Built in the open. Shipping every week.

Recent updates

1. September 14, 2026
   • Ten businesses you can actually use. One real, working business per kind — a salon, a barbershop, a gym, a racquet club, a dance studio, a restaurant, a spa, a physical-therapy clinic, an inn and a music school — each with its own site, services, staff, hours, gallery and FAQ, and each one bookable. They are built out of the same starters a new business begins from, so what you are looking at is the product rather than a mock-up. Every “for your business” page opens the one that matches it.
2. September 12, 2026
   • An assistant can now run the whole front door. The concierge is on the agent endpoint: an outside assistant can open a conversation, relay what the owner says about their business, draft the preview, build the live demo, start the signup from that conversation and claim its grant — thirteen tools, no authorization server to discover, credentials handed back as arguments. Confirming the email and accepting the terms stay the person’s. Details on the Agent API page.
   • A signup that can skip the card. Whether a card is collected at signup is now a platform switch rather than a code path: where it is off, confirming the email creates the business and the person lands inside it. Tools and pages both read the switch, so nothing has to guess.
   • Front-door retention, written down and enforced. A signup nobody finished is deleted thirty days after it expires, and a concierge conversation is anonymised at ninety days — the periods the privacy policy states, run by a nightly job rather than by hand.
   • A price you say out loud lands on the offer. Tell the concierge a haircut is $35 and the drafted offer carries $35, instead of the starter’s default.
3. September 11, 2026
   • See your business running before you own it. Describe your business, and after the preview you can press “See it live” and have a real, bookable copy of it built at its own address in about a minute — your services, your hours, your prices, a working booking page you can book yourself into. It lives a week. Create your account and it is not copied or rebuilt: that demo becomes your business, with everything you changed in it.
   • The preview looks like what it is. The drafted business is shown as a website in a browser window rather than as a form, and a business that books nothing — a restaurant, a shop — previews as its menu instead of an empty calendar.
   • Describe first, pick a starter later. /start is a chat: say what you do in your own words. If you never picked one of the ten example businesses, the preview offers them when you ask for the live demo, so the demo is never refused for a reason nobody explained.
   • A welcome email at the preview. The address you leave gets a message with a link back into the conversation, which confirms the address at the same time — so picking it back up on the phone works, and the signup afterwards does not ask you to prove the same address twice.
   • Third-party webhooks reach us again. A processor’s callback with no browser-shaped user agent, or a large payload, was being turned away at the edge; both now pass, and a card-number scan no longer mistakes a millisecond timestamp for a card number. Proven end to end with a live sale.
4. September 7, 2026
   • The front door is open. Self-serve signup and the concierge are live on production: anyone can describe their business at latticekit.app/start and create it — no invitation, no sales call, no waitlist.
   • One assistant, named Beth, end to end. The same assistant, with the same name, from the first line at /start through onboarding to the console — it was three unnamed “AI” surfaces before.
   • Review the starter before the card. The example business you arrive on is shown, and changeable, before anything asks for payment details; “pick it back up” and “back to the starters” work where they previously bounced.
   • An hourly heartbeat for the platform. Signups, demos, errors and money now report themselves hourly to whoever runs the platform, silent when there is nothing to say.
5. September 5, 2026
   • Ten example businesses to start from. Racquet club, gym, salon, studio, restaurant, barbershop, spa, clinic, hotel and music school — each a complete working configuration you can change, not a template to fill in. /start leads with describing your business in your own words; the examples are there for whoever would rather point at one.
   • Where a business came from is remembered. A visit that arrives from an ad or a link carries that record through the conversation onto the business it becomes, so what actually brings people in is measurable without a third-party tag on the page.
   • Staff can read a conversation in flight. Signups that have not finished, and the concierge conversations behind them, are visible to the people running the platform — so an owner who gets stuck can be helped rather than guessed at.
   • The page-authoring loop, hardened. AI-drafted screens now run behind an explicit gate with a quota, a retry budget and an audit line per attempt, and the component catalog the drafts are checked against is generated rather than hand-kept.
6. September 4, 2026
   • An AI can now sign a business up. A new pre-tenant MCP endpoint lets an assistant — a coding agent, a desktop connector — start a signup for a person, tell them what to do next, and hand them the card page. The person still confirms the email, accepts the terms and ticks a box that lets that assistant into the business once it exists; the card is still entered on the processor's page. When the business is created the assistant claims a scoped, 30-day connection the owner can revoke from Agents. Refused while the platform is invite-only. Details on the Agent API page.
   • Self-serve signup, built and switched off. A business can now create itself: prove an email, put a card on file through the processor's hosted page (card data never touches LatticeKit), accept the terms, and land in Beth's onboarding interview. The front door ships invite-only on every environment and opens with one switch in the console — no deploy. Until then the waitlist is the way in.
   • Account self-service in the console. A tenant sees its own plan, status and card on file and updates the card through the same hosted flow. Owners mint API keys for MCP clients from the Agents page — shown once, scoped, with an expiry and a daily call cap — the key that connects a coding assistant or desktop connector to Gaal.
   • Scale readiness. The API autoscales on request volume; live console reads are push-first and only poll while the socket is down; slot generation and scheme reads come from generation-keyed caches; the scheduling and relay workers wake on demand instead of polling. Measured with a load harness against the booking surface before and after.
7. September 3, 2026
   • Production release. Everything since July is on production: Gaal, Pirenne, Elar, Arkady, the agent-platform follow-ups and the four starter businesses. Gaal and Pirenne move from In progress to Live.
   • Usage metering closes the loop: Arkady. Named meters with real feeds — platform API calls, capability invocations, AI tokens, event outcomes — and cost derived from one rate card. A tenant reads its own usage, rates and limits and can set its own caps; its rates and limits export with the tenant bundle.
