ATLASS OS · Consulting · prepared for Eagle Builders · 14 October 2026
“From a list of operational requirements and potential automation ideas to enterprise grade software in weeks. (Given enough RAM, fast enough cpu's and API credits)”Dave · the thesis, in his own words · 2026-10-14
Dave owns and runs Right Side Roofing in Alberta (est. 2014). Since 24 June 2026 he has directed an AI engineering organization that built ATLASS OS, an operating system for a trades business, with real double-entry books, and FieldOps, its Android field app. You are buying two things: that operating system, and the method that built it (the org runtime, the FFA machine and the gates).
main (each one a deploy)Sources git rev-list / git log on iterating and main · server/generated/routes.ts:2 · tool-inventory.mjs 2026-10-14 · ls static/__dev/releases · proof sheet §01
One scan becomes one event. The device reports who, where, when, which piece and which stage. The server checks that against the stage the piece should be in and writes an append-only audit row. A second scan with the same device key replays the first result and writes nothing. In the normal case nobody types anything.
Arithmetic on your own numbers: a piece that passes 100 scanned stages carries up to 200 hand-typed lines. These are your figures, not mine. Discovery measures the real error rate and time per scan before anyone quotes a saving.
Sources the prospect's own description, relayed 2026-10-14; not verified by me · proof sheet §02
“I run a roofing company, and for years I ran it on QuickBooks, a stack of spreadsheets, and a few apps that never talked to each other. I was losing leads in the cracks and typing the same job into four places.”Dave · roofer-to-developer memoir · 2026-08-12
The market comparison. For a 4-person roofing crew, the stack this replaces (Jobber + QuickBooks Online + QBO Payroll + a phone app) lists at about CA$370–430 a month. That is third-party list pricing researched 2026-07-13, not Right Side Roofing's invoices; no invoice-level saving is on file. ATLASS's own price is read from one catalog at runtime and is never typed into a document. That is one of my floors. Your 12 subscriptions and 60–150 seats need their own count, and that is discovery question 1.
Sources memoir line 67 · competitive-pricing-comparison-2026-07-13.md · ORG-PUNCH-LIST PL-782 (:9048) · fieldops-crew-timesheet-doctrine-2026-09-28.md · db/init/98-phone-spam-blocklist.sql · proof sheet §03
It bends around how your crew already works, and keeps what would otherwise fall through the cracks. Dave's words: “dynamic, learning and working around the humans, filling in the gaps where information can slip.” Below: three things glued apps structurally cannot do, because they don't share a database. No speed-up is claimed.
A receipt photographed on the phone becomes an OCR'd, geocoded, reviewed AP entry in the right project's ledger. OCR runs on an owned GPU.
A call is named at once by Layer 1, recorded with consent into the tenant's own storage, transcribed, and put on the same timeline the foreman sees on the roof.
Leaving home, picking up the crew, arriving on site: the foreman's day becomes time events without typing, and the payroll that pays him is in the same database.
| # | The OS, lead order | Status today | Evidence |
|---|---|---|---|
| 1 | ACAT memory: every channel on one append-only timeline (phone too), recordings with speaker turns, pipeline map by day | Built 3D view planned | PL-908 (28di) · PL-1091 (28dy) · PL-812 (28do) |
| 2 | Real books + payroll under the CRM, self-certifying; T4, T4A, ROE, WCB, remittance | Built, on prod | money-invariants.mts · endpoints/payroll/* · 28dp–28ds |
| 3 | Every screen has a door your AI can use, with parity by rule | 217 tools | 1,113 Parity lines · tool-inventory 10-14 |
| 4 | Crew time events from GPS checkpoints → payroll | Built Crew-day sheet: PL-768 | PL-766/767/769/788 |
| 5 | The S.I.M.P.L.E. Phone System: recording, transcription, caller naming, SMS from FieldOps | Built | PL-565/571/574 · PL-907 (28cp) |
| 6 | Relationship graph + sentiment propagation into the review gate | Built Prod nightly unverified | sentimentDiffusion.tsx |
| 7 | Overhead: drone/phone photos → roof-and-wall measurements → Xactimate-ready PDFs | Door built Accuracy study pending | PL-942/943 · 28dy viewer |
| 8 | Boards: PM kanban, planned vs actual | v1 | PL-1082 (28dy) |
| 9 | Consent-filtered audiences from the same memory; retargeting tiers, GA4-linked; nothing pushed to an ad platform | Built | PL-687 · PL-996 · PL-999 |
| 10 | Agentic C-suite (slide 14) | Coming soon | AD-7 · AD-8 (lane) |
Sources owner, live 2026-10-14 · ScanSnap v2 (db/init/170, 171; PL-801, 28bs) · PL-867 (28ca) · PL-574, PL-565, PL-571, PL-908, PL-1091, PL-812 · PL-766/767/769/788 · ls endpoints/payroll (t4, t4a, roe, wcb, remittance) + releases 28dp–28ds · money-invariants.mts:14-26 · PL-907 · sentimentDiffusion.tsx · PL-942/943 · PL-1082 · retargeting/audiences/sync_POST.ts header · AD-7/AD-8 · proof sheet §04
“My claim to fame is that I've built the org runtime which works from a punch-list, has plan, build, refute, judge, drive, redteam, gate, ship flow. Shipping GUI and MCP parity fully automated from idea to shipped feature.”Dave · 2026-10-14
Every owner order becomes a row with a holder, a date and a GUI/MCP Parity line. A gate flags any owner order that has no row.
