The model proposes.
The engine judges.
A language model never touches your schedule. It returns edits in the same form the undo stack already uses, and every one is checked before it can apply — so a bad answer is a rejected parse, not a corrupted programme.
- The request is sent with a summary, not the file120 activities chosen by relevance · never the whole XER
- The model answers with ops, through tool calling{ type: "edit", table: "TASK", id: "A1050", … }
- Shape · reference · fieldknown op · the row exists · the field is writable
- Anything outside the whitelist is refused hereactuals · status · renamed identifiers
- CPM runs and you see the diff6 activities move · finish slips 4 working days
- You accept it — as one undo stepone command, one undo
Three checks stand between a sentence and your programme.
They run in order, in your browser, on every edit a model returns. Nothing reaches the document until all three pass — and the third is deliberately the narrowest.
Is this an op at all?
A known operation type, with the fields that operation requires. Prose, half-formed JSON and invented op names all die here, before anything is looked up.
Does the row exist?
An edit must name a row that is actually in the file — and an addition must name one that is not. A hallucinated activity code is a rejection, not a new activity.
Is this field writable?
A whitelist per table: names, durations, activity type, calendar, WBS, constraint, relationship type and lag, resource quantities. Anything not on the list is refused.
It cannot report progress
act_start_date act_end_date status_code are excluded on purpose. Recording that work happened is a claim about the real world, and it belongs to the person who was there — not to a text model reading a summary of your file.
It cannot rename an identifier
Changing a key on an existing row silently reparents its relationships and its assignments. New rows may of course carry ids; changing one afterwards is what is refused. Nothing is quietly re-pointed while you are reading the summary.
Three jobs, and the honest split between engine and model.
The deterministic work — parsing, CPM, open ends, leads, constraints, cycles — runs locally and costs nothing. Asking a language model to count missing predecessors is slower, costs money and is less reliable than the code that already does it. So the engine finds; the model judges, explains and proposes.
A blank sheet, filled in.
"Design, procure and install 4 no. 33kV transformer bays including civils, cabling and commissioning. Completion within 9 months of award."
→ proposed: 4 WBS bands · 26 activities · 31 linksRendered as a preview diff. Accept it into the project, edit it first, or throw it away — nothing applies until you say so.
The engine finds. The model triages.
7 open ends · 2 negative lags · 1 cycleThose are found exactly, locally and for free, then handed to the model as fact — not as a question.
"The cycle through CW-1080 is the one to fix first: it's suppressing float on the entire commissioning chain."
Fixes come back as ops you preview, through the same three checks as everything else.
Say it; see what it costs.
> push procurement two weeks
→ 6 activities move · finish slips 4 working daysDurations go in and come back in hours on an eight-hour day, relationships in the XER format's own codes — PR_FS, PR_SS, PR_FF, PR_SF — so what applies is what the file itself will carry.
Previewed in plain language, applied through the normal undo path. One command, one undo.
Model-agnostic by construction — including no model at all.
Each provider gets a small adapter, so nothing above has to know which is in use. Structured output goes through tool calling wherever the provider has it, rather than asking for JSON in the prompt: it is the one mechanism the major APIs share, and the provider enforces it instead of us hoping for it.
Already have an approved assistant? Use that, with no key in the Studio.
Claude, Copilot and Cursor run on your firm’s account, under your firm’s agreement. A small program on your computer lets that assistant read the schedule you have open. It does the thinking; the Studio supplies six tools and checks everything that comes back. In the Studio, open the assistant, then Settings, and choose Your firm’s assistant.
{ "mcpServers": { "aimavera": {
"command": "npx",
"args": ["-y", "aimavera-mcp"] } } }claude mcp add aimavera -- npx -y aimavera-mcp
{ "mcpServers": { "aimavera": {
"command": "npx",
"args": ["-y", "aimavera-mcp"] } } }{ "servers": { "aimavera": {
"type": "stdio",
"command": "npx",
"args": ["-y", "aimavera-mcp"] } } }- Pairing. Ask your assistant to connect to Aimavera. It answers with a port and a six-digit code; you enter them in the Studio and press Connect. The code changes every time the bridge starts.
- Read-only to begin with. The assistant can read the summary, find activities, look at one, list the critical path and the DCMA checks. You switch on Let it propose edits to allow suggestions.
- You still approve. A suggestion arrives in the assistant panel as the same card the built-in assistant uses, checked first. Actuals, status and progress are never accepted.
- Nothing passes through us. The bridge listens on your computer only, answers only the Aimavera site, and needs the code on every request. It needs Chrome or Edge.
Only the request you ask for leaves, and only when you ask for it.
Opening, editing, CPM, baselines, DCMA checks, levelling, earned value, risk and print all run in your browser with no model involved and no request made. The assistant is something you invoke; when you do, the text it needs for that one request goes to the provider you picked, with your key, through a relay that keeps nothing — or to no one at all if that model runs on your machine. A 20,000-activity XER fits in no context window, so what is sent is a summary chosen by relevance, never the file. The full route is written out on how it works, and the long form is in the privacy policy.
Point it at a real file and see what it refuses.
Free to open, no account, nothing uploaded. What it costs →