Feature status

The state of each feature on every platform. We update it as the app changes.

Last updated 2026-10-09. What changed, release by release, is in the changelog.

Type

137

Entry, identity, and room access

Feature	Status	Notes	Agent access
Open a permanent room link and see room / invite contextPermanent personal room / memorable link	Have	Bare room links stay opaque; booking tokens can add title, time, and subject.	Agent accessHuman only: A page for the guest who holds the link.
Book a time from a roomBookable link (/book/<slug>)	Have	The Mac in Join mode opens the public web booking page from Book a time; Host mode has no such button. The phone joins; booking is a web door.	Agent accessHuman only: A public page for visitors outside the workspace.
Sign up for an event and join with a personal linkEvent registration page (Zoom webinars, Luma)	Have	An event with a room and a public slug has a sign-up page at /event/<slug>. Each person gets a personal room link and a calendar invite by mail. In the event window the room is a session: guests join muted and the transcript goes to the host only.	Agent accessHuman only: A public page for visitors outside the workspace.
Send an event’s reminder and follow-up mailsWebinar reminder and follow-up emails	Have	Each registrant gets one reminder an hour before the start, sent by the workspace on its own. The follow-up, with the event’s note and its call to action, goes out when a workspace admin or the person who made the event asks for it, through MCP or the API, to everyone who signed up and has not had it.	Agent accesstask (MCP), /api/events/:id/follow-up
Enter guest name and emailGuest join without account	Have	Human guests do not need an account and provide email; a declared notetaker omits email and joins through the same owner-admission path.	Agent accessstarlings join
Before-you-join camera and microphone check	Have	Each surface uses its platform-native permission and device flow.	Agent accessHuman only: Capture on the person's own camera and microphone.
Ask to join, waiting-room status, cancel, and reconnectWaiting room / admit–deny	Have	No LiveKit media token is issued until the owner admits the request. Every client can withdraw the knock and lands back on Prejoin.	Agent accessstarlings join, starlings leave
Verified member sign-in	Have	A member signs in with an account on one of the workspace's identity domains. The Mac and iPhone apps sign in through the workspace's own sign-in page; Envisioning keeps its native Google sign-in for now. On the Mac sign-in belongs to the app, not the mode: Join mode fills in the signed-in owner's own name and email when you call a colleague.	Agent accessHuman only: Sign-in is the member's own Google consent.
Several workspaces in one app	Have	The Mac and iPhone apps hold a session for each workspace a member adds, and switch between them: the Starlings menu › Switch Workspace on the Mac (the app reopens), Settings › Workspaces on iPhone. Each workspace keeps its own session, caches and links; a room link opens in the workspace it belongs to. No switch during a call. Sign Out leaves the other workspaces signed in; Sign Out of All Workspaces does not. On the web, each workspace is its own address.	Agent accessHuman only: Sign-in is the member's own Google consent.
Host presence / lease protectionHost must be online	Have	The control plane gates admission and token exchange on the owner device lease.	Agent accessBuilt in: A rule the server holds. There is nothing to operate.
Token invite shows booking title / time / subject	Have	Booked links reveal that meeting only; bare slug stays opaque.	Agent accessHuman only: A page for the guest who holds the link.
Guest reschedules / cancels a booking	Have	Handled on Core’s pages so calendar and CRM stay in sync.	Agent accessHuman only: A public page for visitors outside the workspace.
Meeting password / passcode	Don't want	Lobby + owner admit is the gate.	Agent access—
Disposable / one-off room codes	Don't want	Permanent owner rooms only.	Agent access—
Dial-in / PSTN phone audio	Don't want	WebRTC clients only.	Agent access—
SIP / hardware room systems	Don't want	Out of scope.	Agent access—

Live audio, video, and stage

Feature	Status	Notes	Agent access
Mute and unmute microphoneMute / unmute microphone	Have	Available before joining and during the meeting.	Agent accessstarlings microphone
Start and stop cameraStart / stop camera	Have	Camera-off tiles retain participant identity across clients.	Agent accessstarlings camera
Choose camera, microphone, and output deviceCamera / mic device selection	Have	Every surface picks camera and microphone before joining and from the same chevron beside mute and camera in the call. iOS output stays with the system audio-route picker.	Agent accessstarlings devices, starlings select-camera, starlings select-microphone, starlings select-speaker
Spatial audio: voices from where the tiles areSpatial audio	Have	Starlings places each remote microphone on an arc in front of you, where that person's tile is on the stage, and moves the voice when the tile moves. HRTF on headphones, plain panning on speakers. On by default, with a switch on every surface. Screen-share audio stays centred.	Agent accessHuman only: What a person sees or hears in the call.
Participant video grid, participant count, and People panelMulti-participant video grid	Have	Tuned for small rooms with a hard ~100-participant guardrail. People lists who is in the meeting with microphone, camera, and screen-share state; host actions stay native.	Agent accessHuman only: What a person sees or hears in the call.
Publish a screen shareScreen share (display / window)	Have	Mac uses a display / window picker; browsers also expose their native tab option.	Agent accessstarlings screen-share
Watch and identify a remote screen share	Have	Shared tiles are named and visually distinguished from camera video.	Agent accessHuman only: What a person sees or hears in the call.
Stop your own screen share	Have	iOS does not publish screen shares.	Agent accessstarlings screen-share
Host stops another participant’s screen shareStop someone else’s screen share (host)	Have	Host surfaces only; it stops the active share but does not ban future sharing.	Agent accessPlanned
Host mutes a participant, or everyone elseMute all / mute others (host)	Have	Mac and iOS owners. Closes microphones and opens none — unmuting stays with the person muted, on every surface.	Agent accessPlanned
Told who muted you	Have	The SFU mute is what silences the mic; the notice is what stops it reading as broken hardware.	Agent accessHuman only: A notice to the person in the call.
Host removes a participant mid-callRemove / kick participant mid-call	Have	Mac and iOS owners, with confirmation. Disconnects them and spends the admission, so re-entry is a fresh knock.	Agent accessPlanned
Told you were removed, not dropped	Have	All clients distinguish removal from connection loss. iOS observes the session phase and shows an ended receipt with the reason and a way to join again.	Agent accessHuman only: A notice to the person in the call.
Background blur and branded background effectsBackground blur	Have	Mac, web and iOS offer blur, Pixels, Flock and Grid in workspace tones, a workspace picture and a personal picture. Admin sets derived or explicit tones, uploads the public workspace picture and chooses a default; a personal choice, including Off, wins. Personal pictures stay on the device, scaled and re-encoded without metadata. Segmentation runs on the device — the room sees only composited frames.	Agent accessstarlings blur
Hide self view	Have	Hiding the preview does not stop publishing the camera.	Agent accessHuman only: What a person sees or hears in the call.
Connection quality and reconnect handlingConnection quality indicator	Have	iOS shows per-person quality and an explicit reconnecting state in the participants panel.	Agent accessBuilt in: The client does this on its own.
Leave the meeting or end it for everyoneLeave meeting	Have	Guests and owner companions leave their own session. Mac and iOS hosts can end a personal room for everyone; ending the shared internal room for everyone is a separate confirmed action.	Agent accessstarlings leave
Speaker / output device selection	Have	Mac Settings, in-meeting menus, starlings; web prejoin + settings where the browser supports it; iOS route picker.	Agent accessstarlings select-speaker
Share a region of the screen	Want	Natural third option in the Mac picker.	Agent access—
Share one browser tab	Partial	Browser guests already can; Mac host shares a whole window.	Agent accessHuman only: The browser asks the person which tab to share.
Share computer audio with screen	TBD	Common peer feature; not a first-class control today.	Agent access—
End meeting for all (host)	Have	Owner finalizes the room and notes path.	Agent accessstarlings leave
Rejoin after brief disconnect	Have	Admitted credential → fresh token while the lease is live.	Agent accessBuilt in: The client does this on its own.
Speaker / active-speaker emphasis	Partial	Screen share auto-pins on web; no full Speaker View.	Agent accessHuman only: What a person sees or hears in the call.
Pin / spotlight a participant	Don't want	Removed. A screen share takes the big tile on its own; there is no local pin and no host spotlight.	Agent access—
Gallery vs Speaker view toggle	TBD	Starlings is grid-first today.	Agent access—
Full screen meeting window	Partial	OS window chrome; no dedicated in-app stage mode.	Agent accessHuman only: What a person sees or hears in the call.
Picture-in-picture / pop-out video	Partial	Optional Mac self-view only; it can dock back to the stage. There is no generic participant pop-out.	Agent accessHuman only: What a person sees or hears in the call.
Immersive / together mode layouts	Don't want	Novelty layouts.	Agent access—
Virtual / brand backgrounds	Have	Workspace backgrounds are configured in Admin → People → Workspace: derived or explicit tone pairs, a public picture and an optional default. All clients read the live workspace descriptor; personal pictures stay local.	Agent accessHuman only: Capture on the person's own camera and microphone.
Beauty / touch-up filters	Don't want	Out of scope.	Agent access—
Browser noise suppression / AEC	Have	Explicit capture defaults on web.	Agent accessHuman only: Capture on the person's own camera and microphone.
Advanced voice isolation	TBD	OS-level on Mac; not a Starlings control yet.	Agent access—
HD / 1080p video toggle	Partial	Capture around 720p-class; no user HD switch.	Agent accessHuman only: Capture on the person's own camera and microphone.
Low-light adjustment	Don't want	Out of scope.	Agent access—
Lock meeting (no new joins)	Partial	Implicit when the lease dies; no explicit lock toggle.	Agent accessBuilt in: A rule the server holds. There is nothing to operate.
Co-host / alternate host	Don't want	Exactly one verified member owns each room.	Agent access—
Host tools security menu	Don't want	Single-owner model.	Agent access—
Domain-restricted hosting	Have	Only members on the workspace's identity domains host.	Agent accessBuilt in: A rule the server holds. There is nothing to operate.

