perffection.com owner product command center over generic cairn routes Public shell
owner product command center

Run the live intake, reviewed preview, and governed launch path from one workspace.

This owner workspace turns the proven perffection intake and reviewed-preview flow into an operator-friendly command center over cairn's generic owner console, CRM, app-state, feedback, and app-review routes. It shows safe product state and explicit actions; PII reveal stays governed and email remains outside this workspace.

Lead intake

Private briefs and safe app-state row ids for owner review.

generic app-state

Reviewed preview

Separate candidate route state, promote, rollback, and preview link.

generic app-review

Feedback loop

Safe feedback metadata first; body plaintext requires a governed owner read.

generic feedback inbox + read

Ops posture

Resource counts and route checks without exposing engine internals.

owner evidence
  • Anonymous visitors get no owner ids, lead rows, CRM rows, reveal actions, or runtime listings.
  • The bearer token is used in memory for this page load only and is not stored in browser storage.
  • cairn remains the generic runtime; perffection is the app and product interface over it.

Owner access

bearer required

The first request is a generic owner-console JSON read. App-state and CRM checks happen only after that owner route authorizes the bearer.

Locked. Enter an owner principal and bearer token to load safe owner posture.

This page can perform explicit governed app-state lead reveal after owner authorization. It can also ask cairn's generic reviewed-app API to promote or roll back a reviewed edit candidate. It does not perform CRM profile reveal, app-state rollback, email, signup, Stripe webhook ingress, or production-money movement.

Owner metrics

0 owned apps visible through verified owner console
0 CRM customers counted for this owner
0 CRM interactions counted for this owner
0 resource status rows counted for owned apps

App portfolio

This owner-only portfolio is derived from Cairn's generic owner-console JSON. It is a Bootstrap-like admin pattern over shared primitives: app refs, routes, usage, resource posture, billing, CRM, support, review/promote, rollback, provider evidence, and app-user admin surfaces can be composed per app without crossing tenant boundaries. Voice-interview creation lanes stay future governed inputs: private transcripts, provider receipts, resource charges, and owner-reviewed build briefs before any generation or promote.

Locked until owner authorization. App portfolio rows use safe owner-console metadata only.

New app creation brief

This owner-only workbench is the first self-serve app creation step. It drafts a browser-session-only brief for a future reviewed source candidate. It does not create a Cairn app, move refs, run source review, generate code, deploy, promote, rollback, bill, email, provision domains, create users, call providers, run LLM or voice actions, or write browser storage.

Initial modules 
No browser-session app creation brief drafted.
No hosted app-build request sent. Preview/create require an authorized owner bearer and an explicit click.

Review-only starter candidate proof

The first source-candidate bridge is checked in as a generic cairn app-source manifest, but this owner page does not call it. The local M94 proof runs a synthetic owner through generic app-source-review only: no app refs move, no effects run, no app is deployed, and the over-capability negative stays local-only.

review-only

Safe starter manifest

`perffection-app-creation-starter-source-manifest-chirho.json` uses a PrivateBlobRef root for future private intake bodies and a plain starter-preview route for value-free review display.

zero caps

No effects path

The safe starter candidate requests no capabilities, has zero token cost, and remains non-authoritative until a separate owner-gated reviewed promote step exists.

negative proof

Capability escalation visible

A local-only over-capability manifest proves requested write-store capability is surfaced at review without moving live refs or publishing the bad candidate.

Voice interview creation boundary

This owner-only boundary maps spoken app interviews onto generic Cairn primitives before any provider is opened: realtime sessions, private transcript refs, provider usage receipts, resource/ledger charges, plaintext-free access evidence, and owner-reviewed build briefs. It is not a microphone widget and it does not call ElevenLabs, upload audio, run live transcription, run live LLM generation, create source candidates, deploy, promote, email, bill, or start provider action.

  • Customer or owner speech private transcript blob or browser-session-only draft No public/plain durable transcript row is opened by this page.
  • Safe discussion metadata support/build-brief candidate only The owner chooses what becomes a reviewed source candidate or promote step.
  • Provider rollout separate approval required Voice provider calls require signed receipts, resource accounting, ledger evidence, and no-secret verification.

perffection.com login and OAuth boundary

This owner-only boundary separates the future user-facing perffection.com login from the generic Cairn records underneath: identity rows, Argon2id credential inventory, sessions, auth-attempt limits, OAuth clients, scoped tokens, wallets, ledger/gas accounting, revocation, and audit. It does not perform public signup, public login, OAuth authorization, third-party provider login, token issuance, app-user provisioning, impersonation, hosted email, domain provisioning, checkout, production money, public webhooks, real-user email, live voice provider, or live LLM generation.

account-foundation-chirho.json is the checked account foundation map for the full app: platform admin, tenant owner, app user, and service-account layers. It keeps public signup, public login, OAuth authorization, token issuance, password reset, and third-party provider login closed until a reviewed implementation and hosted evidence promote them.

