Clear Frameworks owner control
One login. One CFW control panel.
Evan will handle approved work backstage. You will see customer needs, decisions, verified outputs, tools, and exceptions that require the owner.
Safe local candidate
Owner access is production-disabled.
The dedicated Clear Frameworks identity project is bound. Admin remains disabled until owner activation, recovery, and AAL2 isolation have hosted proof.
Owner sign-in
Open Clear Frameworks Control
Use an invited owner account. Customer and Retehost accounts cannot open this view.
Owner security
One more proof
Select a verified authenticator and enter its current six-digit code.
No verified authenticator is available. Setup remains locked until the separate audited restart and lost-factor recovery path is active, so an interrupted enrollment cannot strand the owner.
Access stopped safely
This account is not a current Clear Frameworks owner.
No admin records were requested. You can return to the customer portal without creating another login.
Open customer portal
Clear Frameworks
/
Owner Control
Local preview
Owner · AAL2 required
Clear Frameworks / All CFW / Candidate
Owner overview
Auto-select lets the harness choose the narrowest qualified operating profile. Profiles never grant authority.
Owner overview
Only what needs you.
Customer needs, owner decisions, verified outputs, and exceptions rise here. AI work stays backstage.
Evan
Give the outcome, not the steps.
When connected, Evan will route the work, select bounded specialists, run independent checks, and return only decisions and verified results.
Current boundary
Connection status
- Identity & dataDedicated CFW project bound; activation locked
- Evan & toolsNo runtime or effects connected
- OwnershipClear Frameworks controls product and data
CRM
Customers and work records.
The business-record workspace: browse what matters, then open one record for detail.
The editable CRM is not connected.
The current safe projection can supply summary counts only after owner and AAL2 checks. It cannot create or change a customer record.
Customer directory is not connected.
When available, this opens the customer list first, then one bounded customer record with contacts, engagements, work, invoices, licenses, and next actions.
No connected customer needs.
This section will contain only work explicitly waiting on a customer, never a generic AI task or owner decision.
Project records are not connected.
When available, this opens the current project list, status, next action, and accepted outputs.
Billing records are not connected.
No invoice, payment, or payment gate can be changed from this candidate.
Customer activity is not connected.
Only customer-safe, authoritative history will appear here. Notes cannot pretend a message was sent.
Evan · CFW coordinator
What should I handle?
Give Evan the outcome. The harness will keep routing, agents, tools, checks, and evidence backstage.
Interface preview
This is where you will give a direction and receive only what needs you, what changed, and the independently verified result.
No active Evan work.
When connected, this opens the requested outcome, bounded agent team, current step, pending owner decision, Overwatch state, stop control, and verified result—without streaming agent chatter.
No Evan history is connected.
Conversation is an interface. Durable history will come from accountable direction, approval, execution, verification, and output records.
Choose or import a bounded role profile above.
The JSON profile narrows how Evan approaches work. It cannot carry credentials, commands, provider settings, or authority.
Download example JSONHarness-controlled execution
- Interpret the requested outcome and current CFW scope.
- Select the narrowest role, tools, and bounded specialists.
- Run independent Overwatch scope, safety, and completion checks.
- Stop risky effects for an exact owner decision.
- Return verified output and retain detailed evidence in Audit log.
Company data
The CFW system of record.
Products, customer editions, sites, licenses, and deployments live here—not on the owner’s front page.
Company records are not projected.
This area will open CFW-owned product and operational records without exposing raw database structure.
Sites & apps are not connected.
Each product runtime will open from here with its own identity, portal, release state, and customer boundary.
Product and license records are not connected.
CFW remains the authority for software, variants, builds, and licenses. Retehost only hosts approved runtime artifacts.
Deployment records are not connected.
This will show approved live versions, exact predecessors, release receipts, and rollback points—not a direct deploy button.
People & access
Identity belongs to each CFW product.
Users, invitations, app access, roles, MFA, recovery, and sessions appear only after exact server authorization.
User directory is locked.
No user list is loaded in this candidate. Customer and Retehost identities cannot grant CFW owner access.
Invitations are not connected.
Future invitations will name one CFW app, role, account, expiration, and inviter. A hosting account or email address alone cannot create access.
Per-app access is not projected.
This will show which CFW product each identity can enter without exposing passwords, factors, tokens, or another product's customer records.
Access control is server-authoritative.
Browser labels, email matches, role JSON, and hosting accounts never grant owner authority.
MFA setup and recovery remain separately gated.
Password recovery cannot remove MFA, change a role, accept a license, or grant owner access. Verified factor state will appear here only after backend authorization.
Open password recoverySession management is not connected.
Owner actions will require a current non-anonymous session and AAL2 revalidation.
Files & assets
Approved content and delivery evidence.
