-
-
-
-
-
-
-
-
-
-
-
-
One engine
-
One trust pipeline, under everything Ghost does.
-
- Ghost runs a single pipeline over both file operations and app steps. Ghost
- Organizer — safe folder cleanup — is the flagship expression of it today. The
- same pipeline is what lets Ghost grow into auditable workflows for teams that can't put
- their data through a cloud tool.
+
+ Muhammad Rafiq
+ · working name may change · commercial intent, no fake logos
-
-
- Capture & review
- Ghost scans the boundary you chose — read-only — and compiles a reviewable plan. Every proposed step is visible before/after, with conflicts and low-confidence items called out.
-
-
- Approve & execute
- Nothing mutates until you approve the exact plan. Deterministic code then executes it, re-checking policy per step — never a model's raw output, never a silent delete or overwrite.
-
-
- Verify & recover
- Each step is verified, the run is sealed into a tamper-evident receipt, and undo data is written first — so any run reverses in one click.
-
-
-
Capture → Review → Approve → Execute → Verify → Recover
-
-
-
-
-
-
Interactive demo
-
Watch the trust model, live.
-
- In-browser simulations of the desktop product — Ghost Organizer's scan-to-approved-plan
- loop, the Ghost 2.0 Action Plan invoice run, and record-and-replay verification.
- Nothing here touches your files or opens network sockets.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+ Ghost — live run (demo fixture)
+
+
+
-
-
Proposed plan
-
-
+
+
-
-
- Scan folder
- Read-only scan — proposes changes, touches nothing.
-
-
-
-
-
-
-
Zone · Downloads
-
+
+
-
-
Receipt (awaiting approval)
-
-
+
+
-
-
- Build invoice plan
- Simulation of action_plan_demo — same approve → execute → verify shape as the desktop app.
-
-
-
-
-
-
-
-
-
-
Ready to record
-
+
+
-
-
- Record the transfer
- Record the transfer once. On replay, Ghost checks every value against what you approved.
-
-
+
+
+
+
+
+
+
The loop
+
Capture → Review → Approve → Execute → Verify → Recover
+
+ AI may propose. Deterministic code executes only approved plans. Sensitivity is decided by
+ a classifier — not a model hoping for the best.
+
+
+ 1
+ Capture
+ Demonstrate the workflow once. Compile into editable, typed steps. (Recording is the next build phase.)
+
+
+ 2
+ Review
+ Inspect every step before it can run. No silent send, pay, or overwrite.
+
+
+ 3
+ Approve
+ Risky steps halt. A human decides. The engine cannot skip the gate.
+
+
+ 4
+ Execute
+ Replay via browser automation today; APIs/connectors next — still through the same pipeline.
+
+
+ 5
+ Verify & audit
+ Assertions + screenshots per step. Hash-chained audit events per organization.
+
+
-
-
+
-
Inside the desktop app
-
Three views. One trust pipeline.
+
Proof, not pitch
+
What works in the repo today.
- The marketing site is the reference look. The desktop app is where these views
- are wired — same language, same approve-before-it-acts model.
+ Phase 1 of the cloud product is runnable end-to-end against a bundled fixture:
+ navigate → fill → halt on Submit → approve → resume → verify → succeed.
+ If it isn’t in this list, don’t assume it ships.
+
- Organizer
- Scan a folder, review the proposed moves and renames, approve, audit, undo. No silent delete, no silent overwrite.
+
+ Playwright execution engine
+ Semantic selectors, per-step screenshots, verification assertions.
+
- Record & Replay
- Capture a data-entry routine once, review every step and the value it writes, then replay only what you approved — with each value verified as it lands.
+
+ Deterministic approval gate
+ classifyStep — not an LLM — decides what must wait for a human.
- Workflows
- Save approved routines and run them again period after period, through the same review → approve → verify → receipt → undo path.
+
+ Live run timeline
+ Status, screenshots, approve/reject; resume restores browser state after the gate.
+
-
-
- Everything else stays off the default surface — experimental tools sit behind an explicit build flag.
-
+
+
+ Hash-chained audit log
+ Per-org append-only events for run/step/gate/finish.
+
+
+
+
+ Not built yet
+ Browser recording, real connectors (email/CRM/ERP), billing, customer deployments.
+
+
+
-
-
+
-
Where this is going
-
The same pipeline, shaped into playbooks for specific teams.
+
Engineering
+
Stack you can actually clone.
- Organizer is the beachhead. The roadmap turns the audited pipeline into repeatable
- playbooks for the teams that feel the pain most — always local, always
- approval-gated, always reversible. These are direction, not shipped features yet.
