Mobile-first capture. Office-secure data. Multi-party workflows that don't require a CAD seat or a SaaS subscription.
Stakeholder briefing · v2026.04
Photos on the inspector's phone. Forms on a clipboard. Notes in three apps. The PM rebuilds it on Monday morning from screenshots and texts.
Plenty of platforms exist. Most charge per-seat, host your photos in the US, and put a vendor between you and your data.
Who signed what, when? Inspectors forget. Files move. Schedules slip. By the time it matters (warranty, dispute, litigation) — it's gone.
Built for AEC professionals on Ontario projects. Self-hosted on your infrastructure. No vendor lock-in. No per-seat fees. PIPEDA-compliant by design.
Core initiates 100% of network traffic. Edge accepts public requests and queues them. If Edge is breached, the blast radius is one VPS — not your office, not your data, not your secrets.
Drag-drop field palette. JSON-driven schemas — versioned, AI-composable, themeable. 27 showcase forms ship pre-built; clone any to start.
Send a form to anyone via signed token URL. Multi-signer chains, fan-out to N reviewers, recurring schedules, magic-link external signers.
Every submission lands in Data/submissions/ with photos and audio. Auto-generates PDF /
DOCX / JSON / archive bundle per form definition.
/admin/ Form builder & theme picker /admin/submissions Submission browser + detail /admin/projects Project hubs (counts, recent activity) /admin/chains Cross-chain orchestration dashboard /admin/access/registrations Pending account requests + approvals /admin/access/approvals-log Append-only audit ledger
Every form is a JSON file. The mobile renderer, the desktop renderer, and the output pipeline all read from the same schema.
Field types: text / number / date / select / multiselect / checkbox / rating / slider / signature / drawing / photo / audio / plan_pins / file_attachment / signoff / repeating_group / capture_strip / qr_scan
Field flags: required, copyable,
autocomplete_history, assigned_user_id,
assigned_signer_email, validation
Themes: 7 bundled (default, document, meeting-paper, field-safety, contract, memo, warning, welcome) + per-deployment custom CSS.
{
"id": "daily-site-report",
"title": "Daily Site Report",
"theme": { "preset": "field-safety" },
"fields": [
{ "id": "project_number", "type": "text",
"required": true,
"validation": { "pattern": "^\\d{4,10}$" } },
{ "id": "weather", "type": "text",
"autocomplete_history": true },
{ "id": "captures", "type": "capture_strip",
"plan_mode": "auto" },
{ "id": "site_signoff", "type": "signature",
"assigned_user_id": 7 }
],
"pipeline": [
{ "kind": "pdf_report", "id": "main" },
{ "kind": "save_to_folder",
"path": "C:/Archive/{project_number}/" }
]
}
OpenWeather snapshot at submit. Temperature, wind, precipitation, conditions — attached to the submission manifest automatically.
Optional watchPosition trail during the session. Throttled to 1 point per 15s,
5m dedup. Proves site-attendance duration.
Per-form polygon or circle. Submissions outside the rule return 403 — no accidental data from the wrong site.
Native BarcodeDetector API. Scan equipment tags, room IDs, project stickers.
Fallback to manual entry where unsupported.
Tap any captured photo to drop a quick tag (issue code, note). Carried through to TagAndReport handoff and admin views.
Fields opt-in to a per-user history. Site names, project numbers, common findings — suggested on focus.
A → B → C. Each hop forwards partial data to the next. Recapture undoes downstream hops.
Send to N recipients in parallel. Three policies: wait_all /
first_wins / manual. Per-recipient deadlines.
One form, multiple signature fields, each assigned to a different person — internal user or external email. Chain rotates automatically.
Multi-signer routing, fan-out review, chain forwarding — these aren't form-fill UX, they're orchestration. We built dedicated admin pages.
Fan-out policy: [Wait for all ▼] Recipients 3 recipients Alice <alice@co.example> by 2026-05-01 ✕ Bob <bob@co.example> ✕ Carol <carol@co.example> by 2026-05-03 ✕ + Add recipient Preview: • 4 hops in parallel • parent + 3 children • policy: wait_all • +per-recipient deadlines
Every gated action is a named capability with a min-tier. Admin tunes via Settings → Permissions.
ANONYMOUS → NAME_ONLY → NAME_PIN
→ LOCAL_USER → OAUTH_USER
→ OAUTH_ALLOWLISTED → ADMIN
Every approval, denial, force-approve, sponsor-endorse, SMS-challenge, admin-code-confirm — logged with actor, IP, user-agent, metadata.
action | actor | when | meta ─────────────── | ────────── | ──────── | ──────── approved | admin@x | 14:32 | role:user sponsor_sent | system | 14:30 | to:eli@… admin_code_gen. | admin@x | 14:31 | — admin_code_conf | edge_echo | 14:31:42 | — approved | admin@x | 09:15 | role:user denied | admin@x | 08:42 | reason:… …
Read-only at /admin/access/approvals-log. Filter by
action / request / date. No truncation API.
For paperwork that already exists as PDF — permits, contracts, change orders. Upload, drop tags at exact coordinates, route through signers.
Every form defines an ordered pipeline. A worker thread runs it after submission lands; the inspector's phone never waits.
{project_number}, {site_id},
{inspector}, {form_id}, plus any field id.
HTML and DOCX templates per-deployment. Drop into
Data/templates/; pick from the form builder.
/admin/outputs shows every task. Failed step?
Click Retry — picks up where it stopped.
Per-form rules; HMAC-signed payloads on every submission landing.
Invite emails, password reset, sponsor / verify magic links, output delivery.
SMS OTP at registration. SMS challenge at approval.
Auto-attached weather snapshot at submit time, when GPS is present.
Signed deep-link handoff. TAR opens the folder in place.
Microsoft / Google. Allow-list tier above plain OAuth.
Claude / OpenAI / Gemini / Ollama. Form & theme compose, voice cleanup.
HMAC-signed protocol. Bootstrap, rotate, push-all, reconcile.
Office firewall blocks all inbound. Edge runs on a VPS that's compromise-recoverable in minutes (DELETE edge.db; re-bootstrap; push-all). Core stays untouchable.
Argon2id hashes. HMAC-signed sync with replay protection. Append-only audit ledger. Capability tiers. Idempotent migrations.
Everything lives on your hardware. SQLite +
flat files under Data/. Hourly hot snapshots, nightly cold backups — no vendor,
no per-seat fees, no jurisdictional surprises.
Photos in your OneDrive / SharePoint / SMB share via save_to_folder.
Inspectors are the primary users. Add to home screen. Works offline. Voice + photo + plan + signature all native. Service Worker keeps things working in basements.
No proprietary file format. JSON form schemas. Standard SQLite. Standard PDF/DOCX/JSON outputs. CSV exports. Stdlib HTTP — no Anthropic SDK dependency, no AWS lock-in.
Walk away with all your data, in formats anyone can read.
Run python tools/seed_demo.py first. Five demo projects, nine users,
twenty workflows in different states.
/?ui=mobile on a phonealice@demo.fieldlog.local / demo1234/my/requests — assigned tokens inbox/admin/chains — point at the in-progress 3-hop RFI/admin/forms/rfi/signers — apply a template/admin/projects — five demo projects, distinct activity profiles/admin/access/registrations — five pending requests, every trust state/admin/access/approvals-log — 31 audit entries, filter by action/admin/stats — date-range filter across 90 daysClean up:
python tools/clear_demo.py
412 backend tests + 79 edge tests passing.
4–6 week pilot on one friendly project. We deploy on your hardware. Your data, your firewall, your workflow. We tune the trust toggles and forms to match.
Press P to print this deck.