Build status
Every capability in the engine, in one of four states. Branch feat/copilot-chat
at commit 6410a7a. Updated 16 August 2026.
What we publish is measured. What isn't measured is labeled accordingly. The states below are checked against the code, not against the roadmap, and a capability that runs on a fixture and nowhere else is not Available.
What Blueprint does not detectVerified
38 Python modules, about 13,700 lines. These are run results, not estimates. The six skips are the chat acceptance tests; they skip loudly and are never counted as passes. The one xfail is the scope-detection gap described further down, and it is held open on purpose rather than tuned away.
One vocabulary, four states, and no fifth.
"Not built", "not wired", "not validated" and "not ready" were four ways of saying the same thing in four different tones. One vocabulary is easier to audit and harder to soften. Nothing here is red: Planned is a roadmap entry, not a failure.
Available Runs today on a real package.
Pilot Runs, and is being validated with design partners.
In Development Being built, not reachable yet.
Planned Specified, id block reserved, no code.
| Capability | What that means in practice | State |
|---|---|---|
| Deterministic rule evaluation, validators, risk register, report | Rules resolve in priority order under conflict groups, derived attributes are written back for later passes, validators return computed values rather than a boolean, and the register ranks deterministically. Golden tests compare the full output byte for byte. | Available |
| Command line: run, ingest, chat | A hand-authored spatial model plus rule packs produces a register, a validation report and a bill of materials, in markdown and JSON. A directory of package PDFs becomes a document model. | Available |
| PDF ingest and CSI segmentation | Text-layer PDFs segmented by CSI MasterFormat section numbering, with document, page and coordinate provenance on every element. No model call, no network, no clock. | Available |
| Deterministic replay | Same inputs plus config hash plus seed produces byte-identical output. Model calls are cached by content hash, and the key includes the vendor and the model identifier, so a run replays identically regardless of which vendor produced it. | Available |
| Model boundary enforcement | An architecture test walks the import graph and fails the build if a model client is reachable from the engine, the validators, the scoring code, the risk code or the benchmark harness. A model may read, extract, classify, transcribe, locate and match. It may never compute a quantity, assign a part number, produce a risk score or determine compliance. | Available |
| Transmission consent gate | Before the first outbound call for a package, the vendors, the model identifiers and the file list are shown and consent is recorded. Consent is re-asked when the file set or the recipient list changes. There is no flag to suppress the prompt. | Available |
| Plan viewer | A static viewer that renders precomputed run output with layer toggles, device markers and the rule trace on click. It does no geometry of its own, so it cannot disguise a missing engine capability with a frontend workaround. | Available |
| Specification and project-manual cross-check, Division 08 to Division 28 seam | Reads two kinds of evidence, located scope statements and structured claims. Only the first is populated on a package the tool can currently produce, so the seam analysis runs at half its designed evidence. | Pilot |
| Scope-ownership statements, SB-001 and SB-002 | One located scope statement at a time, joined to nothing else. A device the documents assign to another party and a device the documents assign to nobody are separate findings with separate severities and separate readers. | Pilot |
| Seam rules SB-020 to SB-024 | One opening and one aspect at a time: locking device, power, rough-in. Both divisions, neither division, conflicting requirements, and the case where the documents do not settle it, which is a distinct rule so it is never reported as the case where nobody is assigned. | Pilot |
| Access-control opening rules, AC-001, AC-010 to AC-014, AC-020 to AC-022, AC-030, with validators V-001 to V-006 | Base kit per controlled opening, egress resolution, storefront withholding, controller allocation, supply sizing and battery standby. Every rule ships a positive test proving it fires and a near-miss negative test proving it does not. | Pilot |
| Video-surveillance rules, VS-001 and VS-002. Experimental. | Coverage classing and coverage-gap detection. The pixels-per-foot thresholds and the coverage fraction are configurable planning figures. Video surveillance is not what this engine is aimed at and it is not a homepage promise. | In Development |
| Structured claim extraction | The one sanctioned model call for reading specification text is written and unit tested. No command reaches it and the ingest path never populates the claims field, so it is code that has never run on a real package. | In Development |
| Dual-vendor extraction agreement | Where two vendors read the same content and disagree, no value is emitted at all and a disagreement record takes its place. Written and unit tested, reached by no command, and the rule id that would carry a disagreement into the register is defined by no rule pack. The two vendors named in the codebase are Anthropic and OpenAI. | In Development |
| Hosted web application, login, chat copilot | Grounded chat over one loaded package exists in the repository, and its retrieval is deterministic code rather than a model choosing what to read next. Nothing is deployed. There is no application to sign into and no upload feature. | In Development |