8. September 2, 2026
   • Two-way messaging: Elar. Staff message each other — everyone on staff, or just these people — in Conversations with participants, read state and unread counts, delivered live to whoever belongs to the thread. Staff membership gates every read, live or replayed. Member-to-business conversations are the next phase; the model already carries them.
   • Usage metering: Arkady. A new primitive for metered usage — usage, rates, limits and charge — so what a tenant consumes is measured once and priced from one rate card.
   • Agent platform hardening. The OAuth connector flow got stricter (refresh rotation, PKCE replay, client identity, per-IP limits); a sandbox-only grant can no longer execute a proposal for real; minting and revoking a grant leaves an audit row; a tenant-as-code plan describes exactly what the apply will do.
   • Docs for agents, corrected. The public document set now states the real id shape, the real error shape, and what a spent budget looks like — the three things a connecting client got wrong first.
9. September 1, 2026
   • An API for AI agents: Gaal. LatticeKit now speaks MCP. An AI client outside the platform — a coding assistant, a desktop connector — can connect to one tenant and work in it, behind a grant the operator consents to on a consent screen and can revoke without rotating a credential. Capabilities are invisible to the gateway until a provider opts in; roughly a hundred reads are exposed today. Writes are tiered: the repetitive ones a scanner or kiosk performs run directly, and anything consequential parks for a human in an approval inbox rather than executing on an agent's say-so. Per-grant daily ceilings bound calls and money, so a loop that goes wrong is limited by policy rather than by whoever notices. Three discovery tools replace a sprawling tool list, because agents degrade under schema sprawl. Not yet generally available. See the Agent API reference.
   • Tenant-as-code: Pirenne. A whole business — schemes, offers, resources, catalog, pricing, tiers, pages, workflows, promos — exports as one portable YAML bundle that uses symbolic handles instead of internal ids, so it applies unchanged to a different tenant. A bundle can be diffed against what is live, pinned as a plan a human approves, applied transactionally, and rolled back. Config only by construction: the format is an allowlist, so no people, bookings, invoices or credentials can ride along. This is what makes an agent safe to let near a configuration — it proposes one document you review, not fifty calls you supervise.
   • Four businesses you can start from, and a way to prove they work. Racquet club, gym, salon and studio ship as ordinary bundles, each shaped to how that business actually runs — the gym's timetable needs a room and a trainer; the salon has two appointment lengths where the long one takes a deposit; the studio is capacity-shaped rather than resource-shaped. Each carries its own scenario as an acceptance test, run against the real configuration with every side effect neutralised, returning a verdict on whether the business it just built actually works.
   • Documentation machines can read. A document set written for callers — the domain model, the contracts that hold everywhere, and how to connect — is now published as llms.txt and llms-full.txt, and served to connected agents as MCP resources — both generated from one list, so an agent can never read a stale description of something the platform stopped doing. Alongside it: errors that teach (a failed call tells the caller what to do differently, not just what went wrong) and a preview mode that shows what a change would do before it does it.
10. August 29, 2026
    • Seldon slot generation got dramatically faster. The generator's persist path went from quadratic to linear, with a constant-time conflict check and one flush per batch instead of one per slot. Large schedules that used to crawl now regenerate in proportion to their size.
    • Two more card processors. Maverick and Dejavoo drivers behind the existing processor seam, joining Stripe and Finix — the point of the seam being that Mallow sees one payments story regardless of who actually moves the money.
    • Tier evaluation swept every tenant. A membership-tier re-evaluation run without an explicit tenant now covers all of them instead of silently doing nothing.
11. August 25, 2026
    • Fiska driver + honest payment amounts. Another processor behind the seam, plus a real correctness fix: the platform now records what the processor actually approved rather than what was asked for, and can settle an interrupted charge by reference instead of losing track of it.
    • Radiant's Git bridge is deployable. Tenant configuration can round-trip through a real Git repository, with a single-commit bootstrap. Also fixed: configuration bootstrap was only ever materialising tenant-private assets, so shared and public ones went missing.
12. August 24, 2026
    • Beth grew up. The in-console assistant gained a scope hierarchy (what she can see and do follows the operator's own permissions), governed writes with server-verified confirmations, an action log and undo, a dated rate card with per-tenant API keys and a usage panel, scheduled prompts and standing agents whose writes park for the owner rather than executing unattended, a declarative canvas for rendering results, disruption handling that assembles a window and executes one plan-pinned batch, an internal support queue, and standing business memory so she knows what the business already looks like without being told each time.
13. July 15, 2026
    • Live payment keys, with a gate. Test and live mode are now distinct postures with credential verification and an explicit activation gate, so a tenant cannot drift into taking real money on unverified configuration.
    • Staff role fix. A permissions backfill had demoted staff to location-scoped roles; the staff bit now always wins when resolving an effective role.
14. July 14, 2026
    • The platform can now bill its tenants. Platform billing v0: a per-tenant billing posture (plan, status, processor subscription refs) behind a driver seam — Stripe subscription-per-tenant on the platform's own account — with an hourly delinquency sweep and the wiring that matters: a delinquent or canceled subscription suspends the tenant through the existing kill-switch, and a recovery reinstates only billing-caused suspensions. Staff console panel + report-visible audit events — the last SaaS-operations gap from the June platform review, closed.
    • Speaker per-tenant send caps. Daily per-channel caps (email / SMS / push) protect the shared sender reputation from one runaway tenant: over-cap sends are recorded-but-refused, a fingerprinted health signal flags the tenant, and user-initiated auth mail is exempt so sign-in never breaks.
    • Access-control hardening. Member QR codes are now single-use — a photographed or replayed code is refused at the door. Two simultaneous scans can't check a booking in twice, the booking rule no longer misses heavy bookers, and a door bound to a specific court or lane admits exactly the booking for that resource.
