Requests
128,400
Costco OS
What are we working on?
Build governed apps, workflows, documents and decks with shared company context.
Explore role workspaces
Peak Readiness Command CenterA service-health app with SLOs, game days and approval-gated rollbacks.
AppCodex PR & Design ReviewDeterministic checks first; model judgment only when needed, with a human merge gate.
WorkflowPost-Incident ReviewBlameless timeline, contributing factors and human-owned corrective actions.
DocumentCentral Eng Quarterly ReviewA quarterly view of delivery, quality, reliability, developer experience and AI spend.
Slide DeckIllustrative prototype. Public-facing demonstration with simulated data; no Costco systems are connected.
Build a holiday peak-readiness command center for Central Engineering: checkout and membership SLOs, game days, release risk and rollback approvals.
AI
I start with no access. I can ask for read-only signals without receiving a raw credential.
Gatekeeper: Observability + CI/CD
Read service-level metrics, release records and game-day results. Changes and rollbacks require a named human approver.
Read service-level metrics, release records and game-day results. Changes and rollbacks require a named human approver.
Approve read-only access. Flag any action that changes production.
AI
I can assemble an illustrative Worker app from typed Gatekeeper bindings and calculate SLO and error-budget trends using code.
Illustrative code
const [slos, releases, drills] = await Promise.all([
env.OBSERVABILITY.getSLOs({ services: ["checkout", "membership", "fulfillment"] }),
env.CICD.getReleases({ window: "24h", access: "read" }),
env.GAME_DAYS.list({ period: "peak-2026" })
]);
app.render(PeakReadiness, { slos, releases, drills });
AI
The example dashboard is ready. One checkout release is consuming error budget at 4.2× its planned rate. I drafted a rollback recommendation, but execution remains pending a human release owner. Two game days remain scheduled.
Review pull requests and design docs against our engineering Codex. Use cheap deterministic checks first and bring ambiguous architecture issues to a human owner.
AI
I can read the relevant Codex rules and request comment-only repository access.
Gatekeeper: Source Control + Engineering Codex
Read pull requests and design docs; propose review comments. No merge, branch protection change or production write access.
Read pull requests and design docs; propose review comments. No merge, branch protection change or production write access.
AI
The workflow separates static checks from model judgment. It escalates only uncertain design decisions and waits for the owning team before blocking or approving a merge.
Illustrative code
const rules = await env.CONTEXT.read("engineering-codex.md");
const changes = await env.SOURCE_CONTROL.listReviews({ access: "read" });
const facts = runDeterministicChecks(changes, rules);
const ambiguous = facts.filter(f => f.needsJudgment);
const recommendations = await model.review(ambiguous, rules);
return queueForHumanOwner(recommendations);
AI
Illustrative run: 62 PRs and 8 design docs checked. Five need owner review; a pharmacy-service design doc has a single-region dependency that the Codex flags for resilience review. No merge was changed automatically.
Draft a blameless post-incident review for last week’s checkout disruption. Merge the incident timeline with alerts and change history, and flag missing evidence.
AI
I can only use incident records this requester is authorized to read.
Gatekeeper: Incident Management + Observability
Read the example incident, alert timeline and related release metadata. Private responder notes remain restricted.
Read the example incident, alert timeline and related release metadata. Private responder notes remain restricted.
AI
I joined the incident, alerts and release events using deterministic timestamps. The example outage lasted 37 minutes; a connection-pool setting changed before the error spike. I’ve separated observed facts from hypotheses.
AI
The review is ready with four proposed actions. Owners must verify evidence and approve the two publication-ready items; I have not notified teams or modified the incident record.
Build a Central Engineering quarterly review: DORA, release quality, reliability, developer experience, AI adoption and cost, with priorities for the next quarter.
AI
I will request only aggregate, team-level metrics. Sensitive individual performance data is outside this workspace.
Gatekeeper: Delivery Metrics + AI Gateway
Read-only aggregate delivery, test quality, incident and model-cost summaries for Central Engineering.