| Published benchmark results | Both scoring scripts are checked in, typed and covered by 89 tests. No package has been adjudicated, so they have never produced a result. The dataset is the missing half, not the instrument. | In Development |
| Schedule-to-specification join, SB-010 to SB-019 | Ids reserved, no rules written. The schedule-row record is modelled, nothing populates it, and no pack defines those ids. The project contract calls this the highest-value check in its phase. | Planned |
| Addendum reconciliation, DC-020 to DC-029 | No addendum parser and no diff against the base documents. The delta record is modelled and validated and nothing produces one. An addendum is read as one more document, not as a modification to the others. | Planned |
| Cross-document contradiction, DC-001 to DC-019 | No rule of that family exists in any pack and no module compares claims across documents. Quantity mismatch, product mismatch and conflicting responsibility assignment between two documents are not detected today. | Planned |
| Plan and drawing extraction | No module exists. No rasterization, no scale determination from a scale bar or title block, no tiled extraction and no review payload. Every spatial model the engine has ever run on was authored by hand. | Planned |
| Bill of materials as an input | The engine emits a bill of materials as supporting evidence for the register. It does not read one in and check it against the documents. That direction is specified and unwritten. | Planned |
Two things are refused rather than unbuilt, and the distinction is deliberate. A PDF with no text layer is refused by name rather than ingested as empty. A package's own equipment schedule is refused on ingest, because it is benchmark truth for that package and a system that reads the answer key cannot be scored against it. Neither will change state; they are design decisions, not backlog.
Phases
| Phase | Note | State |
|---|---|---|
| 1. Deterministic engine | Rules, validators, ranked register, bill of materials, report, CLI. Golden tests compare byte for byte. | Available |
| PDF ingest lane | A directory of package PDFs becomes a document model. No model call, no network, no clock. | Available |
| 2. Document intelligence | Ingestion, scope boundaries and the Division 08 to 28 seam run. Claim extraction, addendum reconciliation and contradiction detection do not. | Pilot |
| Copilot chat lane | Grounded chat over one loaded package. Retrieval is code, not a model choosing what to read next. Not deployed. | In Development |
| 4. Benchmark | Harness checked in, typed and tested. No qualifying dataset. See Blocked below. | In Development |
| 5. Interface | Deliberately gated behind the benchmark. The shells exist in the repository and nothing is deployed. | In Development |
| 3. Plan extraction | Next buildable slice. No module exists. | Planned |
The first measurement against a document nobody wrote for it
The ingest lane was run against a real 316 page project manual rather than against fixtures. Until then the scope detector had only ever been tested against examples written by the same person who wrote the detector, which measures agreement with yourself.
Four of the five acceptance assertions passed: the document identity and page count match the retrieval record, all six specification sections were found, every section starts within one page of where the record says it does, and the cross-division work assignments were located in the numbers the record counts.
One failed. On one page the detector finds nothing, because that page assigns scope in ordinary English as a residual catch-all rather than using any of the standard contract markers the detector matches.
The detector was not widened to make it pass. A pattern loose enough to catch that phrasing would fire across a large fraction of any specification's body text, and a rule that fires too broadly is worse than an absent rule, because it teaches the reader to ignore the output.
The case is held open as a recorded gap that fails loudly if it is ever quietly closed. Closing it properly means a new marker family with its own positive test and its own near-miss negative test.
That is the shape of the result: a narrow sample, one real miss, and a note explaining why the miss is more useful known than tuned away.
What the last session actually did
Nine commits. Roughly half was building the copilot chat lane. The other half was discovering that several things reporting themselves as working did not work.
- The architecture test did not enforce the directive it exists for. Writing an ordinary import into the model-authored package reached the deterministic engine with every test green. Twelve import forms evaded it, and its own tests were exercising a hand-copied duplicate of the detector rather than the detector.
- The transmission consent gate collapsed on duplicate filenames. Two files with the same name in different folders became one digest entry, so replacing one wholesale left consent current. That is precisely how bid addenda are distributed.
- The same gate ignored the recipient list, so adding a model vendor did not re-ask for consent.
- The copy guard let pricing through. A currency symbol followed by a zero-width character renders normally and passed the check. So did three non-dollar currency signs and two characters literally named SMALL EM DASH and VERTICAL EM DASH.
- Retrieval matched vocabulary as raw substrings. A question about panic hardware, this domain's life-safety case, pulled back scope markers about work assigned to others.
- The page selector was wrong in both directions at once, matching page 23 against page 236 while missing a page inside a section that spans it.
- Several tests could not fail. Three retrieval selectors could be deleted outright with the suite green, and two guards were mathematical tautologies.