15. July 13, 2026
    • Cloud door controllers + smarter door rules. A provider-driver seam for cloud access-control systems, ready for the first live provider: grant sync compiles door policies out to the provider, signature-verified webhook ingest folds provider events into the same append-only visit log, and a reconcile sweep repairs drift. A new staff_on_shift rule admits staff only inside a projected Riose shift window, and a velocity flag raises a health signal when one person is admitted at two doors under five minutes apart.
    • Operator permissions, round two. Money and admin mutations across six primitives are deny-by-default behind operator role keys — refunds, payment config, billing, channels, access control, AP entry; POS paths deliberately stay staff-reachable.
16. July 10, 2026
    • Physical access control lands in Trantor. QR self-check-in at the door: rotating HMAC member codes + printed static passes, a fail-closed decision core over priority-ordered policies (membership_tier / open_hours / has_booking with zone matching), an append-only visit log, and an allow that checks the matching booking in. Same week: form_signed (waiver at the door) + staff_role rules, fix-it deep links on denials, an explain debugger, a Palver live feed, and Pelorat visit reports.
    • Operator permissions go deny-by-default. Starting with compensation and finance approval — and the fail-open where an operator with no assigned role acted as an owner is closed.
17. July 9, 2026
    • NEW primitive: Trevize (channel distribution), Live. A generic partner API with machine-partner auth and channel-collected money, availability push webhooks + iCal export, iCal import, commission reporting, partner-initiated modify, and a /dashboard/channels console — with partner availability windows capped at 31 days.
    • Bayta feedback + disputes completed. Public tokenized feedback fill-out with a booking-completed trigger, a testimonials render component with a rating/date public projection, and the dispute evidence panel + deadline nudges — plus a hardening pass over the public funnel.
18. July 8, 2026
    • NEW primitive: Devers (procurement + AP), Live. Vendors, purchase orders, one-transaction receiving into Trantor replenishment, bills with three-way match, AP ledger legs + aging, record-only payments, reorder automation, and the ACH rail seam on the Mock driver — plus /dashboard/purchasing.
    • Payout reconciliation (Payments + Mallow). ProcessorPayout ingest (Stripe + Mock derive), line-kind-aware payout posting through the new 1010 Processor Clearing account, tender-aware payment/refund postings, and a reconciliation console + account-balance report.
    • Riose: time & attendance through payroll. Pay periods + close flow, per-position rate overrides with FLSA blended-rate overtime, manager punch edits + a review queue, PTO balances, a kiosk time-clock UI with PIN identify, shift reminders over the Seldon emission pipeline, batch publish-week with a Speaker digest, payroll runs on the MockPayrollDriver, and consoles for timesheets, punch review, and payroll.
19. July 7, 2026
    • NEW primitive: Riose (workforce) — scheduling end to end in a day. Positions + shifts with an overlap guard, recurring schedule patterns with apply-week materialization, open-shift claims, swap requests with an approval lifecycle, time-off + scheduling advisories, availability preferences — and the schedule console (week grid, per-shift publish/assign/cancel, approval tabs). The time clock, overtime calculator, persisted timesheets, and compensation profiles landed the same day.
    • Shifts gate bookability. Published shifts project ResourceAvailabilityWindows into Trantor, and discrete allocation subtracts staff-less windows — customers can only book what's actually staffed, with a reverse guard when canceling a shift that already has bookings.
    • Loyalty completed (Mallow). Redemption quotes + ledger-less redeem, order- and booking-sourced punch cards with store-credit rewards, person-locked percent-off-next-visit promo rewards, a points-expiry sweep, and tiers by teaching the existing Terminus TierEvaluator to read loyalty stats.
    • Bayta (customer voice) opens + Hober dunning. Support cases with links, notes, and a queue; then the feedback funnel — happy visitors routed to a public review, unhappy ones to a private auto-opened case — firing automatically on completed visits, and a disputes-as-cases subscriber. Hober subscriptions got real dunning: emission-scheduled retries with per-attempt idempotency and a policy-editor console.
    • Intake forms (Terminus + Radiant). Form definitions as Radiant assets, validated submissions, per-person form status, and a forms console — the substrate the waiver-at-the-door access rule now reads.
20. July 1, 2026
    • Mannix account kill switch. Principal.status — active / locked / disabled — is now enforced at every authentication conclusion point (password, TOTP, passkeys, Google, OIDC issuance, API keys), with a staff command to flip it. A disabled account is dead across every tenant it links to.
    • Money correctness: refunds and multi-rate tax. Mallow's per-rate tax posting scales to the snapshotted line taxCents, so multi-rate invoices post exactly what was charged — and refunds now pro-rate order-level discounts into a signed credit-note line, so a discounted order refunds what the customer actually paid, not the sticker price.
    • Continuous deploy, armed. A green main now auto-deploys dev; prod stays manual dispatch. The pipeline diffs each image against its deployed pin, so a docs-only commit ships nothing and burns nothing.
21. June 15, 2026
    • Location-scoped staff act-as. Staff acting as a tenant can pin into a single location (sub-tenant scope) from the Demerzel console switcher, and act-as reads now carry the acting tenant correctly across Hardin, Daneel, and onboarding.
    • Booking-surface polish. Signed-in customers get name and email prefilled at booking; published sites grew a customer sign-up surface; and the booking surface's per-hour exception-window N+1 is dead, with proxy timeouts raised to kill sporadic 502s.
22. June 14, 2026
    • Demerzel visual editor. A visual BlockEditor for simple pages — nested-container drill-in, one-step "Add a page" (create + route in one action), and task-first dashboard pages with drag-reorder — on top of ui_view's new responsive columns, styled nav, and real button styling (with publish-validation and design tokens fixed to match).
23. June 12, 2026
    • Seldon emission hardening. The emission watcher survives dropped database connections, and cascade hops serialize under the target-scheme lock — closing a slot-dedupe race under concurrent cascades.
