Skip to content
CLEPSOdocs

Project / Progress

Progress // 59/75

Every increment, in build order, straight from the project roadmap. Each one names how it is built and the evidence that proves it works; an increment is done only when that proof exists.

Every increment

59 of 75 increments done · 79%
DoneIn progressWaitingNot started
M0: Foundation
6 of 6 done
M1: macOS vertical slice
6 of 6 done
1.7 Details, Stats and redesign
7 of 7 done
1.8 UI refinement
8 of 8 done
1.10 Dashboard restructure
32 of 37 done
M2 to M4
Sequenced

Milestones

Each lane spans its increments in build order; the fill is the share done.

M0: Foundation
6/6
M1: macOS vertical slice
6/6
1.7 Details, Stats and redesign
7/7
1.8 UI refinement
8/8
1.10 Dashboard restructure
32/37
M2 to M4
0/11

Path of progress

2.0

Accounts and web dashboard

ACCOUNTS_AND_SYNC.md: step 1 (schema, row-level security, delete) and step 2 (Mac sign-in by email link, hourly upload) done; step 3 web dashboard at /app (dd5bc6f) and upload on quit (0b5ff72) done; every web notice escaped (d9058a3); hosted project renamed "clepso" (same ref) with the founder's go 19 Oct; Apple/Google/GitHub need provider setup

Arrow keys move along the line.

By status

1.10 Dashboard restructure5 of 37
  • 2.0Accounts and web dashboard
  • 2.5One-tap Calendar (merged 18 Oct; hidden until release, never tried in a real Calendar)
  • 4.1Signing and notarization
  • 4.2iPhone, Watch, widgets: feasibility
  • 0.7bREADME screenshots (PR #7)

In detail

Open a milestone for how each increment is built and the proof it works.

M0: Foundation

6 of 6 done
#StatusIncrementHow it is builtProof it works
0.1DoneDomain, ShimProtocol, StorageTypes from DATA_MODEL; field allowlist and frame from the shim spec §6; schema v1 generated from DATA_MODEL §325 tests: absent ≠ 0, no path leaks, hostile input scrubbed, frame ≤ 4 KiB, dedupe index, absence checks
0.2DoneStatus-line helper: StatusLineShim library + clepso-statusline executableRead stdin (1 MiB ceiling) → start the user's original command with the raw bytes → build the frame → non-blocking socket send with deadlines → forward the child's exit status. Signals forwarded. No disk writes, no networkIntegration tests with a temp home and a fake socket: output byte-identical to running the original alone, exit status forwarded, works with the app absent or hung, own line when there is no original. Overhead measured over 200 runs (p50/p95/max) against the 20 ms p95 / 50 ms budget (ADR-003). otool -L shows no networking frameworks
0.3DoneFixture corpus and contract harnessTestFixtures target holding F01–F19 in the docs/fixtures/README.md format (11 active now, 8 deferred to the stage that owns them); a harness that feeds stdin through the real shim and compares against expected.json; lint for the corpus. The scrubber for captured files moves to 0.6, where the first capture needs itEvery fixture's expected.json matches byte for byte; lint finds no path, email or secret
0.4DoneSettings installer and uninstallerSpan scanner that edits only statusLine.command; byte backup; compare-and-swap; atomic rename; verify; rollback; the install-state machine and recovery (shim spec §3); wrapper script generationInstall → uninstall byte-identical (SHA-256) across the odd-file corpus (BOM, CRLF, no trailing newline, missing file); surgical restore when the user edited in between; refusals leave files untouched. All in a temp home
0.5DoneLocal CImake ci: build with warnings as errors, all tests, otool -L, fixture lint, Date()-in-Domain grep. GitHub Actions lanes A and B are added when the repo is pushedOne command, green, output pasted
0.6DoneFirst real capture (gate); runbook in docs/runbooks/0.6-first-capture.mdInstall into your real Claude Code with backup (0.4), capture one session in debug-record mode, scrub it into C01, and update CAPABILITY_MATRIX tags from [I] to [V]; zero-token proof per shim spec §7A real frame from your Max account; uninstall restores your settings byte for byte; token counters unchanged across idle refreshes

