Component status
One row per component shown in the diagrams. Every box in a diagram links to its row here. The states are taken from the project’s status file (docs/STATUS.md in the code repo) as of Oct 13, 2026, and never go beyond it.
| State | Meaning |
|---|---|
| Works live | Deployed and exercised against the live Worker and real Artifacts repos. |
| Built, not verified live | Built and tested (unit tests, fakes or dry runs), but not deployed or not yet run against the live system. |
| Stubbed | Present in the code but returns placeholder or sample data. |
| Planned | Decided or wired up, but the behaviour is not built. |
Worker check has not run (needs JavaScript).
The line above is checked by your browser when the page loads: it asks a public, keyless Worker route for a response and reports whether the Worker answered. It says nothing about any project.
Clients
Section titled “Clients”| Component | State | How it was verified | Source |
|---|---|---|---|
| wayglass CLI One Go binary. Every command takes --json and returns the {"v":1,"ok":...} envelope for agents. | Works live | scripts/demo/golden-path.sh runs three agents in parallel against the live Worker: 20 pass, 0 fail (docs/demo-run-2026-10-13.md). | cmd/wayglassinternal/cli |
| TUI: wayglass watch Bubble Tea view of intents, declared vs pushed paths, tags as they are classified, overlaps and counters. | Works live | Runs against the live Worker. Overlaps carry a suggested re-plan; nothing re-plans automatically. | internal/tui |
| TUI: wayglass review Queue of changes routed to a person; approve or reject with a required reason. | Built, not verified live | Tested against a fake Worker only. approve and reject themselves work live from the CLI. | internal/tui |
| Desktop app Wails v2 app: swarm, Needs-you queue with approve/reject and a reason, overlaps, audit timeline, counters. | Built, not verified live | 25 Go tests against a fake Worker; built on macOS. Not yet exercised against the live Worker on screen. | desktop |
| Web console (/console/) Browser review console: sign in with a key, approve or reject with a reason through the same Worker checks. | Works live | Served by the Worker. Model tests (tests/console-model.test.mjs) and a Chrome run (tests/console-browser.mjs). | web/console |
| Public audit view Read-only page at the Worker root: overview, intents, decisions, audit timeline, measured cost. Only for projects that opted in. | Works live | Live on the public demo projects through /v1/public/projects/<name>/... (golden path step 8). | webworker/src/public.ts |
| selfhost.sh Deploys the Worker to your own Cloudflare account from a generated, git-ignored wrangler config. | Built, not verified live | Validated with --dry-run and shellcheck only; never run against a fresh account. | scripts/selfhost.sh |
| Release builds and install.sh macOS and Linux archives (arm64, amd64) with checksums, and an install script that verifies them. | Built, not verified live | make release-dry-run builds them. No release is tagged yet, so the public install line fails until one is published. | scripts/install.shrelease workflow |
Worker
Section titled “Worker”| Component | State | How it was verified | Source |
|---|---|---|---|
| Worker (api.wayglass.dev) TypeScript Worker: auth, token minting, intents and forks, push and overlap check, propose, decide, land, audit, why, sessions, keys, public routes, static assets. | Works live | Deployed by Workers Builds from main; routes checked Oct 13 against api.wayglass.dev. 274 Vitest tests. | worker/src |
| Project Durable Object One SQLite-backed object per project: intents, decisions, approvals, sessions and the append-only audit log. | Works live | Used by every live project route. | worker/src/project.ts |
| Registry Durable Object Holds SHA-256 hashes of per-agent keys (wgk_...) and the name each one is bound to. | Works live | Per-agent keys and GET /v1/whoami are deployed. | worker/src/keys.ts |
| Policy evaluator (Go, Wasm) The same Go evaluator the CLI uses for its preview, compiled to WebAssembly and run on the Worker for the decision that counts. | Works live | Deployed (policy wire v2). make wasm-check rebuilds policy.wasm reproducibly. | internal/policycmd/policywasm |
| Shadow mode Rules with mode: shadow are logged (shadow_matches, would_differ) without being enforced. | Works live | Deployed; wayglass policy test previews it locally. | internal/policy |
Cloudflare services
Section titled “Cloudflare services”| Component | State | How it was verified | Source |
|---|---|---|---|
| Artifacts namespace wayglass (us) Trunks and intent forks of projects created with --jurisdiction us. Binding ARTIFACTS. | Works live | Golden path runs on demo projects in this namespace. | worker/wrangler.jsonc |