1,112 rows · 467 doneA brief per row: scope, files, gates, the exact acceptance test, and which model tier and why.
overseer-charter.md:67One Builder (Opus) works on its own lane worktree with its own pinned Sonnet/Haiku sub-agents, and commits at every green gate.
.claude/agents/Builder.mdOne Opus refuter per lane, starting from "refute". A FAIL sends the lane back to Build.
every merged lane gets oneIn FFA, an independent judge corrects the refuters' claims. On the trunk, the one post rules on the verdict, and only the post merges.
FFA-Build-Judge.md · 377 spawnsA cheap model must use the feature through its MCP tools alone. If Haiku can't do it, the tool description is the bug.
FFA-Driver-Haiku.mdAdversarial lenses on tenancy, money and migrations, plus six pre-registered refusal probes: 35/35 (2026-09-02).
e73-floor-probes-RESULTSA 23-item release checklist and 240 CI gate steps that run before migrations and deploy. "Could not check" stops a release just like "failed".
deploy.yml · checklist SSOTRelease notes are written before the push. main only takes squash snapshots, and every push to it is a deploy.
One Overseer post (Fable 5.1) runs the queue. Every sub-agent gets its model pinned at spawn: Opus for judgment and money, Sonnet for mechanical edits, Haiku for monitors. No file lists these nine words in a row; it is my name for the loop. Each word maps to a template or a script (proof sheet §05).
Sources CLAUDE.md §2–§3 · overseer-charter.md §3 · ORG-PUNCH-LIST.md (grep 2026-10-14) · .claude/agents/* · O:/ATLASS-FFA/.claude/agents/FFA-* · proof sheet §05
| Lane | What the refuter caught | Outcome |
|---|---|---|
Receive PaymentPL-1085 | R1 FAIL: an NSF never released the payment's applications. R2 FAIL: AR ≠ GL by a settlement discount, and the PDF showed the discount as still owing. | R3 PASS-WITH-NOTES; round 4 closed the notes; shipped in 28dy, 2026-10-14 |
Owner pay drawsPL-693/674 | HIGH: the caller's drawType chose the account, so a draw on $0 earned booked to the wrong account. | The server now computes the split; four refuter rounds before merge 7d5460c5a |
Product libraryPL-1092 | Real bypasses of the photo-GPS strip: a photo saved as kind=video, an original swapped after publish, PNG text chunks, SVG script. | Four FAIL rounds, then a clean merge; live in 28dz |
Instant estimatePL-733 | Two HIGH defects (R9 FAIL), then one MEDIUM (R10 FAIL) | R11 PASS; merged 9f90022e9 |
CrawlerPL-1101 | HIGH: the Playwright path skipped robots.txt and the rate limit | Held out of today's cut, and the hold is written in the release notes Open |
AI read on prodPL-1068 | An independent refuter, not the builder, found that the AI read of scans and of ACAT layer 2 had been dark on prod since 2026-09-22 (the key was missing from the Lambda env) | Fix shipped 2026-10-13 (28dx) |
“The 2026-08-01 proving run found 13 confirmed defects, every one in code that had ALREADY passed the deterministic build gate — the gate checks PRESENCE, this seat checks CONSEQUENCE.”FFA-Build-Refuter template
“This project has twice shipped green asserts that encoded the very defect they were testing.” So no money assert may call the code it audits.scripts/money-invariants.mts header · anti-circularity rule
Sources ORG-PUNCH-LIST.md PL-1085 (:11055), PL-674/693 (:8026, :8077), PL-1092 (:11119), PL-733 (:8648), PL-1101 (:11205), PL-1068 (:10901) · releases 2026-10-13-28dx.md, 2026-10-14-28dy.md, 2026-10-14-28dz.md · proof sheet §06
scripts/check-*)ffa tree is 629 commits ahead against a budget of 500. The reason is written into the release notes.“parity should run both ways.” (owner, 2026-09-03). All 1,112 numbered punch-list rows carry a Parity line, and 366 of them name both a screen and an MCP door. A "n/a" without a reason is refused. 217 MCP tools are served on prod, and the tree and prod agree. Only 72 of 216 have a measured hit-rate; that gap is disclosed, not hidden.
