The founder console

Status: Candidate — awaiting founder verification. Why this page exists: The /admin surface is the single most important UI in Apiary. This is the design rationale.

TL;DR

The founder console is a 7-tab unlock-gated admin surface at /admin. It exists so the founder can see, pause, and budget every part of the hive without having to read the substrate by hand. Every destructive action has a confirmation gate. Every change is recorded in the audit log.

The seven tabs

Tab 1 — 💰 Budget Caps
  Per-cycle and per-session token spending sliders.
  Confirmation gate: type "APPLY" to commit changes.
  Reason: budget changes are the #1 source of unintended spend.

Tab 2 — 🤖 Agent Controls
  List of every agent in the hive. Pause / resume / kill per agent.
  Bulk pause / resume / kill for the whole hive.
  Reason: the founder needs to stop a runaway agent in one click.

Tab 3 — 🚦 Phases
  Apiary's roadmap as a state machine. Current phase highlighted.
  Future phases locked. Past phases marked complete.
  Reason: the founder always sees where the system is in its journey.

Tab 4 — 🔒 Locked Features
  Every memory-flagged lock listed with reason.
  (Stripe code, locked CSS, Phase 2B ordering, etc.)
  Reason: the founder can audit what's protected from agent edits.

Tab 5 — 📊 Live Ops
  Current spend trajectory vs. budget. Today, this week, this month.
  Real-time agent activity feed.
  Reason: catch problems before they become spend disasters.

Tab 6 — 📜 Audit Log
  Every committee vote, every CEO tiebreak, every reconsideration,
  every founder intervention. JSON-exportable.
  Reason: the regulatory layer. If something goes wrong, there's a trail.

Tab 7 — 🐝 Foundation Team
  The 6-agent foundation crew (Cartographer, Archivist, Strategist,
  Estimator, Scribe, Quartermaster). Session launcher for batched work.
  Reason: this is the team that builds future Apiary releases.

The unlock gate

/admin requires an unlock token. Default token in the dev build is let-me-in. The token is stored as an env var in production. Three properties:

Per-device. Unlock state is localStorage. Other devices see no /admin link in the nav.
Revocable. "Lock console" is a button in the nav once unlocked. One click, the link disappears.
Audit-logged. Every unlock and lock is recorded.

This is not a security boundary — anyone with the token can unlock. It's a handle: it prevents the founder from accidentally clicking into an admin tab on their phone and from leaking the surface to a visitor.

Design rules for the console

Three rules govern every tab:

1. Read first, write second. Every tab opens in a read-only view. Writing requires explicit action. 2. Destructive actions need a gate. Budget changes type "APPLY." Agent kills double-confirm. Wipes need the founder's email typed. 3. Every write is logged. Audit log captures who (founder), what (the change), when (timestamp), and why (optional reason field).

What the console is not

Not a dashboard for end users. Apiary has a separate /dashboard for non-founder users.
Not a chat interface. /chat is its own surface.
Not a replacement for the substrate. Every change still writes to markdown files. The console is just a more humane interface for editing them.

Why the console matters

A founder console is where Apiary's "oversee" pillar becomes operational. Without it, "the founder can intervene whenever they want" is a slogan. With it, intervention is a button.

The console is also the surface that distinguishes Apiary from the long tradition of "agent frameworks." Most frameworks ship a CLI and a config file. Apiary ships a console because the assumption is that someone is watching — and that someone deserves a good seat.

Source quotes

"Seven tabs across the top: Budget Caps, Agent Controls, Phases, Locked, Live Ops, Audit Log, Foundation Team. Click 'Lock console' in nav → the /admin link disappears. Re-unlock → the link comes back. Persists across reloads."