Technical Evaluator OS

Technical evaluator previewPreview data

API surface, security controls, integration dependencies, and the evaluation checklist — drawn from the same code-backed catalogs the live panels use. Private traces and saved notes are not fabricated; they appear below only when the evaluator has real workspace data.

API endpoints

documented + auditable

Security controls

6/ 9 enforced

2 documented · 1 scope note

Integrations

2 hard deps, 4 soft

Eval criteria

weighted, category-grouped

API surface — sample of 6 routespreview

MethodPathAuthDescription

GET

Live build identity/api/health

Public

Service health, version, revision, environment, payment readiness, and support-contact configuration.

POST/GET

Account billing portal/api/account/billing-portal

Signed-in

Signed-in account billing portal entrypoint and readiness check.

GET

Account subscription/api/account/subscription

Signed-in

Signed-in account subscription state for account settings and billing views.

GET

Admin funnel report/api/admin/funnel-report

Owner-only

Owner-only funnel diagnostics guarded by signed-in admin email allowlist.

GET

Admin revenue metrics/api/admin/revenue-metrics

Owner-only

Owner-only revenue and webhook health rollups for operations review.

GET

Admin status/api/admin/status

Owner-only

Owner-only operational status surface for internal checks.

71 more routes in the API Surface panel. The full catalog is derived from shipped BSS route files.

Security posturefactual

Supabase RLS for tenant data
enforced
All write paths go through createSupabaseServerClient with the authed user JWT; service_role is server-only and never bundled.
Cookie-based session, httpOnly
enforced
Supabase sets httpOnly + SameSite cookies; useAuth/useSubscription read from session, not localStorage.
Rate limiting on public endpoints
enforced
Durable token-bucket rate limiting wraps public tool surfaces and returns standard 429 headers.
Stripe webhook signature verification
enforced
Webhook handler validates Stripe signatures before processing; readiness is included in live build health.
Secret material never logged or echoed
enforced
Live health redacts sentinel config values; API keys are shown once at creation and not returned again.
Persona-OS workspace surfaces unlisted from sitemap
enforced
Persona workspaces are unlisted from the sitemap and marked noindex — they're workspaces, not marketing pages.

3 more controls in the live Security Posture panel.

Integration dependenciesall 6

Supabase
hard dep
Auth (email+password / OAuth), Postgres, RLS, storage.
failure: Hard dep — outage = no auth, no DB reads/writes. Fail-closed at request boundary.
Stripe
soft dep
Subscription billing, checkout, webhook-driven entitlement sync.
failure: Soft dep — workspace remains readable; new subscriptions block until Stripe restored. Existing entitlements unaffected.
Resend / SES (provider-flagged)
soft dep
Transactional + notification email.
failure: Soft dep — UI flows succeed; email retry queue picks up later and readiness appears in build health.
Vercel platform
hard dep
Edge runtime, deploy infra, env var management.
failure: Hard dep — platform outage = full app down. Mitigated by Vercel SLA + DNS-level fallback.
OpenAI / Anthropic (provider-agnostic)
soft dep
LLM completions for content-factory + AI-assisted tool runs (where enabled).
failure: Soft dep — non-AI tools fully functional; AI tools fail-closed with provider error.
Cloudflare (CDN + DNS)
soft dep
Asset CDN + DNS + DDoS shield.
failure: Soft dep — origin serves on Cloudflare bypass. Static assets degrade gracefully.

Evaluation checklist — sample criteriapreview

Tenant isolation enforced server-side (RLS, not UI-only)

weight 5pending

Foundational; UI-only isolation is a P0 finding in any audit.

Secret material never returned to client or logged

weight 5pending

API key disclosure is a P0; one-time-show pattern is the bar.

Deterministic health endpoint with version + revision

weight 4pending

Required for safe rollouts and incident triage.

Public endpoints rate-limited with standard 429 headers

weight 4pending

Protects vendor from abuse + protects your bill.

4 more criteria in the live Evaluation Checklist panel. Sign in to save the verdict across devices; anonymous changes use the local fallback.