  • Platform admin safe oversight only L.J./operators can review tenant/app posture through audited actions, not silent owner or app-user impersonation.
  • Tenant owner multi-app admin One owner dashboard can administer apps, budgets, support, review/promote, rollback, provider state, and app-user roles.
  • App user perffection.com account theme Each app may personalize the frontend account/admin theme while reusing generic Cairn identity and accounting boundaries.
  • Provider services future offering only Hosted email, domains, storage, media, or analytics require custody, quota, billing, receipt, revocation, and admin evidence before offering.
  • Full app sequence account rails first Self-serve app creation, LLM and voice edit discussions, payments/topups, domains, email, provider services, and real platform-admin actions depend on this foundation.

Platform admin safe oversight boundary

This owner-visible boundary sketches the future L.J./Perffection platform-operator view: tenant/app inventory, service-account gas floors, public-edge monitor status, provider enablement posture, billing evidence, support posture, launch gates, custody/rotation evidence, and signed operator-action history. It is a safe status model only. It does not impersonate tenant owners or app users, does not expose raw bearer tokens, sessions, credentials, provider secrets, billing secrets, private blobs, customer plaintext, support plaintext, feedback plaintext, CRM plaintext, email payloads, or raw ledger internals, and does not run rollback, promote, provider, email, payout, signup, OAuth, token, domain, webhook, voice, or LLM actions.

  • Tenant and app inventory verified metadata only Show app refs, route state, owner ids, gates, and monitor posture without private bodies or user plaintext.
  • Service survival accounts gas floor posture Surface control-plane gas refresh, admission caps, and alert status without exposing signing keys or service credentials.
  • Provider enablement evidence status Display whether email, Stripe, domains, voice, webhooks, OAuth, and LLM providers are closed, test-evidenced, or explicitly approved.
  • Operator actions separate signed identity Any future intervention must be signed as an operator action with scope, reason, and compensation path where effects cannot be erased.

Platform admin safe overview read model

This read model appears only after the existing generic owner-console JSON authorizes the bearer. It derives safe platform-operator posture from owner-console counts, checked-in service posture, and point-in-time hosted evidence labels. It is not a platform-admin console, not a cross-tenant search surface, not impersonation, and not a mutation surface.

Locked until owner authorization. Platform-admin safe overview uses safe owner-console counts and fixed evidence labels only.

Owner quota state read model

This read model appears only after the generic owner-console JSON authorizes the bearer. It renders safe counts and the installed shared request-cap facts; no public surface exposes owner quota internals, and it does not claim traffic headroom, per-visitor fairness, or DDoS protection.

Locked until owner authorization. Quota state uses safe owner-console counts only.

Quota/fuel refresh policy map

This owner-only map separates Perffection's active platform service-account refresh from future tenant-app allowance policy. It is fixed explanatory copy, not an editable budget, and not a promise that traffic capacity is available.

Locked until owner authorization. Refresh policy is fixed explanatory copy only.

Product command center

These cards summarize the live perffection path in product terms. They show safe status, counts, and links only; explicit reveal, promote, and rollback still go through the governed generic cairn actions below.

Leads ready for review

Locked until owner authorization.

governed reveal below

Reviewed preview route

Locked until owner authorization.

public candidate route

Feedback to edit loop

Locked until owner authorization.

metadata only

Resource posture

Locked until owner authorization.

safe aggregate counts

First-run guide

This guide helps a first-time owner interpret an empty workspace. It uses safe counts and route-state constants only; it does not expose owner ids, lead ids, CRM profile plaintext, feedback body plaintext, bearer tokens, or secrets.

Locked until owner authorization. First-run guidance is read-only and adds no server action.

Delivery queue board

This board combines service-interest triage, safe feedback metadata, reviewed-preview route state, and lead lifecycle status from existing owner-gated reads. It renders safe ids, hashes, counts, labels, and route availability only; it does not read feedback body plaintext and it does not perform reveal, promote, email, rollback, provider, payment, signup, webhook, domain, or LLM actions.

Locked until owner authorization. The delivery queue is read-only and adds no server action; use the explicit governed controls below for reveal, promote, email, and reviewed edit actions.

Engagement handoff summary

This summary is a metadata-only owner handoff. It combines safe counts, fixed engagement labels, service-interest labels, and reviewed-route state; it excludes freeform session notes, reveal plaintext, CRM profile plaintext, email recipient/subject/body, feedback body plaintext, bearer tokens, and secrets.

Locked until owner authorization. The handoff summary is read-only and provides no copy, download, export, post, or persistence action.

Handoff readiness checklist

This checklist derives safe owner states from the metadata-only handoff summary. It is read-only and does not copy, download, export, post, persist, reveal, email, bill, or trigger provider actions.

