§1The framework
The AI never writes code. It edits a spec.
An AI edits a validated, declarative app spec through six fixed operations — it never generates source code. A single Go binary interprets that spec and serves a live, working business app.
Create a Jobs tracker with a status pipeline: quoted, scheduled, done.
beat 2 — the tool calls (real op batch)✓ validated · versioned (ver_000001, seq 1) · materialized → t_ent_000001 (4 columns)
01Run it yourself
02Validation, shown failing
The spec is data, edited only through six validated operations. A batch that breaks an invariant writes nothing — the engine returns a structured rejection, {code, closure}, carrying exactly the pointer a one-step fix needs. Captured verbatim from sq5 console apply:
{
"ok": false,
"rejection": {
"violations": [
{
"code": "uniqueness",
"message": "duplicate field name \"title\" in entity \"Job\"",
"closure": {
"conflictingId": "fld_80qdsw0d",
"existingId": "fld_000001",
"name": "title",
"scope": "entity:ent_000001"
}
}
]
}
}the one-step fix — rename before connecting; recommit:
{"op": "createNode", "ref": "f5", "type": "field", "props": {"name": "notes", "type": "longtext"}}
{"op": "connect", "from": "ent_000001", "edge": "fields", "to": "f5"}
→ {"ok": true, "version": {"id": "ver_wmnqb22g", "seq": 2, "createdAt": "2026-07-22T12:07:00Z"}}sq5 console schema before / after the fix ＋t_ent_000001 · columns (after ver_wmnqb22g): id · created_at · updated_at · version · created_by · updated_by · tenant · deleted_at c_fld_000001 c_fld_000002 c_fld_000003 c_fld_000004 c_fld_q3f4x4ej ← the fix versions: ver_000001 (seq 1) · ver_wmnqb22g (seq 2) — the rejected batch touched neither.
03Architecture as content
(state, ops, clock, gen) — clock and ID generation always injected, never time.Now() or rand inside the engine. Replayable byte-for-byte.04Prove it
Over cold build prompts we measure first-pass-green — the AI's generated spec passes its own generated tests on the first commit — and flat-drift — held-out tests still green after an unrelated edit. Drift is the antidote to code-generation's climbing debt: the write path is always the same six validated ops, never freehand code.
| Phase / scope | Model | Green% | Drift% | Verdict |
|---|---|---|---|---|
| P0 — 8 entity+field apps | claude-sonnet-4-6 | 100% (8/8) | 0% | PASS |
| P1 — booking, orders | claude-sonnet-4-6 | 100% (2/2) | 0% | PASS |
| P2 — full gate, incl. team-tasks perms | claude-sonnet-4-6 | 90.9% (10/11) | 0% | PASS booking borderline cold, fixed |
| P3 — logic prompts | claude-sonnet-4-6 | 100% (3/3) | 0% | PASS |
| P4 — first slice (agentStep) | claude-sonnet-4-6 | 100% (1/1) | 0% | PASS |
| Current gate — deterministic | — | 25/25 = 100% | 0% | PASS held flat through every P5 slice |
05The catalog · from sq5 catalog
Everything below — every node type, view, workflow step, block, field, and function — is created, wired, and reordered through the same six operations. No seventh verb has ever been needed.
06Finished things
Every card opens a live app the interpreter is serving — anonymous read-only share links, no sign-up. Not screenshots.
Everything at once: dispatch board, calendar, crews and resources, invoices, job photos, a live ops dashboard.
Open live → read-only · no sign-upGap-free numbering, exact-decimal totals and tax, payments, printable PDFs, per-client portal access.
Open live → read-only · no sign-upBuilt by demo-factory from a one-paragraph brief — appointments, groomers, pet records.
07Under the hood
A plain-English request becomes MCP tool calls, staged ops, one atomic validated commit, an immutable version, a materialized SQLite schema — and the generic Lit SPA renders it. No app-specific code anywhere in the path.