Security posture entries are factual and verifiable in the codebase — not marketing claims. Live panels below render build identity, saved notes, and your own traces when real data exists.

Loading evaluator evidence...

Live build identity

Reading live build…

Live route inventory

Scanned from route handlers at request time. It lists methods and source-level access signals; it does not infer schemas, latency, or SLA.

Reading route inventory…

Search endpointsCategory

Showing 77 of 77 curated endpoint explanations.

Method	Path	Auth	Description	Category	Rate limit
GET	Live build identity /api/health	Public	Service health, version, revision, environment, payment readiness, and support-contact configuration.	health	none-documented
POSTGET	Account billing portal /api/account/billing-portal	Signed-in	Signed-in account billing portal entrypoint and readiness check.	billing	authenticated
GET	Account subscription /api/account/subscription	Signed-in	Signed-in account subscription state for account settings and billing views.	billing	authenticated
GET	Admin funnel report /api/admin/funnel-report	Owner-only	Owner-only funnel diagnostics guarded by signed-in admin email allowlist.	admin	admin
GET	Admin revenue metrics /api/admin/revenue-metrics	Owner-only	Owner-only revenue and webhook health rollups for operations review.	admin	admin
GET	Admin status /api/admin/status	Owner-only	Owner-only operational status surface for internal checks.	admin	admin
POST	AI result enhancement /api/ai/enhance	Mixed	Signed-in or API-key enhancement path; tier gated and quota/rate limited.	tools	mixed
POST	Claim guest tool result /api/auth/claim-guest-tool-result	Signed-in	Claims a guest-generated tool result into a signed-in workspace.	auth	authenticated
GETPOST	Capability explorer /api/capability	Public	Deterministic explorer metadata and rate-limited capability matching.	tools	standard
GETPOST	Capability explorer alias /api/capability/explorer	Public	Compatibility route that delegates to the capability explorer contract.	tools	standard
POST	Checkout creation /api/checkout	Mixed	Rate-limited checkout session creation for signed-in or guest checkout flows.	billing	standard
POST	Content Factory generation /api/content-factory/generate	Signed-in	Signed-in content generation endpoint with quota and provider fallback behavior.	content	authenticated
GET	Content provider status /api/content-factory/providers	Public	Provider availability metadata for Content Factory UI.	content	none-documented
GET	Conversion nudge cron /api/cron/conversion-nudge	System	Scheduled conversion-nudge job endpoint; intended for platform cron execution.	ops	system
GET	Stripe provisioning cron /api/cron/reconcile-stripe-provisioning	System	Scheduled reconciliation job for Stripe provisioning state.	ops	system
GET	Trial nurture cron /api/cron/trial-nurture	System	Scheduled trial nurture job endpoint; intended for platform cron execution.	ops	system
GETPOSTDELETE	Explorer sessions /api/dashboard/sessions	Signed-in	Signed-in Explorer session list, save, and cleanup operations.	dashboard	authenticated
DELETE	Explorer session delete /api/dashboard/sessions/[id]	Signed-in	Signed-in deletion for one saved Explorer session.	dashboard	authenticated
GETPOST	Subscription management /api/subscriptions/manage	Signed-in	Signed-in user subscription read/update: status, tier, period end, payment-backed flag, and trial classification.	billing	authenticated
POST	No-card trial start /api/subscriptions/start-trial	Signed-in	Internal no-card trial start — fail-closed; respects single-trial-per-user contract.	billing	authenticated
GET	Tool catalog /api/tools	Public	Public tool registry with category and featured filters. Rate-limited.	tools	standard
GET	Tool detail /api/tools/[id]	Public	Tool detail by id — schema-first, validated inputs, deterministic outputs.	tools	standard
POST	Tool execution /api/tools/[id]/execute	Mixed	Executes one registry tool with validated inputs; supports session/API-key identity, quotas, and 429 responses.	tools	mixed