In-meeting collaboration and captions

Feature	Status	Notes	Agent access
Room text chatIn-meeting text chat	Have	One room-wide text channel; file attachments and private DMs are not offered.	Agent accessPlanned
Embedded preview for a pasted link	Have	The Worker reads the page and answers text; no client ever fetches a pasted link, so a site never learns who was in the room. In a meeting the read is authorized by the meeting itself, because a guest has no account. The page’s picture comes through the Worker too, on a signed address — without that signature the route would be an open image proxy.	Agent accessHuman only: A card drawn for the person who reads the chat.
Ephemeral emoji reactionsEmoji reactions	Have	Six reactions float in the room and are not stored.	Agent accessHuman only: A gesture between people in the call.
Reactions on a chat message	Have	The same six emoji, on a message rather than on the room. Reliable rather than lossy, because a tally has to still be right in ten minutes — but stored nowhere: they last as long as the chat does, which is the call, and never reach the record or the summary.	Agent accessHuman only: A gesture between people in the call.
Live captions from the owner deviceLive captions	Have	Speech-to-text runs locally on whichever owner device is the host; only caption text is shared.	Agent accessstarlings transcript
Show and hide the live transcript / captions viewShow / hide captions UI	Have	iOS keeps the caption strip on the stage and opens the full transcript from More.	Agent accessHuman only: What a person sees or hears in the call.
Finalized transcript and AI summary deliveryMeeting transcript (finalized text)	Have	Read in Starlings once finalized, by participants with artifact access; consent-filtered. Share a link to the meeting page (it grants nothing), copy the text, or download .md or .txt: on the web from the meeting page, on the Mac and iPhone from the live transcript. Nothing is emailed and nothing is recorded.	Agent accesstranscript (MCP), starlings://meeting/{room}/{meeting_id}, starlings://changes/{cursor}, /api/rooms/:slug/meetings
Meeting duration and ended receipt	Have	Joining clients explain when the owner ended the room or the session was lost.	Agent accessHuman only: A notice to the person in the call.
Chat file attachments	Don't want	Text only; no file plane.	Agent access—
Raise hand	Have	Stays up until lowered, survives reconnects; badge on the tile, queue count on People. The host can lower every hand at once.	Agent accessHuman only: A gesture between people in the call.
Participant list panel	Have	People panel on every client with per-person mic, camera, and share state; host actions (mute, remove) stay native.	Agent accessPlanned
Private / DM chat	Don't want	One room chat.	Agent access—
Whiteboard	Don't want	Use external docs.	Agent access—
Collaborative docs / slides in-call	Don't want	Out of scope.	Agent access—
Polls / quizzes	Don't want	Out of scope.	Agent access—
Breakout rooms	Don't want	Explicit non-goal.	Agent access—
Annotation on shared screen	Don't want	Out of scope.	Agent access—
Third-party in-meeting apps	Don't want	No marketplace.	Agent access—
AI meeting summary	Have	Available in Starlings after finalization to participants with artifact access.	Agent accesstranscript (MCP)
Cloud A/V recording + playback URL	Want	Proposed, not decided. Starlings does not record today; consent and retention still open.	Agent access—
Local A/V recording	Don't want	Cloud recording is the supported path if it ships.	Agent access—
Livestream to YouTube / Twitch	Don't want	Out of scope.	Agent access—
Artifact viewer / delete / export	Want	Needed before broad transcript rollout.	Agent access—
CRM / meeting log ingest	Have	Hosted Starlings sessions and Granola notes can sync finalized meeting text into Core interactions; deployment needs the optional Core secret and migration.	Agent accessstarlings://feed/{limit}
Share a project with people outside the team: a guest thread for clients, an organization’s Claude	Partial	Share in a subject’s header on the web grants a member, agent, guest or organization read or write on that one subject, or restricts it to the people added. A guest opens a link to the subject’s guest thread with no account; a partner organization’s Claude reaches the same thread through /mcp with its own token. Outside lines are tagged and never wake an agent. Mac and iPhone draw neither the Share dialog nor the guest thread yet (meet#895).	Agent accessHuman only: Who outside the team sees a project is a decision for a person.