+ Self-contained Turborepo under cloud/. Legacy Rust/Tauri desktop remains in-tree
+ for history — it is not the product being built.
-
- Accounting & bookkeeping
- Month-end close: scan and rename by period, file per client, reconcile against an expected-docs checklist, and produce a partner-signable close report.
-
+
+ Web
+ Next.js 15 · Auth.js · org-scoped API routes
-
- Legal & paralegal
- Matter intake and filing, dated renaming, and privilege-review packet assembly — with on-export redaction, entirely on the machine that holds the client files.
-
+ Worker
+ BullMQ · Playwright · approval state machine
-
- Healthcare admin
- Claims, EOB, and record filing where cloud RPA is a compliance burden — local, audited, and reversible, with on-device OCR and ID parsing.
-
+ Core
+ Prisma · Postgres · Zod step schema · audit chain
-
- Legacy data entry
- Desktop apps with no API: record once, review every step, approve, and replay with semantic resolution and coordinate fallback — the trusted alternative to heavyweight RPA.
-
+ Ops
+ Redis queue · disk/S3 artifacts · Docker Compose local
Each playbook rides the same audited pipeline above — nothing gets a fast lane around approval, receipt, or undo.
-
-
+
-
Who it's for
-
Built for people whose data can't go to the cloud.
+
Product sense
+
Who this is for — when it graduates.
- Ghost is for bookkeepers and finance/admin staff, consultants handling client
- deliverables, small-business operators, and founders whose local folders became the
- system of record — people who need the work done safely and need proof of what changed.
+ The design target is operations-heavy SMBs (wholesale, bookkeeping, property admin,
+ logistics) that re-key work between ugly systems and cannot accept unsupervised agents.
+ That ICP guides the build even before the first paid pilot.
- Barred from cloud tools
- Handling client financials, PHI, or privileged files and told it can't go through a cloud service. Ghost runs entirely on your machine — no account, no uploads.
+ Cross-app grunt work
+ Reporting, reconciliation, document processing — repetitive and measurable.
- Accountable for what changed
- Recurring operational files and workflows — month-end packets, client deliverables, exports — where "what moved, and can I show it" is the job, not a nicety.
+ Human on the sensitive step
+ Send, pay, delete, submit must stop. That constraint is the product, not a bug.
- The same non-negotiables
- Local-first, no account required, files never leave the machine. Nothing runs unapproved, every change is audited, and reversible steps undo in one click.
+ Proof afterward
+ Screenshots, verification, audit chain — something a manager can review.
-
-
-
-
The trust pipeline
-
Every action takes the same path.
-
Select a folder → scan → propose a plan → review → approve → execute → audit → undo. AI may propose. Deterministic code executes only what you approved — and checks the result.
-
- 1 Select Point Ghost at a folder or Zone. Read-only, and never in the background.
2 Scan Ghost reads file metadata inside that boundary only — nothing moves yet.
3 Propose A deterministic planner suggests folders, moves, and dated renames.
4 Review & Approve Every move and rename is visible before/after, with conflicts and low-confidence items flagged. Nothing mutates until you approve.
5 Execute The executor re-checks policy and boundaries, then applies the change. No silent delete, no silent overwrite.
6 Audit & Undo The run is sealed into a local audit chain. Undo data is written first, so one click reverses it.
-
-
-
-
+
-
The sharper claim
-
“Approve before it acts” is table stakes. Local, reversible, and audited isn't.
-
Every serious automation now waits for a human. Ghost's difference is where it runs and what happens next: entirely on your machine, no silent delete or overwrite ever, every run sealed into an audit trail, and any run undoable in one click.
+
Positioning
+
What this is not.
-
-
Manual work
-
- You're the safety net — a wrong delete or overwrite is permanent
- No record of what moved where, or why
- Nothing to undo once it's gone
- Doesn't scale past a few folders a week
-
-
-
-
RPA suites & cloud agents
-
- Often run your files and data through someone else's servers
- “Human approves” the plan — but nothing stops a silent overwrite
- Hard to see exactly what changed, or to reverse it
- Procurement, licenses, and consultants before the first run
-
-
-
-
-
- Previews the exact plan before anything happens
- Never deletes or overwrites silently — conflicts are flagged, not guessed
- Runs entirely on your Mac or PC — no account, no uploads
- Every run seals a tamper-evident receipt; every change is reversible
- Deterministic code executes the approved plan, not a model's raw output
-
-
-
-
-
Keep doing it by hand
-
You are the safety net. A wrong delete or overwrite is permanent — if you even notice.
-
-
-
Script it yourself
-
Days to build, and one bad regex away from clobbering a folder.
