Waypoint — the roadmap, computed

Every tracker you have used asks the same thing of your team: after the work happens, come back and tell the board about it. At one or two changes a day that is a small tax. At the rate harness-driven teams actually ship — agents opening pull requests overnight, reviews landing in minutes — nobody pays it, so the board drifts, the roll-up lies, and the people who should be deciding spend their attention on grooming instead.

Waypoint inverts that. Your engineering system already emits the truth: a claim, a build, a review verdict, a passing suite, a merge, a release. Waypoint records those as evidence and computes the board from them. There is no status field to update, because there is no status field at all.

Evidence in, lanes out

Every signal becomes an immutable event in an append-only, hash-chained ledger — one per project. Events use the CloudEvents envelope with a pinned sdlc.* vocabulary, carry a ULID that makes ingestion idempotent, and link causally, so a release can be traced back through verify → review → build → claim to the original intent.

A work item's lane is then a pure function of its evidence:

Intent → Shaped → Warmed → Building → Qualifying → Verified → Released

Nothing drags a card. An item moves because something provably happened. blocked and needs-human are not lanes either — they are computed flags, rendered as heat, because being stuck is a property of an item, not a place it sits.

"Done" has a depth

A one-bit done is how green dashboards hide red projects. Waypoint grades every item by the evidence actually behind it, in the spirit of a supply-chain attestation:

Views tint by grade, so "green" means evidenced, not asserted. An item that merged but has not shipped sits in its own merged-but-unreleased band rather than disappearing into a done column — the inventory you have paid for but not yet collected on.

Assignment by function, not by role

Roles blur at this velocity: product people ship code, QA people build, agents do real work. So an item does not have an assignee — it has a cast:

• Builders — who is making the change.
• Qualifiers — who is proving it works.
• Domain experts — who holds the judgment about whether it is right.

Several people can hold a function, and agents are first-class members alongside humans, always acting on behalf of a person who stays accountable. Waypoint will suggest a cast from who has actually shipped and reviewed in the affected modules, for a human to confirm — the suggestion model is built; the surface that offers it is not yet wired.

Waves: sprints that compose themselves, and still wait for you

A wave is a rolling capacity window — the sprint, minus the ceremony and minus the fixed fortnight that empties by Tuesday.

Waypoint proposes one by ranking candidates and filling until it exhausts the first of three declared limits:

1. Forecast throughput — a Monte-Carlo simulation over your observed completion history, reported as a 50th/85th/95th percentile band and committed at the 85th. No story points.
2. Economic budget — the token and compute spend the window is allowed to consume.
3. Attention budget — how many approvals and reviews your people have actually declared they can absorb. Human attention is capacity, and treating it as infinite is why review queues become the real bottleneck.

Every number on the proposal shows the denominator it was computed against.

Then it stops and waits. A wave does not start until a human approves it — one steward for a single team, m-of-n for a cross-team wave. That gate is enforced in the reducer itself, so it holds under replay, not just on the happy path.

You stay in charge after approval, too. Override a priority, pull an item out, add one — the system records your decision as an event and responds rather than silently obeying: it tells you what the change costs and, when it can, suggests what to pull to stay inside forecast. Ask it mid-wave and it prices what to pull forward rather than leaving people idle. Unplanned work — incidents, interrupts — consumes a reserved expedite allocation, visible as its own band, so it is never invisible in the math.

Because forecasting is a prediction, Waypoint scores itself: each completed wave is compared against what was committed, and the running calibration is shown to you. When there is not enough history to be honest, it says so instead of inventing confidence.

Releases are the same machine, one horizon out

The composer that assembles a wave can also assemble a release train: from verified inventory it proposes a dependency-coherent, grade-annotated set, and a human approves before anything is cut. It proposes on request today; proposing automatically as inventory accumulates is not yet wired. Sprint planning and release management stop being two rituals that disagree with each other.

One stream, every altitude

The live standup, the team board, the company heatmap, and the executive brief are not four systems that sync. They are four projections of the same event stream at different aggregation windows:

• Standup — what moved since yesterday, including what agents did overnight, live all day rather than at 9:15.
• Team board — the traditional kanban, filtered to one stream.
• Company heatmap — where the organization burns and where it waits, cells coloured by event density, queue pressure (including how long work is waiting on people), and blockage.
• Executive brief — a narrative over live aggregates where every figure links back to the evidence chain that produced it. It reads the same heatmap the page has already fetched, and its velocity comes from the ledger in complete weeks only. What it cannot do yet is compare weeks: nothing captures the snapshots a trend would be measured against, so the brief describes where you are, not what changed since last week.

Every aggregated cell carries its own freshness. If a source has stopped reporting, the view says so rather than showing you a confident blank — a stale cell that admits it is stale beats a roll-up that quietly lies.

Adding up a company without inventing it

Two of those four projections claim to describe the organization rather than one team, and a roll-up is the easiest place in a tracker to be confidently wrong. So it is worth saying exactly what Waypoint adds up, and what it refuses to.