Owner workspace, scheduling, and operations

Feature	Status	Notes	Agent access
Home / own room status / copy room linkCopy invite / share link	Have	Home is today on web too — the clock, then the modules in the order you chose in Settings → Home, among them your room with its link, a copy button and Schedule…, with Home / Calendar / Work / Team / Docs navigation. The member room flow belongs to Home; `/join` remains a direct public room door. On the Mac the launch card is Host mode only. Starting the room is native (see Start room, admit / reject guests).	Agent accessnow (MCP)
Connect Google Calendar and subscribed feeds, view the Upcoming agenda	Have	Account attachments, Google calendar selection, and subscribed-feed selection use the shared control-plane contract; refresh tokens stay encrypted there, not on the device. Home Upcoming includes selected Google calendars and subscribed feeds on Mac, iOS, and web; events marked Hide from Next are omitted there and from alerts, while remaining visible in Calendar. Web reads the Google week or month at `/calendar`, shows explicit travel duration metadata when present, and can start the Google connect flow. Its Calendars menu turns each account, Google calendar and the subscribed feeds on or off in the same owner-wide choice the Mac and iPhone read. It can create timed events, edit and delete writable ones, and answer an invitation. EventKit calendars are read on the Mac and iPhone only.	Agent accessstarlings://calendar/{days_back}/{days_ahead}, /api/calendar/events, /api/calendar/upcoming
Native Calendar views (Google + EventKit + subscriptions)	Have	Mac has the full window/sidebar and direct grid move/resize; iOS has day/2-day/3-day/week/month/agenda, source management, and deliberate long-press movement, while resize stays in the editor. Upcoming rows show explicit travel duration metadata when supplied; Starlings never estimates routes. Envisioning Internal remains writable shared context but is not a move source or destination; Duplicate is the copy path. Web shows one Google week or one month at a time, with no day or multi-day grid and no drag. It adds read-only Events, Milestones, Tasks, and Core-computed My availability layers, which it toggles only in the browser.	Agent accessHuman only: The person's own preferences and views.
Create a meeting invitation from the owner workspaceSchedule from calendar	Partial	Native clients create meeting invitations; web creates timed or all-day Google events with invitees, location and notes. Adding a Starlings booking token remains native; visitor booking is separate.	Agent accessschedule (MCP)
Describe an event in one sentence	Have	A field above the new-event form fills in title, times, place and guests from one sentence, on all three surfaces; nothing is saved until Add. One grammar in Swift and TypeScript on one fixture; a sentence it cannot read goes to the notes engine, and the form says so.	Agent accessHuman only: A typing aid for the event form. An agent passes the fields to schedule.
Forward a mail to calendar@ and add the events it describes	Have	A member forwards a booking or an invitation to calendar@ on the inbound domain; the Inbox proposes each event with Add to calendar and Discard, on all three surfaces. Add writes to the primary Google calendar. The mail body is read once and not kept. Needs INBOUND_EMAIL_DOMAIN, which production does not have yet.	Agent accessPlanned
Calendar selection, display preferences, timezone/weather, public events, and contacts	Have	Source selection is one owner-wide choice that the Mac, iPhone and web Calendars menu all write, and Upcoming display policy is shared and editable from Settings on all three surfaces. Device-local grid preferences, timezone/weather, and contacts remain native. Web lists and locally toggles the read-only Events, Milestones, Tasks, and Core-computed My availability layers. Web edits all-day dates and chooses This event or All events on a recurring Google event; the Mac adds All future on EventKit calendars, which the browser does not read.	Agent accessHuman only: The person's own preferences and views.
Start room, admit / reject guests, and end roomAdmit / reject waiting guests	Have	iOS hosts its owner’s permanent room: start, waiting room, admit and decline, end. Web still explains the native requirement and offers “Join my room” while the room is open, rather than starting one.	Agent accessstarlings host, starlings lobby, starlings admit, starlings reject
Move the host between devices and members	Have	The host sees a Host badge on its tile, and so does everyone. Move host… hands the host to another Mac, iPhone or iPad in the call: another of the same member takes it at once; another member of the workspace is asked and, on yes, rejoins as the host, in any room. A connected Mac companion can also take the host; the current Mac drains local transcription and uploads pending text first. When the host leaves or its lease runs out, a connected companion Mac takes host on its own. The room owner keeps room settings and End meeting, and can take the host back. A live phone host is asked to hand over only when it offered the host itself.	Agent accessHuman only: A live call between people.
Guest knock alerts and host wake protectionWaiting-room knock alerts	Have	Mac owns waiting-room sound / Dock alerts and the host wake assertion; in Join mode it still sounds and badges a knock at your own room, but holds no wake assertion. iOS posts a local knock notification while the app is running — there is no push — and holds the screen awake instead of a wake assertion.	Agent accessHuman only: Sound, badges and wake on the person's own device.
Account, audio/video, captions, calendar, privacy, and update settingsIn-app settings	Have	Mac has the complete settings area, in either mode. Web has Settings at /settings from the header gear — account and picture, Google Calendar connection, the Gmail and Drive grant, appearance, about, sign out; audio, video and background stay in the in-meeting Settings. Privacy remains available from the site footer. iOS exposes its applicable subset.	Agent accessHuman only: The person's own preferences and views.
Team presence: who in the workspace is around, and call a peer	Have	Members only, never guests. Every client reads the roster and offers Message, Wave, Call, and Join room from a person's context menu; a video mark on the shared avatar shows a live meeting. Agents are messageable but never waved or called.	Agent accessnow (MCP), search (MCP), /api/peers
Profile picture — one face per member, drawn everywhere a person is	Have	Members only, never guests: the roster carries the version, the image is a member-gated read, and every surface falls back to the same initials. Uploaded from the Team window on macOS, the Team tab on iOS, and your own row at `/team`. Seeded once from the Google account picture, which an upload replaces.	Agent accessHuman only: Each member uploads their own picture.
Direct messages between members	Have	Team opens DMs, notes to self and Everyone on all clients. Format message text with bold, italic, strikethrough, inline code, links, lists, quotes, and code blocks; each client renders the same Markdown subset. React to any message, including your own; copy your own text to private Quick Notes for the usual Work triage. Web supports send, older history, visible-tab polling, bounded read receipts, and per-member archive; a new message brings an archived DM back.	Agent accesssend_message (MCP), starlings://thread/{id}, starlings://changes/{cursor}, /api/threads/:id/messages, /api/threads/messages
Interactive questions in agent conversations	Have	New questions in shared chats name one eligible human recipient; only that person can answer. Existing unassigned shared questions retain their chat behavior. An agent can ask a short informational question with two to eight choices in its DM or a thread it belongs to. A single choice submits immediately; people select several options and explicitly submit them. Starlings stores one winning human reply and resumes the same Eve thread session. Web chat reads canonical terminal state and assigned-recipient controls. Mac and iOS answer inline and render projected replies; canonical dismissal and recipient presentation remain in #774. It does not request approval or authorization.	Agent accessHMAC callback: /api/internal/channel-events
Answer agent questions from Inbox	Have	On the web, Home and Work Inbox show assigned questions with the asker and source context. Answer with button choices or explicitly dismiss. The originating web chat reads the same winning request and closes terminal controls. Native Inbox controls and canonical chat refresh remain in #774; existing native question replies still resolve the server record.	Agent accessHuman only: Only the assigned human recipient can answer or dismiss their request.
Approve the follow-up after a call	Have	After a call filed on a lead, project or partner with people from outside the team, the host gets a drafted follow-up in Inbox with the call's proposed tasks. Approve accepts the ticked tasks, declines the rest, and opens the draft in the host's own mail app. The web edits the draft before Approve; the Mac and the iPhone edit it in the mail app. Unanswered, it leaves Inbox after a week.	Agent accessHuman only: Only the host approves; Starlings never sends the mail.
Check agent work from Inbox	Have	A card an agent moved to Review or Blocked is an Inbox row for the person who handed it off, on Work and Home. The row opens the card and leaves when the card moves on. Tasks and GitHub issues both arrive.	Agent accessHuman only: An agent moves a card as far as Review or Blocked. Only a person moves it to Done or Dropped.
Private group conversations	Have	A DM with more than one other person in it — same kind, same authorization, no name: the people in it are the name. Started from Team on every client, and found there again afterwards. Up to twelve people; past that the answer is Everyone. Not a channel, and not discoverable — you cannot browse to one, only be in one.	Agent accesssend_message (MCP), starlings://thread/{id}
Channels on the work itself	Have	One conversation on each project and lead, reached by opening the subject in Work — never by making a channel. Unread routes to Work on every client: the Mac launch button, the iOS tab badge and Home card, and Work's Mine pane, which lists subjects with something new first. Web opens the subject conversation from Talk in Work.	Agent accesssend_message (MCP), starlings://thread/{id}
Projects and leads, with their tasks and issues	Have	Work: Mine, the workspace's own projects, Projects and Leads — a foldable sidebar on Mac and a single work list on iOS, with the same work graph on web. New leads and projects require a Core organization; the Mac, iPhone/iPad and web pickers search Core and can create an organization inline. Create, assign, date, complete and file a task on GitHub; read, comment on, close and file GitHub issues on a linked project. Mine completes in place on every client (a tick on Mac and web, a swipe on iOS) and files on GitHub from the row natively. Team person details on every client also list assigned open tasks and, when GitHub is connected, issues; task rows open in the client task view, and New task starts the usual editor after a searchable project/lead choice. Recently finished work stays available for seven days on all three clients, with a Reopen action for tasks and issues. A project's Board pane shows its tasks and issues by stage on all three clients, with drag (Mac, web) or a move menu (iOS) to change a stage, Hand off to an agent from a card's menu, a filter by who holds a card, and columns each person hides on every device. Overview lists UNOWNED below Mine on all three clients: open tasks and issues on any subject that nobody on Envisioning's side holds. All three clients create and edit supported project/lead fields through the Worker; Core stays the system of record. A member's Claude creates a lead or a project through MCP `task` with `action: "create_lead"` or `action: "create_project"`, naming the organization by id or by name, on Core and on a D1 workspace; Core posts "New Lead Created" in a lead's channel. Web also creates, edits, comments on, closes/reopens and manages metadata for issues.	Agent accesssearch (MCP), open (MCP), task (MCP), record_decision (MCP), set_goal (MCP), starlings://subject/{kind}/{id}, starlings://subjects/{kind}, starlings://board/{days}, starlings://board/project/{id}/{days}, /api/crm/board, /api/crm/tasks, /api/crm/mine, /api/crm/recently-closed, /api/crm/unowned, /api/crm/goals, /api/crm/decisions, /api/crm/subjects, /api/crm/organizations
Goals on a project, decisions on any subject	Have	A goal is a title with a status, a target date and an owner on a project; tasks and decisions point at it. A decision is something the team settled on a project, lead, partner or event, written once, with its source: typed, a channel line marked as one, a Claude through MCP, or the meeting notes. Both live in Core. Every client lists them on the subject, picks a goal on the task sheet, marks a channel line as a decision, and finds both in search; the web meeting page records or dismisses what the notes proposed. Meet#261, #262, #278.	Agent accesssearch (MCP), open (MCP), record_decision (MCP), set_goal (MCP), task (MCP), transcript (MCP), starlings://subject/{kind}/{id}, /api/crm/goals, /api/crm/decisions
A queue of decisions waiting on you	Have	An agent puts a question to a member through MCP `ask_decision` — options, a recommendation and a default-by day — when nobody is in the conversation with it, instead of burying it in an issue comment. It is the first row in INBOX on every client, overdue first; one tap on an option answers it, with an optional note, and opening it shows the context and links. The agent reads the answer back through `now` or `ask_decision`. An answer on a subject is recorded as that subject's decision in Core. Past the default-by day a decision shows as overdue; the recommendation is applied only when somebody asks for it.	Agent accessask_decision (MCP), now (MCP), open (MCP), starlings://subject/{kind}/{id}, /api/decision-asks
Interaction history on a project or lead	Have	A read-only History pane combines interactions with quiet subject events. Activity in Work Overview on Mac, iOS and web shows the latest 30 entries from the past seven days across visible, unmuted open projects and events, plus leads with Sales on; every entry opens its subject at History. Activity is separate from response items and unread counts.	Agent accessstarlings://feed/{limit}, /api/crm/feed
Every field on a project, lead or partner	Have	A subject's Fields pane draws every field Core's registry lists for the record behind it — the project, the lead, or a partner's organization — and saves only what changed, when you say, as you. Core decides what you may change. Mac and iOS read Core with a device token; the web reads and writes through Starlings as the member and holds no Core token. The web edits text, numbers, dates, toggles and choices; relations, lists, countries and industries show read-only there and edit on the Mac, the phone or in Core. An event's fields are its CMS page.	Agent accesscms (MCP), starlings://core/registry
Core in search	Have	Search lists each Core entity you can read. On Mac and iOS it opens that entity in Work's Core browser, and Search Core finds records across them. On the web the entity opens on Core's own page, and the palette finds Core records below Docs: a project or lead opens on its Fields in Work, anything else on its Core page. Browsing Core entity by entity stays on Mac and iOS.	Agent accesscms (MCP)
Keep: client credentials in sealed vaults	Have	Keep holds client credentials in vaults the server cannot read: every value is sealed on the device under keys only the vault's members hold. Mac and iOS open Keep from Work, and a project's menu opens its vault. The web is deliberately without Keep: a browser would have to trust whoever serves its JavaScript with the keys, so a project's Keep vault on the web says to open it on Mac or iPhone and never shows vault material.	Agent accessPlanned
Release one Keep item to an agent	Have	An agent asks in a thread for one item of a Keep vault, for one task: a card names the item, the task, the reason and the time asked for, never a value. A member of that vault taps Approve on Mac or iPhone and picks how long, 15 minutes by default and 24 hours at most. Keep unlocks there, and that device seals the item to a key the agent made for this request; the server never sees the value. The agent fetches it once before the expiry. End now on the card, or Revoke in Keep's list, ends it sooner. Keep records the approval, the fetch and the end. The web shows the card and says to approve on Mac or iPhone.	Agent accessHMAC callback: /api/internal/channel-events, HMAC callback: /api/internal/keep-release
Issues that read like GitHub's own	Have	Both native clients have labels, assignees, milestones, server-backed filters/sort, pagination, issue details, comments and activity, and metadata editing. iOS uses Foundation markdown with fallback text; Mac has its own richer reading surface. Web reads details/activity and supports issue actions with repository metadata pickers; description text preserves markdown source, while native reading remains richer.	Agent accesscreate_issue (MCP), /api/crm/issue
Today's work on Home	Have	What is overdue and what is due today, on the Mac launch card and menu bar, on the iOS Home and on the web Home (its Work card), each row opening its subject in Work on the Tasks pane. Decided on the device, so "today" is the day you are in. Hidden when there is nothing.	Agent accessnow (MCP), /api/crm/mine
Meet about a project or lead	Have	Start your room from a subject in Work and the meeting is filed under it the moment it opens — notes and tasks land where the conversation is. On the Mac a filed meeting's CRM sidebar opens the subject in Work; the phone's hosting screen owns the session and has no door out.	Agent accessPlanned
A meeting's trail in its channel	Have	A project or lead channel carries quiet lines the work graph writes: a meeting filed here, ended and how long it ran, notes filed, a task the meeting proposed and somebody accepted. Never unread on their own, never the preview. Web renders these event rows in Talk too.	Agent accessstarlings://thread/{id}, HMAC callback: /api/internal/channel-events
A calendar event knows its project or lead	Have	File any event under a subject from the Mac inspector or the phone's event sheet; the choice is owner-wide. The web event editor names the subject an event is filed on and links to it, but cannot file one. A room started from that event is filed under it, Home and the launch card name it, and Google events arrive filed from the control plane.	Agent accessPlanned
Docs: the corpus, read and written from Starlings	Have	The fifth surface: newsletters, reports, research, notes and everything written from Starlings, on the shared shell. Documents on a subject in Work are the contextual slice of the same store. Connecting is one act in Settings → Account. A member's Claude shares a document under /work by link when the member asks; other folders and public stay the member's act, in Docs.	Agent accessdocs_write (MCP), starlings://document/{id}
Docs graph view	Have	See up to 5,000 accessible Docs documents in the same graph across Mac, iPhone, iPad, and web. Folders group and color nodes; resolved wikilinks draw connections and pull related nodes closer. Filter groups, pan, zoom, fit visible nodes, and open documents.	Agent accessHuman only: A picture of the corpus for people. An agent reads the documents.