Read-only aggregate delivery, test quality, incident and model-cost summaries for Central Engineering.
AI
The illustrative deck reconciles source periods before charting and labels targets separately from actuals. AI Gateway shows 89M tokens and $2,460 for Central Engineering, below its $3,000 demo cap.
AI
Five slides are ready. The roadmap prioritizes finishing two peak game days, extending the Codex review to tier-2 repositories and closing checkout rollback gaps. A human leader signs off before distribution.
Peak Readiness Command Center
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
99.95%
Checkout SLO target
4.2×
Checkout error-budget burn
7 / 9
Game days complete
1
Rollback awaiting approval
Approval required: Checkout API release R-218 is exhausting its error budget. Recommendation drafted; no production change has occurred.
Peak readiness: Two remaining game days are scheduled before the holiday change freeze.
Service-level overview
Membership sign-in
99.98%
Healthy
Checkout API
99.91%
Review
Fulfillment service
99.96%
Monitor
Game-day plan
| Exercise | State | Gate |
|---|---|---|
| Payment provider failover | Complete | Observability review |
| Regional checkout failover | Scheduled | SRE owner approval |
| Warehouse event backlog | Scheduled | Central Eng approval |
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
App blueprint
The view is generated from a sandboxed client and a Worker server. Its server-side logic calls approved, typed Gatekeeper capabilities; source credentials are never embedded in the generated app. Stateful apps can use Durable Objects with SQLite.
Server-side assembly
const metrics = await env.OBSERVABILITY.getSLOs({ scope: "central-engineering" });
const releases = await env.CICD.getReleases({ access: "read" });
const plan = evaluateErrorBudget(metrics, releases);
return { metrics, plan, rollback: "requires-human-approval" };
Policy trace
| Step | Boundary | Status |
|---|---|---|
| Read metrics | Typed, read-only capability | Logged |
| Build app | Sandboxed client + server | Illustrative |
| Rollback | Release-owner approval required | Not executed |
| Share | Re-check every observed resource | Per viewer |
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Resource boundaries
Observability GatekeeperService-level metrics and error budgets, read-only, Central Engineering scope.
CI/CD GatekeeperReleases and rollback plans, read-only until a human approves changes.
Game-day recordsApproved drill results and upcoming exercises; no cross-team access implied.
Engineering contextSRE standards, service owners and peak change policy, curated centrally.
Sharing & approvalsRe-check every viewer against all observed resources. Credentials stay with Gatekeepers; consequential actions need a human owner.
Codex PR & Design Review
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
62
PRs checked
8
Design docs checked
5
Owner reviews needed
0
Autonomous merges
Review pipeline
1
Trigger & scope
New PR or design doc. Read only the resources granted by Source Control and Context Gatekeepers.
2
Deterministic checks
Lint, dependency, test, ownership and Codex rules run in code; no model call for known facts.
3
Selective model judgment
Architecture tradeoffs and ambiguous exceptions route through AI Gateway with a bounded budget.
4
Human decision
Findings are proposed as comments; a designated owner decides on merge, exception or remediation.
No direct merge permission. Only an authorized engineer can accept or reject a recommendation.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Recent review run
| Artifact | Check | Result | Next step |
|---|---|---|---|
| PR-1042 Checkout retries | Tests + ownership | Pass | Engineer review |
| PR-1048 Membership cache | Latency budget | Comment | Review TTL |
| DD-112 Pharmacy failover | Single-region dependency | Owner review | Compare multi-region options |
| PR-1051 Release manifest | Canary requirement | Owner review | Attach rollout plan |
Sample Codex rules
- Tier-1 services require a documented rollback and SLO owner.
- New critical paths need dependency and failover review.
- Changed auth boundaries require a security owner.
- Exceptions must include an accountable human decision.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Resource boundaries
Source Control GatekeeperRead pull requests and design docs; comment proposals only.
CI/CD GatekeeperBuild and test results, read-only.