M1: macOS vertical slice

6 of 6 done
#StatusIncrementHow it is builtProof it works
1.1DoneSocket listener and ingestIngestSocket actor: bind, peer uid check, 20 frames/s, 4 KiB cap; Ingestor maps a frame to observations (session-to-pool resolution, DATA_MODEL §5)Spoof, oversize, replay and symlink tests; F06 yields absent observations, never 0
1.2DoneUsage engine and storePure reducer (latest-wins, dedupe, freshness, windows); Store actor runs insert → reduce → snapshot in one transaction per frameF08 shows 83, never 163; rebuild from the ledger is byte-identical; out-of-order samples never win
1.3DoneDesign systemTokens, ValueState/CardState, status style table, the first six components, previews per fixtureContrast test ≥ 4.5:1; no state differs only by colour; lint finds no literal colours
1.4DoneApp shellXcodeGen project.yml; MenuBarExtra popover, provider detail, provenance inspector, plan picker, settings, onboarding and consent; login item after consentApp launches from the built bundle; popover opens under 200 ms p95; demo data always badged
1.5DoneDiagnostics, export, delete-allRedacted log drawer, JSON export, delete-all that also restores settingsNo allowlist-external field in DB, logs or export; delete-all leaves nothing behind
1.6DoneLive demo gateYour real Claude Code session drives the menu barScreenshot: 5-hour and 7-day usage, reset time, model, context, each with source and freshness

1.7 Details, Stats and redesign

7 of 7 done
#StatusIncrementHow it is builtProof it works
1.7aDoneSession detail dataAllowlist + durations and lines (A4 amended); prompt cache, output tokens stored; value kinds count/duration/flag; migration v2 with backupOracle-generated fixture rows match; migration keeps every row (negative control); canary still clean
1.7bDoneVisual conceptFounder references: Matrix, Tesla Roadster, frosted-glass panels, the Kafaadami pixel UI pack (style reference only; paid asset, not copied). Pixel fonts under SIL OFL, pinned and bundled; pixel bars, bevelled pixel buttons, glass panels, as Theme tokens and componentsConcept board rendered from real components, approved by the founder before rollout; contrast still ≥ 4.5:1
1.7cDoneHistory and paceTime series per pool from the ledger; pace estimate (least squares over the current window, only when rising with enough points), always labelled an estimateUnit tests: flat, rising, reset inside the window, too few points
1.7dDoneClaude Code stats readerReads ~/.claude/stats-cache.json (undocumented format) through an allowlist: daily activity, daily tokens per model, per-model totals, sessions, messages, longest session (never its session id), hour counts. Opt-in switch in Settings; on for the founderFixture of the file's shape; unknown keys ignored; session id never stored; missing or changed file degrades to "not available"
1.7eDoneDetails windowLimits with history and pace; session (model, context, tokens, cache, cost estimate, durations, lines); per-model split by main model (labelled)Screenshots; VoiceOver labels; Dynamic Type
1.7fDoneStats viewOverview (heatmap, favourite model, totals, sessions, active days, streaks, longest session) and Models (tokens per day per model, shares); All time / 30 / 7 daysValues match /stats for the same day
1.7gDoneRedesign rolloutPopover, detail, inspector, Settings, onboarding in the approved styleScreenshot review, probe timing ≤ 200 ms p95, contrast and design-token CI checks