Call and task reading

Feature	Status	Notes	Agent access
Call an available colleague	Have	Call asks an available colleague to open their room, waits up to 45 seconds, and joins through the ordinary admission flow when it opens. When a meeting is already live, the person menu offers Join room directly.	Agent accessHuman only: A live call between people.
Answer an idle-room Call	Have	Native clients offer Open room / Not now; the browser explains the native hosting requirement and can decline. Calls do not enable notes by default on the answering native device; notes can be turned on deliberately.	Agent accessHuman only: A live call between people.
Read a task directly from Mine	Have	Every client opens task details and subject navigation from Mine, with edit and completion actions. iOS also opens the same reader from a subject task list.	Agent accessopen (MCP), task (MCP), /api/crm/mine

Clients, ops, and platform

Feature	Status	Notes	Agent access
CLI / agent control through `starlings`CLI / agent meeting control	Have	Same-user local socket for status, host, lobby, media, transcript, and leave commands.	Agent accessstarlings status, starlings devices, starlings show, starlings auth, starlings host, starlings join, starlings leave, starlings lobby, starlings admit, starlings reject, starlings microphone, starlings camera, starlings blur, starlings screen-share, starlings select-camera, starlings select-microphone, starlings select-speaker, starlings transcript
Native auto-updateAuto-update (native)	Have	Mac checks the signed update feed; iOS uses App Store / TestFlight distribution.	Agent accessHuman only: The person installs and updates the app on their own device.
macOS native host app	Have	AppKit Host mode.	Agent accessstarlings host
macOS native join	Have	Same admit contract as the browser.	Agent accessstarlings join
Browser guest	Have	Primary guest path.	Agent accessHuman only: A page for the guest who holds the link.
Windows / Linux native	Don't want	Browser covers guests.	Agent access—
iOS / iPad client	Have	SwiftUI Host and Join: start your room, admit at the door, transcribe on device, file the meeting. Screen sharing from iOS is still ahead.	Agent accessHuman only: The person installs and updates the app on their own device.
Android client	TBD	Browser may be enough.	Agent access—
Meeting info panel	Partial	Invite link + room status; no Zoom-style Meeting Info sheet.	Agent accessstarlings status
Webinar / presenter–audience roles	Want	Backlog; do not market webinars until roles and load work exist.	Agent access—
Capacity hard limit (~100)	Have	Safety guardrail, not a webinar product.	Agent accessBuilt in: A rule the server holds. There is nothing to operate.
One wire contract for every client	Have	Every shape the server sends or accepts is written once, as a schema. The web reads it as types, and the Mac, iPhone and watch read and write Swift generated from it. A field that changes fails the build, not the phone.	Agent accessBuilt in: A rule the server holds. There is nothing to operate.
Notetakers attend as declared meeting participants	Partial	The listening slice works on every client; the row stays partial for the speaking half. A link-joining recording notetaker declares itself, waits for owner admission, is marked across the room, can be refused per room, and leaves a transcript consent line. Speaking agents, their room-side worker, and live MCP tools remain planned.	Agent accessPlanned
Website content from a Claude	Have	A member's Claude reads and writes envisioning.com content — events, and the other CMS entities the registry publishes — through Starlings, as the member, with a cms-editor PAT. On the web, a member with that grant also edits an event's CMS record from the Calendar and Work (meet#530). The same tool lists and reads organizations, contacts, interactions, projects and leads, creates and edits all five (a note is an interaction), and deletes an organization only when no record points at it, as the member.	Agent accesscms (MCP), starlings://cms/registry, starlings://core/registry
An agent starts a meeting	Have	`start_meeting` schedules the meeting in the member's own room and asks their devices to open it: the ask rides `rings` with a 45-second life, and the member answers Open room or Not now. The Worker never hosts and nothing opens a microphone on its own, so an unanswered ask leaves the meeting on the calendar and the room shut. A meeting opened this way transcribes, because it is convened; a walk-up from Call does not.	Agent accessstart_meeting (MCP), schedule (MCP), starlings host
Any agent joins Team by enrollment	Have	An agent runtime anywhere (Hermes, Eve, custom code) asks to join a workspace's Team with its name and an https endpoint, and shows a short code. A workspace admin approves the code in web Admin › Agents. The runtime then collects its address (`<name>@agents.<workspace host>`, given by Starlings) and its own two keys, once. No configuration change or deploy. An admin removes an enrolled agent there too; its keys stop working at once. The agent appears in Team on every client.	Agent access/api/agents/enroll, /api/agents/enroll/poll
Default workspace agent for meeting follow-through	Want	A named Starlings-managed agent will read finalized meeting text, propose notes, tasks and decisions, explain their sources and draft an unsent follow-up. Identity, meeting grants and signed context/result tools with canonical persistence are implemented (#1082, #1085); managed runtime, onboarding and dispatch remain #1083, #1084 and #1086. Included product processing remains separate from customer subscriptions; no live media access or automatically accepted work.	Agent accessHMAC callback: /api/internal/meeting-agent/context, HMAC callback: /api/internal/meeting-agent/commit, HMAC callback: /api/internal/meeting-agent/status
Agent activity in Admin	Have	Web Admin › Agents shows the last 30 days of handoffs, runtime acceptance or refusal, final replies observed by Starlings, and watchdog reset outcomes. It does not show work inside an agent runtime or model costs.	Agent accessHuman only: Oversight of agents is for people.
Error overview from a Claude	Have	An admin asks their own Claude what is failing across Starlings (meet#419). It reads error groups from Mac, iOS, web and the Worker, ranked by count over the last day, week or month, filtered by release, platform or code, each with its trend against the previous window and a few request ids to find the Worker log. Codes and counts only: no error text, people, rooms or meeting content. A member is refused, and so is an agent acting for anyone.	Agent accessstarlings://operational-errors/{window}

By surface

macOS HostAuthoritative host: starts rooms, admits guests, and runs local transcription.

macOS JoinThe Mac app in Join mode: joins another room as a guest through the same waiting-room and media contract as the web. Calendar, Work, Team, Docs and Settings are the app's windows, open in either mode; Home's launch card, hosting and moderation are Host mode only.

