TEMPO

Stop coding agents from spending the build budget before the business case is ready and a human has authorized the work.

TEMPO is a Work & Productivity workflow for product and innovation leads who supervise coding-agent work. It turns “should we build this?” into one of two useful outcomes: the cheapest next experiment, or a bounded MVP charter that can receive a separate human warrant. Research, finance, engineering, founders, and agencies participate as secondary workflow roles.

This repository is a hackathon vertical slice, not a production authorization service. It is local-first, dependency-light, and designed to be inspected by a judge from a clean clone without credentials.

Judge in 60 seconds

From a clean clone, run one command:

python bin/tempo demo

In about two seconds, the deterministic journey shows four product outcomes:

• EXPERIMENT_REQUIRED names the evidence gap and cheapest next experiment;
• an evidence-backed case can become MVP_AUTHORIZED while build_allowed: false keeps implementation blocked;
• one bounded, warranted start succeeds while an unwarranted start and protected-input drift fail closed; and
• the ledger verifies, a machine receipt is produced, and the human verdict section remains blank for its owner.

Prefer a browser? The bilingual, read-only audit console turns the same control vocabulary into an inspectable today -> timeline -> trace -> receipts -> export experience. It uses an explicitly synthetic fixture and cannot authorize work. Serve the demo/ directory with python -m http.server 8000 --bind 127.0.0.1 --directory demo, then open http://127.0.0.1:8000/audit-console.html.

Open the self-contained 60-second judge story in a browser preview for an animated overview with the key readiness, repository-binding, warrant, guard, and ledger code beside each step. It has no external assets or runtime dependencies. Its source remains reviewable in this repository.

Watch the 155-second judge video or inspect the verified public CI run.

Why it exists

Coding agents can make implementation fast enough that teams start building before they agree on the decision, target user, evidence threshold, economics, budget, deadline, or kill condition. That is a work-management problem, not only a code-safety problem.

TEMPO moves the control boundary upstream:

flowchart LR
    Q["Business question"] --> P["Untrusted planning proposal"]
    P --> E["Evidence + rank-1 hypothesis"]
    E --> R{"Deterministic readiness"}
    R -->|"Not ready"| X["Cheapest next experiment"]
    X --> E
    R -->|"Eligible"| H["Human authorization"]
    H --> W["Hash-bound warrant"]
    W --> B["Bounded build"]
    B --> V["Machine receipt"]
    V --> D["Human verdict"]

Loading

A planning model may propose and summarize. Output entering through the provider adapter is always normalized as model synthesis, so correctly labeled model output and fixtures cannot satisfy the external-evidence gate, authorize a build, manufacture a passing receipt, or fill the human verdict. TEMPO validates declared provenance and freshness; this local slice does not authenticate whether a user-supplied source record is genuine.

What the demo proves

The one-command scenario shows the complete control boundary:

1. a model-shaped planning proposal is normalized as untrusted input;
2. insufficient evidence yields EXPERIMENT_REQUIRED with a concrete next action;
3. explicit fixture measurements satisfy the rank-1 hypothesis threshold and make the sample eligible for authorization;
4. implementation still stops because no warrant exists;
5. a demo-only, local-integrity warrant permits one in-scope start; and
6. protected charter drift invalidates that warrant.

The fixture is deliberately labeled. It proves the workflow, not market demand or production-grade signing.

Sample data

samples/business-mvp/ contains the complete credential-free scenario: opportunity and business-model records, one rank-1 hypothesis, a readiness policy, initial/ready decision briefs, a charter proposal, a model-synthesis fixture, supporting and contradictory interview fixtures, and a bounded task. Every synthetic record says that it is a fixture. The demo copies these inputs to an ignored workspace; it does not rewrite the checked-in samples.

Setup

Prerequisites: Git and Python 3.10 or later. Runtime dependencies are from the Python standard library; Docker is only needed to reproduce the isolated CI profile.

Supported hosts are Windows, macOS, and Linux with Python 3.10+.

From a clean clone:

git clone https://github.com/vemodalen-x/TEMPO.git
cd TEMPO
python --version
python bin/tempo context
python bin/tempo selfcheck

The submission repository is public at github.com/vemodalen-x/TEMPO.

On systems where Python is installed as python3, substitute python3 in the commands. An editable install is optional:

python -m pip install -e .
tempo --help

Run

Run the credential-free judge path:

python bin/tempo demo

Run the complete local verification and inspect the ledger:

python bin/tempo verify --level all
python bin/tempo ledger verify

Machine-readable output is available by placing global --json before the command, for example python bin/tempo --json demo. The CLI uses stable exit codes: 0 pass, 2 policy block, 3 checker failure, and 4 warning.

For the manual workflow and all options:

python bin/tempo --help
python bin/tempo business --help
python bin/tempo evidence --help
python bin/tempo mvp --help

Core commands cover business initialization/import/status, hypothesis and evidence inspection, readiness assessment, charter creation/signing, warrant authorization/revocation/status, gated MVP start, verdict compilation, verification, and submission checks.