1.8 UI refinement

8 of 8 done
#StatusIncrementHow it is builtProof it works
1.8aDoneReadabilitySentence text in a monospaced system face at body 13 pt and callout 12 pt (macOS caption/footnote are 10 pt, so the first pass still fell short); stat values always outrank their captions; no squeezed or truncated text (fixed-height stats and rows); one DEMO tag per screenReadableTextTests (12 pt floor, negative control fails at 10 pt); screenshots
1.8bDoneAccuracyContext tokens labelled as context, not session totals; by-model grouping on cost, lines and timeTests on the projection
1.8cDoneNavigationDetails window sidebar (Usage › Limits, Session; Stats › Overview, Models); section title, one-line explanation and its controls in a fixed headerScreenshots; keyboard reachability not yet checked with Full Keyboard Access
1.8dDoneLimits chartWindow-true time axis, 0–100 scale, 80/95 bands, filled step line, NOW at its position, hatched "not watching yet" span, dashed pace; edge labels kept insideCalendarAxisTests (window, ticks); screenshots
1.8eDoneOverview calendarAll time: January–December year sized to the window, year switcher, "no data" outlines, legend, per-day tooltips; 30 days: month calendar with day numbers and message counts beside tokens per day; 7 days: a column per day; hour-of-day chart with hover readoutCalendarAxisTests; screenshots of each range and the previous year
1.8fDoneModelsChart: tokens per day (per week past 120 days) stacked by model on a real date axis with zero days, round scale, hover readout, colour + pattern legend. Arena: a pixel character per model family; level from all-time output tokens on fixed 1-2-5 targets (1K, 2K, 5K…; founder review: levels from total tokens doubling were unreadable and mostly counted cache re-reads), bar labelled "progress to LV n · output / target", ranked by level; specialty relative to all models; tokens by kindModelsViewTests (scale, levels, specialty, sprites); screenshots; Reduce Motion stops the idle bob in code, not yet run with the setting on
1.8gDonePopover spacing20 pt between blocks; session figures two by two; pace estimate wrapsScreenshots; probe opens p50 57–79 ms
1.9DoneAgents per taskHelper hook mode (allowlisted frame: event, HMAC session and agent refs, built-in type or "custom"; always exit 0, silent); HooksInstaller adds four async hooks byte-for-byte after the user's own and removes only them; migration v3 (agent_tasks, agent_runs); Session page panel and popover line; opt-in in Settings › Providers with the exact entry shown (DECISIONS C8)HookModeTests (canary in every content field), HooksInstallerTests (corpus round trip, coexisting hooks, surgical removal, refusals, command never fails), AgentTasksTests, AgentsTests (end to end, delete-all); screenshots. Waiting: live check on the founder's real settings needs a fresh go