WebZero-install guest, booking, and signed-in workspace; live hosting still hands to a native owner client.

iOS / iPadOSHosts, admits, and transcribes on device, alongside joining and owner scheduling.

WorksPartialHandoffNot available

Entry, identity, and room access

Capability	macOS Host	macOS Join	Web	iOS / iPadOS	Notes
Open a permanent room link and see room / invite context	Works	Works	Works	Works	Bare room links stay opaque; booking tokens can add title, time, and subject.
Book a time from a room	Not available	Handoff	Works	Not available	The Mac in Join mode opens the public web booking page from Book a time; Host mode has no such button. The phone joins; booking is a web door.
Sign up for an event and join with a personal link	Not available	Not available	Works	Not available	An event with a room and a public slug has a sign-up page at /event/<slug>. Each person gets a personal room link and a calendar invite by mail. In the event window the room is a session: guests join muted and the transcript goes to the host only.
Send an event’s reminder and follow-up mails	Not available	Not available	Not available	Not available	Each registrant gets one reminder an hour before the start, sent by the workspace on its own. The follow-up, with the event’s note and its call to action, goes out when a workspace admin or the person who made the event asks for it, through MCP or the API, to everyone who signed up and has not had it.
Enter guest name and email	Works	Works	Works	Works	Human guests do not need an account and provide email; a declared notetaker omits email and joins through the same owner-admission path.
Before-you-join camera and microphone check	Works	Works	Works	Works	Each surface uses its platform-native permission and device flow.
Ask to join, waiting-room status, cancel, and reconnect	Works	Works	Works	Works	No LiveKit media token is issued until the owner admits the request. Every client can withdraw the knock and lands back on Prejoin.
Verified member sign-in	Works	Works	Works	Works	A member signs in with an account on one of the workspace's identity domains. The Mac and iPhone apps sign in through the workspace's own sign-in page; Envisioning keeps its native Google sign-in for now. On the Mac sign-in belongs to the app, not the mode: Join mode fills in the signed-in owner's own name and email when you call a colleague.
Several workspaces in one app	Works	Works	Not available	Works	The Mac and iPhone apps hold a session for each workspace a member adds, and switch between them: the Starlings menu › Switch Workspace on the Mac (the app reopens), Settings › Workspaces on iPhone. Each workspace keeps its own session, caches and links; a room link opens in the workspace it belongs to. No switch during a call. Sign Out leaves the other workspaces signed in; Sign Out of All Workspaces does not. On the web, each workspace is its own address.
Host presence / lease protection	Works	Works	Works	Works	The control plane gates admission and token exchange on the owner device lease.

Live audio, video, and stage

Capability	macOS Host	macOS Join	Web	iOS / iPadOS	Notes
Mute and unmute microphone	Works	Works	Works	Works	Available before joining and during the meeting.
Start and stop camera	Works	Works	Works	Works	Camera-off tiles retain participant identity across clients.
Choose camera, microphone, and output device	Works	Works	Works	Partial	Every surface picks camera and microphone before joining and from the same chevron beside mute and camera in the call. iOS output stays with the system audio-route picker.
Spatial audio: voices from where the tiles are	Works	Works	Works	Works	Starlings places each remote microphone on an arc in front of you, where that person's tile is on the stage, and moves the voice when the tile moves. HRTF on headphones, plain panning on speakers. On by default, with a switch on every surface. Screen-share audio stays centred.
Participant video grid, participant count, and People panel	Works	Works	Works	Works	Tuned for small rooms with a hard ~100-participant guardrail. People lists who is in the meeting with microphone, camera, and screen-share state; host actions stay native.
Publish a screen share	Works	Works	Works	Not available	Mac uses a display / window picker; browsers also expose their native tab option.
Watch and identify a remote screen share	Works	Works	Works	Works	Shared tiles are named and visually distinguished from camera video.
Stop your own screen share	Works	Works	Works	Not available	iOS does not publish screen shares.
Host stops another participant’s screen share	Works	Not available	Not available	Works	Host surfaces only; it stops the active share but does not ban future sharing.
Host mutes a participant, or everyone else	Works	Not available	Not available	Works	Mac and iOS owners. Closes microphones and opens none — unmuting stays with the person muted, on every surface.
Told who muted you	Works	Works	Works	Works	The SFU mute is what silences the mic; the notice is what stops it reading as broken hardware.
Host removes a participant mid-call	Works	Not available	Not available	Works	Mac and iOS owners, with confirmation. Disconnects them and spends the admission, so re-entry is a fresh knock.
Told you were removed, not dropped	Works	Works	Works	Works	All clients distinguish removal from connection loss. iOS observes the session phase and shows an ended receipt with the reason and a way to join again.
Background blur and branded background effects	Works	Works	Works	Works	Mac, web and iOS offer blur, Pixels, Flock and Grid in workspace tones, a workspace picture and a personal picture. Admin sets derived or explicit tones, uploads the public workspace picture and chooses a default; a personal choice, including Off, wins. Personal pictures stay on the device, scaled and re-encoded without metadata. Segmentation runs on the device — the room sees only composited frames.
Hide self view	Works	Works	Works	Works	Hiding the preview does not stop publishing the camera.
Connection quality and reconnect handling	Works	Works	Works	Works	iOS shows per-person quality and an explicit reconnecting state in the participants panel.
Leave the meeting or end it for everyone	Works	Works	Works	Works	Guests and owner companions leave their own session. Mac and iOS hosts can end a personal room for everyone; ending the shared internal room for everyone is a separate confirmed action.
Virtual / brand backgrounds	Works	Works	Works	Works	Workspace backgrounds are configured in Admin → People → Workspace: derived or explicit tone pairs, a public picture and an optional default. All clients read the live workspace descriptor; personal pictures stay local.

In-meeting collaboration and captions

Capability	macOS Host	macOS Join	Web	iOS / iPadOS	Notes
Room text chat	Works	Works	Works	Works	One room-wide text channel; file attachments and private DMs are not offered.
Embedded preview for a pasted link	Works	Works	Works	Works	The Worker reads the page and answers text; no client ever fetches a pasted link, so a site never learns who was in the room. In a meeting the read is authorized by the meeting itself, because a guest has no account. The page’s picture comes through the Worker too, on a signed address — without that signature the route would be an open image proxy.
Ephemeral emoji reactions	Works	Works	Works	Works	Six reactions float in the room and are not stored.
Reactions on a chat message	Works	Works	Works	Works	The same six emoji, on a message rather than on the room. Reliable rather than lossy, because a tally has to still be right in ten minutes — but stored nowhere: they last as long as the chat does, which is the call, and never reach the record or the summary.
Live captions from the owner device	Works	Works	Works	Works	Speech-to-text runs locally on whichever owner device is the host; only caption text is shared.
Show and hide the live transcript / captions view	Works	Works	Works	Works	iOS keeps the caption strip on the stage and opens the full transcript from More.
Finalized transcript and AI summary delivery	Works	Works	Works	Works	Read in Starlings once finalized, by participants with artifact access; consent-filtered. Share a link to the meeting page (it grants nothing), copy the text, or download .md or .txt: on the web from the meeting page, on the Mac and iPhone from the live transcript. Nothing is emailed and nothing is recorded.
Meeting duration and ended receipt	Works	Works	Works	Works	Joining clients explain when the owner ended the room or the session was lost.
Share a project with people outside the team: a guest thread for clients, an organization’s Claude	Not available	Not available	Works	Not available	Share in a subject’s header on the web grants a member, agent, guest or organization read or write on that one subject, or restricts it to the people added. A guest opens a link to the subject’s guest thread with no account; a partner organization’s Claude reaches the same thread through /mcp with its own token. Outside lines are tagged and never wake an agent. Mac and iPhone draw neither the Share dialog nor the guest thread yet (meet#895).