POST	Tool result export /api/tools/[id]/export	Mixed	Exports a tool result artifact after validating the requested tool and payload.	tools	mixed
GET	Tool quota check /api/tools/[id]/quota	Mixed	Returns the current user or visitor quota state for a tool before execution.	tools	mixed
GET	Shared tool result read /api/tools/share/[token]	Public	Reads a public share token for a tool result without exposing private workspace state.	tools	standard
POST	Shared tool result create /api/tools/share	Signed-in	Creates a share token for a signed-in user-owned tool result.	tools	authenticated
GET	Workspace usage /api/dashboard/usage	Signed-in	Per-user usage analytics: 14-day daily series + totals + top tools.	usage	authenticated
GET	Saved tool sessions /api/dashboard/tool-sessions	Signed-in	Authed user saved tool sessions — supports trace replay use cases.	dashboard	authenticated
GETPATCHDELETE	Saved tool session detail /api/dashboard/tool-sessions/[id]	Signed-in	Signed-in read, patch, or delete for one saved tool execution trace.	dashboard	authenticated
GETPOST	API key management /api/dashboard/api-keys	Signed-in	Signed-in API key list/create endpoint; plaintext key material is not echoed after creation.	dashboard	authenticated
DELETE	API key revoke /api/dashboard/api-keys/[id]	Signed-in	Signed-in API key revocation for one user-owned key.	dashboard	authenticated
GETPOST	Email unsubscribe /api/email/unsubscribe	Public	Public unsubscribe landing/action endpoint for email preferences.	marketing	standard
GET	Explorer quota /api/explorer/quota	Mixed	Quota state for Explorer usage, based on current visitor or signed-in tier.	usage	mixed
GETPUT	Founder workspace preferences /api/founder-os/preferences	Signed-in	Signed-in founder workspace preference read/update path.	dashboard	authenticated
GETPOST	App prototype generator /api/generator	Signed-in	Template list and signed-in Pro-gated app prototype generation.	generator	authenticated
GETPOST	Business system blueprint /api/generator/blueprint	Mixed	Blueprint metadata and Pro-gated generation via session or API key.	generator	mixed
POST	QuickBooks import preview /api/integrations/quickbooks/import-preview	Signed-in	Signed-in QuickBooks import preview path for connected accounting data.	integrations	authenticated
GET	QuickBooks OAuth callback /api/integrations/quickbooks/oauth/callback	Mixed	OAuth callback endpoint for QuickBooks connection completion.	integrations	standard
GET	QuickBooks OAuth start /api/integrations/quickbooks/oauth/start	Signed-in	Signed-in OAuth start endpoint for a QuickBooks connection.	integrations	authenticated
GET	QuickBooks connection status /api/integrations/quickbooks/status	Signed-in	Signed-in connection status check for QuickBooks integration.	integrations	authenticated
POST	Lead capture /api/lead	Public	Rate-limited lead capture endpoint with validation and delivery fallback.	marketing	standard
POST	Newsletter signup /api/newsletter	Public	Rate-limited newsletter signup endpoint with email validation.	marketing	standard
GETPOST	Onboarding state /api/onboarding	Mixed	Onboarding read/write route for user setup flows.	auth	mixed
GET	Ops automation readiness /api/ops/automation-readiness	Owner-only	Internal operations readiness check for automation surfaces.	ops	admin
GET	Ops checkout recovery /api/ops/checkout-recovery	Owner-only	Internal checkout recovery status for owner/operator review.	ops	admin
GET	Ops commercial truth /api/ops/commercial-truth	Owner-only	Internal commercial truth reconciliation endpoint for owner/operator review.	ops	admin
GET	Ops distribution readiness /api/ops/distribution-readiness	Owner-only	Internal distribution readiness status for owner/operator review.	ops	admin
GET	Ops first-dollar action ladder /api/ops/first-dollar-action-ladder	Owner-only	Internal first-dollar action ladder endpoint for operations review.	ops	admin
