the control-plane studio

Built to last.

We build control planes: the software that governs how your systems change. Nothing happens by accident — every change planned, previewed, gated, reversible.

Start a conversation ↗See the work ↓

01 The signature

Nothing by
accident.

Before · PlannedWhat will this do?Every change begins as a plan you can read — not a command someone types into production.

At the gate · ReviewedWho approved it?Routine changes flow. High-blast-radius changes stop until a person says go — approval enforced, not assumed.

After · ReversibleHow do we undo it?Every step is logged and attributed, and rolls back to known-good when the bad day comes.

Most internal systems are held together by scripts, tribal knowledge, and the hope that nobody runs the wrong command. A control plane makes change deliberate — software that refuses to do the wrong thing.

02 The proof

Not a theory.
Shipped twice.

Governance & accessZero-direct-writeA governance console for GitHub Enterprise that cannot change live state. Every edit becomes a reviewed pull request.

Operations & deployPlan-firstAn operations CLI that prints the exact plan and stops. Nothing mutates without --execute.

Two systems · in production

One governs change inside a bank; the other ships releases at a media platform. Different worlds, same rule: nothing goes live until the plan is approved. The audit trail isn't a report; it's the git history.

Case file · 01 — GovernanceorbGitHub Enterprise governance at a tier-1 bank. An AI agent's change passes the same gate as a person's.Open the case file ↓Case file · 02 — OperationsmeridianPlan-first operations at a media-tech platform. Nothing mutates without --execute.Open the case file ↓

03 Case file — Orb· in its own design system, Ledger · the gate is live

§ I — the brief

01 / 04

Orb · governance control plane/a tier-1 bank · GitHub Enterprise/design system — Ledger

orbrecursive broker · est. 2026

§ 01zero-direct-write

A governed console for the whole of GitHub — that cannot change a thing on its own.

Orb is an audit-grade access broker for GitHub Enterprise, built across a tier-1 bank's SDLC (2023–2026). It gives non-CLI users a governed surface for organizations, repositories, rulesets and role-based access inside a regulated bank — permission rendered as weight, not colour.

Its defining trait is zero-direct-write: the interface holds every change as staged state and cannot touch production. To make a change real it files a sync — a pull request under your own identity — reviewed and then reconciled downstream. The tool proposes; the record decides.

orb · ledger v0.1 · the demonstration is one sheet over

II.

The demonstration

The zero-direct-write mechanic, miniature and live. Nothing you do here writes anywhere.

§ 01.B · working example

Realm · EDGE-OPS — access matrix

Seven repositories inherit this matrix. Re-grade a weight below.

standard

Persona	Staged	Live state
GUESTbrowse only · 6		read
PMissues + boards · 4		triage
DEVstandard push · 11		write
OPSbranch protection · 3		maintain

0 unsynced edits—

The ledger is clean. Click a staged weight above — the edit is held, not written.

In flight. The matrix is locked while the sync is under review.

The procedure · § 01.A

I.
Stage
Held, not written
Edits accumulate client-side as unsynced state. Nothing has happened yet.
II.
File a sync
A reviewed pull request
The staged change is filed as a PR under your identity — never written straight to live state.
III.
Review
Filed, or returned
Approved, amended, or returned at a gate. The exact plan is visible before it is real.
IV.
Reconcile
Now it is live
On merge, a downstream run reconciles the change into state. Only now — and fully audited.

SYN-2026-0412pending

Re-grade personas · EDGE-OPS

pr state-repo#412 · branch sync/edge-ops/2026-07-02
reviewer kira-anand · awaiting review

III.

The system

Ledger, v0.1 — paper before pixel; rules, not shadows; one signal colour; documentary voice.

§ 02 · specimen

Permission is weight, not colour

none
read
triage
write
maintain
admin

Five greyscale weights; crimson only at admin — and admin is never offered in a select. The one colour in the system is a state, not a decoration.

State earns the colour

pendingin reviewfiledreturned

A sync is filed or returned— never “merged”, never “rejected”. The vocabulary is a clerk's, because the interface is a record.

Three voices

Source Serif 4 — the document speaks.

IBM Plex Sans — the working prose.

JETBRAINS MONO — THE MACHINE RECORD

The palette is paper

paper
paper-2
ink
rule-3
signal
confirm

No gradients, no shadows, no radius. Structure comes from 1px rules at four weights — the way a printed form holds itself together.

