A trade operations team member, the morning after month-end close.
The demurrage costs blew up again. Vessel nominations run across three teams and four systems: laytime terms live in the contract system, nominations travel by email, the exposure calculation lives in a spreadsheet exactly two people understand, and finance finds out last - after the counterparty's claim arrives.
She knows precisely where it hurts. She opens CoPilot and types "how can we automate our vessel nomination and demurrage management process?"
She gets a beautiful answer. Confident. Structured. Bullet points. It agrees with everything she suspected and proposes an integration program that sounds expensive.
Two weeks later she pitches it. One of stakeholders asks one question: "Where did this number come from?" Silence. The case dies in that meeting. Not because the idea was wrong - because nothing in it could be traced to anything.
I have watched versions of such meetings for fifteen-plus years across supply chain space. So I have worked on idea how my logistics and supply chain teams could get better in driving process excellence initiatives that are grounded, factual and help avoid empty screen paralysis.
Problem statement
Here is the uncomfortable structure of the problem, and it has three layers:
- Layer one: the people who know the process can't get to a fundable case. The knowledge sits with operators and team leads - the ones who live the workarounds. But turning the statement - this is killing us, into a case a someone signs requires a method: framing, mapping, friction analysis, honest cost assumptions. Consultants bring that method and charge accordingly. Process mining platforms bring it too - if you have clean event logs, which most operational work doesn't. An estimated seventy percent of it lives in email, Excel and phone calls. No logs, no mining.
- Layer two: a blank chat window flatters you. This is the part almost nobody talks about. Ask a general AI to assess your process and it anchors on your framing, mirrors your suspicions back, and scores your ideas before you've thought for yourself. It is a brilliant intern with no methodology and a deep need to please. Behavioral science has a name for what happens next - anchoring - and once the AI has said "this looks like a quick win," your own judgment quietly retires.
- Layer three: even a good analysis dies without provenance. Leaders don't reject improvement cases because the ideas are bad. They reject them because the figures float. "14 hours per week saved" - says who? Measured where? The moment one number can't answer where did you get this, the whole document is negotiable.
Method. Anchoring. Provenance. Any tool that solves one and ignores the other two produces exactly the meeting I described above.
My Approach
I've argued in the newsletter that it was never the model - it's the harness. Process Navigator Project (Procezio) - is that argument built into a product, twice over: once in how it works, once in how it was made.
- How it works: rules decide, the model speaks. There is one hard rule in the codebase, and everything else hangs from it: the LLM never decides whether to act. A versioned, human-readable YAML ruleset decides when the agent may speak, probe, or challenge. The model's job is wording and generative drafts - inside schema-validated contracts.
Deterministic control plane, generative language surface. When the agent finds a re-keying handoff between two systems, that's not model intuition - that's rule HD-2 firing on the data you entered, and you can read the rule.
- Anti-anchoring is enforced by architecture, not by politeness. The method runs Understand → Diverge → Converge on one canvas. During ideation, scoring is visibly asleep - the widgets are literally locked, with the reason written on them. You score your opportunities first. Then you commit - a small signing ceremony, borrowed deliberately from e-signature UX, which writes an irreversible event into the session log.
Only that event wakes The Challenger, one of three personas (Facilitator paces, Process Auditor verifies, Challenger attacks). And when it challenges your scores, it must cite evidence from your own canvas - the app draws a dashed line from the objection to the element it's quoting. The AI is structurally incapable of agreeing with you too early. That's not a prompt. That's an event schema.
Provenance is the product. Every AI contribution renders in pencil module until you accept it - a second ink, always visible.
Every figure carries a source and confidence tag, and the export gate physically blocks a business case containing an unsourced number. The session file itself is an append-only event log: corrections are new entries, never deletions. Accountants figured this out a few centuries ago; I just applied it to process analysis.
- How it was made: spec-based, agent-built - not vibe-coded. This entire codebase was created by several coding agents. It was decided by something else. That distinction is the difference between spec-based development and vibe coding, and it's worth three paragraphs, because the method is half the product.
Vibe coding has a precise failure mode, and it isn't code quality - modern agents write good code. It's ownership. When the specification lives in your chat history, the intent evaporates (every prompt is an unrecorded decision), the agent drifts (each session re-interprets the product), and you can't say no (an agreeable model would have absorbed every conference talk and obvious-sounding feature I threw at this build).
Demos reward speed. Products reward memory. Vibe coding has no memory.
So this build ran on four artifacts and one loop:
- A constitution - six principles that don't change without a recorded decision.