Sources releases/2026-10-14-28dz.md (checklist table, cut record) · check-deploy-gates.mjs --list · ls scripts/check-*.mjs|mts · find -name '*.selftest.*' · git log main · check-punch-list.mjs and check-lane-mergeback.mjs run 2026-10-14 · ORG-PUNCH-LIST.md:51-62 · tool-inventory.mjs --no-db 2026-10-14 · proof sheet §07
“it's not meant to be a test. it's meant to be a feature development automation”owner · feature-automation-org SSOT v2 · 2026-07-29
192 tasks · 11 modules · 124 green. 226 conductor runs and 1,691 seat spawns are recorded in an append-only ledger of 2,692 events.
Stated plainly. The owner parked the machine until the Saturday 2026-10-17 account reset: “we should park the ffa machine until next account reset. Saturday.” Procurement, the first module built under the current tree protocol, lives on the ffa tree and has not crossed into the trunk or prod yet. Its "assets" and "inventory" modules are bookkeeping (CCA, costing), not piece tracking.
Sources O:/ATLASS-FFA/ledger3/index.md + events.jsonl fold (2026-10-14) · gate-build-review-*.json ×3 · ledger seq 2692 · PL-849 status · ffas37-merge-fence.mjs:1-21 · ffa-overseer-state.md:7 · proof sheet §08
Append-only at the database. A trigger (2026-07-13), revoked DELETE/TRUNCATE grants and ENABLE ALWAYS, with before and after measured on prod on 2026-09-04.
Every query is scoped by business. A 1,488-line scanner refuses any new unscoped query, and the exceptions are itemized with reasons and can only shrink. RLS is the backstop; app-level scoping is primary.
Asserts A0–A9 (debits = credits, subledgers tie to the GL, no double numbers) run on every cut. The auditor may not call the code it audits.
Restore drill on 2026-10-04: 351/351 tables, sha256 matched, money invariants green on the restored copy, checks D1–D7 PASS.
A replayed request returns the stored result and writes nothing. The signature is on 219 of 224 money doors.
Agent deletes are soft only. When the gate first ran it found three doors that could hard-delete, and it now fails on any new one.
Endpoint census, 2026-10-04. Down from 275 permission gaps on 2026-09-12.
“Token scoping is designed for context management, not for access control. Access control is handled at the endpoint by RBAC enforcement.”owner · 2026-09-04 · now a gate: check-write-tools-require-permission
Not claimed. These are SOC 2-sensitive controls, not yet audited. There is no attestation and no external pen test. MFA is not built yet (PL-430 is open). CSP is report-only by design. The product is pre-revenue, so all blast radius so far has been demo and eval data.
Sources db/init/17-audit-log-immutability.sql · db/init/104-audit-log-grants.sql:3-25 · check-tenant-scoping.mjs · money-invariants.mts · backup-drills/2026-10-04.md · endpoint-census-2026-10-04-HEAD.md · check-write-tools-require-permission.mjs:4-6 · check-agent-surface-soft-delete.mjs · proof sheet §09
Upload one or many recordings. Stereo audio is split by channel; mono goes through a diarizing model. The transcript gets Layer 1 tags immediately, then Layer 2. One usage row is written per engine call. Released 2026-10-14.
