Forever Works
the control-plane studio · selected work

Two control planes.
Nothing moves unreviewed.

Orb, built for a tier-1 bank's GitHub Enterprise across 2023–2026, files every edit as a reviewed pull request. Meridian, the operations CLI at a media-tech platform, mutates nothing without --execute. Each case file below is rendered in the design system it shipped with — and each gate is live. Try them.

01 — Orb rendered in its own design system · Ledger

Orb · governance control plane/a tier-1 bank · GitHub Enterprise/design system — Ledger
orbrecursive broker · est. 2026
§ 01zero-direct-write

A governed console for the whole of GitHub — that cannot change a thing on its own.

Orb is an audit-grade access broker for GitHub Enterprise, built across a tier-1 bank's SDLC (2023–2026). It gives non-CLI users a governed surface for organizations, repositories, rulesets and role-based access inside a regulated bank — permission rendered as weight, not colour.

Its defining trait is zero-direct-write: the interface holds every change as staged state and cannot touch production. To make a change real it files a sync — a pull request under your own identity — reviewed and then reconciled downstream. The tool proposes; the record decides.

II.

The demonstration

The zero-direct-write mechanic, miniature and live. Nothing you do here writes anywhere.
§ 01.B · working example
Realm · EDGE-OPS — access matrix
Seven repositories inherit this matrix. Re-grade a weight below.
standard
PersonaStagedLive state
GUESTbrowse only · 6read
PMissues + boards · 4triage
DEVstandard push · 11write
OPSbranch protection · 3maintain
0 unsynced edits—
The ledger is clean. Click a staged weight above — the edit is held, not written.
In flight. The matrix is locked while the sync is under review.
The procedure · § 01.A
  1. I.
    Stage
    Held, not written
    Edits accumulate client-side as unsynced state. Nothing has happened yet.
  2. II.
    File a sync
    A reviewed pull request
    The staged change is filed as a PR under your identity — never written straight to live state.
  3. III.
    Review
    Filed, or returned
    Approved, amended, or returned at a gate. The exact plan is visible before it is real.
  4. IV.
    Reconcile
    Now it is live
    On merge, a downstream run reconciles the change into state. Only now — and fully audited.
SYN-2026-0412pending
Re-grade personas · EDGE-OPS
pr state-repo#412 · branch sync/edge-ops/2026-07-02
reviewer kira-anand · awaiting review
III.

The system

Ledger, v0.1 — paper before pixel; rules, not shadows; one signal colour; documentary voice.
§ 02 · specimen
Permission is weight, not colour
  • none
  • read
  • triage
  • write
  • maintain
  • admin

Five greyscale weights; crimson only at admin — and admin is never offered in a select. The one colour in the system is a state, not a decoration.

State earns the colour
pendingin reviewfiledreturned

A sync is filed or returned— never “merged”, never “rejected”. The vocabulary is a clerk's, because the interface is a record.

Three voices
Source Serif 4 — the document speaks.
IBM Plex Sans — the working prose.
JETBRAINS MONO — THE MACHINE RECORD
The palette is paper
  • paper
  • paper-2
  • ink
  • rule-3
  • signal
  • confirm

No gradients, no shadows, no radius. Structure comes from 1px rules at four weights — the way a printed form holds itself together.

IV.

The record

What was built, in the numbers a ledger keeps.
§ 03 · filed 2026
Repos
14
7 named in EDGE-OPS
Realms
07
2 under lock
Members
24
across all personas
Channels
03
GitHub organizations
In flight
02
syncs under review
Surface
React 18 + TypeScript strict — dashboard, orb detail, realms, syncs; a marketing/login twin beside it
Custody
GitHub OAuth, sealed in an AES-256-GCM HttpOnly session cookie — no tokens in the page
Write path
staged edits → a pull request against state-file repositories → a GitOps reconcile run. The audit trail is the git history
Tenure
2023–2026 · a tier-1 bank's enterprise SDLC · shipped with its own design system
orb · ledger v0.1 · § 01–03governed by review, not by access

02 — Meridian rendered in its own design system · v4

Meridian · operations CLI/a media-tech platform/design system — v4
meridianall lines converge

Run it local. Ship one image. Nothing mutates without --execute.

Meridian is the plan-first operations CLIbehind a media-tech company's supply-chain platform. It runs the backend locally and ships a single proven image to AWS — and every command that would touch infrastructure, images or release tags prints the exact plan and stops.

Nothing runs without --execute. The spine is Terraform on AWS with keyless GitHub-OIDC — CalVer release trains (meridian/v2026.06.1), and per-client deploys that can never cross tenants. Pure engine modules return data; a thin CLI is the only thing that touches a process — argv-lists, never a shell.

live · the gate, in your hands

The terminal is the product.

These are the real command shapes. Run the plan — it stops at the gate. Only --execute walks the steps green, and only a passed health gate earns the cyan ◆.

meridian — plan, then gate
$
✓ a step that ran▸ a plan, pending the gate◆ earned — health-gated, live✗ refused, with the way forward
the delivery spine

One line, commit to client.

The CLI is the visible tip. Under it: Terraform on AWS, a single proven image, keyless trust, and releases that are cut — not pushed.

one image

The container the dev stack builds is the container that ships. Dev → prod with no drift to debug at 2 a.m.

the health gate

Green means a step ran. The cyan node exists only past the gate — earned by a healthy service, never awarded by a script.

no stored keys

GitHub OIDC assumes a role in AWS per run. There is no credential to leak, rotate, or find in a laptop's dotfiles.

releases are cut

meridian train cut tags a CalVer release and CI does the rest. A version is an annotated fact in git, not a push someone remembers.

design system — v4 “flagship”

Precise. Calm. Certain. Built. Dry.

The CLI shipped with a complete brand system — glyph grammar, an ANSI-16 theme, a voice spec. The error message is the most-read copy, so it is designed like the logo.

glyph grammar
  • ▸actiona step the plan will take
  • ⠧runningone spinner per screen, verb attached
  • ✓step doneit ran — green is work, not glory
  • ◆earnedlive & health-proven — the only cyan
  • ⊘blockeda gate refused; the message says what now
  • ·queuedknown, not yet in motion
ansi-16, shipped as the default theme

Every colour is a named token; if it is unnamed, it does not ship. Iris is interactive, green is a step, coral is failure — and cyan belongs to the mark and the earned moment alone.

three voices
Space Grotesk — the display voice.
Instrument Sans — the working prose.
ibm plex mono — the true voice: 2026.06.1, every path, every slug
meridian · v4.0 flagship · 2026.06one reference line, from commit to client ◆
the pattern

Two designs.
One gate.

Orb files every change as a pull request; Meridian prints every change as a plan. A bank and a media platform, years apart — and the same gate holds in both: nothing goes live until the full plan is approved. The bad day has nowhere to start.

Book a call ↗← Back to foreverworks