    • Demo sites got personality. Navigation, About and FAQ pages, and photographic art across the demo verticals.
24. June 11, 2026
    • Hardening phases 0–2, complete and in production. The June 10 review's launch plan executed in a day. Phase 0 closed the tenant header-trust hole with a trusted-proxy-secret gate — only callers presenting X-Foundation-Proxy-Secret (injected by the render-runtime and console on every server→API call) may assert a tenant header. Phase 1 added a per-account brute-force lockout on Mannix password credentials, Speaker delivery-webhook signature verification plus a closed device-registration IDOR, structured JSON logging in prod, CloudWatch alarms with an SNS pager on the deployment unit, an inert-by-default continuous-deploy workflow, and a disaster-recovery runbook (point-in-time database restore plus secret and scheduler recovery). Phase 2 brought a tenant SUSPENDED / CLOSED kill-switch, GDPR person data export + anonymize-in-place erasure, and a two-connection test harness proving the locking invariants. Prod is pinned to the full Phase 0+1+2 release.
    • Stripe Payment Element deposits. Booking deposits are now collected with real cards on the public booking flow: a booking-deposit PaymentIntent endpoint on Payments, webhook settlement (payment_intent.succeeded settles the deposit and confirms the booking), and a Stripe Payment Element deposit widget in the render-runtime.
    • POS tax. The Hober point-of-sale path now charges sales tax, and the tax-divergence bug between the order and the Mallow invoice is dead.
    • Synthetic smoke canary. foundation:ops:smoke probes the API and every published booking site end-to-end through the render proxy every 15 minutes; failures — and any refused tenant header — page immediately.
25. June 10, 2026
    • Whole-project review → Phase 0 fixes, same day. A verified whole-project health review produced a phased launch plan, and Phase 0 landed immediately: the Seldon/Trantor double-booking races and cross-tenant slot anchors are closed; the Payments/Mallow/Hober money path tells the truth (no more optimistic statuses ahead of the processor); cross-tenant, LFI, and XSS holes in Palver, Korell, and the render-runtime are fixed; prod stops leaking raw exception messages to API callers; credential endpoints are actually rate-limited (the old IP limiter targeted a dead route); and the scheduler service is restored to the deployment unit.
26. June 9, 2026
    • Pelorat report viewer. Report runs now write durable output to object storage and stream back through a tenant-scoped download endpoint (GET /pelorat/v1/reports/{id}/runs/{runId}/download) — reports stopped being fire-and-forget.
    • Mallow onboarding defaults. New tenants get their financial spine seeded at onboarding — a chart of accounts and a default tax rate — so the first invoice posts without setup.
    • Demo polish + a fresh API spec. Every step of the live demo now works end to end (payments, receipts + receipt config, reports, tabs), and the OpenAPI spec was regenerated — 429 paths, up from 320 — picking up Hober subscriptions, Terminus employees, and Pelorat downloads in the live API reference. Prod was promoted to the full release the same night.
27. June 8, 2026
    • Korell is live — AI-driven data import, end to end. The import primitive went from phase-1 scaffold to operator-usable in a day. Upload a CSV, XLSX, or a whole ZIP export of your old system (signed direct upload, an archive inspector enumerates the entries); propose_import_plan has Beth read your files against a typed target-field catalogue and propose the mapping; a dry-run preview validates before anything writes; and an ImportRefMap remaps cross-file IDs so customers imported this morning link to bookings imported this afternoon. Operators get a Demerzel import wizard (with per-file target + mapping editing and an inline run-in-chat card) — or just drag a data export onto Beth's chat. Targets so far include Terminus persons + employees and Trantor resources, with every row going through the target primitive's normal validation.
    • Mallow exports for the accountant. CSV financial export, a QuickBooks-ready QBO journal CSV, and PDF account statements (dompdf) — with a Demerzel export & statements download UI, Imports/Exports surfaced to tenant operators behind per-capability gating, and customer self-service statement download through Mannix.
    • Tenant isolation goes claim-mode — on prod. Tenant identity is now sourced from the verified Mannix token claim rather than a trusted header, activated on dev and production (with business-unit isolation claim-sourced and piloting STRICT on dev). The operator surface kept pace: an airtight operator-mode boundary in the render-runtime, the operator-capability proxy hop wired end to end, a Palver operator realtime token, and a frontend realtime client with a live_tabs widget for Palver-pushed operator reads.
28. June 7, 2026
    • Hober subscriptions v0. Recurring revenue landed as a real state model — a Plan, a Subscription, and a SubscriptionPeriodCharge per billing period — with a billing cycle that charges, invoices into Mallow, and advances the period, plus pause / resume / cancel and a full HTTP surface. Beth reads it and operators manage it from the console.
    • Multi-location businesses. Sub-tenant (business-unit) isolation arrived in one arc: a SubTenantQueryScoper + business-unit directory, a write guard with a real-database isolation proof, the header→claim flip, and the scoper rolled onto Person / Booking / Order / Invoice / subscription list reads. Demerzel gained admin business-unit CRUD, a per-location activity breakdown, and a team roster.
    • Employees & roles. Terminus grew an employee STAFF spine (roster + profile read model) and an employee provisioner — hire / re-role / suspend / terminate — driven from the console's new /dashboard/team. Underneath, a platform role/permission keystone (resolver + gate + catalogue) puts per-operator console roles on the token, with a PermissionGate rolled across operator and per-location admin surfaces.
    • Operators on the public site. The render path gained server-side view-level enforcement and a console→render operator identity handoff (revocable sessions + exit) behind an "Open operator view" button — and the first operator-gated component: POS as a widget, a pos ui_view component scoped by the new RENDER_OPERATOR front-end class.