GET	Ops first-dollar readiness /api/ops/first-dollar-readiness	Owner-only	Internal first-dollar readiness check for owner/operator review.	ops	admin
GET	Ops first-dollar tracking /api/ops/first-dollar-tracking	Owner-only	Internal first-dollar tracking endpoint for owner/operator review.	ops	admin
GET	Ops first-value paths /api/ops/first-value-paths	Owner-only	Internal first-value path diagnostics for owner/operator review.	ops	admin
POST	Persona workspace share create /api/persona-os/[persona]/share	Signed-in	Creates a share token for a signed-in persona workspace artifact.	persona_os	authenticated
GETPUT	Persona workspace storage /api/persona-os/[persona]/workspace	Signed-in	Tenant-scoped JSON workspace read/update for persona OS panels.	persona_os	authenticated
GET	Persona workspace share read /api/persona-os/share/[token]	Public	Reads a public persona workspace share token without requiring a session.	persona_os	standard
GET	Pricing metadata /api/pricing	Public	Public pricing metadata used by pricing and checkout surfaces.	billing	none-documented
POST	Stripe checkout alias /api/stripe/checkout	Mixed	Stripe checkout creation path used by payment flows.	billing	standard
GET	Stripe publishable config /api/stripe/config	Public	Public Stripe client configuration needed by checkout UI.	billing	none-documented
POST	Stripe customer portal /api/stripe/portal	Signed-in	Signed-in customer portal session creation.	billing	authenticated
GET	Stripe price metadata /api/stripe/prices	Public	Public price metadata read from configured Stripe price IDs.	billing	none-documented
GET	Stripe checkout session read /api/stripe/session/[sessionId]	Mixed	Checkout session status lookup for post-checkout flows.	billing	mixed
GET	Stripe webhook runtime probe /api/stripe/webhook-runtime-probe	Owner-only	Owner/operator probe for webhook runtime readiness.	billing	admin
POST	Stripe webhook receiver /api/stripe/webhook	Signed webhook	Stripe-signed webhook receiver; rejects unsigned or invalid-signature events.	billing	webhook
POST	Support request /api/support	Mixed	Support-ticket intake for signed-in or contactable users with validation.	support	standard
GETPOST	Generated systems collection /api/systems	Signed-in	Signed-in system workspace list/create route.	systems	authenticated
GETPATCHDELETE	Generated system detail /api/systems/[id]	Signed-in	Signed-in system workspace read/update/delete route.	systems	authenticated
GETPOST	System modules /api/systems/[id]/modules	Signed-in	Signed-in module list/create for a generated system.	systems	authenticated
PATCHDELETE	System module detail /api/systems/[id]/modules/[moduleId]	Signed-in	Signed-in module update/delete for a generated system.	systems	authenticated
GETPOST	System runbooks /api/systems/[id]/runbooks	Signed-in	Signed-in runbook list/create for a generated system.	systems	authenticated
PATCHDELETE	System runbook detail /api/systems/[id]/runbooks/[runbookId]	Signed-in	Signed-in runbook update/delete for a generated system.	systems	authenticated
GETPOST	System workflows /api/systems/[id]/workflows	Signed-in	Signed-in workflow list/create for a generated system.	systems	authenticated
PATCHDELETE	System workflow detail /api/systems/[id]/workflows/[workflowId]	Signed-in	Signed-in workflow update/delete for a generated system.	systems	authenticated
POST	System approvals /api/systems/[id]/approvals	Signed-in	Signed-in approval creation for a generated system.	systems	authenticated
PATCHDELETE	System approval detail /api/systems/[id]/approvals/[approvalId]	Signed-in	Signed-in approval update/delete for a generated system.	systems	authenticated
POST	Telemetry event /api/telemetry	Public	Rate-limited client telemetry ingestion with required payload validation.	telemetry	standard
POST	Visitor telemetry ping /api/telemetry/visitor-ping	Public	Rate-limited visitor activity ping for anonymous funnel analytics.	telemetry	standard
POST	Workspace session attach /api/workspace/sessions	Signed-in	Signed-in workspace session attachment route for generated systems.	dashboard	authenticated