Owner workspace, scheduling, and operations

Capability	macOS Host	macOS Join	Web	iOS / iPadOS	Notes
Home / own room status / copy room link	Works	Not available	Works	Works	Home is today on web too — the clock, then the modules in the order you chose in Settings → Home, among them your room with its link, a copy button and Schedule…, with Home / Calendar / Work / Team / Docs navigation. The member room flow belongs to Home; `/join` remains a direct public room door. On the Mac the launch card is Host mode only. Starting the room is native (see Start room, admit / reject guests).
Connect Google Calendar and subscribed feeds, view the Upcoming agenda	Works	Works	Partial	Works	Account attachments, Google calendar selection, and subscribed-feed selection use the shared control-plane contract; refresh tokens stay encrypted there, not on the device. Home Upcoming includes selected Google calendars and subscribed feeds on Mac, iOS, and web; events marked Hide from Next are omitted there and from alerts, while remaining visible in Calendar. Web reads the Google week or month at `/calendar`, shows explicit travel duration metadata when present, and can start the Google connect flow. Its Calendars menu turns each account, Google calendar and the subscribed feeds on or off in the same owner-wide choice the Mac and iPhone read. It can create timed events, edit and delete writable ones, and answer an invitation. EventKit calendars are read on the Mac and iPhone only.
Native Calendar views (Google + EventKit + subscriptions)	Works	Works	Partial	Partial	Mac has the full window/sidebar and direct grid move/resize; iOS has day/2-day/3-day/week/month/agenda, source management, and deliberate long-press movement, while resize stays in the editor. Upcoming rows show explicit travel duration metadata when supplied; Starlings never estimates routes. Envisioning Internal remains writable shared context but is not a move source or destination; Duplicate is the copy path. Web shows one Google week or one month at a time, with no day or multi-day grid and no drag. It adds read-only Events, Milestones, Tasks, and Core-computed My availability layers, which it toggles only in the browser.
Create a meeting invitation from the owner workspace	Works	Works	Partial	Works	Native clients create meeting invitations; web creates timed or all-day Google events with invitees, location and notes. Adding a Starlings booking token remains native; visitor booking is separate.
Describe an event in one sentence	Works	Works	Works	Works	A field above the new-event form fills in title, times, place and guests from one sentence, on all three surfaces; nothing is saved until Add. One grammar in Swift and TypeScript on one fixture; a sentence it cannot read goes to the notes engine, and the form says so.
Forward a mail to calendar@ and add the events it describes	Works	Not available	Works	Works	A member forwards a booking or an invitation to calendar@ on the inbound domain; the Inbox proposes each event with Add to calendar and Discard, on all three surfaces. Add writes to the primary Google calendar. The mail body is read once and not kept. Needs INBOUND_EMAIL_DOMAIN, which production does not have yet.
Calendar selection, display preferences, timezone/weather, public events, and contacts	Works	Works	Partial	Works	Source selection is one owner-wide choice that the Mac, iPhone and web Calendars menu all write, and Upcoming display policy is shared and editable from Settings on all three surfaces. Device-local grid preferences, timezone/weather, and contacts remain native. Web lists and locally toggles the read-only Events, Milestones, Tasks, and Core-computed My availability layers. Web edits all-day dates and chooses This event or All events on a recurring Google event; the Mac adds All future on EventKit calendars, which the browser does not read.
Start room, admit / reject guests, and end room	Works	Not available	Handoff	Works	iOS hosts its owner’s permanent room: start, waiting room, admit and decline, end. Web still explains the native requirement and offers “Join my room” while the room is open, rather than starting one.
Move the host between devices and members	Works	Works	Not available	Works	The host sees a Host badge on its tile, and so does everyone. Move host… hands the host to another Mac, iPhone or iPad in the call: another of the same member takes it at once; another member of the workspace is asked and, on yes, rejoins as the host, in any room. A connected Mac companion can also take the host; the current Mac drains local transcription and uploads pending text first. When the host leaves or its lease runs out, a connected companion Mac takes host on its own. The room owner keeps room settings and End meeting, and can take the host back. A live phone host is asked to hand over only when it offered the host itself.
Guest knock alerts and host wake protection	Works	Partial	Not available	Partial	Mac owns waiting-room sound / Dock alerts and the host wake assertion; in Join mode it still sounds and badges a knock at your own room, but holds no wake assertion. iOS posts a local knock notification while the app is running — there is no push — and holds the screen awake instead of a wake assertion.
Account, audio/video, captions, calendar, privacy, and update settings	Works	Works	Partial	Partial	Mac has the complete settings area, in either mode. Web has Settings at /settings from the header gear — account and picture, Google Calendar connection, the Gmail and Drive grant, appearance, about, sign out; audio, video and background stay in the in-meeting Settings. Privacy remains available from the site footer. iOS exposes its applicable subset.
Team presence: who in the workspace is around, and call a peer	Works	Works	Works	Works	Members only, never guests. Every client reads the roster and offers Message, Wave, Call, and Join room from a person's context menu; a video mark on the shared avatar shows a live meeting. Agents are messageable but never waved or called.
Profile picture — one face per member, drawn everywhere a person is	Works	Works	Works	Works	Members only, never guests: the roster carries the version, the image is a member-gated read, and every surface falls back to the same initials. Uploaded from the Team window on macOS, the Team tab on iOS, and your own row at `/team`. Seeded once from the Google account picture, which an upload replaces.
Direct messages between members	Works	Works	Works	Works	Team opens DMs, notes to self and Everyone on all clients. Format message text with bold, italic, strikethrough, inline code, links, lists, quotes, and code blocks; each client renders the same Markdown subset. React to any message, including your own; copy your own text to private Quick Notes for the usual Work triage. Web supports send, older history, visible-tab polling, bounded read receipts, and per-member archive; a new message brings an archived DM back.
Interactive questions in agent conversations	Partial	Partial	Works	Partial	New questions in shared chats name one eligible human recipient; only that person can answer. Existing unassigned shared questions retain their chat behavior. An agent can ask a short informational question with two to eight choices in its DM or a thread it belongs to. A single choice submits immediately; people select several options and explicitly submit them. Starlings stores one winning human reply and resumes the same Eve thread session. Web chat reads canonical terminal state and assigned-recipient controls. Mac and iOS answer inline and render projected replies; canonical dismissal and recipient presentation remain in #774. It does not request approval or authorization.
Answer agent questions from Inbox	Not available	Not available	Works	Not available	On the web, Home and Work Inbox show assigned questions with the asker and source context. Answer with button choices or explicitly dismiss. The originating web chat reads the same winning request and closes terminal controls. Native Inbox controls and canonical chat refresh remain in #774; existing native question replies still resolve the server record.
Approve the follow-up after a call	Works	Not available	Works	Works	After a call filed on a lead, project or partner with people from outside the team, the host gets a drafted follow-up in Inbox with the call's proposed tasks. Approve accepts the ticked tasks, declines the rest, and opens the draft in the host's own mail app. The web edits the draft before Approve; the Mac and the iPhone edit it in the mail app. Unanswered, it leaves Inbox after a week.
Check agent work from Inbox	Works	Not available	Works	Works	A card an agent moved to Review or Blocked is an Inbox row for the person who handed it off, on Work and Home. The row opens the card and leaves when the card moves on. Tasks and GitHub issues both arrive.
Private group conversations	Works	Works	Works	Works	A DM with more than one other person in it — same kind, same authorization, no name: the people in it are the name. Started from Team on every client, and found there again afterwards. Up to twelve people; past that the answer is Everyone. Not a channel, and not discoverable — you cannot browse to one, only be in one.
Channels on the work itself	Works	Works	Works	Works	One conversation on each project and lead, reached by opening the subject in Work — never by making a channel. Unread routes to Work on every client: the Mac launch button, the iOS tab badge and Home card, and Work's Mine pane, which lists subjects with something new first. Web opens the subject conversation from Talk in Work.
Projects and leads, with their tasks and issues	Works	Works	Works	Works	Work: Mine, the workspace's own projects, Projects and Leads — a foldable sidebar on Mac and a single work list on iOS, with the same work graph on web. New leads and projects require a Core organization; the Mac, iPhone/iPad and web pickers search Core and can create an organization inline. Create, assign, date, complete and file a task on GitHub; read, comment on, close and file GitHub issues on a linked project. Mine completes in place on every client (a tick on Mac and web, a swipe on iOS) and files on GitHub from the row natively. Team person details on every client also list assigned open tasks and, when GitHub is connected, issues; task rows open in the client task view, and New task starts the usual editor after a searchable project/lead choice. Recently finished work stays available for seven days on all three clients, with a Reopen action for tasks and issues. A project's Board pane shows its tasks and issues by stage on all three clients, with drag (Mac, web) or a move menu (iOS) to change a stage, Hand off to an agent from a card's menu, a filter by who holds a card, and columns each person hides on every device. Overview lists UNOWNED below Mine on all three clients: open tasks and issues on any subject that nobody on Envisioning's side holds. All three clients create and edit supported project/lead fields through the Worker; Core stays the system of record. A member's Claude creates a lead or a project through MCP `task` with `action: "create_lead"` or `action: "create_project"`, naming the organization by id or by name, on Core and on a D1 workspace; Core posts "New Lead Created" in a lead's channel. Web also creates, edits, comments on, closes/reopens and manages metadata for issues.
Goals on a project, decisions on any subject	Works	Works	Works	Works	A goal is a title with a status, a target date and an owner on a project; tasks and decisions point at it. A decision is something the team settled on a project, lead, partner or event, written once, with its source: typed, a channel line marked as one, a Claude through MCP, or the meeting notes. Both live in Core. Every client lists them on the subject, picks a goal on the task sheet, marks a channel line as a decision, and finds both in search; the web meeting page records or dismisses what the notes proposed. Meet#261, #262, #278.
A queue of decisions waiting on you	Works	Works	Works	Works	An agent puts a question to a member through MCP `ask_decision` — options, a recommendation and a default-by day — when nobody is in the conversation with it, instead of burying it in an issue comment. It is the first row in INBOX on every client, overdue first; one tap on an option answers it, with an optional note, and opening it shows the context and links. The agent reads the answer back through `now` or `ask_decision`. An answer on a subject is recorded as that subject's decision in Core. Past the default-by day a decision shows as overdue; the recommendation is applied only when somebody asks for it.
Interaction history on a project or lead	Works	Works	Works	Works	A read-only History pane combines interactions with quiet subject events. Activity in Work Overview on Mac, iOS and web shows the latest 30 entries from the past seven days across visible, unmuted open projects and events, plus leads with Sales on; every entry opens its subject at History. Activity is separate from response items and unread counts.
Every field on a project, lead or partner	Works	Works	Works	Works	A subject's Fields pane draws every field Core's registry lists for the record behind it — the project, the lead, or a partner's organization — and saves only what changed, when you say, as you. Core decides what you may change. Mac and iOS read Core with a device token; the web reads and writes through Starlings as the member and holds no Core token. The web edits text, numbers, dates, toggles and choices; relations, lists, countries and industries show read-only there and edit on the Mac, the phone or in Core. An event's fields are its CMS page.
Core in search	Works	Works	Works	Works	Search lists each Core entity you can read. On Mac and iOS it opens that entity in Work's Core browser, and Search Core finds records across them. On the web the entity opens on Core's own page, and the palette finds Core records below Docs: a project or lead opens on its Fields in Work, anything else on its Core page. Browsing Core entity by entity stays on Mac and iOS.
Keep: client credentials in sealed vaults	Works	Works	Handoff	Works	Keep holds client credentials in vaults the server cannot read: every value is sealed on the device under keys only the vault's members hold. Mac and iOS open Keep from Work, and a project's menu opens its vault. The web is deliberately without Keep: a browser would have to trust whoever serves its JavaScript with the keys, so a project's Keep vault on the web says to open it on Mac or iPhone and never shows vault material.
Release one Keep item to an agent	Works	Works	Handoff	Works	An agent asks in a thread for one item of a Keep vault, for one task: a card names the item, the task, the reason and the time asked for, never a value. A member of that vault taps Approve on Mac or iPhone and picks how long, 15 minutes by default and 24 hours at most. Keep unlocks there, and that device seals the item to a key the agent made for this request; the server never sees the value. The agent fetches it once before the expiry. End now on the card, or Revoke in Keep's list, ends it sooner. Keep records the approval, the fetch and the end. The web shows the card and says to approve on Mac or iPhone.
Issues that read like GitHub's own	Works	Works	Partial	Works	Both native clients have labels, assignees, milestones, server-backed filters/sort, pagination, issue details, comments and activity, and metadata editing. iOS uses Foundation markdown with fallback text; Mac has its own richer reading surface. Web reads details/activity and supports issue actions with repository metadata pickers; description text preserves markdown source, while native reading remains richer.
Today's work on Home	Works	Not available	Works	Works	What is overdue and what is due today, on the Mac launch card and menu bar, on the iOS Home and on the web Home (its Work card), each row opening its subject in Work on the Tasks pane. Decided on the device, so "today" is the day you are in. Hidden when there is nothing.
Meet about a project or lead	Works	Not available	Not available	Works	Start your room from a subject in Work and the meeting is filed under it the moment it opens — notes and tasks land where the conversation is. On the Mac a filed meeting's CRM sidebar opens the subject in Work; the phone's hosting screen owns the session and has no door out.
A meeting's trail in its channel	Works	Works	Works	Works	A project or lead channel carries quiet lines the work graph writes: a meeting filed here, ended and how long it ran, notes filed, a task the meeting proposed and somebody accepted. Never unread on their own, never the preview. Web renders these event rows in Talk too.
A calendar event knows its project or lead	Works	Works	Partial	Works	File any event under a subject from the Mac inspector or the phone's event sheet; the choice is owner-wide. The web event editor names the subject an event is filed on and links to it, but cannot file one. A room started from that event is filed under it, Home and the launch card name it, and Google events arrive filed from the control plane.
Docs: the corpus, read and written from Starlings	Works	Works	Works	Works	The fifth surface: newsletters, reports, research, notes and everything written from Starlings, on the shared shell. Documents on a subject in Work are the contextual slice of the same store. Connecting is one act in Settings → Account. A member's Claude shares a document under /work by link when the member asks; other folders and public stay the member's act, in Docs.
Docs graph view	Works	Works	Works	Works	See up to 5,000 accessible Docs documents in the same graph across Mac, iPhone, iPad, and web. Folders group and color nodes; resolved wikilinks draw connections and pull related nodes closer. Filter groups, pan, zoom, fit visible nodes, and open documents.