1.10 Dashboard restructure

32 of 37 done
#StatusIncrementHow it is builtProof it works
1.10aDoneNavigationSidebar: Home, Usage (Limits, Session), Stats (Overview, Models, Card), Goals, Account, Settings; version under the name; plan badge pinned at the bottomScreenshots
1.10bDoneHomeGreeting, running total with today's change, both limits, latest task, goals at a glance, one contextual promptTests on the projection; screenshots
1.10cDonePlayer cardShareable pixel card: name, first session, plan, milestone stamps, output total, named level and progress, four stats; copy image, save PNG, shareTests on milestones and level names; the saved PNG
1.10dDoneGoalsActive days per week, 5-hour peak under a target, 7-day finish under a target; progress and streaks; stored locallyTests on goal evaluation
1.10eDoneAccount and Settings in the windowProfile (name), plan, year calendar; sign-in card (ACCOUNTS_AND_SYNC, not yet active); settings as pixel rowsScreenshots
1.11DonePanel and icon (founder review)Menu bar panel 580 pt wide and ~40% shorter; one DASHBOARD button; Settings moved into the Dashboard; the approved pixel menu bar icon builtScreenshots; icon shapes tested
1.12DoneLayouts from Mobbin picksEvery page re-laid out after the founder's 18 picksScreenshots
1.13DonePixel icons and light mode53 pixel glyphs replace every system symbol (CI gate); Phosphor light; Appearance: System/Light/DarkGlyph and contrast tests (4.5:1 both modes)
1.14DoneOne page structureAll pages in the Account page's structure (founder's model): sections with name and line on the left, content rightScreenshots, dark and light
1.15DoneThemes and premium detail pass (founder request)Phosphor, Amber, Cobalt, Orchid, Graphite, each dark and light, chosen in Settings; one action bar per panel page; figures instead of sentences; pixel sheets and onboardingTheme contrast tests (4.5:1, every theme × mode); 280 probe captures
1.16DoneClepso identity in the app (founder request)Clepso Pixel and Clepso Mono replace Silkscreen and the system mono; the brand mark in the menu bar ring; first app iconFont resolution test (no substitution); probe screenshots; menu bar icon rendered from code
2.0In progressAccounts and web dashboardACCOUNTS_AND_SYNC.md: step 1 (schema, row-level security, delete) and step 2 (Mac sign-in by email link, hourly upload) done; step 3 web dashboard at /app (dd5bc6f) and upload on quit (0b5ff72) done; every web notice escaped (d9058a3); hosted project renamed "clepso" (same ref) with the founder's go 19 Oct; Apple/Google/GitHub need provider setupmake backend-test (16 pgTAP), SyncClientTests, AccountSyncTests; anonymous access refused on the live API
2.1DoneLimit alerts (founder items 1–10, 18 Oct)80 / 95 / 100%, reset expected, ready again, snooze, alerts too old to be news dropped (24a1d6d, b7c9e0a)AlertPlannerTests, TimeTravelTests
2.1qDoneQuiet hours (18 Oct night)QuietHours (minute-of-day span in the current zone, crosses midnight, off by default); during it 80/95% wait for one digest at the end, everything else arrives without sound; Settings › Notifications FROM/TO in 30-min steps (00c3e64)QuietHoursReminderTests, TimeTravelTests.quietHoursDigest; probe screenshots dark and light
2.3DoneReset reminders (18 Oct night)ReminderPlanner: one request per pool at resetAt − lead (5/15/30/60 min, off by default), identifier carries the window not the reset time, reconciled with the notification center every tick, 64 nearest first; B11 as decided (no age TTL). The reset_schedules table is not written: the pending list is the schedule (00c3e64)QuietHoursReminderTests, TimeTravelTests.resetReminders, .remindersAfterNinetyDays, .reminderAcrossDaylightSaving. Not yet seen from a real macOS notification
3.4bDoneCodex everywhere (items 2 and 4)Menu bar % takes the highest of both agents; Stats › Overview tokens per day; Codex agents per task (2db559b, 4eccc84, 7184449)CodexOverviewTests; live on the founder's Mac
1.18DoneMenu bar states, popover speed, keyboard and Reduce Motion (items 7–9)Brand-kit state family (7eb3477); cached formatters and launch warm-up, first open ~110 ms (e968cb6); pixel focus ring, arrow keys in charts, ⌘, (07c3716)Probe timings; A11Y_CHECKS.md (founder's 2-minute hand check pending)