IV.

The record

What was built, in the numbers a ledger keeps.

§ 03 · filed 2026

Repos

7 named in EDGE-OPS

Realms

2 under lock

Members

across all personas

Channels

GitHub organizations

In flight

syncs under review

Surface: React 18 + TypeScript strict — dashboard, orb detail, realms, syncs; a marketing/login twin beside it
Custody: GitHub OAuth, sealed in an AES-256-GCM HttpOnly session cookie — no tokens in the page
Write path: staged edits → a pull request against state-file repositories → a GitOps reconcile run. The audit trail is the git history
Tenure: 2023–2026 · a tier-1 bank's enterprise SDLC · shipped with its own design system

governed by review, not by access · read the full case file ↗

04 Case file — Meridian· in its own design system, v4 · the terminal is live

01 — the brief

01 / 04

Meridian · operations CLI/a media-tech platform/design system — v4

meridianall lines converge

Run it local. Ship one image. Nothing mutates without --execute.

Meridian is the plan-first operations CLIbehind a media-tech company's supply-chain platform. It runs the backend locally and ships a single proven image to AWS — and every command that would touch infrastructure, images or release tags prints the exact plan and stops.

Nothing runs without --execute. The spine is Terraform on AWS with keyless GitHub-OIDC — CalVer release trains (meridian/v2026.06.1), and per-client deploys that can never cross tenants. Pure engine modules return data; a thin CLI is the only thing that touches a process — argv-lists, never a shell.

live · the gate, in your hands

The terminal is the product.

These are the real command shapes. Run the plan — it stops at the gate. Only --execute walks the steps green, and only a passed health gate earns the cyan ◆.

meridian — plan, then gate

✓ a step that ran▸ a plan, pending the gate◆ earned — health-gated, live✗ refused, with the way forward

the delivery spine

One line, commit to client.

The CLI is the visible tip. Under it: Terraform on AWS, a single proven image, keyless trust, and releases that are cut — not pushed.

one image

The container the dev stack builds is the container that ships. Dev → prod with no drift to debug at 2 a.m.

the health gate

Green means a step ran. The cyan node exists only past the gate — earned by a healthy service, never awarded by a script.

no stored keys

GitHub OIDC assumes a role in AWS per run. There is no credential to leak, rotate, or find in a laptop's dotfiles.

releases are cut

meridian train cut tags a CalVer release and CI does the rest. A version is an annotated fact in git, not a push someone remembers.

design system — v4 “flagship”

Precise. Calm. Certain. Built. Dry.

Glyph grammar, an ANSI-16 theme, a voice spec — the error message is the most-read copy, so it is designed like the logo.

glyph grammar

▸actiona step the plan will take
⠧runningone spinner per screen, verb attached
✓step doneit ran — green is work, not glory
◆earnedlive & health-proven — the only cyan
⊘blockeda gate refused; the message says what now
·queuedknown, not yet in motion

ansi-16, shipped as the default theme

Every colour is a named token; if it is unnamed, it does not ship. Iris is interactive, green is a step, coral is failure — and cyan belongs to the mark and the earned moment alone.

three voices

Space Grotesk — the display voice.

Instrument Sans — the working prose.

ibm plex mono — the true voice: 2026.06.1, every path, every slug

one reference line, from commit to client · read the full case file ↗

05 The craft

On the layer
everyone neglects.

The console an operator stares at during an incident deserves the same design attention as anything a customer sees. A tool your engineers hate gets bypassed — and a bypassed control is no control.

DesignBuilt like a productBoth systems shipped with their own complete design system — the layer most teams never design at all.

We build internal software as products, not projects. Products get maintained; projects get abandoned.

Ledger: Paper-first, documentary
v4: Dark, earned signal
Discipline: Rigor + taste

06 How we work

A senior
collective.

A small senior bench — no juniors, no pyramid, no rotating cast. Everything ships in your repository:yours to read, run, and change the day we're gone. We measure engagements in years.

Y0 Build

Y5 Still live

07 Contact

Start a
conversation.

We build control planes — only control planes. If your systems have outgrown duct tape and you won't stand up a platform org to compensate, the first conversation is thirty minutes.

Book a call ↗

hello@foreverworks.com ↗LinkedIn ↗

Track recordIBMSiemensGlobal PaymentsGameloft

the control-plane studio · built to last — planned, gated, reversible, in your repo