Locked until owner authorization. Checklist states use safe constants only.

Safe review packet

This packet gives a next human reviewer the safe owner context only. It is a briefing view, not an export, approval, deployment, reveal, email, provider, payment, signup, webhook, domain, or LLM action.

Locked until owner authorization. The review packet uses safe metadata and constant boundary text only.

Service library boundary map

This owner-visible catalog is backed by checked-in service-library-chirho.json and maps reference modules to generic Cairn evidence boundaries. Status means capability posture, not automatic live availability; provider, signup, production-money, public-webhook, domain, live-LLM, certification, SLA, bank, and Walmart approvals remain explicit.

Website and content intake

Private intake, safe list, governed reveal, reviewed preview link, and owner feedback metadata over generic Cairn app routes.

proven

CRM and lead follow-up

Owner-governed promote, CRM timeline metadata, CRM profile reveal, and test-mode email UI; production real-user email is separate.

proven

Reviewed preview and edit loop

Customer-preview-v2 route is reviewed-hash-bound with owner promote and rollback controls; it is not automated generation.

reviewed-preview

Email delivery

Hosted Mailu test-mode acceptance and IMAP-observed receipt evidence exist; sender policy and real-user promotion stay explicit.

test-evidence

Payments and billing

Hosted Stripe test-mode transfer and reconciliation evidence exist; production money and public webhook ingress remain separate approvals.

test-evidence

Domains and provisioning

DNS/TLS cutover, rollback, monitoring, and customer communication runbooks are future provider-action evidence.

explicit-approval-required

Calendar and shop

Interest capture and catalog copy only; bookings, orders, provider effects, quotas, and compensation paths are not launched.

deferred

Analytics, uploads, media, and voice

Privacy retention, storage, export, realtime transcript, and data-residency evidence must exist before customer media launches.

deferred

Live app generation

Source review and manually reviewed candidate paths exist; customer live-LLM backend generation is not running.

explicit-approval-required

SSO, API, and integrations

First-party perffection.com login and OAuth are future cross-app identity services backed by generic Cairn identity/session/scoped-token evidence; public signup and token issuance are not open.

deferred

Platform admin and tenant oversight

Safe tenant/app posture, service-account gas, monitors, provider enablement, support state, and launch gates are future verified evidence views; impersonation and raw plaintext are not open.

deferred

Enterprise assurance

Point-in-time evidence and runbooks exist; audit certification, regulated-healthcare, SLA, bank, and Walmart claims are not made.

explicit-approval-required

Resource admission posture

This owner-visible map is backed by checked-in resource-admission-chirho.json. It explains which traffic should stay at Caddy/static aggregate logs, which actions create durable Cairn rows, and which actions should consume owner and app quota, resource, fuel, or ledger budget. It is posture and next-controls guidance, not a claim of automatic capacity.

Static GET noise

Public shells, static inventories, and random query strings should terminate at static responses and aggregate logs, with no durable DAG/CAS/app-state/effect rows.

edge-static

Private intake writes

Accepted public writes create private-blob refs and safe metadata; public promotion needs trusted-source gates, body caps, and owner write refresh rules.

admitted-private-write

Owner safe reads

Dashboard reads are owner-gated safe projections; polling should use read budgets and freshness windows so status refresh can be shed safely.

owner-gated-read

Governed reveals

Lead, CRM, and feedback plaintext reveals write privacy access evidence and should consume reveal quota; access logs are not disposable.

governed-reveal

Email provider actions

Provider sends are paid-effect-gated and idempotent; send quotas, bounce/unsubscribe posture, and monitoring are future real-user promotion controls.

paid-effect-gated

Money actions

Stripe work is verified-ledger gated; production money and public webhook ingress need separate limits, reserve rules, and reconciliation evidence.

paid-effect-gated

Review and promote

Review/promote moves refs only after hash-bound review; builds and generated candidates should consume review, generation, and deploy quota.

reviewed-ref-move

Media and analytics

Customer media, uploads, voice, analytics, export, and retention remain deferred until storage quotas and lifecycle evidence are defined.

deferred-enforcement-required

Generation candidates

Live generation is not open; future candidates need model budget, review queue limits, source capability review, and reviewed promote.

deferred-enforcement-required

Todo app data-growth example

This owner-visible example is backed by checked-in data-growth-example-chirho.json. It uses rough ranges for a small todo app to explain what creates durable Cairn records, what should stay at edge logs, and what needs cold-storage or retention policy. It is not pricing, capacity evidence, or a scale guarantee.

