Skip to content
Foundation

Your system, typed — not a picture of it

Every box gets a type and a file. Every arrow gets a rule something can check.

  • Screens, APIs, services, tables
  • Auto-layout at 200 nodes
  • Edit it directly
  • Knows what it inferred
checkout-flow · graph
GraphFlowsTasksHealthSecurity
The moat

Find out the day the drawing stops being true

Every node records a content hash. So we can answer: is this still what your code does?

  • In sync · changed · gone · unbuilt
  • Accept or rebuild
  • Runs nightly
  • Works on imported code
checkout-flow · sync
GraphFlowsTasksHealthSync

Five nodes claim a file in this repo.

Press Check sync to hash every one of them against the code that is actually on disk right now.

Your machine

Check the whole thing without uploading your code

One command scans the repo where it already lives, and answers with an exit code.

  • Source never uploads
  • Exit 0 · 1 · 2
  • Watch mode
  • Fires on every commit
zsh · checkout-flow
$ graph
no graph here, scanning ./checkout-flow
map 47 nodes · 62 edges · 9 tables
sync 44 in sync
2 changed since last check
1 file gone
rules 2 contract violations
nothing left this machine
exit 1
Start where you are

Point it at a repo that already exists

Folder, git URL or upload. The same typed graph comes out.

  • Next.js · FastAPI · Flask
  • Prisma · SQLAlchemy · SQL
  • Real edges, not just files
  • Re-import merges
~/work/acme-store · import

You do not have to start from a drawing.

Point it at a repository that already exists (a local folder, a git URL, or an upload) and the same graph comes out the other side.

Execution

One task, one scope, green or reverted

The agent gets its nodes and an allowlist of their files. Nothing else.

  • Edges become acceptance criteria
  • Out-of-scope edits fail
  • Must report node → file
  • Never left broken
One task, end to endReader4 of 7 stages run no model
Reader

Sketch → shapes

deterministic

Intent

Shapes → typed nodes

model

Planner

Infer what wasn't drawn

model

Task engine

Graph → ordered work

deterministic

Executor

One task, then stop

model

Gate

Green or reverted

deterministic

Sync

Drawing still true?

deterministic

6 shapes, 5 arrows, 6 labels recovered from the board

Enforcement

Turn “payments must go through auth” into a check

The rule in someone's head becomes the rule that fails a build.

  • protected_by
  • only_via
  • no_direct_edge
  • layer_boundary
checkout-flow · health
GraphFlowsTasksHealthSecurity
2 high2 medium1 info9 finding kinds · deterministic
  • Auth check exists but nothing calls it

    lib/auth.ts → app/api/payments/route.ts

    gate_not_wired
  • Refund handler returns success without refunding

    app/api/refunds/route.ts

    stub_shortcut
  • Two handlers answer POST /api/checkout

    app/api/checkout/route.ts

    duplicate_endpoint
  • Nothing imports this module

    lib/legacy-cart.ts

    orphan_file
  • Receipts is drawn but connects to nothing

    graph node · service:receipts

    isolated_node

Hypotheses until an agent pass confirms them. A scanner that overstates its confidence gets ignored.

Enforcement

A change that breaks the architecture fails the build

Drift and violations come back as annotations on the files that caused them.

  • Inline on the diff
  • No bot to install
  • Works on forks
  • Blocks the merge
CI · pull request #218
$ graph check --format github
::error file=app/api/orders/route.ts,line=14::
orders reaches payments directly: must go via billing
::warning file=lib/session.ts,line=61::
session no longer matches the node that owns it
annotations appear inline on the pull request
exit 1 · check failed
Verification

Risk located by shape, not by grep

The graph knows what each part is, so it knows which defects are even possible there.

  • 9 defect kinds
  • 227 rules, platform-keyed
  • Leaked secrets
  • Ships its own false positives
checkout-flow · security
GraphFlowsTasksHealthSecurity
1 critical2 high1 medium
  • criticalidorapi:getOrder

    reads a table keyed by a client-supplied id, with no ownership edge

  • highssrfservice:webhookRelay

    fetches a URL that arrives in the request body

  • highauthz_bypassapi:deleteUser

    no protected_by edge, unlike every sibling route

  • mediumsecrets_in_logservice:mailer

    logs the full request object on failure

See it work

Watch the journey you drew actually run

Replayed against the code as it is. A step with no code path doesn't light up.

  • Derived, not authored
  • Drawn vs built
  • Narrated per step
  • No diff to read
checkout-flow · flows
GraphFlowsTasksHealthSecurity
Checkout · happy path4 of 5 steps backed by code
  1. 1
    Loginscreen

    user submits credentials

  2. 2
    Authservice

    verifies and issues a session

  3. 3
    Dashboardscreen

    renders with the session

  4. 4
    Paymentsapi

    charges via Stripe

  5. 5
    Receiptsserviceno code path

    emails the receipt

Replayed against the graph re-read from your code. You drew it; you get to watch it run.

No lock-in

A connector, not another window

Drive the whole thing from the coding agent you already use.

  • No second app
  • Your own subscription
  • Export any time
  • No proprietary format
checkout-flow · board
An empty board
LoginDashboardPaymentsSuccessLoginscreenapp/login/page.tsxDashboardscreenapp/dashboard/page.tsxPaymentsapi…p/api/payments/route.tsSuccessscreenapp/success/page.tsxAuthservice · inferredlib/auth.tsUsertable · inferredprisma/schema.prisma

No prompt. No template. No prose.

Together

Argue about the box, not the diff

Approve a node or ask for changes on it, with the conversation attached to the thing itself.

  • Comment on any node
  • Approve · request changes
  • See who is on it now
  • Four roles, enforced
Payments · review

Payments

api · charges.ts

Changes requested

Maya

This talks to the users table directly. Should it go through Auth?

Alex

Agreed — adding a contract so it fails if it happens again.

2 viewing now
Request changesApprove
No account needed

Send the architecture to someone who will never sign up

One read-only link to the current graph — for a client, a candidate, or the person doing your diligence.

  • Read-only, no login
  • Revoke any time
  • See the view count
  • Always the current graph
Share

Anyone with the link

Read-only. They see the graph as it is now — no account, nothing to install.

graphlit.co/s/9f2c‑a41e‑77bd
Copy

41

views

9

people

Live

always current

Revoke it and the link is dead everywhere, immediately.

Unattended

Find out it drifted before the next person does

Re-run drift and the defect scan nightly, and send the result where your team already looks.

  • Nightly re-check
  • Rules you set
  • Webhooks out
  • Email when it matters
Automation

Nightly check

Drift + defect scan · 02:00

  • Today, 02:003 nodes drifted
  • Yesterday, 02:00in sync
  • Sat, 02:00in sync

Tell

WebhookEmailPull request comment
Programmable

Everything the board does, over HTTP

Issue a key, call the same endpoints the product calls, wire it into whatever you already run.

  • Scoped to your org
  • Shown once, hashed at rest
  • Revoke instantly
  • Same API as the app
Settings · API keys
  • CI — main

    gl_live_••••••••••••7f21

    Revoke
  • Staging runner

    gl_live_••••••••••••b904

    Revoke

Shown once, at creation. Only a hash is stored — a leaked database holds no working key.

curl -H "Authorization: Bearer $KEY" \
  https://graphlit.co/v1/projects

See it against your own codebase

Point it at a repo you know. Compare its map to yours.