What shipped, what moved, what we learned

The complete launch site — proof, trust, changes, and honest checkout

Four new pages joined the landing: the Evidence Room (/proof) where one real dogfood workflow will be replayed as recomputable receipts, the trust ledger (/trust) where every claim carries how we know it and the gaps get equal prominence, this changelog with its RSS feed, and rewritten privacy and terms naming who is legally responsible.

Paid checkout went live only after verifying the actual Stripe prices — the audit found the Team plan’s billing config was missing entirely, so its checkout had never worked. Fixed, verified, then enabled.

The site is now machine-readable too: /llms.txt describes Everform truthfully for AI agents, including the honesty constraints they should relay.

Known limitation: The /proof record is pending its first production export; /about ships when the founder pages are complete.

The landing page is launch-ready

The scroll journey is ~24% tighter without losing a story beat. The hero now opens with the problem — "Your business runs on knowledge nobody wrote down" — before the category statement.

A new proof section discloses our dogfood setup honestly: the two companies running on Everform are founder-owned pilots, not customers, and the page says so.

Launch guards landed: dead GitHub links removed while the repo is private, plain-language privacy and terms drafts published (counsel review pending), and dishonest cancel-copy fixed on pricing.

Known limitation: Legal pages are drafts pending counsel review.

"Watch it change" — the organizational-CI loop as a film

The landing now shows the whole improvement loop: a working workflow, a tempting cheap change that breaks guardrails in front of you, Eve's hybrid revision growing around the failure, a 10% canary lane behind a sandbox boundary, and the owner's promote-or-return decision re-routing live particle flow.

Every number derives from one illustrative case record and is labeled as illustration — the act never pretends to be production evidence.

Production-truth spine: signed run witnessing, deployed dark

Runs can now be cryptographically witnessed at the platform boundary (Ed25519-signed attestations) and written into readiness evidence as directly observed — the machinery that will let "it works in production" be a provable claim instead of a sentence.

Deployed fully dark: no production evidence is minted until the enablement flag flips after verification.

Known limitation: Flag off in production; no anchors minted yet.

Porcelain — light mode for the platform

The signed-in app has an opt-in light theme designed as its own material world (matte porcelain, gel-teal accents) rather than an inverted dark theme. Dark stays the default and is pixel-locked.

Programmatic WCAG contrast checks now gate every themed token pair.

Eve’s proposals now apply and re-score in one loop

Approving one of Eve's workflow edits now applies it atomically and re-scores the workflow live on the canvas — the full see-it, approve-it, watch-the-score-move loop.

The apply path is guarded against version drift and double-application; failures surface honestly instead of pretending success.

Security: the billing table could be self-awarded. Now it can’t.

A platform audit found that a signed-in user could in principle write their own billing-credit rows. The hole is closed at the database-policy layer, and the audit that found it also hardened adjacent write paths.

We publish notes like this because a trust page without incident honesty is decoration.

Eve now runs on GPT-5.6 Sol

The platform default model moved to OpenAI's GPT-5.6 Sol for Eve's chat and drafting. Structural scoring is unaffected — it makes zero model calls by design.

Calm Precision — a design elevation across the whole canvas

Constellation focus choreography, an owned Eve message layer, a three-zone inspector, evidence-stage marks, and a strict motion budget landed together — hierarchy before decoration, everywhere.

Scoring self-heals across deploys

Workflow scoring jobs interrupted by a deployment are now fenced by generation and swept back to completion by a five-minute cron — a score request can no longer be silently lost to bad timing.