29. June 6, 2026
    • Onboarding & invites. Beth's onboarding learned the difference between a duration and a cadence (a 14-day rental now provisions cleanly instead of failing), and invite-accept got friendlier — it reuses an existing operator rather than 409-ing, and prompts a brand-new invitee to set a password through Mannix.
    • Agentic onboarding. The tenant build loop became a real agentic loop: hard validation relaxed to integrity-only checks so Beth has room to design, Beth triggers the build herself when the design is ready, a second AI build critic confirms the design before provisioning, and build failures route back to Beth to fix and retry.
    • Variable-length stays. Multi-day rentals where the customer picks the length: an adaptive provisioner materializes multi-day stay windows on a range Offer, the BookingCalendar renders them, and Beth recognizes stays / rentals / variable-length businesses at onboarding.
    • Beth capability coverage, three waves. A 20-agent audit of Beth's tool coverage produced a fix-plan executed the same evening: her primitive catalogue rebuilt accurate + complete, safe non-sensitive reads exposed to her over MCP across 18 primitives, and the console's existing forms wired to useSherpaForm so she can drive them.
    • Quality gates & prod parity. A frontend quality gate plus a shared API-error mapper close a class of UI bugs, and end-to-end "getting into LatticeKit" access journeys now run in CI — with CI itself pulling a prebuilt runtime image (~50 min → ~5 min). On the infra side, prod gained full worker parity (a Daneel worker + a low-priority worker) and a fix for the emission worker that had been crash-looping.
30. June 5, 2026
    • Seldon emission, rebuilt for precision. The lifecycle-emission pipeline was reworked to fire events within tens of milliseconds of their target. A just-in-time emit consumer on a stripped-down runtime cut cold start to under two seconds; the Meerkat worker pre-warms on the upcoming schedule; and a deliver-at-target path leads each fire by the learned one-way latency so the event lands on time, not late. Cancels propagate as markers on the same queue, and fire times now carry microsecond precision.
    • Daneel execution modes, in plain language. Workflow execution modes are now operator-facing as Wait, Background, and Durable (Background is the default) — the old queue picker is gone — over the same execution backends underneath. A default Background queue + worker ship with it.
31. June 4, 2026
    • NEW: the capability registry. Every primitive now publishes its operations as typed capabilities in one platform CapabilityRegistry. The AI tool surface is auto-generated from it — the nine hand-written MCP tool providers were retired onto a single MCP bridge — and an exposure matrix gates every front-end by actor class (customer / operator / staff / AI). On top of it, operators (or AI) can wire an event straight to an outcome — a capability call, a Daneel DAG, or an SQS publish — through event→outcome bindings, with no workflow to author.
    • NEW: the needs ledger. A persisted ledger of deferred obligations (a Need) gates a flow until its condition clears: a booking deposit-to-confirm, an Elliot delivery payment-to-dispatch, an approval-to-proceed. Needs expire on a timer, unwind through saga compensation when a flow is abandoned, and surface in a Demerzel operator UI — approvals, pending payments, and outstanding obligations in one place.
32. June 3, 2026
    • Mannix completes the auth surface. The last four phases landed in a day: passkeys (WebAuthn, enrolled as "this computer" or "phone / security key"), social sign-in ("Continue with Google", pluggable), Mannix as an OIDC provider (a standard authorize / token / userinfo flow + discovery document, so third-party apps and branded domains can "Login with LatticeKit"), and machine API keys + a service-token exchange that ends the old internal header-trust. Operators get an Account → Security page for passkeys + MFA, and the console root is now a real sign-in rather than the waitlist landing.
    • Apex cutover, platform email, operator sessions. Production cut over to the latticekit.app apex behind a standalone root-DNS stack; Speaker gained a platform-managed default email provider (click and open tracking off); and operator sessions moved to a fast shared store, with staff operator management and the ability to invite an email to an existing tenant.
33. June 2, 2026
    • NEW: Mannix, the authentication primitive (in progress). One hardened enforcer owns every credential, token, and auth flow — for customers, operators, and machines, across every tenant. A global Principal (keyed by verified email) holds the credentials, so a customer reuses one login across businesses with no business-to-business visibility and without ever seeing "LatticeKit"; a per-tenant toggle can isolate a tenant's pool instead. Mannix issues short-lived RS256 access tokens that every primitive verifies offline against a published JWKS, with a revocable Session behind the refresh token. Today's phases — password auth, the cross-tenant pool + Terminus Person backlink, the operator cutover (the Demerzel console becomes a relying party, magic-link retired), and TOTP MFA — supersede the day-old Terminus customer-auth in a clean rebuild. Authorization stays with each primitive of record: Mannix says who, the owner says what they may do.
    • The page builder. The Radiant ui_view editor became a real site builder: a live preview that renders through the actual render-runtime (so it's WYSIWYG and data-bound widgets show live tenant data), if conditions evaluated as real CEL, view_ref layouts composed on a drag-and-drop canvas, theme assets that bind a palette, and a platform template library (Home hero, About, Hours, Contact, Gallery, FAQ, Menu, Booking) a tenant binds or forks. New no-JS disclosure and live menu (self-fetching the tenant's Hardin menu) components round it out.
34. June 1, 2026
    • Four demo businesses, fully populated. A one-command seeder provisions salon, restaurant, fitness, and courier tenants and drives synthetic customers through the entire stack — bookings across the full Seldon lifecycle into Mallow invoices + double-entry ledger, mock Payments, and consent-gated Speaker comms (a seeded salon tenant lands ~880 bookings / ~477 paid invoices). Each gets a real customer-facing home page with a live booking widget.
    • Seldon scheme templates + a real booking calendar. Parameterized scheme templates (Salon / Restaurant / Fitness / Services) materialize a working chair or table grid — cascade edges and all — in one POST /seldon/v1/templates/{id}/use. A new booking-surface read (GET /seldon/v1/availabilities/{id}/booking-surface) backs a scheme-aware booking_calendar render component, so demo sites take a real end-to-end customer booking in the business's own hours and timezone — with a best-effort confirmation email on self-serve bookings.