The same recording uploaded twice is linked, never duplicated. Device SMS carries a content key with a DB uniqueness constraint, and scan pages carry a sha256 with a CHECK constraint.
| Row | Coordinates it carries | Since |
|---|---|---|
| Locations | lat/lng + geocode source, confidence and input; one server-side writer | mig 151 · 2026-09-25 |
| Job-site photos | lat/lng, accuracy, compass heading, pitch, roll, and a frustum (focal length, sensor, field of view) | mig 135, 175 · 2026-10-01 |
| Canvass houses / photos | camera GPS, heading, resolved house position, route trail | mig 190, 192 |
| Scans | capture fix and geocode in side tables, kept away from readers that must not see them | mig 170, 171 |
| Time entries · ACAT orphans | start/end fix; orphan geocode for events with no known place yet | mig 152, 195 |
| Crew checkpoints | none, by design. A CHECK constraint refuses coordinates in the event detail | mig 167 |
Stated plainly ACAT's inferring layer (Layer 2) was dark on production for three weeks (2026-09-22 to 10-13). Our own refuter found it and the fix shipped the next day; the first Layer 2 row on prod since then is not yet confirmed. This is tags and graph edges, not vector search; embeddings are deferred.
Sources helpers/acatTaggingEngine.tsx:1210-1250 · helpers/schema.tsx:3805-3825 · db/init/128 · acatL2Vocabulary.ts · PL-1091 (:11109) + releases/2026-10-14-28dy.md:6 · callRecordingIngest.ts · db/init/162, 170 · PL-1068 · proof sheet §10
The Overseer runs on Fable 5.1. Builders, refuters and money work run on Opus 5.5; scoped mechanical edits on Sonnet; monitors and triage on Haiku. The model is pinned on every spawn, because an unpinned fan-out silently inherits the parent's (most expensive) tier.
Heavy work runs on remote machines first (owner order 2026-10-14, after the dev PC hit 90% RAM). Four hosts are bound in code, with secret scans on every host. Only one heavy gate runs at a time across the org, behind an atomic lock, and the type check fails closed against a ratcheted baseline.
A pull-only worker on the GPU box runs PaddleOCR and faster-whisper. It leases jobs over HTTPS, so prod never calls in: no tunnel, no open port. Textract is the fallback. Prod journal, 2026-10-13: an OCR job at 3,646 ms, then 678 ms.
ai_usage_events row per billed call, with cost frozen at write. 21 files call the recorder, and it is capped at 1.5 s so metering can never slow a turn.Sources .claude/agents/*.md frontmatter · CLAUDE.md §3, §6 · scripts/remote-gate.mjs:203-231 · with-heavy-gate.mjs · lane-tsc.mjs · scripts/remote-worker/inference/README.md · PL-899 (:10201) · db/init/105-ai-usage-events.sql · aiUsageRecorder.ts · llm-routing-overseer-charter.md §2 · judge-round2-2026-10-12.md · AD-29 spec · proof sheet §11
“travel: auto detect travel when I leave my house, or leave a vendor_location. etc.” · “crew pick-up: auto detect if I stop >10s at employee's house.” · “vendor stop: auto detect when I arrive at a vendor_location, include all who have been picked up.” · “depart site - auto detect site departure.”owner · after a full dogfood day as foreman · 2026-09-28
Why it matters to you: a checkpoint here is an event with a mode, who, where, a source and a confidence, and the day's state is derived from those events. A scan at your crane is the same shape.
Sources fieldops-crew-timesheet-doctrine-2026-09-28.md · PL-766 (:8915), PL-767 (:8923), PL-788 (:9093), PL-769 (:8940), PL-907 (:10255), PL-768, PL-789, PL-1111 (:11276), PL-910 · endpoints/phone/ (67 entries) · db/init/166, 167, 168 · releases 2026-09-29/30, 2026-10-07 · proof sheet §12
| App | What it does | Status |
|---|---|---|
| Atlass FieldOps | Crew time, GPS checkpoints, customer timeline, SMS. One Android foundation in four flavours: “no server, no database, no infrastructure of its own” | Built |
| · ScanSnap | Receipts straight into the books: auto-capture, batch review, an adaptive page-edge finder (0.22.0) | Built |
| · ProjectCam | Job-site photos with pose and frustum metadata and originals on demand | Built |
| · CanvassCam | Door-to-door capture: each house becomes a located record before any lead exists | Built |
| Overhead | Drone and roof media plus a PDF document door into ATLASS | Door built |
| Understudy | An R&D rig that records an expert building an estimate, to train an agent later | Goal, not done |
| Flix-Fix | A separate product exposing one user's taste graph over MCP: “the data source and the actuator, not the recommender.” | Built |
The pattern you need is write_entity: one tool that creates, corrects or deactivates any of nine entity kinds. An unknown field is refused, and the refusal returns the real field list so the agent can correct itself. FieldOps is sideloaded on the founder's own phone; no app-store distribution is claimed.
