Real today
What the current preview actually claims
The homepage says preview mode, simulated, local-first, canonical library loaded, and real connectors blocked. That language is honest and should stay that way until a real send path is explicitly built.
- Preview commands are deterministic and local-first.
- Audit model should explain what happened, what was simulated, and what stayed blocked.
- Any claim about production actions needs a separate, gated path.
Receipt model
What each receipt should capture
| Field | Why it matters |
| external_mutation_performed | Proves the preview did not change anything outside the sandbox. |
| real_send_performed | Shows whether a real send or writeback happened. It should stay false in preview. |
| production_ready | Explicitly false until a separate approval path is opened. |
| receipt_recorded | Confirms an auditable record exists for the action or preview. |
The audit page is the place to prove the difference between preview, simulated reads, and real production work. If the distinction gets blurry, this page should make it obvious again.