The pipeline

AI shouldn't go around your process. It should run it.

The rule at every stage: a step that didn't happen is not a pass.

Most AI adoption bolts agents onto the side of delivery. A chat produces a diff, and a person squeezes it into the old process. Graphban runs the stages on the board instead, so every piece of AI-built work takes the same path, and each stage leaves evidence a person can read.

  1. specgrilled, then frozen
  2. plannon-colliding clusters
  3. buildone agent, one worktree
  4. reviewindependent, with evidence
  5. verifyCI attests the commit
  6. shipPR, then opt-in merge
  7. observestack, usage, OTLP

When the worker is an agent →

1 · Spec

Work starts from a spec somebody actually finished.

A PRD is graded on four dimensions by the grill, and approval is earned by answering what it asks. It is never a status anyone sets. The approved version is frozen, and every card says which section of it the card implements.

update_prd(status="approved") ApprovalNotEarned — names the dimensions still open.

Changing an approved spec is a rebaseline: a new version linked to the old one, so the work already built against the old version is never quietly re-pointed. Spec to done, in full →

2 · Plan

The server proposes the split. The planner commits it.

The spec is decomposed into cards with declared touchpoints. Cards that touch the same parts of the code are clustered, so two agents are never handed the same files.

  • Allocation by tier and lane. A planner asks for cheap or frontier, backend or frontend. The resolver picks the harness and model, and records what it chose and why.
  • Delegation is a bound seat. A delegated card goes to one child that claims it at registration and cannot drift onto anything else.
  • Dependencies hold. A card whose dependency's PR is still unmerged waits, so work is never built on a base that doesn't exist yet.

Collisions and allocation →

3 · Build

One agent, one worktree, one branch.

The local supervisor cuts a git worktree for each child from the fetched base branch, not from whatever happens to be checked out, and starts the agent your tier resolved to.

Claude Code Cursor Grok Gemini · Antigravity DeepSeek Qwen Code local models · gbagent
  • Every child gets the same context. The repo's AGENTS.md and skills, the MCP servers the repo names, and the team's published lessons.
  • It runs where your agents already run. Outposts are the machines that host fleets: macOS, Linux and Windows, set up from the app.
  • The supervisor holds no authority. It can only launch a process on a seat the server issued, to do work the server arbitrates.

The supervisor →

4 · Review

Somebody else looks, and brings evidence.

A builder moves its card to review and stops there. Sign-off takes a reviewer who did not build it, either another agent or a person, enforced at two separate gates keyed on authorship, so promoting the builder to reviewer doesn't launder it.

  • Evidence, not a thumbs-up. Non-trivial work needs adversarial evidence: a claim, the mutation that should break it, and how many tests failed when it did.
  • The reviewer's own tests count. The builder's receipts don't stand in for them, and evidence that denies an acceptance clause blocks sign-off.
  • Vendor diversity is recorded. The sign-off receipt says which vendor and model reviewed which, so you can see when a model checked its own family's work.

The loop → Review handoff and independence →

5 · Verify

CI attests the exact commit.

Your CI posts its result to the card as an attestation tied to a commit. A green run on some other commit isn't evidence for this one, and a sign-off may not attest the commit its branch was cut from.

A check that didn't run is not a pass

An acceptance clause nobody tested, a CI job that was skipped and a spec section with no delivery each get their own name. None of them is allowed to read as green.

6 · Ship

The branch is published at review. Merging is your call.

When a card reaches review, the fleet supervisor pushes its branch and opens a draft PR, so a reviewer always has something to read. One card per branch, one card per PR.

  • Opt-in auto-merge. Run a wave with --merge and, once a card is signed off and CI is green, the supervisor marks the PR ready and enables squash auto-merge. Without it, a person clicks merge.
  • The server never touches git. It tells agents the delivery contract, meaning the base branch and whether they may push to it, or says that the process is unmeasured.