Sources O:/FieldOps git log + docs/releases (42 files) + package.json 0.22.0 · O:/FieldOps/README.md · find endpoints/satellite · tool-inventory.mjs 2026-10-14 · PL-942/943 · O:/understudy/README.md · helpers/mcpToolRegistry.tsx:3480-3505 · proof sheet §13
“A team meeting whenever. No scheduling conflicts. Each C-suite position is an agent, and each employee has an agent with months of operational context regarding compliance and performance to bring to the board room at the drop of a hat.” Coming soon: ~2 weeks (owner, 2026-10-14).
Foundation: personas (AD-7) and the executive assistant “Ava” (AD-8) are built and tested on the ai-delivery lane, with the drainer disarmed; not on prod. Roadmap record: AI-DELIVERY-IDEAS.md #8 and ECOSYSTEM-AND-REVENUE R-8, which file it as Phase 4. The date is the owner's word, not a file's. "Months of context" describes the design, not a history that exists yet.
The pose and lens of every job-site photo is captured today Built. Projecting events onto that imagery is the next layer.
“eventually, a frustrum rendering engine to browse in 3D, with ACAT icons at ground level (lower for buried infrastructure assets, or higher for elevated. things like tower maintenance records visible composited onto drone inspections.), and render overlays on drone footage.”owner · 2026-09-13
The plan folds the public tool names into 68 job-shaped verbs, in the shape of write_entity, which exists today:
“kind of a god tool, but a very easy one for any model to understand, because it's programmatic. syntax defined.”owner · 2026-09-27
Drafts texts and emails and never sends them. Honours STOP and refuses to reply across businesses. Passed 9/9 live checks. The drainer is disarmed. Not on prod.
One door for speech-to-text, OCR, TTS and video, routed shelf → frontier → fallback, all metered. Spec dated 2026-10-13; every kind is still a stub.
Vendors, nested units, tiered prices and price history. The next module after the 2026-10-17 reset (PL-1081).
Sources db/init/175 · OWNER-DIRECTION-2026-09-13.md:43,49 · PL-811 (OPEN) · ORG-PUNCH-LIST.md:14-17 (owner 2026-09-27) · AI-DELIVERY-PUNCH-LIST.md AD-8, AD-29 · PL-1081 (:11018) · proof sheet §14
ACAT over every checkpoint. Each piece gets one timeline: every scan, photo, QA note and call.
Parity. Scanners, your ERP, people and agents all hit the same doors, with the same checks.
Hours from checkpoints. Crew time comes from events; payroll runs in the same database. Timecards are what the build removes.
The runtime is what you buy. Each of those is built through plan → refute → gate → ship.