Anonymous static GET noise

Hundreds to many thousands of static GETs can happen before a real write; query-string noise should create zero durable Cairn rows.

edge log only

Private todo writes

Tens to hundreds of item writes per day create private refs and signed app-state/query/effect evidence; raw todo text stays private.

durable private write

Owner safe reads

Owner list refreshes can outnumber writes; safe reads should use gates, caches, and volatile/read evidence rather than customer-state rows per refresh.

volatile read pressure

Governed reveals

Plaintext reveals should be rare and intentional; privacy access evidence grows while plaintext stays in the owner response.

privacy log growth

Cold-storage candidates

Old completed items and stale projections may move cold only when refs, signatures, subject binding, and restore evidence stay verifiable.

retention policy needed

Deferred heavy surfaces

Media, realtime voice, analytics streams, and live generation can grow faster than todo writes; each needs separate quota and restore proof.

separate proof needed

Cold-storage lifecycle boundary

This owner-visible map is backed by checked-in cold-storage-lifecycle-chirho.json. It explains what may be disposable, what may move cold, what must remain verifiable, and what needs restore evidence in a time-travel Cairn app. It is not active GC, not live archive automation, and not permission to erase history.

Edge GET aggregate logs

Public static GET noise is disposable external log data; it is not app state and does not need Cairn restore evidence unless elevated by an incident.

external-disposable-log

Disposable query projections

Safe list and status projections may be rebuilt from authoritative signed rows; restore proof should verify the source rows before display.

warm-disposable-projection

Private customer write refs

Private intake, feedback, CRM refs, and private blobs may move cold only when signatures, hashes, key ids, subject binding, and governed reveal still verify.

hot-verifiable-record

Privacy access evidence

Plaintext-free access records are never-disposable audit evidence; archival custody must preserve sequence, subject scope, and no-plaintext proof.

never-disposable-evidence

Ledger and provider evidence

Money and provider history cannot be undone by erasure; cold restore must re-run ledger, provider, and reconciliation verification.

never-disposable-evidence

Source review and ref history

Unpromoted candidates may become cold candidates, but reviewed hashes, promote records, rollback records, app refs, and route refs remain verifiable history.

cold-verifiable-candidate

Deferred media and generation artifacts

Media, voice, analytics, and generated code need separate storage quota, retention, export, data residency, and restore proof before launch.

policy-required-deferred

perffection intake app

Not loaded.

Generic route checks

Not loaded.

Lead review

Load the workspace to list safe lead row ids. Revealing a lead posts to cairn's governed app-state reveal route; promoting a lead posts the safe row key to cairn's generic promote-crm-chirho route and reuses the existing private blob without profile reveal.

No lifecycle board loaded. The board summarizes safe intake and CRM ids from existing generic Cairn routes; it adds no new route and does not silently trigger reveal, promote, email, rollback, provider, payment, signup, webhook, domain, or LLM actions. 
    No lead revealed.
    No CRM promotion requested.
    No CRM timeline status selected. Timeline status reads only safe metadata from the generic CRM timeline route; it does not render raw timeline HTML, profile plaintext, reveal forms, email forms, or provider payloads. 
    No CRM profile revealed.
    No revealed service interests or engagement lane yet. Service-interest labels and fit_path_chirho engagement-lane labels are parsed only after governed reveal, stay browser-session-only, and are not stored by this page.
    Engagement session notes

    Browser-session-only engagement notes are advisory text for the owner. This note is not posted, persisted, emailed, billed, stored in browser storage, or sent to a provider. 

    No engagement session note in this browser session.

    Customer feedback

    Load the workspace to list safe feedback metadata from cairn's generic bearer-gated feedback inbox. Feedback body plaintext is not shown unless the owner explicitly runs the governed feedback read. Selecting a row prepares safe metadata for review and an optional browser-session-only read.

    Each feedback row can become a generic support discussion issue shaped like feedback-<seq>. The owner chooses which discussion items to build; LLM generation, source review, promote, rollback, provider, billing, and email actions stay separate governed steps. 

    No feedback body read in this browser session.
    Feedback-to-edit brief bridge

    After an explicit governed feedback read, the owner can draft a browser-session-only edit brief for comparison with the reviewed edit candidate. This bridge does not generate, deploy, promote, email, bill, persist, export, or send provider actions. 

    Governed feedback must be read before a session-only edit brief can be drafted.

    Reviewed edit action

    Load the workspace to enable owner-gated promote and rollback through cairn's generic app-review route. The action uses a stored source-review report and candidate hash; feedback body reads remain a separate explicit owner action.

    candidate app
    perffection-feedback-edit-candidate-chirho
    route
    customer-preview-edit
    preview version
    customer-preview-v2
    candidate DAG
    5f64816712fa5f83548efaaeceda3ce9a2161eee38ba17eb1525371b435e376c
    source review
    3a8643f641ed0f89ad2fb239ba1acfa8ca206064ff56a1976116abee8e58a6c9

    Reviewed edit route state has not been checked. The public preview link appears only after the separate candidate route returns the expected customer-preview-v2 marker.

    Open reviewed preview 
    No reviewed edit action sent.