- A ratified spec - versioned v0.1 → v0.4 and genuinely fought over: every section was pressure-tested against the real-life challenges we face in operations - the escalations, the workarounds, the month-end cases that break neat process pictures - and thirty-plus decisions were recorded before feature-complete code existed - amendments only, never silent edits.
- A harness - the agent's rules of engagement travelling with the repo: reading order, the hard rules, the build order, and the contract that one task equals one bounded card whose acceptance criteria are the stop condition; on ambiguity, the rule is stop and ask.
- And a continuous integration via CI gate suite - typecheck, schema drift, rule fixtures, replay determinism, a license allowlist, and the e2e privacy proof. The agent's work isn't done when it says it's done. It's done when the gates say so.
Read the Diagram 1 top to bottom, then follow the dashed lines back up - they're the point. Learnings become amendment PRs, never quiet edits. And the loop earned its tax on this very build: it parked a mid-build multi-agent temptation with a written revisit condition, transformed a process simulator request into the defensible target-state composer once a reality check against single-informant data exposed the false precision, superseded the wizard UI through a ratified paradigm amendment instead of prompt-flailing.
The two hard rules rhyme on purpose. In the product: versioned rules decide whether - the model words it. In the process: the ratified spec decides what - the agent types it. Same architecture, two altitudes.
The barrier to building software has collapsed. The barrier to owning it hasn't - and the specs are how you own it.
What it looks like
Everything below runs in your browser and I will release desktop versions a bit later. No account, no server, no telemetry - and that's not a marketing line, it's a CI gate: an end-to-end test proves the running app makes zero off-origin requests except to the model endpoint you configure.
The first version I built was a wizard - eight screens, next-next-next. It was methodologically correct and it felt like filing a tax return. The fix came from an unexpected pair of teachers: n8n's editor and a GPS. One infinite surface where the method is furniture, not walls - and when you jump ahead of yourself, the agent doesn't scold. It recalculates: the business case needs friction data you haven't swept - I'll route through zone 3. You can ignore it. The completeness rail tracks named missing items, never percentages.
This one is my favorite architectural dividend. The session file is an event log, so a demo is just... a replay. Append ?demo=1 to the URL and the canvas performs the whole loop - template, pain, ideas, triage, commitment, challenge, sourced case - deterministically, with zero model calls. The thing that makes the audit trail work also makes the demo free. Three full worked scenarios ship in the repo: Purchase-to-Pay, Order-to-Cash, carrier onboarding.
The pattern is taken from cases like legal e-signature flows, and it's the heart of the anti-anchoring machinery. Scoring your ideas is cheap; committing them costs a signature. That tiny ritual does two jobs: it makes you own your judgment before the AI touches it, and it writes the log entry that unlocks structured opposition. In testing, this is the moment people lean in - the agent that was quietly helping suddenly pushes back, quoting your own canvas at you.
Colleagues disagree with you. Tools don't. That's the difference I was after.
The pattern is taken from cases like legal e-signature flows, and it's the heart of the anti-anchoring machinery. Scoring your ideas is cheap; committing them costs a signature. That tiny ritual does two jobs: it makes you own your judgment before the AI touches it, and it writes the log entry that unlocks structured opposition. In testing, this is the moment people lean in - the agent that was quietly helping suddenly pushes back, quoting your own canvas at you.
Colleagues disagree with you. Tools don't. That's the difference I was after.
The output is built for that director meeting. It leads with a credibility header - how many figures, how many verified, how many assumed with named owners - because two seconds of honest provenance buys more trust than ten pages of confidence. It ends with The Ask, because I've seen too many convinced directors file a case and do nothing when nobody told them what to approve. Exports as PNG, PDF, or a 16:9 slide - and here's a small trick I'm fond of: the PNG carries the session inside it. Someone sends you the picture, you drop it into Procezio, and the full canvas opens.
What I'm still exploring
The credibility ladder tops out at doer-verified - the person who actually runs the process confirming the numbers. The printable walk-through sheet exists in the spec; whether busy teams will actually run that ritual is a human question no test suite answers.
And the target-state composer - the feature that derives a to-be hypothesis of your process from the opportunities you committed - currently generates a read-only pencil sheet. Letting people edit that hypothesis without breaking its provenance chain is the next hard design problem.
Finally few more extensions in mind, incl. desktop versions and enterprise grade architecture - time will show in what direction to push development further.
The repo is public, link and project details are here: Apache-2.0, spec-driven, and meant to stay that way. Open a demo scenario, commit some scores, and tell me whether the Challenger annoyed you. If it did - it's working.