trellisStart with one app

Evidence boundary · 2026-08-10

Proof before promise.

A local Contract Lab demonstrates that the operating contract can be coherent. It does not demonstrate that Trellis works with Plane, survives production, saves money, or meets a sovereignty claim.

evidence classLOCAL
FIXTUREnot Gate 0 Stage 4

Freshest executable evidence

Contract Lab v0 passed its fixture boundary.

The canonical evidence report records a clean run on Darwin arm64 with Python 3.14.6.

126 / 126
automated tests passed
2
structurally different fixture payloads
36
exact governed actions
20
executed mutations with approvals
2 + 2 + 2
backup, clean restore, and export runs
0
network and model paths by fixture boundary

These are verified fixture observations from the repository report, not benchmarks, customer outcomes, or production telemetry.

What it supports

The mechanics can fit together.

  • Lifecycle, customization, and company-content actions passed through one gateway and policy implementation.
  • Exact approvals, idempotency, append-only receipts, provenance, projection rebuild, and replay stayed coherent.
  • Two local payload shapes implemented the contract without reducing everything to one database.
  • Adversarial fixture tests covered tenant boundaries, injection-as-data, retries, failures, restore staging, and evidence tampering.

What it cannot support

Reality has not passed through it.

  • No Plane API, version, container, domain, real project, or production credential was exercised.
  • Approvals were synthetic; identity, secrets, and emergency access were fixtures.
  • No real human attention, infrastructure cost, backup destination, recovery time, or storage growth was measured.
  • No production security, EU-controlled operation, licensing, migration, subscription retirement, or 30-day pilot was established.

The evidence ladder

Each next claim needs a harder environment.

  1. 01
    completed

    Disposable contract lab

    Local fixture payloads prove mechanics, exactness, failure semantics, and verifier behavior.

  2. 02
    next · requires founder boundary

    Plane feasibility spike

    Read-only and synthetic work must discover real API coverage, credential scope, isolation, backup granularity, restore mechanics, and upgrade rollback.

  3. 03
    not authorized

    One protected real project

    Desired state, daily agent task packets, one visible customization, health, drift, restore, and export pass on the approved Plane boundary.

  4. 04
    not started

    Thirty-day dogfood

    The selected project becomes authoritative while founder attention, incidents, cost, recovery, and avoided work are measured.

  5. 05
    later

    Second heterogeneous adapter

    Forgejo extends the same lifecycle and action model without a core fork and links work to code with stable causality.

Before a live write

The founder must bound the blast radius.

01

Name the project

Select one dogfood project and the exact workflow it should stop duplicating.

02

Bound the service

Approve Plane version, topology, unrelated-project protection, lifecycle lab, and recovery environment.

03

Bound authority

Verify credentials, fail closed when scopes are too broad, and define separate production-change decisions.

04

Bound the data

Classify the whole-instance backup, destination, encryption, key custody, clone network, retention, and deletion.

05

Bound success

Approve or revise founder-time, cost, RPO, RTO, 30-day operation, and subscription or workflow replacement thresholds.

06

Keep the stop condition

Stop or narrow when API, lifecycle, isolation, recovery, economics, or operator attention violates the approved envelope.

Claim ledger

Language the site may—and may not—use.

ClaimStateWhy
A coherent three-plane contract exists. Supported locallyTwo fixture payloads passed exact execution and verification.
The first wedge is Plane Steward. ProposedThe plan is reviewable; the founder has not authorized a live implementation.
Trellis manages Plane. UnsupportedNo real Plane adapter or lifecycle evidence exists.
Trellis is EU sovereign. UnsupportedRequirements exist; provider, egress, key, operator, and recovery evidence do not.
It replaces SaaS subscriptions for less. UnsupportedNo incumbent baseline, cancellation, measured labor, or TCO evidence exists.

Next honest step

Read Plane first.
Touch production later.

The proposed 1–2 week feasibility spike is read-only and synthetic. Production mutation and whole-instance backup handling remain separate decisions.

Review Plane Steward See what comes after