| Your need | ATLASS today | Status | What gets built for you |
|---|---|---|---|
| 100+ step process | Configurable stage types and instances with planned and actual dates; Boards v1 | Built v1 | Stages per piece, MCP verbs for stages, a load test at your scale |
| Scan at a checkpoint, never twice | Idempotent event doors carrying who, where, when, source and confidence; a replay writes nothing | Pattern | QR/barcode decode on the scan door; a scan event per device key |
| Labour hours | Crew checkpoint events (auto-detected) and payroll on prod | Both halves | Station hours from scans feeding pay runs; the crew-day sheet (PL-768) |
| The piece itself | Nothing yet | Not present | Serialized piece table and a per-piece timeline |
| Yard organization | Locations are addresses with lat/lng; there is no yard model | Not present | Yard zones, bays and slots, with put-away and pick events |
| Lidar measuring | A pull-only edge worker (built for OCR and voice) | Pattern | Lidar ingestion as a satellite door: a measurement and a tolerance verdict on the piece |
| Hundreds of scanners | Narrow per-device bearer doors, minted in CI, rotated mint-first, revoke-last | Built | Fleet minting and revocation for hundreds of device tokens |
| 60–150 seats | RBAC by section and level, agent ceilings, append-only change history (83.3% / 94.6% coverage) | Built | Role presets for the plant: crane, QA, yard, office |
| QA traceability | An append-only audit log enforced by the database; photo capture with pose | Built | A QA checklist per stage, with non-conformance recorded as an event |
| Inbound materials | FFA procurement: POs, receiving, partial receipts | ffa tree | Carried to prod through a lane, a refuter and a cut |
| 12 subscriptions | One tenant DB: CRM, projects, books, phone, documents, field app | For roofing | A migration per subscription, ordered by cost and risk |
Not present today, said up front: camera or hand-scanner decoding, a piece entity, a yard model, lidar ingestion. Those four are the build.
Sources db/init/202 + PL-1082 (Boards v1, 28dy) · db/init/166, 168, 195 · helpers/creditNoteIdempotency.ts · db/init/179 · pl942-overhead-document-door.md · PL-953/957 · rbac-architecture.md + census 2026-10-04 · db/init/104 · FFA ledger procurement.* · grep 2026-10-14 (no QR decode, no piece table, no lidar) · proof sheet §15
| Weeks | Phase | Ships | The gate that proves it |
|---|---|---|---|
| 1 | Discovery | The stage map for your 100+ steps; a draft piece and yard schema; one punch row per need, each with a Parity line | Your sign-off on the stage map; every row names its screen and its MCP door |
| 2–3 | Scan pilot, one line | Piece table, QR decode, scan events, and device tokens for the pilot scanners | Red-first selftest: a replay writes nothing, an unknown device is refused, cross-tenant returns 404. Plus tenant scoping and a refuter PASS |
| 4–5 | Checkpoints + yard | Stages advance on a scan; yard slots; QA capture; planned vs actual per piece; crew hours from checkpoints into payroll | An invariant script: each piece's stage equals the fold of its events. A drive test through MCP alone |
| 6–7 | Fleet + lidar | Hundreds of device tokens, the lidar door, and crane and forklift terminals | Bearer round-trip and edge gates; a load test at your scan rate |
| 8+ | Collapse the stack | Subscriptions migrated by cost and risk, seats under RBAC, a parallel run | Reconciliation for each system retired; the release checklist on every cut |
“Given enough RAM, fast enough cpu's and API credits.” (Dave). Today: 80 GB RAM, two GPUs, ~24 cores (owner, 2026-10-01).
The weeks are an estimate from my own delivery record (FieldOps went from first commit to 0.22.0 in 30 days), not a quote. Discovery firms them up.
Sources PROPOSAL, not evidence. The gates named exist today: check-tenant-scoping.mjs, satellite-bearer-roundtrip.selftest.mts, check-edge-forwards-authorization.mjs, money-invariants pattern, FFA drive seats · FieldOps git log · ffa-overseer-state.md:7 · PL-430 · proof sheet §16
“an amateur agentic workflow designer with no certificates, but willing to get them.”Dave · 2026-10-14
A man who shows you the red gate he recorded on purpose is the man to run your platform program.
Sources memoir lines 49, 71 · git log --reverse (2026-06-24 18:01) · git rev-list --count iterating · git log --format=%an · CLAUDE.md §4 · releases/2026-10-14-28dz.md item 12 · proof sheet §17
90 minutes with the director and a floor lead: the 100+ steps, where the scanners sit, and what gets typed today.
The 12 subscriptions with their seat counts and renewal dates, plus your system of record.
Fixed scope and small enough to cancel. It ends with the stage map, the pilot plan with its gates, and the hardware list.
dave@rightsideroofing.ca
Alberta, Canada · Mountain Time. On request: the proof sheet, any release note, and the file behind any number in this deck, figure by figure.
Sources none needed; this slide is the offer · proof sheet §18
Keys: ← → or Page Up / Page Down to move, Home and End for the ends, / to search, Enter to jump to the first hit, Esc to clear. Prints one slide per page.
Prepared 2026-10-14 for Eagle Builders. Numbers are as of that date; the proof sheet dates each one.