35. May 31, 2026
    • NEW: Media, the media-store primitive. A MediaAsset backs a three-step presigned-upload flow — the browser PUTs the bytes straight to storage and the application never proxies a file. Public assets serve from a CDN that alone can read the private store; private assets mint short-lived signed reads. A Demerzel media library uploads, browses, copies URLs, and deletes. Everything else points at an opaque med_* id.
    • NEW: Sign, the e-signature primitive (in progress). One SignatureEnvelope drives the signing lifecycle (DRAFT → SENT → PARTIALLY_SIGNED → COMPLETED, with declined / voided branches); the document is a Media asset and each signer an opaque Terminus ref. The actual vendor sits behind one SignatureProviderInterface — the same driver shape as Payments processors and Elliot carriers — with HMAC-verified webhooks advancing status and the executed PDF recorded back into Media. A Mock driver ships today; the Demerzel signing UI composes envelopes and manages providers. Real DocuSign / Dropbox Sign / Adobe Sign drivers are the next slice.
    • Elliot freight EDI. Elliot gained an X12 layer so carriers that run on EDI rather than REST ride the same tender lifecycle — a built-in codec emits a 204 Load Tender + 997 ack and decodes inbound 990 / 214 / 997, with async tendering parking a shipment in TENDERED until the 990 resolves it. The carrier-driver registry made it a new CarrierType::EDI driver, no core rework.
    • Seldon variable-duration grid bookings. A grid Booking can now span N consecutive SlotInstances, so a set-duration service (salon 30 / 60 / 90) books on the appointment grid without abandoning it — contiguous slots locked in id order, capacity restored across the whole span on cancel / no-show / modify. Plus a per-scheme generation lock so concurrent slot regeneration can't double-run.
    • Seldon group & staged bookings, Daneel-owned journeys. Three more booking shapes landed on top of the grid work. A BookingGroup parents N sibling Bookings with all-or-nothing creation — one member failing (slot full, tier gate, no resource) rolls the whole group back with no leaked Trantor holds — plus single confirm / cancel and a single-invoice anchor (POST /seldon/v1/booking-groups). A range-availability window enumerator projects the bookable windows for a range Offer the way the grid pre-renders slots (GET /seldon/v1/availabilities/{id}/windows), cached and busted on every booking write; a matching Trantor fix makes the discrete-resource read path overlap-aware, so a resource with an unrelated same-day hold stops hiding its other free windows. And multi-stage journeys are now orchestrated by a Daneel DAG instead of a Seldon entity: a seldon.book_offer step books a stage and seldon.cancel_booking compensates it, so a tenant composes book → wait → book → branch as a workflow — a staged_flow Offer is booked through its DAG, not directly.
    • Payments & Hober deepened. Payments filled in manual capture (authorize-now / capture-later, partial + tip), stored-credential / MIT reuse, processor routing + failover, a full dispute / chargeback state machine, and signature-verified per-processor webhooks (dedupe + dispute ingestion). Hober added refunds & returns (an OrderRefund that books a Mallow CreditNote and restocks inventory through the outbox), even-split payment, delivery-address editing, a receipt-printer driver seam, and a ledger-readiness probe.
    • Deferred-backlog sweep across the Live primitives. A broad pass filled in the next slice on nine primitives: Mallow AR-aging + a TaxJar/Avalara provider seam; Terminus segment CEL→query compiler, attribute constraints, and HoldBack trim/reject wired into Seldon booking; Trantor pluggable allocation strategies, RRULE blackout rules, low-stock alerts + purchase orders, and a real hold sweeper; Hardin tier / channel / segment pricing scopes; Radiant POST /validate, YAML parse-on-publish, and generic promote-to-asset; Speaker fallback-on-failure chains + a web-push driver scaffold; Palver per-entity ACL v2 (CEL) + replay-from-position; Branno experiment scope + a termination sweeper; and Daneel reactive state triggers v2.
    • Demerzel: onboarding, dashboards, and a handbook. A new Explorer walks a new operator through a conversation that provisions their tenant and then tours it; operator dashboards landed for the Media library and Sign envelopes; proactive insights and clustered Signal Themes graduated to v1; a mobile-friendliness pass shipped; and a staff-only Engineering Handbook (72 codebase-derived docs behind the staff gate) went up.
    • Sandbox & platform hardening. Test-mode gained one-click Reset sandbox (purges every sandbox-tagged invoice / message / charge / effect for the tenant) and report isolation — sandbox audit events are tagged and excluded from Pelorat, so test traffic never pollutes reports. Tier-1 production scaling added two cache pools (disposable vs. never-evicted) and a durable-pool-backed rate limiter returning RFC 7807 429s.
36. May 30, 2026
    • Elliot is live. In a day the logistics primitive went from MVP to real carriers: production-grade parcel drivers (EasyPost, Shippo, direct UPS / FedEx), on-demand last-mile couriers (DoorDash Drive, Uber Direct), and a freight LTL/FTL broker driver with a full CarrierTender lifecycle (shop every broker → award → tender). Signature-verified carrier tracking webhooks ingest status and stream it to Palver, and a Hober order.closed now auto-creates a draft shipment — ship-to from the order, one parcel per line at the variant's ship weight.
    • Composable additions to the Live primitives: Mallow stored-value — gift cards, store credit, and loyalty as one double-entry ledger primitive (open / issue / redeem); Terminus typed Person attributes — composable custom customer fields with a promoted index that Magnifico audiences filter on; Seldon event-series + roster — leagues and tournaments as an additive listener over Offers (series, sessions, registrations, attendance); and Payments card-present (EMV) Slice 1 — connection tokens + a capture-mode for in-person chip terminals.