The company figures are computed by reading your Outposts at request time — no warehouse, no nightly job, no summary table that can quietly fall behind the ledgers it summarizes. Every figure is as old as the request that drew it and still carries the evidence chain of the read it came from. The thing it reads is an (Outpost, project) pair, not an Outpost, because one Outpost routinely holds more than one ledger — a production roadmap and a staging one side by side — and a total that counted one of them has covered part of one Outpost's work while calling itself the company's.

Not everything composes, and Waypoint is opinionated about which things do. Item counts add: two Outposts' inventories are one company's inventory. Velocity adds as a rate. Each Outpost is measured over its own observed weeks and the company figure is the sum of those rates rather than their average — items/week plus items/week is items/week, where an average lets a quiet subsidiary dilute a busy one into a number that describes neither. An Outpost with no completed work yet is a visible row reading no figure, never a zero folded into the total. Heat does not add. A heat score is a weighted composite, so averaging two Outposts' cells yields a number belonging to neither, and summing them would make a sprawling organization look hot for being sprawling. The company view therefore ranks the hottest real cells and names the Outpost holding each one, and leaves the thermal grid itself to the Outpost you have narrowed to.

"3 of 5 Outposts read" is a denominator, not a warning

Every company figure arrives with the coverage it was computed over — "Figures cover 3 of 5 Outposts this organization owns" — and that denominator is what you own, never what answered. Built from the reads instead, a missing Outpost would be uncounted, unnamed and invisible inside a sentence that still reads as consistent. A second denominator sits beside it counting projects rather than Outposts, because how much of the company and how much of its work are different questions and one noun cannot answer both.

N below M is the ordinary case, not an error state. Something in a real organization is always quiet, mid-outage, or not yet wired. What matters is that each scope outside N is named underneath the figures with what actually happened to it, because a read states its own cause and the causes are different facts: we never asked, we asked and the read failed, and we asked, it answered, and the ledger held nothing. The last is a quiet team, the middle is an outage, and the first is usually us. Collapsing the three into one grey "unavailable" is how a dashboard turns its own decisions into somebody else's failure.

The read budget is the honest example of that first cause. A fan-out is bounded — the runtime holds only so many reads in flight — so Waypoint declares a ceiling on how many pairs one company view will read, and admits them in a fixed order, so the same organization read twice yields the same pairs rather than an arbitrary subset. Whatever the ceiling leaves over is reported in its own register: not read (read budget), never failed. The bound is ours and the page says so.

Waypoint will not withhold the figures over a suspicion, either. When two of your projects declare most of the same roadmap in common — an environment copy attached to a production organization is the usual cause — it aggregates them both and posts the measurement above the numbers: these projects share most of what they declare, and if a flagged pair is one body of work registered twice, the figures count that work twice. It names the pair and stops there, because it has evidence of an overlap and none at all that the two are one project. That is a deliberate reversal of an earlier design: refusing to aggregate fell back to a single Outpost's numbers under a company heading, and a known-wrong figure is worse than a missing one.

What it does withhold is a claim. Below two Outposts actually read, the panel will not call the figures a portfolio — it names the one Outpost they came from, because one subsidiary's throughput presented as the whole company's is the failure this surface exists to avoid. When nothing could be read at all there are no figures, rather than three calm measurements over an empty set. And when there is only one scope to compare, the company panel does not appear: it would be the grid above it, repeated under a grander heading.

Two planes, equal rank

Waypoint runs a mechanical plane and an advisory plane, and keeps them honest about which is which. Reducers, flow math, forecasts, and calibration are deterministic code you can replay and audit. Prioritization critique, override nudges, cast suggestions, and the executive narrative are model-generated advice — and that advice is inert data. It cannot change state unless policy explicitly grants it, which is asserted by tests, not by convention.

Where this is today

Waypoint is built and running inside Pnyon's own repository first — the four checkpoints (ledger and derived board, wave composer, fleet loop and release trains, company altitudes and tenancy) are merged, and Pnyon is wiring its own roadmap onto them before opening the door. Harness itself now speaks the protocol: sdlc.* emission ships in harness 12.6 as an opt-in config block, and pnyon is a first-class tracker kind. Wiring it to a live Waypoint ledger is the next step — Pnyon's own repository has not enabled it yet.

One consequence of that gap is worth naming, because it shapes what a new organization sees in its first weeks. The wave composer's throughput forecast is a Monte-Carlo simulation over observed completion history, and it stays cold-start until the ledger holds the carriers that mark work done: sdlc.release.published.v1, or sdlc.verify.graded.v1 at grade V2. Below that the band reports insufficientHistory, the committed figure is zero, and the composer admits nothing on the forecast denominator rather than inventing a number it has not earned. Connecting a repository does not lift it: those carriers come from harness sdlc.* emission, not from GitHub activity, so the forecast denominator stays cold until the wiring above is enabled. The spend ceiling and declared-attention denominators are unaffected — they are yours to set and they bind from the first wave.

Adopter onboarding — connecting your organization, your Outposts, and your repositories — lands with early access. If you want to be in that first group, request access.

Next

• Outposts & the BYO worker model — the tenant boundary everything above is scoped to.
• Connect a worker — the hands-on path that is live today.