Call and task reading

Capability	macOS Host	macOS Join	Web	iOS / iPadOS	Notes
Call an available colleague	Works	Works	Works	Works	Call asks an available colleague to open their room, waits up to 45 seconds, and joins through the ordinary admission flow when it opens. When a meeting is already live, the person menu offers Join room directly.
Answer an idle-room Call	Works	Not available	Handoff	Works	Native clients offer Open room / Not now; the browser explains the native hosting requirement and can decline. Calls do not enable notes by default on the answering native device; notes can be turned on deliberately.
Read a task directly from Mine	Works	Works	Works	Works	Every client opens task details and subject navigation from Mine, with edit and completion actions. iOS also opens the same reader from a subject task list.

Clients, ops, and platform

Capability	macOS Host	macOS Join	Web	iOS / iPadOS	Notes
CLI / agent control through `starlings`	Works	Not available	Not available	Not available	Same-user local socket for status, host, lobby, media, transcript, and leave commands.
Native auto-update	Works	Works	Not available	Not available	Mac checks the signed update feed; iOS uses App Store / TestFlight distribution.
Notetakers attend as declared meeting participants	Works	Works	Works	Works	The listening slice works on every client; the row stays partial for the speaking half. A link-joining recording notetaker declares itself, waits for owner admission, is marked across the room, can be refused per room, and leaves a transcript consent line. Speaking agents, their room-side worker, and live MCP tools remain planned.
Any agent joins Team by enrollment	Not available	Not available	Works	Not available	An agent runtime anywhere (Hermes, Eve, custom code) asks to join a workspace's Team with its name and an https endpoint, and shows a short code. A workspace admin approves the code in web Admin › Agents. The runtime then collects its address (`<name>@agents.<workspace host>`, given by Starlings) and its own two keys, once. No configuration change or deploy. An admin removes an enrolled agent there too; its keys stop working at once. The agent appears in Team on every client.
Agent activity in Admin	Not available	Not available	Works	Not available	Web Admin › Agents shows the last 30 days of handoffs, runtime acceptance or refusal, final replies observed by Starlings, and watchdog reset outcomes. It does not show work inside an agent runtime or model costs.

How it fits together

Every service Starlings runs on, what each one stores, and what data moves between them, down to each bucket and queue.

In the meeting

The devices a person is looking at.

The hosting device: One owner device opens the room, admits guests, and writes the transcript on its own hardware.
Mac app: AppKit. Host and Join, local speech-to-text, the five windows, and the starlings socket.
iPhone and iPad app: SwiftUI. Hosts, admits and transcribes on device, with the Live Activity and widgets beside it.
Apple Watch: A companion to the phone. Reads agenda.json out of the app group; never a token.
Chrome extension: Tells the Mac who is speaking in a call Starlings did not host, so ambient capture has names.
The browser: Guests join at /room/<slug> with no account; a signed-in member gets the five surfaces too. It never hosts.

Media

Audio and video, end to end, never recorded.

LiveKit CloudLiveKit: Carries audio, video and screen between the people in the room. Nothing is recorded, and no stream is stored.

The control plane

One Cloudflare Worker. Text only — it never sees a stream.

Starlings control planeCloudflare: One Worker: the door, the routes, and the SPA in front of them. It holds text and never media.
Room: A Durable Object per room: who knocked, who was admitted, consent, the transcript text, the summary.
Threads: A Durable Object per conversation: messages, reactions, mentions, and the attachments' keys.
Quick Notes: A Durable Object per member: the notes taken in a hurry, from any surface.
MCP door: A member's Claude calls the Starlings tools as that member, under a grant they issued.
Static Assets: The built web app, served by the same Worker. The Worker runs first, so every route is checked before the app answers.
Rate limiting: Seven per-minute burst guards: the knock, presence, feedback, error reports, link previews, the agent door and MCP.
Secrets Store: Keys every Starlings workspace shares, kept once in starlings-shared. Envisioning reads the support line key, which signs its request to connect to hq.
Cron trigger: Every five minutes: the agent watchdog, the calendar sweep, favorites and GitHub sync, pruning, and the daily backup plan.
Workers Logs: One request in a hundred is logged. A failure is also counted in D1, and the count is what mails a person.
Workers Builds: Every push to main builds the web app and deploys the Worker, with its D1 migrations.

What it keeps

Room state, the words, the ledger, the files.