3.4DoneCodex limits (founder request, 17 Oct 2026; docs/MULTI_AGENT.md)CodexAdapter: reads only token_count events (5-hour and weekly used %, reset, plan) and the model from the tails of the newest ~/.codex/sessions files; prompts are never decoded. Store: an account and connection per agent. Opt-in Settings switch; Codex section in the panel and LimitsCodexAdapterTests (canary never leaks, absent ≠ 0, tail-only read), MultiAgentStoreTests (side by side, rebuild, unknown connection refused); real-file run 47 ms; CodexOverviewTests; probe screenshots of the panel, Limits page and Settings with a synthetic ~/.codex. Not yet observed live on the founder's Codex: needs the Settings switch turned on
2.4DoneTime-travel harness (merged 18 Oct, b7c9e0a)TimeTravelTests: the real app model, store, reducers and alert planner on a test clock with real helper frames: London both DST changes (F17), New York both ways, zone change with relaunch (F16), 90 days idle, 90 days quit, a weekend asleep, clock back 90 s and back across a passed reset. Found and fixed three bugs: reset times kept the old zone until relaunch (TimeZone.current snapshot → auto-updating); times ignored the 12/24-hour convention (fixed h:mm a → locale skeletons; en_GB now "Resets Sun 01:30", "1 Nov"); a reset passed during sleep was announced days late (per-kind age caps 10/15/30 min, stale_dropped receipt, one alerts.expired Diagnostics line)10 harness scenarios, AlertPlannerTests.tooOldIsExpiredNotShown, TextTests.clockConvention; make ci-contributor exit 0, 309 tests
2.5In progressOne-tap Calendar (merged 18 Oct; hidden until release, never tried in a real Calendar).ics route: CalendarFile (RFC 5545: UTC instants, CRLF, 75-octet folding, alarm at the reset, never busy, one UID per reset instant); Add reset to Calendar on Limits for weekly windows only (B9), opens Calendar, which asks before adding; nothing created by default; hidden in Stage A behind calendarActions (debug -ClepsoCalendarActions YES). EventKit write-only is a release decision (calendars entitlement under hardened runtime), see code docs/RELEASE.md §5CalendarFileTests (golden file, folding, escaping), CalendarActionTests (nothing by default, weekly only, one file and one open); probe screenshots of Limits with the action on and off. Not yet done: importing a generated file into the founder's real Calendar (it would add an event)
4.1In progressSigning and notarizationRunbook in code docs/RELEASE.md: archive, Developer ID export, signature checks, notarize, staple, DMG, release gate. The Developer ID Application identity is now in the keychain (A6 done); notary credentials not set up; bundle id com.elvisobi.clepso (A7 decided 18 Oct)Nothing run yet: the runbook says so
4.2In progressiPhone, Watch, widgets: feasibilityCode docs/APPLE_PLATFORMS.md. Compiled 18 Oct: Domain, UsageEngine, Storage build for iOS and watchOS simulators; DesignSystem builds for iOS, fails on watchOS (onHover). Data lives on the Mac, so the phone reads through the accounts backend; Mac widgets first from an App Group snapshot fileThe four xcodebuild results above
0.5bDoneGitHub Actions CI (PR #4, 18 Oct night).github/workflows/ci.yml: contributor-mode quality gates and a SwiftPM build and test job on every pull request and push to main; read-only token, no secrets, every action pinned to a full commit SHA; GitHub's xcode-27 image (Xcode 27.1, 27A9275). dependabot.yml keeps the pins and Swift packages current (150e5ee)Both jobs green on PR #4 and on every PR since; Dependabot 0 open alerts (19 Oct)
0.5cDoneCode scanning with Swift (PR #5, 19 Oct).github/workflows/codeql.yml advanced setup: Actions, JavaScript/TypeScript, Python and Swift (manual swift build). CodeQL supports Swift up to 6.3, so the Swift job builds with Xcode 26.6 on macos-26 for analysis only; make ci and ci.yml keep Xcode 27.1. Uploads from main only; default setup switched off (707fe7c). Runs on main always finish, only a newer pull-request push replaces a run (3c48f17)11 Swift alerts (swift/cleartext-storage-database on Store.accountID, a local random UUID) dismissed as false positives with the founder's go; code scanning 0 open (19 Oct)
0.5dDoneGitHub settings and web notice escaping (19 Oct)Applied with the founder's go and read back: squash-only merges (PR title and body), delete branches on merge, GitHub-owned actions only with SHA pinning, approval for all outside contributors; recorded in GITHUB_SETTINGS.md. CodeQL's js/incomplete-multi-character-sanitization in app.js: not exploitable, but notice() now escapes its text and the regex is gone (d9058a3)Settings read back from the API; CodeQL JavaScript clean
0.7DoneREADME rewrite (PR #6, 19 Oct)Header lockup, badges and website links; what it does with screenshots; private by design; how it works; design system; docs; get started; quality gates (14); licence and trademarks; contributors. Facts corrected against main: alerts, quiet hours, reminders and the web dashboard are built (4bb2986)scripts/ci.sh --contributor exit 0; every link and image checked; rendered light and dark
