System Health & Connection Status

Live connection status for every system the Toolbox reads or writes, with latency, uptime, and the last successful check. Nothing here is assumed — an unreachable source shows as unknown, never as clean. ↻ Re-check all

Engine boot & governance arm-state

Chat — the governed front door

Ask about live tenant data or the doc corpus. Every factual claim is validated against a read path before it reaches you and carries its source tag. Writes never happen here — they route to Approvals. What can't be verified is withheld.

Runner — a goal into a governed plan

Give it a business goal; it decomposes into a cited, step-by-step M3 plan. Any step that changes data becomes a draft that waits in Approvals — the Runner never writes on its own.

1. 1.Read the credit-hold queue and classify by reason OIS300MI.LstHead · HOLD via @o2c
2. 2.For each held order, pull customer credit + aging CRS610MI.GetFinancial ARS200MI.LstInvoices
3. 3.Propose credit-limit changes where aging is clean draft → Approvals via @finance
4. 4.Draft a standard release for orders now within limit draft → Approvals via @o2c
5. 5.Summarize expected cash-flow impact for the CFO GL · posted

Approvals — Consequence Preview

The draft inbox. Every proposed write waits here. You approve an outcome — the consequences, not a raw field diff. Nothing touches the tenant until all three locks pass and you confirm, and the exact preview you saw is hashed into the audit.

Tickets

Read-only Jira, correlated to M3 entities. Ticket facts and M3 facts are each tagged to their own system of record and never blended. Nothing is written back.

JQL: project = OPS AND status in (Open,"In review") ORDER BY updated DESC · read-only. Remove the credential and this surface fails closed with a specific remediation, never a silent empty state.

Audit

Every governed operation, hash-chained. Each row commits to the one before it — a later edit, deletion, or reorder breaks the chain and fails verification. A confirm row also records the hash of the exact consequence preview the human saw.

Our own governance failures — found, dated, published

Capabilities & governance

What the Toolbox is allowed to do on this tenant, and how it decides what to trust. Writes are default-deny; only an explicitly allowlisted triple can execute. Every claim carries a confidence from its source, with hard floors for reads and writes.

Write allowlist — per CONO, default-deny

Source-tag confidence ladder (Truth Protocol)

MI Payload Builder

The ION fluency proof. The Toolbox walks this tenant's own MI catalog at boot (MRS001MI), so every program, transaction, field, type, and required flag comes from the tenant — not a hardcoded list. Pick a program and transaction; the form is schema-driven. It builds and validates the payload; it never executes.

Narrate

Deterministic narration over validated findings — the same facts produce byte-identical output. Every dollar is a finding's own amount, every count a real row count. Any evidence reference that doesn't resolve is dropped and tallied, never narrated. Two lenses, same facts.

EDI

Translate X12/EDIFACT into M3 EDI BOD drafts — or honestly withhold what can't map yet. Nothing posts; mapped documents become drafts that wait in Approvals.

Mapped (customer role — M3 sells)

Withheld (2) — no guess

NL→SQL Reports

Ask a data question in plain English; get a grounded Compass SQL statement, server-validated as SELECT-only, and not executed. If it can't be grounded in real tables, it says so instead of inventing a query.

SELECT  OHCUCD AS currency,
        SUM(OHTOTA) AS total_order_value
FROM    oohead
WHERE   OHORDT >= '20260101'
GROUP   BY OHCUCD
ORDER   BY total_order_value DESC

Generated, validated, and grounded — never executed here. In a live engagement, execution is tenant-gated behind the same governance as any read.

Birst — governed analytics

Source-tagged KPI rows from Birst, clearly marked as derived and time-lagged. Analytics inform; they never authorize a write on their own.

SELECT [Fill Rate] BY [Warehouse]