Browse bounded files by purpose. Private source and customer delivery authority remain separate.
No file store is connected.
No private file can be listed, downloaded, released, or delivered from this candidate.
No release manifest is projected.
Approved artifacts will be bound to exact source and output digests.
No asset library is connected.
Public, customer-safe, and private assets will remain explicitly classified.
No delivery authority exists here.
A file approval is not a download, dispatch, provider action, or customer receipt.
Automations
Bounded capabilities Evan can use.
Approved procedures, active runs, schedules, and stop controls remain narrow, versioned, and independently checked.
No capability executor is connected.
Runbooks and templates remain guidance inside a versioned capability. Routing one never authorizes it; every effect requires its own current authority gate.
No automation run is active.
When connected, this shows the requested outcome, current bounded step, stop state, and verified result—not background chatter.
No automation approval is waiting.
Each future approval will identify one exact action, target, expected predecessor, impact, expiration, and recovery path.
No scheduled automation is active.
Nothing can run merely because time passed. Current authority is rechecked at execution time.
Automation remains globally disabled.
Capability-specific and global kill switches must be independently enforced and tested before any executor can become active.
Live activity
What is changing now.
A calm event surface for new customer needs, active work, and important state changes.
Live inbox is not connected.
No message, customer event, or background agent signal is being streamed.
No active-work projection is connected.
Routine AI progress will stay collapsed unless it becomes an exception.
No event stream is connected.
Only bounded, redacted business events will be visible here.
Decision center
Only decisions that need you.
AI preparation and routine work stay backstage. Exact impact and rollback appear before approval.
The current backend does not expose owner decision records. Customer records waiting on a response remain in CRM and are never mislabeled as your decision.
Decision records are not projected yet.
Evan will not ask for approval until an exact target, effect, customer impact, and rollback are available.
No advisor findings are projected.
Security, performance, business, and policy findings will be ranked by severity and routed to the exact owning surface.
No safety review is active.
Overwatch evidence will remain separate from the agent requesting an effect.
Health
Can CFW operate safely?
Service status, failures, and capacity belong here. Healthy machinery stays quiet.
CFW identity
Dedicated project bound. Shared Retehost identity remains prohibited; activation is locked.
Evan runtime
Private harness connection is not active.
Ownership boundary
CFW remains software, data, and license authority.
Production
Promotion remains locked pending hosted proof.
Application health is not connected.
Each CFW product will report its current release, availability, and verified rollback point.
AI runtime health is not connected.
Model activity, agent traces, and token noise will remain hidden unless there is a cost, failure, or owner decision.
Retehost runtime health is not connected.
Hosting status cannot grant CFW product, data, license, or owner authority.
Audit log
Proof behind the summary.
Verified records stay authoritative; AI memory and chat never become the source of truth.
Every approved direction, role version, approval, tool call, verifier result, and output receives a stable record.
Detailed evidence stays here instead of crowding the owner screen.
Derived views rebuild from immutable evidence and verify themselves.
Owner queue projection
Unclassified action records
The backend does not yet prove whether each action is a customer need, owner decision, or another exception, so these records stay neutral.
No open owner-action records.
When connected, only the bounded owner-action projection is counted here.
The Evan record service is not connected.
No run history or AI memory is fabricated in this local candidate.
No output ledger is connected.
Chat text, agent activity, and unverified drafts are never presented as finished work.
No approval ledger is connected.
Future approvals will bind one exact target, effect, actor, predecessor, and rollback.
No incident projection is connected.
Failures that need owner attention will be bounded, redacted, and linked to recovery evidence.
Tools & connections
Open the interface you need.
CFW tools, customer applications, and provider connections remain separate. Unavailable routes say so plainly.
CFW tool routes are not connected.
The authenticated CRM summary can become a read-only projection, but this candidate opens no effectful tool route.
Customer applications are not projected.
Each customer app will open its own CFW-built interface and app-owned identity boundary. Retehost hosting never becomes the customer login.
No provider connection can be managed here.
Connection health may be shown later. Credentials, provider payloads, and broad service identities remain outside the browser.
CFW settings
Configuration and boundaries.
Low-frequency technical detail stays here unless it creates an owner decision.
CFW identity
Dedicated project bound; production activation locked.
Production state
Candidate only; no provider or customer effect.
Clear Frameworks is the authority.
Software, source, products, variants, builds, customer data, operating profiles, and licenses remain CFW-owned. Retehost supplies private runtime hosting only.
Evan profiles
Versioned role JSON
Imported profiles are validated and remain session-only candidates. They narrow behavior but cannot grant authority.
Private runtime hosting by Retehost.
Hosting metadata and deployment health can be shown here. They cannot become CFW owner, product, customer, or licensing authority.