Operate from verified project state.

One typed registry owns project identity, workspace authority, GitHub mapping, venture relationships, and client-pilot capacity.

Private mode reads registered roots only and caps folders, files, bytes, snippets, Git metadata, and execution time.

A shallow scan reconciles the configured workspace root with the registry and reports missing, outside-root, and unregistered projects plus activity heartbeats.

Project notes, decisions, and lessons stay in the external private Markdown vault; Studio OS retrieves bounded metadata and excerpts without copying the vault into Git.

The private RAG endpoint reconciles a local Ollama embedding index on every query, reuses unchanged vectors, and removes notes that left the vault; UI wiring is still pending.

Private mode reads deployment URLs from vault frontmatter and performs bounded HEAD-to-GET liveness probes; it has no deploy authority.

The organization adapter turns review, unassigned-issue, and stale-branch evidence into proposals. Comments, assignments, merges, and deletion remain human actions.

One private route gathers the workspace map, selected scan, ranked snippets, linked vault metadata, risk gates, proof targets, and handoffs into a deterministic mission pack.

Only declared npm typecheck, lint, test, and build scripts can run, after nested lifecycle scripts are inspected and credentials are removed from the subprocess environment.

Browser state records plans, proof, reviews, and run traces. Only human-reviewed useful or shipped traces can enter the explicit private JSONL export.