Platform

Six surfaces, one source of truth

NODAVX is a graph store, a live projection of it, and a disciplined path from a question to a committed change. Nothing on the screen is a second copy of the truth.

Build state

What is implemented today

Every row below was exercised through the public HTTP surface, not unit-tested in isolation.

Surface	State	Evidence
Vertex	Built	584 entities in the commercial pack and 615 in defense, each typed, scoped to a workspace, searchable and inspectable.
Edge	Built	1,507 native record links in the commercial pack and 1,502 in defense, with declared cardinality; traversal is one query, and removing a node removes its edges from the snapshot.
Meta	Built	Ontology Studio creates and edits object and link types at runtime; an invalid link is rejected with the rule that broke.
Atlas	Built	R3F scene with worker-side d3-force-3d layout, filters, lenses, selection, and a history replay mode.
Reason	Built, single-user	Retrieval plus graph grounding with clickable citations and a supporting-subgraph action. Vector search is off until an embedding model is verified.
Twin	Built, single-user	Scenario branches, patches, compare, reviewed action preview/commit with idempotency, and a replayable journal.

Screens

The product, as it actually renders

Captured from the running application at 1600×1000. No mockups, no composited dashboards.

Workspace launcher: Two segment packs with live per-workspace counts, and a local service panel that names SurrealDB and the inference endpoint instead of hiding them. — **Workspace launcher** — Two segment packs with live per-workspace counts, and a local service panel that names SurrealDB and the inference endpoint instead of hiding them.

Readiness margin flips to −6: After the maintenance failure: 3 ready vessels, 48 places of capacity against 42 demanded, and a Shortfall tile that prints its own subtraction. — **Readiness margin flips to −6** — After the maintenance failure: 3 ready vessels, 48 places of capacity against 42 demanded, and a Shortfall tile that prints its own subtraction.

Margin restored to +6: Reserve vessel committed. Same tab, no reload — the journal cursor advances and the mission list stops crediting the broken platform. — **Margin restored to +6** — Reserve vessel committed. Same tab, no reload — the journal cursor advances and the mission list stops crediting the broken platform.

Object inspector: One platform as records: status, capacity, maintenance history and the links that place it in a mission. — **Object inspector** — One platform as records: status, capacity, maintenance history and the links that place it in a mission.

On hand versus planned supply: A transfer in transit is planned supply, never stock: on hand stays 80 units while planned supply rises to 140. — **On hand versus planned supply** — A transfer in transit is planned supply, never stock: on hand stays 80 units while planned supply rises to 140.

Shortfall closed at zero: After the transfer and the expedite, with the committed intervention cost of SGD 1,380.00 held as integer minor units. — **Shortfall closed at zero** — After the transfer and the expedite, with the committed intervention cost of SGD 1,380.00 held as integer minor units.

Ontology Studio: Object types and link types as editable records with cardinality rules — the model is stored data you can query. — **Ontology Studio** — Object types and link types as editable records with cardinality rules — the model is stored data you can query.

Copilot with citations: A grounded answer whose citations each select an object, with status, model name and elapsed milliseconds printed in the footer. — **Copilot with citations** — A grounded answer whose citations each select an object, with status, model name and elapsed milliseconds printed in the footer.

Branch compare: A scenario branch beside reality, so a what-if is judged before it becomes a commit. — **Branch compare** — A scenario branch beside reality, so a what-if is judged before it becomes a commit.

Ingestion rejects: Invalid arrivals refused with named reasons rather than coerced into a shape that would pass. — **Ingestion rejects** — Invalid arrivals refused with named reasons rather than coerced into a shape that would pass.

Keyboard-first navigation: Every primary journey is reachable without a pointer, including selection and the inspector. — **Keyboard-first navigation** — Every primary journey is reachable without a pointer, including selection and the inspector.

Scope and permission

A session decides what you can see, and the API enforces it

Workspace scope comes from the session and never from a query string, so an edited URL cannot reach into somebody else's data. Cross-workspace reads, evidence, actions and live updates are all refused, and that refusal is one of the asserted journeys.

Role	Granted
viewer	Read snapshots, search, inspect, follow the live stream.
analyst	Everything a viewer can do, plus scenario branches and previews that write nothing.
operator	Create and update entities and relations; run and commit reviewed actions; ingest arrivals.
owner	All of the above plus workspace and ontology changes.
public URL	Clamped to viewer. A request that arrives through the tunnel cannot mint a stronger session and cannot write — it is told so in the 403, not left guessing.

Interface

Every surface is one HTTP call away

The UI is a client of the same API it ships with, same-origin, so the browser never holds a credential and never talks to a second backend.

Method	Path	Contract
GET	/api/graph	The one snapshot contract. Filtered, bounded, and identical to what the table and inspector read.
GET	/api/search	Bounded entity search over the current workspace.
GET	/api/entity/:uid	One record with its evidence and links.
GET	/api/stream	Server-sent events carrying invalidation only — never a payload an attacker could invent.
GET	/api/actions	Action types with their preconditions, split into blocking and advisory.
POST	/api/actions/:type/preview	Compute the consequence and write nothing.
POST	/api/actions/:type/commit	Apply it with an idempotency key; a replay duplicates nothing.
POST	/api/ingest/preview	Validate a payload against the ontology and report every reject by name.
POST	/api/copilot	Grounded question answering; the answer names its sources and its model.
POST	/api/scenarios/:uid/compare	Branch versus reality, field by field.

The live stream carries invalidation only: event: invalidate with a workspace id, a journal cursor and a reason. The client then refetches the snapshot it is allowed to see, so a forged event can cause a refresh but never inject a fact.

Open the atlas and click around

The public deployment is the real application in read-only mode — pick a pack, drag the globe, ask the copilot a question and follow its citations.

Open the atlas See the test gates