| Artifacts namespace wayglass-eu (eu) Trunks and forks of projects created with --jurisdiction eu. Binding ARTIFACTS_EU. Changes here are tagged eu. | Works live | PII changes quarantined live on an eu-demo project (golden path step 4). | worker/wrangler.jsonc |
| Queue artifacts-events Receives cf.artifacts.repo.* events from per-trunk event subscriptions; the Worker consumes them. | Works live | Queue consumer and per-trunk push subscriptions are deployed; trunk pushes are counted from these events. | worker/src/events.tsworker/src/subscriptions.ts |
| Workers Builds Builds and deploys the Worker on every push to main. | Works live | Check runs on each main commit report the build and deploy. | worker |
| Workers AI and AI Gateway The Worker has an AI binding that reaches AI Gateway "wayglass". Intended for an LLM agent_review. | Planned | Bound, but no route uses it. The LLM agent_review is on the cut list; a reviewer agent session reads agent_review work with review --for agent --json instead. | worker/wrangler.jsonc |
Change flow
Section titled “Change flow”| Component | State | How it was verified | Source |
|---|---|---|---|
| Intents and forks intent declare records goal, paths and reason; the Worker forks the trunk for it and returns a fork token. --on stacks on an unlanded intent. | Works live | Golden path steps 1 and 2. | internal/intentworker/src/index.ts |
| Overlap check On push, declared and pushed paths are compared with every open intent. Overlaps carry a suggested re-plan (land_first, stack, split). | Works live | Golden path step 3. The re-plan is a suggestion; nothing re-plans automatically. | worker/src/paths.ts |
| Classification The Worker computes the diff itself and tags it: area, data class, risk, jurisdiction. | Works live | Golden path step 4. | internal/classifyworker/src/diff.ts |
| Policy actions .wayglass/policy.yaml maps tags to auto_merge, agent_review, human_approve, multi_approve, quarantine or block. | Works live | Docs auto-merge, auth to a person and PII quarantine all seen live (golden path step 4). | internal/policy |
| Approve and reject A person or reviewer agent decides with a reason. No self-approval; filler and placeholder reasons are refused. | Works live | approve and reject work live (golden path step 5). | worker/src/index.ts |
| Land Merges an approved change onto the trunk with a 300 s trunk token; the Worker verifies the result (landed) or takes it back (land/abort). Only the intent author or the admin key may land; it works from any checkout (wayglass clone), fetching the approved commit from the fork. | Works live | Works live; conflicts stop with land_conflict. | internal/cli |
| Git notes and why The decision is written to refs/notes/wayglass on the landed commit; wayglass why <file>:<line> reads it back. | Works live | Golden path step 6. | internal/notes |
| Audit log Every intent, push, overlap, decision, verdict, token, land and abort is appended to the project log. No edit route; only throwaway projects (demo-test-*, eu-demo-test-*) can be deleted whole, with the admin key (wayglass project delete). | Works live | Read live through wayglass log, the audit view and GET /v1/audit. | internal/auditworker/src/project.ts |
| Session share and fork session share publishes an intent with its notes and context; session fork continues it on another machine, stacked on the source. | Works live | Shared on a Mac, forked, pushed and proposed in a linux/arm64 container (golden path step 7). | scripts/demo/second-machine |
Credentials and tokens
Section titled “Credentials and tokens”| Component | State | How it was verified | Source |
|---|---|---|---|
| Cloudflare credentials Only the Worker holds them: Artifacts through bindings, plus Worker secrets (admin key, account id, a Queues-only token). None in the Go binary. | Works live | Worker secrets set on the deployed Worker. | worker/src/env.d.ts |
| Admin key and agent keys Clients call the Worker with a key. Agent keys are bound to one name; the admin key names itself. | Works live | Deployed. Short-lived session tokens and project-scoped keys are not built. | worker/src/auth.tsworker/src/keys.ts |
| Short-lived repo tokens Per-repo Artifacts tokens: fork write 900 s, land trunk write 300 s, trunk read 60 s. Passed to git through environment variables, never on disk. | Works live | Used by every live push and land. | internal/gitxworker/src/artifacts.ts |
Known gaps
Section titled “Known gaps”These are listed as open in the status file and are not shown as components:
- Artifacts has no branch protection. The Worker detects a trunk push that was not an approved land, after the fact; it cannot prevent one.
- A change that forked before a policy change lands under the older policy.
- Agent keys are long-lived and not scoped to a project. Short-lived session tokens and project-scoped keys are not built.
- AI Gateway cost guardrails beyond cache and rate limit are decided but not built.