    • Speaker push. A real PUSH channel: a Web Push driver (VAPID) and a device-token registry back browser and mobile push, the operator console ships as an installable PWA, and the first live trigger pushes operators when a proposal needs review.
    • Radiant ui_view templates + instances: author a view once with a typed variables: block, instantiate it per tenant, and resolve at render time. The Layer-2 git bridge is real now too — creating a proposal enqueues an async job that materializes it to a GitHub branch + PR without blocking the API.
    • Sandbox / test-mode (platform): a per-request sandbox flag and an effect log that captures what would have happened, with egress neutralized so Speaker won't send, Payments won't charge, Mallow won't post, and Elliot won't dispatch — while every internal effect still runs for real. An effect-log endpoint (its own Sandbox API tag) and a Demerzel toggle let an operator flip into test mode and review the captured effects.
    • Failure console: one feed for everything that breaks. A HealthSignal store + ingest API collect failures from the CI gate (PHPStan + PHPUnit on every push and PR), the nightly tester, and production, surfaced in a Demerzel dashboard and mirrored to GitHub — so a regression shows up in one place instead of scattered logs.
    • Demerzel: the assistant Beth gained voice input, a mobile-friendly panel, and the full bookable-business playbook, plus proactive insights — evidence-backed nudges Beth raises on its own — while operator feedback clusters into a ranked staff backlog (Signal Themes). Operators can now author Radiant proposals in-dashboard (make a branch, AI-draft or hand-write, see the diff), spin up a real or demo tenant from the admin page, and bulk- or duplicate-create resources. MCP coverage and dashboards expanded across Elliot (carriers + shipments), Magnifico, Mallow stored-value, Terminus attributes, and Seldon event-series.
37. May 29, 2026
    • NEW: Elliot, the logistics primitive. One Shipment model and one mode-agnostic carrier-driver contract (quote / book / cancel) span three flavors that all landed today: parcel shipping (quote → buy label → track), last-mile own-fleet (zone-gated dispatch, pickup/dropoff stops, driver progress), and recurring B2B freight (RRULE route templates → materialized runs → advisory load consolidation). A Mock and an OwnFleet driver ship; real carriers (EasyPost, UPS, FedEx), real geocoding/routing, and the cross-primitive wiring are the next slices.
    • Branno is live — and now wired into pricing end-to-end. Hober calls the bandit when a line is added to an order and attributes the realized revenue back when the order closes (durably, through the outbox relay). A continuous-reward Normal-Gamma allocator joins the binary Thompson one, and an auto-convergence detector runs hourly on the new platform scheduler — settling experiments that clear their confidence threshold and, for proposals started from Radiant, self-merging the winning variant with no human in the loop. Demerzel surfaces the convergence verdict per experiment.
    • Seldon field-service: travel-aware availability. An Offer can carry a travelBufferSec that widens only the Trantor hold window, so a technician's prior job bleeding into the inbound drive is rejected as a conflict; a service-area gate runs each booking through Elliot's zone resolver; and a read-only tech-route view projects a technician's ordered day with appointment and travel-buffered windows.
    • Hardin demand signal: a predictive demand feature now feeds the yield engine. An hourly job refreshes a model-free trailing-velocity signal per variant; a YieldRule can reference it (predicted_demand) to adjust the base price before Branno's bandit layer sits on top.
    • Demerzel: MCP tool coverage expanded to Hardin pricing, Branno, Pelorat, Payments, and Speaker; per-experiment convergence surfaces; invitation emails now send outside the DB transaction; and the assistant now presents as Beth.
38. May 28, 2026
    • NEW: Branno, the experimentation primitive. Experiment + Arm + Allocation with Thompson / UCB1 / ε-greedy / fixed-split allocators; cohort-stable allocation (a UNIQUE(experiment, cohort) row means one customer always sees one arm); push-attribution of outcomes, idempotent on the source reference. It closes the config-as-code loop with Radiant: a VersionProposal can carry a banditExperimentId, run as a live experiment when it's approved, and the winning arm merges itself — or the proposal closes if control wins.
    • Radiant config-as-code grows three layers past the pull-request primitive: a Layer-2 git bridge (in-memory back-end + signature-verified webhook receiver — a skeleton ahead of the real GitHub client), a Layer-3 AI proposal author (POST /assets/{id}/proposals/draft-with-ai opens a proposal with authorKind=AI), and the Layer-5b bandit handoff above. Assets also gained an audience (tenant_private / tenant_public / platform) and a fork endpoint that copies a platform asset into a tenant.
    • Demerzel AI + admin surfaces: a performance-review agent reads Pelorat reports, calls the model, and opens DRAFT Radiant proposals (authorKind=AI) for a human to approve; the Sherpa autopilot lets the chat drive the dashboard itself through a browser-tool transport (WebMCP) with Manual / Auto / On-rails modes; plus the Palver Live Activity page, an admin waitlist queue with ?q= search, and one-click staff demo tenants.
    • Platform hardening: a security-audit sweep landed a real JWT-backed StaffGate in production with act-as override, a lock + idempotency + cumulative cap on payment refund/void, a pessimistic lock and status re-assert on Hober order close, Speaker failing closed on consent for identified recipients, discounts posting negative ledger lines + capped invoice discounts + compounded stacked codes, and the outbox relay re-acquiring its row before stamping.
    • OpenAPI generator + combined spec. Foundation now exports a single foundation.json generated from route introspection — 197 endpoints across every primitive, with per-primitive tag providers. The live API reference renders it with deep links from every primitive page (#tag/Radiant, #tag/Seldon, etc.).
    • Palver is live: real-time channels are deployed. Realtime runs at wss://palver.latticekit.app behind the same TLS as the API; the connect/subscribe proxy authorizes against Terminus on the same JWT the REST endpoints use. Twelve per-primitive channel derivers fan domain events out of the audit outbox, publishing happens out-of-transaction, and Demerzel's new Live Activity page subscribes over the live socket.