7 · Observe

See what's running, who is working on it, and what it cost.

Stack view

A map of the running system derived from the code: what you write, what you run, and the external services you depend on. Code health is drawn on top. More →

Live and Activity

Who holds which card right now, what each agent is calling, and a searchable history of every event.

Usage

Tokens and model usage across the deployment, so the cost of AI-built work is a number, not a guess.

OTLP log export

Send Graphban's logs to the observability stack you already run, with counters for what was exported.

And the loop closes. Customer feedback arrives through the Feedback Kit (public boards, votes, a roadmap and an ingest API) and becomes cards. Lessons mined from finished work are reviewed, published, and handed to every agent on the next wave. The learning loop →

Why every stage is a gate

Without gates, an absence reads as a clean result.

No spec, so there's no drift to measure. No review, so nothing gets rejected. No check, so it's green. Each silence reads as approval, and they compound.

Without gates, three empty checks produce a green "all clear". In Graphban, the same three emptinesses each produce a named state and the summary is not green. without gates spec review check ✓ all clear emptiness produced the green Graphban spec review check 2 unanswered no independent reviewer check did not run emptiness produced a name
Without gates, emptiness produces green. With them, emptiness produces a name. Same three gaps. The dashed lines exist only on the left, because only there does an absence feed a verdict.

The longer argument is in the bug that started it and why a folder of Markdown specs says yes to everything.

Rules shipped

The gates are a map, and an unloaded rule is not off.

Build → Rules draws the delivery process as one flow. Each rule says what holds it, and the drawing says how strong that hold is.

Six strengths, drawn apart

Enforced, checked, external, advisory, unmeasured, or not used. A rule the server refuses is not a rule CI reports, and neither of those is a rule nobody has measured.

No pack is not a clean off

library_loaded: false means no rule pack is loaded. It does not mean every rule is off, and it does not mean nothing was adopted.

An agent cannot flip the switch

Turning a rule on or off is a person's action over REST. get_rule_toggles will tell an agent the effective toggle and where it came from. There is no MCP write for it.

What a rule is →

Fits the stack you have

Your tools stay. Graphban sits between them and the agents.

Your toolWhat Graphban does with itStatus
Claude Code, Cursor, CodexConnect over MCP and work the board interactivelyshipped
Seven fleet harnessesRun unattended in waves, one worktree eachshipped
GitHub issuesArrive as cards (HMAC webhook, routed by repo)shipped
GitHub branches and PRsPublished at review; opt-in auto-merge after sign-offshipped
GitHub ActionsAttests suite results to the card, per commitshipped
Your observability stackOTLP log exportshipped
A Markdown folder or Google DrivePRD ↔ folder sync, no OAuthshipped
LinearMirror in, constrained write-backin progress adapter built, not yet connectable
JiraThe same bridgeplanned after Linear

Everything else is on the status table.

← overviewGraphban next →Spec → done

What's new

latest 2026-11-10
run

The playbook pack, applied with gban update

A deployment publishes the playbook pack at GET /api/playbooks. gban update applies that pack to the checkout. The fleet supervisor still holds no authority of its own.

fleet

Harness capacity is a routing mode beside the grades

Cheap or frontier still comes from measured sign-offs, and a cell under five samples stays unmeasured. The Harness Capacity tab is the other mode: entitlements, a subscription hierarchy you set, and a forecast of spend. A routing verdict the router never recorded is null, with a note. It is not zero.

run

First run is a checklist, not an empty form

After the stack starts, first run is a checklist, a setup-status card that stays until the first job is proven, and a one-time tour. Finish later with no project and the shell keeps the setup chip. It does not drop you into an empty create form.

run

Specs is a library, and a canvas finding stays open

The Specs list is the PRD, its preamble, and the design-set documents, plus the folder they sync to. search_docs searches baselined PRD bodies; drafts and design rows stay out until the call opts in. A design set compiles a prompt, stores the canvas, and can file a finding with a canvas check. That finding stays open until the bound canvas for the latest compiled prompt passes it.

