One spec in.
The same result out, every time.
The platform is arranged around a specific split: the AI handles the conversation with the builder, and everything downstream of it is ordinary, deterministic software. The spec is the handoff. Apps aren’t generated — they’re governed assembly from a versioned spec.
Each layer below is something you can ask us to demonstrate.
Intake
The builder describes what they want, in plain language, to a model. Anything the model can't pin down is written into an assumptions list instead of quietly filled in.
Schema
That conversation is turned into a spec: what the app should do, what data it should call out to, what has to be true about the result. It's readable by people and by machines, and the domain owners can diff it.
Gate
The spec is checked against the domain's rulebook. The result is approved or blocked; nothing in between, and no one can wave an error through. The way past a rule is to change the rule — versioned, owned, recorded — or to change the spec. Re-run it a year later against the same five inputs and you get the same answer, which is how the record stays checkable.
Engine
Code is assembled out of blocks that have already been through review. The same spec on the same engine produces the same bytes, every time. That's what makes ordinary QA possible again.
Runtime
The grants the app was given are checked when it's built and again when it makes a call. The audit trail is complete on day one, and monitoring is wired up before anyone opens the app.
A number we can't stand behind is not shown.
Most software fills a gap. A stale figure keeps rendering. A missing value becomes a zero, or last week's number wearing today's timestamp. Groundwork doesn't do that. When a figure can't be verified right now, the screen shows an em-dash and one line saying why — the source is unreachable, the mapping is unsigned, you don't have access to it. Every figure that IS shown carries the time it was read.
- — · no number we can stand behind right now, with the reason beneath it
- as of 14:15 · every figure carries its age
- needs attention · the cause is always named, never just a color
We never show a guess. That sounds small until the number is in front of a regulator.
If we can't point at the part of the system that makes a claim true, we don't put the claim on the page. If a build can't do the same, it doesn't ship.