A language model never touches your schedule. It returns edits in the same form the undo stack already uses, and every one is checked before it can apply — so a bad answer is a rejected parse, not a corrupted programme.
They run in order, in your browser, on every edit a model returns. Nothing reaches the document until all three pass — and the third is deliberately the narrowest.
A known operation type, with the fields that operation requires. Prose, half-formed JSON and invented op names all die here, before anything is looked up.
An edit must name a row that is actually in the file — and an addition must name one that is not. A hallucinated activity code is a rejection, not a new activity.
A whitelist per table: names, durations, activity type, calendar, WBS, constraint, relationship type and lag, resource quantities. Anything not on the list is refused.
act_start_date act_end_date status_code are excluded on purpose. Recording that work happened is a claim about the real world, and it belongs to the person who was there — not to a text model reading a summary of your file.
Changing a key on an existing row silently reparents its relationships and its assignments. New rows may of course carry ids; changing one afterwards is what is refused. Nothing is quietly re-pointed while you are reading the summary.
The deterministic work — parsing, CPM, open ends, leads, constraints, cycles — runs locally and costs nothing. Asking a language model to count missing predecessors is slower, costs money and is less reliable than the code that already does it. So the engine finds; the model judges, explains and proposes.
"Design, procure and install 4 no. 33kV transformer bays including civils, cabling and commissioning. Completion within 9 months of award."
→ proposed: 4 WBS bands · 26 activities · 31 linksRendered as a preview diff. Accept it into the project, edit it first, or throw it away — nothing applies until you say so.
Those are found exactly, locally and for free, then handed to the model as fact — not as a question.
"The cycle through CW-1080 is the one to fix first: it's suppressing float on the entire commissioning chain."
Fixes come back as ops you preview, through the same three checks as everything else.
> push procurement two weeks
→ 6 activities move · finish slips 4 working daysDurations go in and come back in hours on an eight-hour day, relationships in P6 codes — PR_FS, PR_SS, PR_FF, PR_SF — so what applies is what P6 would have written.
Previewed in plain language, applied through the normal undo path. One command, one undo.
Each provider gets a small adapter, so nothing above has to know which is in use. Structured output goes through tool calling wherever the provider has it, rather than asking for JSON in the prompt: it is the one mechanism the major APIs share, and the provider enforces it instead of us hoping for it.
Opening, editing, CPM, baselines, DCMA checks, levelling, earned value, risk and print all run in your browser with no model involved and no request made. The assistant is something you invoke; when you do, the text it needs for that one request goes to the provider you picked, with your key, through a relay that keeps nothing — or to no one at all if that model runs on your machine. A 20,000-activity XER fits in no context window, so what is sent is a summary chosen by relevance, never the file. The full route is written out on how it works, and the long form is in the privacy policy.
Free to open, no account, nothing uploaded. What it costs →