One decision system. Deliberately separated trust zones.

axiasphere.com · public product surface, documentation and public-source risk.

Synthetic-data workspace demonstration on the public host; it never consumes private workspace state or bypasses production AAL2 controls.

Twelve protected workspace modules share one controlled route registry and memory-only state boundary.

Private notes support categories, tags, symbols, references, pin/archive, editing, search and conversion into follow-up actions without hosted persistence.

Deterministic exact-symbol lineage across holdings, Research Notes, theses, decisions and actions with explicit evidence-debt checks and no inferred causal links.

Thesis Board exposes explicit structural checks for research coverage, source references, disconfirming evidence, review dates, open tests and decision expectations without judging investment merit.

Deterministic analysis of Decision Journal structure, review timing, user-authored outcome assessments and calibration debt without turning subjective outcomes into a performance score.

Thesis, decisions, actions and review dates feed one deterministic review agenda with canonical date handling.

Command Center compares a memory-only baseline with current holdings, actions, theses, decisions and research notes, including decision-integrity warnings.

Unlike currencies are never silently summed for portfolio value, concentration, scenario or delta metrics without approved FX normalization.

AES-256-GCM user-controlled .axiasphere export/import; passphrases are not persisted by AxiaSphere.

Public/app/Ops routing is fail-closed; Vercel preview bypass is allowed only in the preview environment.

Operations telemetry requires an exact hostname allowlist, safe scheme/port and redirect rejection before outbound access.

Automatic Vercel Git deployments are disabled; candidate/main validation precedes deliberate deployment, production is pinned to the exact AxiaSphere Vercel project inside the existing paid team, the prior READY production deployment is captured before promotion, the apex alias must resolve to the exact newly created deployment before smoke, and verification failure requests rollback to the captured target.

Privacy-safe control plane exists, but production Operations authentication remains fail-closed.

Aggregate-only no-store adapter exists; an approved external endpoint is not connected.

Control/evidence roadmap exists; AxiaSphere makes no attestation or certification claim.

Production app hostname remains closed until server-side session verification and MFA enforcement are complete.

Provider contract, entitlements and provenance adapter are still required.

AI policy architecture is documented; provider activation waits on retention, redaction, authorization and cost controls.