Local-first operations console where the UI and the AI work the same files — facts derive from live sources, and the console alone moves work to done.
The console renders state; Claude Code changes it. Both sides meet in /data — plain JSON files, one per record, no database. The UI writes through API routes with atomic temp-and-rename saves; agent sessions edit the same files with ordinary file tools under a binding contract (CLAUDE.md).
Since the 2026-08-21 overhaul the deeper rule is derive, don't author: a record may not carry a fact that has a live source. Repo motion, ports, liveness, spend, and build currency are all computed at read time from git, PORTS.md, the filesystem, and the transcripts — hand-written records survive only for intent (focus / paused / dropped / legacy, notes, decisions). The hand-authored copies of derivable facts are exactly what froze the console in July.
The live loop: a chokidar watcher on /data pushes Server-Sent Events to the browser, so the screen moves the instant either side changes anything. The same watcher feeds the policy reconciler — the one writer allowed to move finished work from review/ to done/ without the operator, and only for assignment classes the operator listed in a live-editable policy file. Agents never take that move themselves.
In the browser the console lives at ccos.internal:3100, its own private hostname, so the login cookie — host-scoped, port-blind — never reaches the other apps on this machine. Seven modules remain after the fold: bridge, estate, assignments, skills, architectures, activity, token-metrics.