honesty

An unloaded rule pack is not off

Build → Rules draws each rule at a strength: enforced, checked, external, advisory, unmeasured, or not used. library_loaded: false means no pack is loaded. It does not mean every rule is off, and it does not mean nothing was adopted. Turning a rule on or off is a person's REST action. get_rule_toggles has no MCP write.

run

The tracker board has a Blocked column

The tracker defaults to a board. The columns are Backlog, Next, In progress, Review, Blocked, and Done. Blocked sits beside Review, so a card that cannot move is its own column.

graph

Dead code and test results join the Stack overlay

Two new code-health categories on every component. Dead code reads vulture, knip and ts-prune. Tests reads pytest, vitest, jest or any JUnit report, with passed, failed and skipped counts, and each failing test becomes a finding you can Defrag into a card. A run that executed zero tests is recorded as a finding, not a pass, and a suite that hasn't run at the current commit shows as stale or never run.

graph

The Stack view: an architecture map nobody has to draw

Build → Stack maps the running system from the topology the API reports: your deployables grouped by host, the infrastructure you run, and the external services you depend on, in three nested rings. A code-health overlay records scan findings per component and colours each box by its worst severity. A box that was never scanned reads as never scanned, not as clean.

graph

The code graph groups by area

Nodes now cluster by area and draw their kind as their shape, so the map reads at a glance before you open a single label.

fleet

Gemini and DeepSeek join the fleet

Two new named adapters, agy for Google's Antigravity CLI and dsh for DeepSeek, bring the fleet to seven harnesses alongside Claude Code, Cursor, Grok, Qwen Code and local models through gbagent. Each is version-checked before a child starts. Codex still connects over MCP but has no fleet adapter.

honesty

Hand-merged work can be closed without faking a sign-off

Work merged outside the fleet used to sit open forever, or get a sign-off it never had. A project owner can now close it as merged, and the record says that is what happened.

honesty

A check that did not run is not a pass

Sign-off now refuses evidence that denies an acceptance clause, counts only the reviewer's own tests, and treats a skipped check as missing rather than green. A refusal names the word it matched and the rule behind it.

memory

The decider sorts the memory queue

A project can opt in to a fast System One model that grades each memory candidate: grounded, ready, and whether it contradicts a published lesson. Thresholds are calibrated against human decisions, the uncertain middle stays with a person, and a decider that cannot answer says so on the page.

fleet

Review-only seats, and branches published at review

A review-only seat can review but never build, so a reviewer cannot quietly take a slice. When a card reaches review the supervisor pushes its branch and opens a draft PR, one card per PR. With --merge it enables auto-merge after sign-off; without it, a person merges.

run

Usage, Activity and OTLP log export

A deployment-wide Usage page with model usage, an Activity view rebuilt around lenses and facets, and log export over OTLP to the observability stack you already run.

run

The app, reorganised: Plan, Build, Observe

The redesign groups every surface into three sections: Plan (tracker, requests, PRDs, roadmap), Build (code graph, stack, MCP tools, fleet, outposts) and Observe (memory review, lessons, activity, live, harness). The same in self-host and hosted.

run

Feedback Kit: public boards, votes and a roadmap

Collect feedback through an ingest API or the embeddable widget, publish boards people can vote on, and show a public roadmap. Submissions land in triage and become cards.

fleet

Outposts and the harness mix

The Fleet view is rebuilt around a catalog of harnesses, a mix that sets each vendor's share of launches, and outposts: the macOS, Linux and Windows machines your fleets run on.

fleet

A capability matrix built from real sign-offs

Models are graded per function set from reviewed work and probes, learned across users. Ask for a tier and the resolver picks from what has been measured. A cell with under five samples says unmeasured instead of guessing.