Curated rows explain buyer-visible capability. The live inventory above is generated from route handlers.

0 pass0 fail8 pending0 n/a

Tenant isolation enforced server-side (RLS, not UI-only)

security · weight 5

Foundational; UI-only isolation is a P0 finding in any audit.

weight:5

Secret material never returned to client or logged

security · weight 5

API key disclosure is a P0; one-time-show pattern is the bar.

weight:5

Deterministic health endpoint with version + revision

reliability · weight 4

Required for safe rollouts and incident triage.

weight:4

Public endpoints rate-limited with standard 429 headers

reliability · weight 4

Protects vendor from abuse + protects your bill.

weight:4

Pricing tiers documented with per-tier limits, not "contact sales"

cost · weight 3

Self-serve evaluability — a hard requirement for pilot decisions.

weight:3

Stripe (or equivalent) webhook signature verification

integration · weight 4

Webhooks without signature checks are an exploit primitive.

weight:4

LLM provider abstraction (not single-vendor lock-in)

integration · weight 3

Risk mitigation — provider pricing/availability changes.

weight:3

Per-persona usage docs + sample evaluations exist

support · weight 2

Faster onboarding for the evaluator and the eventual buyer.

weight:2

Local only — sign in to save across devices.

Supabase RLS for tenant data
enforced
evidence: All write paths go through createSupabaseServerClient with the authed user JWT; service_role is server-only and never bundled.
Evaluator note
Cookie-based session, httpOnly
enforced
evidence: Supabase sets httpOnly + SameSite cookies; useAuth/useSubscription read from session, not localStorage.
Evaluator note
Rate limiting on public endpoints
enforced
evidence: Durable token-bucket rate limiting wraps public tool surfaces and returns standard 429 headers.
Evaluator note
Stripe webhook signature verification
enforced
evidence: Webhook handler validates Stripe signatures before processing; readiness is included in live build health.
Evaluator note
Secret material never logged or echoed
enforced
evidence: Live health redacts sentinel config values; API keys are shown once at creation and not returned again.
Evaluator note
Persona-OS workspace surfaces unlisted from sitemap
enforced
evidence: Persona workspaces are unlisted from the sitemap and marked noindex — they're workspaces, not marketing pages.
Evaluator note
CSRF: cookie SameSite=Lax + state-changing routes POST only
documented
evidence: Supabase default SameSite cookies; tool execution routes accept POST with JSON body and validate origin via Next.js framework.
Evaluator note
Per-user usage caps surface on dashboard
documented
evidence: Per-user usage events are shown in the dashboard; tier gates are enforced server-side, not just UI-hidden.
Evaluator note
Audit trail for write actions
scope note
evidence: Usage events record product activity today. A dedicated admin-grade audit log is outside the current self-serve workspace scope.
Evaluator note

For an external attestation, request the latest security-audit memo from the BSS owner — independent of the surface here. Notes are stored locally until sign-in.

Supabase
auth
hard dep
Auth (email+password / OAuth), Postgres, RLS, storage.
Failure mode
Hard dep — outage = no auth, no DB reads/writes. Fail-closed at request boundary.
Evaluator note
Stripe
payments
soft dep
Subscription billing, checkout, webhook-driven entitlement sync.
Failure mode
Soft dep — workspace remains readable; new subscriptions block until Stripe restored. Existing entitlements unaffected.
Evaluator note
Resend / SES (provider-flagged)
email
soft dep
Transactional + notification email.
Failure mode
Soft dep — UI flows succeed; email retry queue picks up later and readiness appears in build health.
Evaluator note
Vercel platform
observability
hard dep
Edge runtime, deploy infra, env var management.
Failure mode
Hard dep — platform outage = full app down. Mitigated by Vercel SLA + DNS-level fallback.
Evaluator note
OpenAI / Anthropic (provider-agnostic)
ai
soft dep
LLM completions for content-factory + AI-assisted tool runs (where enabled).
Failure mode
Soft dep — non-AI tools fully functional; AI tools fail-closed with provider error.
Evaluator note
Cloudflare (CDN + DNS)
storage
soft dep
Asset CDN + DNS + DDoS shield.
Failure mode
Soft dep — origin serves on Cloudflare bypass. Static assets degrade gracefully.
Evaluator note

We keep the integration surface deliberately small; fewer dependencies mean a smaller security blast radius. Notes are stored locally until sign-in.

