$150 a seat a month. One price.

An application you can install

There is no installer, no menu bar and no notarized build, and buying a seat today does not hand anybody an app. There IS a local page: node apps/desktop/src/cli.ts serves the observing state, the stream, the day's record and all five hands on one screen, reading a directory on your own machine. It prints a URL and opens nothing. Underneath it are a Swift probe, a redaction library, a skill registry, a hand runner and a recall CLI, with 267 test files green on 12 September 2026.

A notarized Developer ID build

Reading the accessibility tree cannot be sandboxed, so the Mac App Store is closed to it and Developer ID with notarization is the only route onto an employee’s Mac. That needs a paid Apple Developer account. It is not an engineering problem and it is not solved.

The hands still waiting for a signature

A person read desk.collect on 13 September 2026, typed its id back and signed it, so it runs: it is the safest of them, reversible, asks nothing, and sends nothing off this Mac. The other 4 have not been read by anybody, so the registry refuses to load them and they print the field they refused on. That is the gate working in both directions rather than only in the one that flatters us — and the remaining 4 are a reading job nobody has been staffed for, not a feature nobody has built.

A model that reasons about the day

No model is in any of these paths. Classification is a heuristic scoring 25 right and 3 wrong on a 28-row labelled fixture, and where it is not sure the task type reads unclassified at confidence zero on purpose. That is deliberate — a frontier model got 118 of 270 rows wrong on the sibling project’s labelled set where the heuristic got 13 — but it means the reasoning tier is specified, priced and unbuilt.

An administrator’s console

There is no fleet deployment, no MDM profile, no seat assignment screen and no billing portal, so the honest description of a sale is still a spreadsheet. Two of the promises underneath it did stop being contracts: an administrator cannot put somebody on a seat — enrolment turns on who is asking, and the database refuses an enrolled seat whose invitation was never spent — and an administrator can neither grant nor cancel the confirmation an employee gives before anything acts. Those are mechanisms. The console is not.

A measurement that the hours are there

The case for it is 1.7 hours a month of somebody's time, and nobody has measured whether a thing that watches all day finds them. Not on one person, not for one month. The number has never been observed. Nobody should count on those hours before somebody has run it for a month.

An independent privacy review

Nobody outside the project has read the probe, the redactor or the serializer. Everything in the trust section is a mechanism you can make us run in front of you, not a review somebody else has signed.

Live payments

Checkout is not connected on this deployment — no Stripe key is set, so the deposit button opens no payment page and asks for no card. Taking real money needs an account this project does not have yet. The switch is one environment variable and it has not been thrown.

It reads text, and there is no path for a picture

The probe walks the accessibility tree and prints counts, roles and timings. In its report modes it never prints the text it read, which is why you can run it in front of somebody; --emit and --watch are the two modes that do put captured text on stdout, and --watch is the one the product runs. There is no screenshot code anywhere in the tree, and no field for a picture in the eight the serializer will accept.

Your account name is removed by exact match

The machine knows the account name, the home directory and the device name at runtime, so they are removed by exact match at full precision with nothing to tune — and that pass runs first, before any pattern. It was found the honest way rather than designed: a Terminal window title carried the developer’s own account name straight through a live run, and every one of the pattern passes had no opinion about it. A name is only a name if you already know it, which is exactly the thing the machine does know.

A password field is never asked for its value

The subtree is not entered, the secure check runs before any text attribute is requested, and a node that will not answer a subrole query is treated as secure rather than as ordinary. 9 gates in the probe are pinned structurally by an audit rather than by a test, because deleting one would break no test, fail no audit, and produce output that looks better — more nodes, more text, richer sketches. A regression that improves every number you are watching is the kind nobody catches.

One outbound serializer, with a key whitelist

Exactly one file may build the payload that carries your day off this Mac. It assembles from a dedicated struct and re-checks against an allowed-keys set that throws on an extra key and on a missing one; three of the eight are members of a closed vocabulary, three more are numbers, one is an HMAC of a key that never leaves the Mac, and the eighth is the sentence, so the only field that can hold screen text is the one the redactor produced; and a leak guard refuses any field sharing a twelve-character run with the text before redaction, any field still containing something the redactor removed, and any field that still holds a URL, an email address or a key. The eight keys printed on this site are that constant.

A hand cannot widen its own permissions

The runner refuses a write to the directory that decides whether hands may run, so a skill cannot write its own approval, and it refuses a resource that looks remote to any skill declaring outboundReach: none. Both refusals are structural: they are checked before the step runs, and the reason is printed. Read outboundReach narrowly, though: it is about the resources a hand claims, not about the words it read. Whether those leave is a second field every manifest has to declare, and the two hands that do declare it — reply.draft and mail.send — say so in their own row above.