honesty

Done cannot be minted at the door

Two ways around the completion gate existed: create an item already marked done, or release a claimed one into done. Both now refuse. Signing work off still requires an attestation — the status is not a field you get to set because the form accepted it.

honesty

Agents are told the git process, or told it is unmeasured

Nothing used to name a base branch, so agents opened PRs against main because that is what models do. The org — or the local project — now stores a sparse delivery contract: base branch, whether they may push to it, optional naming. get_context returns it. An unset field stays unmeasured, not a silent main. Graphban still does not open PRs, merge, or rebase.

fleet

until is a planner loop, not a thicker supervisor

gbfleet up is still one wave: spawn, wait, reap. until sits around it — keep going while there is work, spawn reviewers when review appears, and on restart adopt the children that are already running rather than launching a second set beside them. The supervisor still holds no authority of its own.

fleet

A wait for a human is a blocked item

When an agent needs a person, that wait is a blocked item on the same tracker rather than a side channel nobody will look at. The work stays visible, and the reason is on the record.

memory

A published lesson that nobody retrieved is a miss

Observe now has a Lessons catalog. Reach and outcomes are computed rather than assumed, and publishing something the next agent never found is recorded as a miss — not as a silent success that looks like the lesson landed.

run

Install without Docker, as a system service

Compose is still the default. A Mac or Linux box can now run Graphban as launchd or systemd, with one CLI for install, upgrade and uninstall. Postgres with pgvector is required and verified, never installed for you. There is no .app.

fleet

The caller picks the model a child runs

Every spawned child used to run whatever its vendor CLI defaulted to, with no way to say otherwise — the cost lever the whole fleet idea rests on, missing. The supervisor now passes a model through, along with the two knobs one vendor each exposes. Pass-through, not selection: the supervisor still does not choose models on your behalf, and a knob the chosen vendor does not have is refused rather than quietly ignored.

graph

The living graph answers back

Hubs, shortest path and two-hop reach reach the UI rather than staying in the API. Paths say which way each edge points, and the whole graph is one tab stop — arrows move real focus, so it is navigable without a mouse.

honesty

The reference docs cannot silently fall behind

Three documents presented themselves as complete inventories and were not: the API reference covered 87 of 160 routes, configuration 19 of 51 settings, the data model 15 of 48 tables. A ratchet now records the known gap and fails on any new one, in both directions — documenting something and leaving it listed as missing fails too.

fleet

The fleet supervisor

gbfleet runs one wave: a child per seat, spawned in its own worktree, waited on, reaped. It is a separate distribution that depends on httpx and nothing else, and it holds no authority of its own — it can only launch a process holding a seat the server issued. Delete it and every invariant still holds; the fleet just needs a human to open terminals again.

fleet

Vendor adapters, named and version-checked

claude, cursor-agent, grok and codex, each resolved by name rather than guessed at, with the supported version asserted before a child is spawned. The credential is written to the child's config file and never to argv, because argv is world-readable on a shared box.

fleet

Mint, list and retire became one capability

A planner can retire the seats it minted and only those, scoped by minted_by. Ending a wave expires seats, never credentials — no client config is touched and nothing has to reconnect.

proof

The supervisor walk, run against a real server

Sixteen steps passed, one is blocked on a decision rather than a budget, and it found nothing in the supervisor. The walk refuses to run unless pointed at a real instance and refuses any project it did not create itself — a walk that quietly passed by not running would be the worst possible version of it.

fix

A closed PRD no longer blanks the PRD page

The status map covered three states and the server sends four. One closed PRD threw during render and took the whole list and editor with it. An unrecognised status now costs one oddly-labelled chip instead of a white screen, and a test compares the two lists across the stack.

fix

Linking a request to an item works on a renamed project

Item ids are frozen at issue time while the key you see is rendered from the project's current tag. The link stored the key you sent instead of the id it resolved to, so on any renamed project it violated a foreign key and returned a 500.

Every entry is work that merged. The full history is on GitHub.