The lesson worth keeping. Every defect above passed its own tests. They were found by mutation testing, which changes the source and checks that some test notices. A green suite is not evidence that the code works; it is evidence that the tests ran.
Four rule packs ship, and each one is versioned and citable.
A rule you cannot inspect is a rule you cannot dispute. Every pack is a JSON file in the engine repository carrying its own version, its jurisdiction and the technical authority each rule cites, and every rule is project and authority-having-jurisdiction overridable.
| Family | Rule ids | Technical authority | Version | Last changed | Change history |
|---|---|---|---|---|---|
| Scope boundary scope_boundary |
SB-001, SB-002 | CSI MasterFormat Division 08 and Division 28 boundary; AIA A201 General Conditions 3.2 on the contractor's review of the contract documents; public contract code pre-bid clarification practice | 0.1.0 CA-DSA |
9 Aug 2026 853ee72 |
git log packs/scope_boundary.json |
| Division seam division_seam |
SB-020 to SB-024 | CSI MasterFormat Division 08 and Division 28 boundary; AIA A201 General Conditions 1.2.1 on complementary documents, 3.2 on pre-bid review, and 3.2.2 on reporting discovered discrepancies before proceeding | 0.1.0 CA-DSA |
9 Aug 2026 853ee72 |
git log packs/division_seam.json |
| Access control ac_k12_base |
AC-001, AC-010 to AC-014, AC-020 to AC-022, AC-030, plus validators V-001 to V-006 | NFPA 101 Life Safety Code 7.2.1.5; CBC 1010.2 and 1010.2.13; UL 294 Access Control System Units; ANSI/BHMA A156.31 Electric Strikes, Grade 1; NFPA 72 10.6 Secondary Power Supply; TIA-568 horizontal cabling distance; CSI 28 13 00, 08 41 13 and 08 71 00 | 0.1.0 CA-DSA |
26 Jul 2026 78030a9 |
git log packs/ac_k12_base.json |
| Video surveillance vs_k12_base |
VS-001, VS-002 | IEC 62676-4 Video surveillance systems, operational requirements; CSI 28 23 00 Video Surveillance; district security design standard | 0.1.0 CA-DSA |
26 Jul 2026 1b1f515 |
git log packs/vs_k12_base.json |
External review: not yet commissioned
No architect, code consultant, authority having jurisdiction or independent security engineer has reviewed these rule packs. The field is here, labeled and empty, rather than absent, because a governance table with no reviewer row reads as though the question was never asked. When a reviewer is engaged, their name, their standing and the date go in this position.
Ids are permanent, and that is a constraint on us
A rule id is never renumbered and never reused. A superseded rule keeps its id, stays resolvable, and gains a pointer to the id that replaced it, because a published benchmark result cites rule ids and a renumbering would silently reattach an old number to new behaviour. That is why the Planned blocks above are reserved rather than left to be allocated later.
Every rule carries a rationale written for a practitioner and an authority citing a code section or a manufacturer document, and both print in the deliverable rather than living in the source. Exposure bands are order-of-magnitude planning figures; every band shipped today is uncalibrated and every rendering says so.
Read the published rulesBlocked
| What | Why |
|---|---|
| Chat acceptance against a real package | Needs recorded model responses, which do not exist yet. |
| Recording those responses | Requires sending a real bid package to a model vendor. That leaves the machine, so it needs a deliberate go-ahead rather than standing approval. |
| Phase 4 benchmark | No qualifying dataset found. Districts that publish full bid documents ran the wrong division of work; districts that ran the right work hold their documents for in-person review. This is a records-access problem, not a research problem. |
Waiting on a decision
| Item | Shape of the call |
|---|---|
| Committed source excerpts | Rewrite as derived annotations and leave history alone, rewrite history too, or amend the rule explicitly. Recommended: the first. |
| A second adjudicator | One adjudicator is one opinion. Independent re-adjudication by a second person, reporting the disagreement rate, is the correct next step for the benchmark and has not been done. |
What this does and does not claim
What the project can defend today: every output line carries a rule identifier and a document citation, runs replay deterministically from the same inputs, and the system produces a flag rather than a guess where the documents do not determine an answer.
What it cannot defend yet: that the things it flags are the things that actually become change orders. That is what the benchmark measures, and the benchmark has no dataset. Auditable and correct are different properties, and only one of them has been demonstrated.
Public build tracker. It is public on purpose: a tracker that names its own failures is worth more to a reader deciding whether to trust this engine than a tracker nobody can see. It contains no bid specification text, no drawings, and no findings paired with a district name.