Run a reference call — prove determinism

Executes the real roi-calculator tool (pure arithmetic, no network, no LLM) twice with fixed inputs, hashes each normalized result (SHA-256), and asserts they are byte-identical. See reproducibility instead of reading a claim.

Canned inputs

{
  "currentAnnualCost": 120000,
  "estimatedAnnualSavings": 48000,
  "implementationCost": 25000,
  "timeToImplement": 3,
  "discountRate": 10
}

Run the reference call to capture the verdict, both run hashes, and timing.

Prove it across the product — full reference suite

Runs a curated set of six pure-arithmetic tools (spanning financial modeling, scoring, and planning) twice each, hashes every result, and reports a per-tool and aggregate verdict. This is a reproducibility check, not a load, latency, or stress test.

Run the suite to capture per-tool verdicts, the aggregate fingerprint, and the downloadable signed report.

Loading sessions…

Tier positioning

Free: validate fit with rate-limited runs and public surfaces.

Starter: smallest paid pilot with saved sessions for one evaluator.

Pro: team evaluation with higher budgets and API-key analytics.

SeatsPilot length (months)

Linear projection only — does not assume volume discount.

free

$0/mo

$0/yr (monthly × 12, no fabricated discount)

seats: 1 evaluator

tool budget: Limited per-tool runs; rate-limited for fairness

api budget: Public endpoints only; no API keys

Pilot cost (3mo × 1 seat)

Best for: validating tool quality, schema review, security posture audit. Not a long-term workspace.

starter

$29/mo

$348/yr (monthly × 12, no fabricated discount)

seats: 1 paid seat

tool budget: Generous monthly tool runs; saved tool sessions

api budget: Personal API key, standard rate limit

Pilot cost (3mo × 1 seat)

$87

Best for: a single technical evaluator running pilots; the smallest paid commitment that includes saved artifacts.

pro

$99/mo

$1188/yr (monthly × 12, no fabricated discount)

seats: Up to small team

tool budget: Highest per-month tool runs + advanced tools

api budget: Pro API tier, higher rate limit, per-key analytics

Pilot cost (3mo × 1 seat)

$297

Best for: a team scoping a department-wide rollout; full saved-session history + advanced analytics.

Honesty: published rates only. For multi-seat or annual prepay quotes, the evaluator should request a written quote from the BSS owner — those terms are not surfaced here.

Browser (Next.js client) — React + Tailwind; hydrates SSR HTML; reads session cookie.
Vercel edge runtime — Routes requests to nearest region; runs middleware.
Next.js server (nodejs runtime) — App router handlers; force-dynamic where needed; SSR.
Supabase (Postgres + Auth) — RLS-enforced data, JWT session, Storage buckets.
Stripe — Checkout, subscriptions, webhook-driven entitlement sync.
LLM providers — Anthropic / OpenAI; provider-agnostic content-factory.
Rate limit store (durable) — Per-IP and per-user durable token bucket.

Edge style: solid = direct call; dashed = webhook (inbound to next-server).

Evidence commandFactual catalog summary and next review moves.Hide

Technical evaluator previewPreview data

API surface — sample of 6 routespreview

Security posturefactual

Integration dependenciesall 6

Evaluation checklist — sample criteriapreview

API surfaceLive route inventory + curated endpoint explanations.Hide

Evaluation checklistWorksheet grading for each criterion with evidence notes.Hide

Security postureCode-backed vs documented controls and scope notes.Hide

IntegrationsDependency map with outage impact by platform.Hide

Trace inspectorWorkspace traces, determinism proof, and export artifacts.Hide

Cost projectionPilot cost model with explicit assumption notes.Hide

Reference architectureCall flow and dependency map for implementation review.Hide

Ready to use Technical Evaluator OS for your business?