Read the result

Human-readable commands use one order throughout: Outcome -> Why -> Evidence -> Next action. The two states that matter most are kept separate:

• MVP_AUTHORIZED from readiness means eligible for a human authorization decision.
• build_allowed: true appears only after an independently valid warrant and exactly one matching mvp_started receipt bound to the active task, actor, session, lane, action, and repository workspace.

New human warrants use a V2 repository subject digest bound to the exact Git origin, revision, commit, worktree root, Git directory, and common directory. Only explicitly labeled demo fixtures may use a non-Git subject. Historical signed references remain recorded for audit, but legacy path/name subjects cannot authorize new work and are never silently upgraded.

Generated artifacts live under plan/; the append-only ledger API, durable head checkpoint, and receipts live under .tempo/. The checkpoint detects a missing or truncated ledger tail, but remains local-integrity evidence rather than an external notarization. If a checkpoint replacement fails during an append, TEMPO verifies and rolls back exactly the uncommitted tail while holding the ledger lock; an unsafe rollback fails closed. JSON schemas live under schemas/.

Architecture

Layer	Responsibility	Authority
Commercial planning provider	Propose normalized opportunity, model, hypotheses, and experiments	Suggestion only
Evidence/readiness kernel	Validate provenance and freshness, run blockers, score deterministically	Eligibility decision
Human warrant boundary	Bind signer, scope, budget, deadline, and protected hashes	Implementation authority
Start/guard layer	Revalidate authority for each declared task/action/lane	Allow or deny work
Ledger/verification/verdict	Preserve events, generate receipts, compile a human-owned memo	Evidence, not self-approval

The code is intentionally vendor neutral. The current provider path normalizes JSON fixtures and does not call the OpenAI API. See docs/openai-provider.md for the exact Codex/GPT-5.6 claim boundary.

Work & Productivity fit

TEMPO is not presented as a generic developer guardrail. Its unit of value is a faster, clearer team decision: research knows the evidence gap, product knows the next experiment, finance sees the cap, engineering sees authorized scope, and the business owner gets a reviewable verdict memo. No measured savings are claimed in this release; time and avoided-cost impact remain hypotheses for a real pilot.

The framework has nevertheless changed one real internal development process. The limitation-labeled Understand Video single-founder dogfood records repeated readiness blocks, one fail-closed authority revocation, and a recovery run with one valid start plus 38 exact-path lease rotations while an independent public product was delivered. This is process evidence, not customer validation or a savings claim.

See docs/judging-alignment.md for the official criteria mapping and the explicit boundary between published guidance and inferred OpenAI UX sensibilities.

The superseded 140-second recording plan is preserved in demo/video-script.md for provenance. The final 155-second judge video is available at youtu.be/CbfAwNdwy5c.

Codex and GPT-5.6

Codex Desktop with GPT-5.6 in Sol Ultra mode is the primary build environment used to create and test this repository under AGENTS.md. This is meaningful build-time model use, not a decorative label: GPT-5.6 materially contributed to source reconciliation, the readiness/authority architecture, deterministic contracts, adversarial cases, the fixture journey, and the submission narrative. The artifact-level map is recorded in submission/ai-usage.json.

The owner-confirmed /feedback session value is recorded in submission/session.json. The product runtime does not make a live GPT-5.6 call, and the recorded commercial proposal fixture is not presented as API evidence.

Codex accelerated four inspectable decisions in the primary build task:

• reconciled the supplied TEMPO specification, pinned VEMO mechanisms, and the earlier commercial-planning contract while preserving source boundaries;
• identified the circularity between readiness and authorization and captured the two-stage resolution in ADR 0001;
• changed the product framing and config to Work & Productivity after the owner selected that track, captured in ADR 0002; and
• implemented the vertical slice and adversarial conformance cases in parallel, then used executable checks instead of narrative completion claims.

What is new for Build Week

The standalone repository, schemas, deterministic readiness kernel, warrant boundary, ledger/receipts, fixture demo, tests, and submission package were created during the 2026 Build Week submission period. The TEMPO v1.3 archive, VEMO repository, and earlier commercial workflow predate this entry and are credited as design sources. Source pins and the adaptation boundary are recorded in MANIFEST.json, THIRD_PARTY_NOTICES.md, and docs/source-analysis/.

Security and verification

Start with SECURITY.md and SANDBOX_CONTRACT.md. Local runs provide deterministic checks and local integrity, not hostile-code isolation. CI adds a digest-pinned, unprivileged, network-disabled container profile. Receipts record which profile actually ran.

If Docker or Podman is available, reproduce that profile with python bin/tempo verify --level all --require-container. Missing container tooling is a checker failure, never a simulated pass.

Requirement-to-code-to-proof links are in TRACEABILITY.md. Third-party lineage and licenses are in THIRD_PARTY_NOTICES.md and LICENSE.

Submission status

The public repository and judge video are available, the /feedback value is owner-confirmed, and the clean-clone journey plus cross-platform CI are verified. TEMPO was submitted to OpenAI Build Week as Devpost submission 1103781; the live project is authoritative. The URL retains an earlier slug, but the submitted project name, primary repository, description, and category are TEMPO. Packaging evidence is tracked in submission/checklist.md.