current evidence and next check

the native companion and signed archive, TestFlight, screenshot, and App Store submission paths exist. Public availability still requires Apple credentials, a successful signed submission, privacy metadata, and Apple review approval.

As a watch user, I receive a compact, fresh Forge snapshot whose age and source are visible.

Where it lives

Watch snapshot API and WatchConnectivity.

Current evidence and next check

snapshot age, stale, clock-skew, unavailable, and source states are explicit; complete payload-size and offline-transition checks.

As a watch user, commands use a secure direct HTTPS route first and the paired iPhone relay only when direct access is unavailable.

Where it lives

Direct watch transport and phone relay.

Current evidence and next check

direct/phone batches are bounded and continue after receipts; complete route-loss, handoff, duplicate, and recovery checks.

As a watch user, every outgoing command is stored durably and only appears complete after a Forge receipt.

Where it lives

Watch outbox and /mobile/watch/actions:batch.

Current evidence and next check

durable bounded outboxes clear only after receipts and preserve dedup history; complete crash, conflict, rejection, and queue-pressure checks.

As a watch user, I can review Now and the current actionable context without opening the phone.

Where it lives

Watch Now surface.

Current evidence and next check

stale, clock-skewed, and unavailable snapshots now lead with precise source/age guidance and a Refresh now action while cached Now/run cards remain swipe-accessible; fresh snapshots retain the original layout. Complete no-work, active-run, due-habit, attention, and offline-transition matrices.

As a watch user, I can start, heartbeat, complete, release, or move work with explicit receipts.

Where it lives

Watch Work surface and task_run actions.

Current evidence and next check

command receipts persist and deduplicate; complete competing-run, timeout, offline, and accidental-tap scenarios.

As a watch user, I can record positive and negative habit outcomes with clear Done/Missed and Resisted/Performed language.

Where it lives

Watch Habits surface, streak rings, habit.

Current evidence and next check

habit outcomes retain durable deduplicated receipts; complete day-boundary, correction, offline, and long-label checks.

As a watch user, I can inspect compact Goals and Today summaries without pretending the watch is a full planning editor.

Where it lives

Watch Goals and Today surfaces.

Current evidence and next check

test ordering, empty state, truncation, and deep link to phone.

As a watch user, I can inspect compact Health and Movement freshness and useful current signals.

Where it lives

Watch Health and Movement surfaces.

Current evidence and next check

test permission denial, stale sync, missing metrics, and privacy.

As a watch user, I can review Psyche prompts and Attention items and take only safe, bounded actions.

Where it lives

Watch Psyche and Inbox surfaces.

Current evidence and next check

verify sensitive-copy quality, privacy, snooze/dismiss eligibility, and handoff.

As a watch user, I can inspect and trigger Sync with truthful direct/relay/offline status.

Where it lives

Watch Sync surface.

Current evidence and next check

Sync shows snapshot source, freshness, pending count, and latest receipt; complete transport, retry, and stale-receipt checks.

As a watch user, I can quickly capture an emotion, trigger, routine, prompt, place, trip, workout, or note and review the backend receipt.

Where it lives

Watch quick capture and action envelopes.

Current evidence and next check

quick captures use bounded durable envelopes and visible latest receipts; complete every capture, dictation, ambiguity, and correction scenario.

As a watch user, I can launch Habits, Check In, Mark Moment, and Emotion from widgets or App Intents.

Where it lives

WidgetKit and App Intents.

Current evidence and next check

test locked phone, stale widget, intent failure, localization, and deep links.

As a new user, I can choose the outcome I want from Forge and receive a short first-run path that ends in a useful result rather than a tour of every screen.

Where it lives

Launchpad Outcomes, starter packs, progress and resume state.

Current evidence and next check

a new account opens Launchpad, can choose weekly planning, daily reflection, or research, review the exact starter pack, resume after interruption, skip the flow, and open its first created record. Complete live first-use testing with new users and permission-denied cases.

As a prospective user, I can try a safe public demonstration of Forge without installing it or exposing personal information.

Where it lives

Isolated demo gateway, per-session runtime, deterministic sample data, reset and abuse controls.

Current evidence and next check

the demo image creates an isolated temporary Forge data root per signed session, enforces capacity, lifetime, idle, request-rate, and body-size limits, blocks sensitive routes, and labels sample data. Hosting still needs an approved domain, TLS termination, runtime secret, cost controls, and an operational abuse response.

As a new user, I can import supported records from Markdown or Obsidian, Notion, Todoist, Apple Reminders, calendars, GitHub Issues, or Linear while preserving source provenance and reviewing conflicts.

Where it lives

Launchpad Import, source adapters, preview, provenance, receipts, rollback.

Current evidence and next check

Forge reads Markdown directly and bounded JSON exports for the other sources, shows every create-or-skip decision before an atomic import, preserves source identity, lists durable receipts, and can move records from one receipt to the bin. Complete real export-version fixtures and live partial-failure review.

As a user, I can opt in to privacy-preserving product feedback that records activation outcomes without sending record content, titles, paths, credentials, or stable device identifiers.

Where it lives

Launchpad Privacy feedback, strict event schema, local inspection, deletion and export.

Current evidence and next check

feedback is off by default, remains in local SQLite, accepts only six activation event names and bounded non-content fields, expires after 90 days, and can be inspected, exported, or deleted. Complete a live network-observation check proving the feature never opens a feedback transport.

As a desktop user, I can install and update a signed Forge package through a normal application flow without using a terminal, while keeping data location and rollback choices visible.

Where it lives

Tauri desktop packages, signature-pinned updater, data-root and rollback links.

Current evidence and next check

Forge can build Apple Silicon and Intel packages, requires signing and notarization credentials, creates signed updater artifacts, checks the pinned update channel in the app, reports download progress, installs, and restarts. Release still requires the real signing credentials and successful clean-install, upgrade, downgrade, and uninstall runs on both macOS architectures.

As a new user, I can start from a reviewed Forge setup for a concrete outcome and understand exactly which records, links, settings, and permissions it will add.

Where it lives

Starter-pack manifest, preview, scoped install, provenance, removal.

Current evidence and next check

Forge ships three first-party packs for weekly planning, daily reflection, and research. Each pack has a hash-bound manifest, exact record preview, collision report, atomic idempotent installation, durable provenance, install history, and explicit two-step removal. Complete live dense-account collision and interrupted-removal testing.

As a user, I can browse a trustworthy gallery of templates and integrations, inspect compatibility and permissions, and install only an explicitly reviewed package.

Where it lives

Launchpad Gallery, first-party metadata, compatibility, permissions, setup routes.

Current evidence and next check

the gallery lists the three Forge-reviewed starter packs and seven first-party integration entries with authorship, compatibility, permissions, review state, and setup action. Third-party publishing remains disabled until signing, moderation, reporting, update, and removal governance is implemented.

As an Android user, I can pair a companion, grant Health Connect permissions selectively, and synchronize supported health and movement evidence through the same provider-neutral Forge contracts.

Where it lives

Android companion, Health Connect, encrypted pairing and queue, WorkManager, signed bundle workflow.

Current evidence and next check

the native companion uses HTTPS QR pairing, Android Keystore encryption, no health category by default, explicit Steps, Heart rate, and Weight permissions, an encrypted 500-item queue, manual retry and discard, and truthful background-sync state. Complete a signed Android build, device-level permission and recovery tests, source-provenance comparison, and Google Play review.