    • NEW: Magnifico phase-1 marketing primitive. Audience + Campaign + CampaignRun + CampaignAttribution + Conversion entities; AudienceEvaluator + CampaignRunner; Daneel step handlers for in-flow dispatch; HTTP controllers for audiences and campaigns. Speaker dispatches; Terminus consent-gates; Daneel executes the steps.
    • Radiant Layer-1 PR primitive: VersionProposal + ProposalComment + ProposalApproval. Asset changes now flow through pull-request-style review — employees and AI agents open proposals through the same API; tenants configure required approvals; the merge handler atomically writes the new AssetVersion, sweeps superseded siblings, and emits the outbox event. DRAFT → OPEN → APPROVED → MERGED with explicit conflict gating.
    • Hardin pricing engine: dynamic pricing grows from phase-1 scopes into a full engine over a day — phase 2 (Magnifico audience scope on PriceOverride), tier 3 (raw CEL PricingRule fallback), tier 4 (YieldRule for yield / surge / off-peak adjustments), tier 5 (cart-shape promotions: CartDiscount, BogoPromotion), tier 5b (BundlePromotion fixed-price combos), and tier 6 (customer-redeemable promo codes with Hober redemption at order close). The catalog now carries every shape a real merchant pricing engine needs.
    • render-runtime AC1+AC2: the tenant-facing SSR runtime ships its ui_view component catalog (eight layout primitives) plus server-side ${binding.…} resolution and a data-loader. Demerzel-authored sites now have a real rendering layer underneath them.
    • Pelorat phase 3: report definitions and scheduled runs. Report + ReportRun entities plus a ReportRunner service plus a Daneel step handler — reports can now be authored, scheduled, and delivered through the same workflow engine that drives operational flows.
    • Demerzel authoring surfaces: Seldon dashboards (TimeScheme / Instance / ExceptionWindow / Edge) with a calendar view; a templates dashboard with per-row fork and audience-aware picker. Operators can configure scheduling and edit messaging without curl.
39. May 27, 2026
    • Demerzel operator console launched at latticekit.app — magic-link auth, AI chat with an MCP tool registry over every primitive, visual asset editor with "Apply to editor", multi-page tenant sites backed by a dedicated render runtime.
    • Daneel goes from scaffolded to a full DAG engine — branch, switch, parallel, join, sleep, wait-for-event, wait-for-signal, and loop control-flow nodes; CEL triggers; a three-backend executor; ad-hoc run + external signal-send endpoints; retry policy; domain step library (fire_lines, serve_line, dispatch_action).
    • Speaker real drivers shipped — real email delivery with inbound forwarding, and SMS. Mock driver retires from the dispatch path; consent-gated email and SMS are live.
    • Payments real drivers shipped — tokenized Stripe (PaymentIntent capture + status mapper) and tokenized Finix (Authorization → Transfer → Reversal). Credentials thread through refund and void; Transaction snapshots the consumer-entity link.
    • Mallow posting pipeline closed — chart of accounts lazy-seeds on first invoice; the register-payment subscriber flips Invoice to PAID on Hober close; refunds post a compensating Journal; TaxJurisdiction + JurisdictionResolver for address-driven tax-policy auto-pick; FiscalPeriod operator CRUD.
    • Terminus TierDefinition entity + auto-enrolment evaluator — tier programs now carry structured policy (entry rules, default validity window), not just Group + GroupMember rows.
    • Trantor calendar-aware allocation shipped — closed_by_calendar shortfall returns structured 409 detail when a Resource's availability calendar blocks an allocation window.
    • Two new primitives: Pelorat (reporting-fork data plane, phase-1 data plane + phase-2 query + backfill) and Korell (data-import primitive, phase 1).
40. May 26, 2026
    • Documentation hub launched with 11 primitive spec pages, each with concepts, API surface, real examples, and a Mermaid architecture diagram in "How it fits."
    • Getting started walkthrough: seven curl calls from registering a Radiant repo to a confirmed Seldon Booking.
41. May 25, 2026
    • Hober order primitive designed — POS live order tabs with split-by-item, split-tender, snapshot-at-add-time pricing, and a long-running OPEN → CLOSED lifecycle that lands as a Mallow Invoice.
    • Hardin catalog designed — products, variants, modifiers, composite-slot combos, recipe-driven Trantor inventory consume on order close.
    • Payments v0 landed — ProcessorConfiguration + Transaction + a mock driver. Expansion (PaymentIntent / Authorization / Settlement / Dispute) designed and queued.
42. May 24, 2026
    • Terminus RankedGroup landed — one Group + GroupMember pair replaces eight near-duplicate entities (household, family, corporate, team, joint_account, care, tier, ad_hoc). Standalone Membership entity dropped.
43. Earlier in May
    • Seldon BookingLifecycleAutoAdvancer wired to the outbox — booking.starting and booking.ending emissions auto-promote status (confirmed → checked_in → live → completed) without operator intervention.
    • Seldon Booking PATCH for modify — atomic Trantor hold swap, emission resync, gated by cancelDeadlineSec and modifyRevalidates.
    • Trantor allocator: atomic all-or-nothing holds via PESSIMISTIC_WRITE; AllocationConflictException returns structured 409 shortfall detail.
44. Earlier in 2026
    • Seldon universal scheduling model locked — Offer + Availability + Booking handles appointment, stay, queue, open_capacity, staged_flow, and external sources in one model.
    • Radiant Git-backed config registry live — Repository, Asset, AssetVersion, Alias, and the resolve endpoint that pins a stable id to an effective version.
    • Trantor and Terminus directory services wired into the Booking flow via dependency injection — cross-primitive opaque-id refs, no database FKs.