-
-
-
Buy an RPA suite
-
Procurement, licenses, and consultants before the first run — usually cloud-hosted.
-
-
-
Ghost
-
Download, point it at a folder, and approve the exact plan — same machine, same day.
-
-
- “Automate the work, but never let it delete or overwrite silently — and prove every change. That's the whole trust model.”
-
-
-
-
-
-
-
Privacy by default
-
What Ghost will never do.
-
-
-
-
No camera or microphone access.
-
No hidden screen capture or background recording.
-
No background email, browser, or tab reading.
-
No raw secret capture — password & payment fields are suppressed.
-
No cloud-first storage. Workflows stay on your device.
-
No account required. Ghost runs fully without signing in to anything.
-
Keyboard & pointer captured only while you record or an approved replay runs.
+
+
-
-
-
-
Honest status
-
What's real today — and what's next.
-
We'd rather under-promise. Here's exactly where things stand.
-
-
-
Shipped
-
Organizer: scan → propose → approve → execute → audit → undo
-
Point Ghost at a folder or Zone. It scans read-only, proposes moves and dated renames, detects conflicts, and never overwrites or deletes silently. Every run seals into a tamper-evident audit chain with one-click undo.
-
-
-
Now
-
Record → replay → verify, as a trust-core capability
-
Record a data-entry routine, replay it with per-step verification, a sealed execution receipt, and undo written before every change — useful today, but not the front-page promise until reliability and verification are stronger.
-
-
-
Next
-
Scheduled runs & the first vertical playbook
-
Recurring “propose a plan every month-end” that still resolves to an approval and a sealed receipt, plus the accounting-close playbook (reconcile + signable close report) — building now, not fully shipped.
-
-
-
Later
-
Team audit layer & scoped connectors
-
Aggregate sealed receipts (never files) for a reviewer or auditor, and opt-in, scoped connectors to the systems teams already run — behind the experimental flag. Ghost proposes; deterministic code executes only what you approved.
+
+
+
Built in public. Aimed at a real business.
+
+ I’m building Ghost as a serious systems project — trust pipeline, tests, and a runnable
+ cloud engine — with the long-term goal of selling implementation + seats to ops teams.
+ Today: open source, early, no logos. If you hire for product engineering or want to
+ follow the build, the repo is the résumé.
+
+
+
+ Working name: Ghost (likely to change before a real go-to-market). Direction will not:
+ approval-gated execution with verification and audit.
+
-
-
+
-
Connect your AI
-
Use Ghost safely from the AI tools you already work with.
+
Archive
+
Legacy desktop preview (not the résumé piece).
- Claude Desktop and Cursor can drive a saved-routine demo over local stdio:
- list → preview → approve in Ghost → execute → receipt .
- The AI proposes; you approve; deterministic code acts on your machine.
- ChatGPT needs a remote HTTP/connector path that is still experimental,
- so it is not supported on the stock local build.
+ An earlier local-first Mac/Windows Organizer build (v2.0.3 ) is still
+ downloadable for reference. The active work — and what to judge — is the cloud operator
+ under cloud/ on GitHub.
-
- 1
- Install Ghost
- Download for macOS or Windows below. No account, no cloud setup. Save one short routine first if you want the full list→receipt demo.
-
-
- 2
- Add Ghost to your client
- Paste into Claude Desktop's or Cursor's MCP config (Windows: C:\Program Files\Ghost\Ghost.exe):
- {
- "mcpServers": {
- "ghost": {
- "command": "/Applications/Ghost.app/Contents/MacOS/Ghost",
- "args": ["mcp", "serve"]
- }
- }
-}
-
- 3
- Pair, then walk the routine flow
- Enable a pairing code in Settings. From the client: list_routines → preview_routine → request_routine_approval. Approve in Ghost, then execute_approved_routine and read the receipt — nothing runs until you approve locally.
-
-
-
- Local stdio only (Claude Desktop / Cursor). No listening socket, no relay, no uploads on the stock build.
- ChatGPT is not supported on stock local stdio today. Step-by-step: docs/claude-ghost-demo.md in the repo.
-
-
-
+
-
Get Ghost
-
v2.0.3 for macOS and Windows.
+
Legacy · optional
+
Desktop preview downloads
+
v2.0.3 for macOS and Windows — superseded by the cloud build.
macOS 12+ · Apple Silicon & Intel · Windows 10/11 · v2.0.3 — macOS notarized;
Windows unsigned (SmartScreen may warn).
All releases →
- · SHA256SUMS
+ ·
+ SHA256SUMS
@@ -602,20 +418,25 @@ Get Ghost