0.7bWaitingREADME screenshots (PR #7)Screenshots from the current app and the new Models screenAll six checks green; waiting for the founder's merge
1.19DoneMenu bar stale mark and crisp % (19 Oct)The stale mark follows the cards behind the shape: the flatline or approaching glyph opens its ring when none of the limits behind it has a live reading (a two-day-old Codex weekly flatline beside live Claude Code was shown plain). The % text is drawn aliased, hard pixels at 1x and 2x (382e60c, merge 6348de3)MenuBarStateTests (the live Codex case as a regression fixture), PixelMenuBarIconTests.textOnTheGrid
1.20DoneCodex provenance and reading fixes (founder report, 19 Oct)Inspector shows Codex's own source, reader, field and version (cli_version from the session file's first line); the reader lists every day folder of the last 8 days, so the newest reading is caught (36% was missed for 35%); only Codex's own allowance counts (other limit_id buckets ignored); a null window is left out; stale cards wrap instead of truncating and drop a passed reset line (b348d4c, merge 4453ebb)Regression tests on synthetic rollout files and projections; make ci green
1.21DoneAgents panel: running now (19 Oct)A "Running now" card lists every subagent with no stop yet from any task (type, starting task, time running; "Last seen" after 10 quiet minutes; stops counting 6 hours after start); readable type names (Explore (research), Plan, General…); latest-task card layout. Helper allowlist unchanged (0a15fd7, merge d601d19)AgentsTests, AgentTasksTests (injected clock); probe screenshots (-ClepsoProbeAgents)
1.22DonePixel bars and pixel bar charts (founder review, 19 Oct)Progress fills follow the frame's stepped pixels (PixelSteppedRect); every bar chart (Home 30 days, When you work, tokens per day incl. Codex, Models) drawn by one PixelColumns on whole pixels (75b89e0, merge 12ba130)PixelGridTests: layout, and no anti-aliased shades at 1x and 2x
1.23DonePixel activity calendar (founder review, 19 Oct)Each day a pixel tile whose level is pixel density (~20/55/80/100 % lit), "no data" as the tile's outline, whole-point squares and gaps; the year switcher runs from 2025 (or an earlier first session) to today's year (2d831f9, merge 847fd24)PixelDensityTests, CalendarAxisTests (years from 2025)
1.24DoneMenu bar decisions (DECISIONS C10, 19 Oct)Flatline only for a window that hit its limit (an idle window past its reset counts as an old reading); no % beside the flatline; the % is the highest live % among the cards behind the shape, none when they are old; "· last seen {age}" whenever the shape comes from old readings. Alerts unchanged (5abb1db, merge 65875f3)MenuBarStateTests; the no-% rule locked by a test
1.25DoneApproved custom agent names (DECISIONS C8 amended, 19 Oct)Exact-match allowlist in Settings › Claude Code (1–40 of A–Z a–z 0–9 _ -, at most 50); the helper sends a custom type verbatim only if approved, else "custom"; the app re-checks; schema v4 (live database migrated with backups first); removal relabels history to "custom"; approved names don't sync (4651679, merge d3bf40d). Frame: docs/specs/hook-frame.mdFrame gate, helper with approved, unapproved and malformed lists, migration v4, sync folding, hook canary through the real helper into the database, export and log
1.26DoneModels redesign (founder's pick, 19 Oct)Stats › Models as roster + dossier (proposal A) from the founder's five Mobbin references (03, 05, 09, 10, 14): ranked roster with one keyboard stop, dossier with token kinds and the level card, level track 1–20, how-to-level-up cards; shares to one decimal (ab491d2, merge d21712e)ModelsRoster tests for ranking, selection, zones, track and activity, and for every fact the old page showed
1.27Done30-day calendar band (founder review, 19 Oct)Figures on the tile's plain ground, level as a pixel band in the bottom rows: no cut-out box; count in a 4.5:1 token (46d50bb, merge cddb2cf)PixelDensityTests, CalendarAxisTests; year, legend and 7-day views pixel-identical before and after
1.28DoneEvery Dashboard page fits the 1100 pt minimum window (19 Oct)Root cause: the pane took its content's width as its minimum, so a calendar fitted to a wider window never shrank back; pane minWidth 0, same fix in FittedCalendar and the Models track; Settings theme swatches wrap; Card actions two to a row (22cf598, merge e73a59b)30-day geometry at the minimum window for every theme and at any width; probe -ClepsoProbeFromWidth

