Building blocks
One boundary for every change
Every change, from the app, from an Agent, or from the API, goes through the same path: sign-in, then permission check (authority, gates and limits together), then validation, then audit, then the change. There is no private route for the app and no side door for Agents.Inside Worksong
In the Worksong app, Work is a tab. You sign in once. Work is on in the web app and the phone app. Source:worksong-ai/Boardy:README.md@6775786, worksong-ai/Boardy:CLAUDE.md@6775786, worksong-ai/worksong:docs/WORK-IN-WORKSONG.md@e5e65e9. Docs version: Worksong 2.0 with Work 1.2.