Starlings storeCloudflare: The ledger, the tokens, the files and the job queue behind the Worker. Text and files — no media bucket.
D1 meet-usage: The usage ledger, the people, their roles and their work preferences.
KV namespaces: CALENDAR_TOKENS: the Google Calendar refresh tokens, one per owner who attached a calendar. CORE_CACHE: sixty seconds of the Core reads the board and the feed fan out to.
R2 buckets: Four buckets: meet-downloads for release zips, meet-avatars, meet-attachments for the files in a conversation, and meet-backups, the daily text backup of every Durable Object, kept in the EU for 30 days. No audio, no video.
Queue meet-artifact-jobs: Finalization, CRM filing and the nightly backups, one consumer at a time. Three failures and a job waits on meet-artifact-jobs-dead for an admin.
Queue meet-import-jobs: The Granola, GitHub and Slack imports, on their own queue so a bulk import never holds up a meeting's notes. Same policy, and its own dead queue, meet-import-jobs-dead.

The rest of the company

Services Starlings reads and writes on a member's behalf.

CoreEnvisioning: The CRM. Subjects, tasks and interactions, read and written over HMAC — a meeting is filed on the project it belongs to.
DocsEnvisioning: Where documents and their comments live. Every read goes through the Starlings Worker; the browser never holds a Docs token.
D1 docsCloudflare: Every document, its comments, who it is shared with, and the signatures on it.
R2 docs-filesCloudflare: The images in a document, a saved link's preview, and a signature's image.
The Docs WorkerCloudflare: Static Assets for its own app. An hourly Cron that mirrors documents out to the surfaces that need them as files. Rate limiting on claiming a shared link and on signing. Workers Logs, with traces.
KeepEnvisioning: Where client credentials live. Starlings reads what a member may see, over a service binding.
The Keep WorkerCloudflare: Static Assets for its own app. Rate limiting on revealing an item, 300 a minute. Workers Logs, with traces.
D1 keepCloudflare: Every vault today: wrapped keys and sealed items, in Keep's own database.
SupabaseSupabase: A vault kept in Postgres as sealed rows. Supabase Vault adds nothing here; the item is already sealed on the device.Planned — envisioning/keep#1
VercelVercel: A vault kept in Vercel Marketplace storage, Neon Postgres or Blob, as sealed rows.Planned — envisioning/keep#1
Google WorkspaceGoogle: Both halves of Google: who is one of us at sign-in, and the owner's day once they attach a calendar.
Starlings sign-inEnvisioning: Google sign-in and Google consent on auth.starlings.work, for a workspace that binds it (hq first). The workspace starts an attempt and redeems its one-time code over a service binding, then sets its own session.
The models: Where the writing happens: the notes after a meeting, a forwarded mail read into events, suggested tasks and filing.
Workers AICloudflare: The small models on the same account: the summary a meeting ends with, and the tasks it suggests from what was said.
Vercel AI GatewayVercel: One door, for the decision model that suggests where an imported Granola note should be filed.
AgentsVercel: Peers with no device. Each is one row in the roster; a hand-off is signed, and an unanswered one is reset every five minutes.
Connectors: Every outside source that writes meetings into Starlings. One card each on /admin/connectors; the next one is a card, not a page.
GitHubGitHub: The Work board is issue labels on envisioning/meet; the connector maps repositories to subjects.
SlackSlack: Channel history read into the subject's channel by a paced job chain.
BeeperBeeper: Chat from every network in one client. Two ways in: straight into the subject's channel, and through Core's Mac helper, which syncs it too.
GranolaGranola: Notes from calls Starlings did not host. Two ways in: the Starlings bridge on the webhook, and Core's Mac helper, which syncs them too.
TurnstileCloudflare: The bot check in front of the routes anyone may POST without signing in. Its keys are the switch; a native knock skips the widget.
Cloudflare Email RoutingCloudflare: Mail to a subject's address, or to calendar@, handed to the Worker as one message from the member who sent it. The address exists once a zone is named.
The open web: The page behind a link somebody pasted, fetched once so the message can show what it points at.
A peer workspace: Another organization's workspace: its people and agents reach ours through the door a member's Claude already uses, per shared subject, and neither company's conversations leave the workspace that holds them. Designed, not built.
PostmarkPostmark: Outbound mail — invitations and the notices a guest gets — sent from contact@envisioning.com.

What runs between them

The hosting device ↔ LiveKit CloudAudio, video and screen · WebRTCNever: A recording. Nothing is written to disk, here or anywhere.
The browser ↔ LiveKit CloudAudio, video and screen · WebRTCNever: A recording, and never a stream before the owner has admitted you.
The hosting device ↔ Starlings control planeTranscript text, summaries, admissions and room state · HTTPSNever: Audio, video, or the screen. The words leave; the sound does not.
The browser ↔ Starlings control planeThe knock, admission status, chat, and every workspace read · WebSocket
Starlings control plane → LiveKit CloudA media token, minted only once the owner has admitted the guest · HTTPSNever: Media. No stream passes through the Worker.
Starlings control plane ↔ Starlings storeRoom state, the words, the ledger, the files, the jobs · Cloudflare binding
Starlings control plane ↔ CoreThe meeting, its notes and its tasks, filed on a subject · HTTPS
Starlings control plane ↔ DocsDocuments and comments, on the member's behalf · Cloudflare bindingNever: A Docs token into the browser. The Worker keeps its own, per owner.
Starlings control plane ↔ Google WorkspaceThe owner's day, and the meetings scheduled from Starlings · HTTPS
Connectors ↔ Starlings control planeMeetings from outside sources — a webhook in, a paced job pulling history · HTTPS
Starlings control plane ↔ The modelsTranscript text to write the notes from, and a mail to read into events · HTTPSNever: Audio. A model reads the words the device wrote, never the sound.
Agents ↔ Starlings control planeA signed hand-off out, the agent's answer back · HTTPSNever: A seat in the room. An agent has no device and no media.
Chrome extension → Mac appWho is speaking in a call Starlings did not host · On the device
Apple Watch → iPhone and iPad appagenda.json, out of the shared app group · On the deviceNever: A token. The watch holds no credential.
Mac app ↔ RoomThe outbox: transcript segments, idempotent by segment UUID · HTTPSNever: A tear-down of media when it fails. The room outlives the outbox.
iPhone and iPad app ↔ RoomThe same outbox, from the phone when the phone is the host · HTTPS
The browser ↔ ThreadsMessages, reactions and mentions, live · WebSocket
The browser ↔ Quick NotesA note taken in a hurry, from whichever surface is open · HTTPS
Room → Queue meet-artifact-jobsA finalization job, once the meeting ends · Queue
Queue meet-artifact-jobs → CoreThe filed interaction, its tasks, and the subject it belongs to · HTTPS
Queue meet-artifact-jobs ↔ Workers AIA transcript to read, and the summary and tasks it comes back with · Cloudflare binding
Beeper → Starlings control planeChat from every network, into the channel of the subject it is about · HTTPS
Beeper → CoreThe conversations Core's Mac helper syncs, on their way to a subject · HTTPS
Granola → CoreThe same notes, synced by Core's Mac helper as well · HTTPS
Granola → Queue meet-import-jobsA note from a call Starlings did not host, on its webhook · HTTPS
Core → ThreadsGitHub events on a project — issues, pull requests, releases — into its channel · HTTPS
Starlings control plane ↔ GitHubThe Work board's issues and their agent:* labels · HTTPS
Starlings control plane → SlackChannel history, paced into the subject's channel · HTTPS
Starlings control plane ↔ Vercel AI GatewayWhich kind, which subject — the suggested filing for an imported note · HTTPSNever: A decision. The answer is drawn as a pre-filled control and never written on its own.
The browser ↔ Google WorkspaceSign-in with the Workspace account that makes somebody one of us · HTTPS
The hosting device ↔ Google WorkspaceThe same sign-in, natively, and the calendar the owner attached · HTTPS
The browser ↔ TurnstileA bot check before a knock a stranger may send · HTTPS
Starlings control plane → TurnstileThe token from that check, verified before the knock is taken · HTTPS
Cloudflare Email Routing → Starlings control planeA forwarded mail, as one message from the member who sent it · HTTPS
Starlings control plane ↔ The open webOne fetch of a pasted link, to show what it points at · HTTPS
A peer workspace ↔ MCP doorAn organization, reading and writing the subjects it shares with us · HTTPSNever: More than the shared subject. A peer is a third principal on one door, not a new one.
Starlings control plane ↔ Starlings sign-inA sign-in attempt, and the one-time code that redeems it · Cloudflare bindingNever: A session or a refresh token. Only the workspace holds those.
Starlings sign-in ↔ Google WorkspaceWeb sign-in and consent for every workspace, on one registered host · HTTPS
Starlings control plane ↔ KeepThe credentials a member may see · Cloudflare binding
Starlings control plane → PostmarkInvitations and the notices a guest gets · HTTPS
Mac app → R2 bucketsA notarized release zip, on the updater's check · HTTPS

Surface snapshot 2026-10-09. Intent statuses are not a build tracker. packages/contracts/src/capabilities.ts.