M2 to M4

Sequenced; detail is written when the milestone before it closes
#StatusIncrementBuild approach in one line
2.2PlannedReset expected / Available againReducer guard G6 only; property test that "ready" never appears without a fresh reading
3.5PlannedGemini CLI limits and usage (founder request, 18 Oct 2026)Study what Gemini CLI records locally (session logs, telemetry, quota responses) on a machine that has it; reader + adapter like 3.4; opt-in switch
3.6PlannedGrok (founder request)Same pattern once a Grok coding agent with local records is identified; otherwise dated manual snapshots (3.2)
3.7PlannedCursor (founder request)Cursor keeps usage on its servers; the local ai-code-tracking.db holds no limits (checked 17 Oct). Options: manual snapshot, or its documented usage API if one exists, with the user's consent
3.8PlannedGitHub Copilot (founder request)Copilot's quotas live on GitHub; study the documented billing/usage API and the VS Code extension's local state
3.9PlannedWindsurf (founder request)Study Windsurf's local state on a machine that has it; same adapter pattern
3.1PlannedPlan catalogSubscriptionCatalog decoding the signed seed; plan never inferred from usage
3.2PlannedManual snapshotsDated user-entered values for Codex, Gemini, Claude web, ChatGPT, Grok, labelled "entered by you"
3.3PlannedCodex and Gemini spikesProbe documented structured outputs only; stay manual unless a stable interface exists
4.3PlannedRelay and pushTwo-day CloudKit spike first, then the encrypted relay if rejected
4.4PlannedAnnouncements feedRules-first, human-reviewed allowlist, no LLM in v1

The map

M0 FOUNDATION                         M1 MAC VERTICAL SLICE                   M2 STATE & SCHEDULING
0.1 Domain · ShimProtocol · Storage ✓ ─┬─ 1.1 Socket listener + ingest ✓┐      2.1 Threshold + notification engine
0.2 Status-line helper (the shim) ✓ ───┤  1.2 Usage engine + Store ✓───┤      2.2 Reset expected / ready again
0.3 Fixture corpus F01–F19 + harness ✓┤  1.3 Design system ✓───────────┼─► 1.6 LIVE DEMO GATE ─► 2.3 Reset reminders
0.4 Settings installer / uninstaller ✓┤  1.4 App shell (menu bar) ─────┤      2.4 Time-travel harness (DST, 90-day)
0.5 Local CI script (+ GitHub later) ✓┤  1.5 Diagnostics, export, delete-all  2.5 One-tap Calendar (P1)
0.6 FIRST REAL CAPTURE ✓ ──────────────┘
                                                                         M3 MORE PROVIDERS        M4 ECOSYSTEM
                                                                         3.1 Plan catalog         4.1 Signing + notarization
                                                                         3.2 Manual snapshots     4.2 iPhone, Watch, widgets
                                                                         3.3 Codex / Gemini spikes 4.3 Relay + push
                                                                                                  4.4 Announcements feed