Engineering CodexVersioned organization context and standards; read-only to the agent.
AI GatewayModel routing, task budget and request-level audit for judgment steps.
Sharing & approvalsRe-check every viewer against all observed resources. Credentials stay with Gatekeepers; consequential actions need a human owner.
Post-Incident Review
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Checkout API — Post-Incident Review
Summary
A payment-token connection-pool setting introduced during a release increased checkout failures. The response team identified the change, authorized a rollback and confirmed error rates returned to baseline. This example reconstructs the response using synthetic events, not real incident data.
| Impact measure | Example value | Interpretation |
|---|---|---|
| Incident duration | 37 minutes | 11:03–11:40 PT |
| Peak checkout errors | 8.2% | First 12 minutes |
| Time to detect | 6 minutes | Telemetry threshold fired |
| Time to mitigate | 37 minutes | Rollback approved and verified |
Contributing factors
- Canary traffic did not reflect peak checkout load.
- The connection-pool configuration lacked a high-load guardrail.
- An alert route referenced a retired on-call rotation.
Corrective actions
| Action | Human owner | State |
|---|---|---|
| Add peak-load canary validation | Checkout engineering | Approved |
| Test connection-pool saturation | Platform SRE | Approved |
| Audit paging ownership | Incident response | Awaiting review |
| Update rollback drill | Central Engineering | Awaiting review |
Reader access is re-checked against every incident resource used to produce this review. Restricted notes are not included without permission.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Reconciled incident timeline
| Time | Event | Source |
|---|---|---|
| 11:03 | Payment-token connection-pool setting released | CI/CD |
| 11:09 | Checkout errors cross alert threshold | Observability |
| 11:15 | Responder paged; on-call route corrected | Incident Management |
| 11:23 | Pool saturation correlated with errors | Traces |
| 11:36 | Human release owner approves rollback | Change record |
| 11:40 | Errors return to baseline; monitor continues | Observability |
Hypothesis: unrepresentative canary traffic delayed detection of high-load pool saturation. Confirm against test evidence before publishing.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Resource boundaries
Incident Management GatekeeperAuthorized incident metadata, timeline and action items.
Observability GatekeeperScoped SLO, alert and tracing evidence.
CI/CD GatekeeperRead-only release and change records.
Confluence GatekeeperReference incident-review template; publishing needs a human.
Sharing & approvalsRe-check every viewer against all observed resources. Credentials stay with Gatekeepers; consequential actions need a human owner.
Central Eng Quarterly Review
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Deck source ledger
| Slide | Source boundary | Check |
|---|---|---|
| Delivery | Delivery Metrics Gatekeeper | Q3 team-level aggregate |
| Quality | CI/CD + incident records | Same reporting period |
| Reliability | Observability + game-day results | Service owners verify |
| AI cost | AI Gateway team summary | 89M tokens, $2,460 of $3,000 cap |
| Next priorities | Engineering Codex + review actions | Leader approval needed |
Distribution is approval-gated. A viewer must have permission to every observed source used for the deck.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Resource boundaries
Delivery Metrics GatekeeperAuthorized team-level DORA and developer-experience aggregates.
Observability + CI/CD GatekeepersService SLOs, release health and quality at the same reporting cadence.
AI GatewayAggregate model requests, token volume, spend and budget for Central Engineering.
Engineering CodexCurated architecture and review principles, versioned and read-only.
Sharing & approvalsRe-check every viewer against all observed resources. Credentials stay with Gatekeepers; consequential actions need a human owner.
Integrations
Organization-wide Gatekeepers expose scoped capabilities, hold credentials and record access across workspaces.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
Gatekeepers
Google Workspace
Calendar, mail, files, Docs, Sheets and Slides
Google Chat
Read scoped spaces and draft team notifications
Jira
Issues, delivery status and architecture reviews
Confluence
Read approved documentation and engineering standards
Source Control
Repository metadata, design docs and pull requests
Observability
Service SLOs, traces and error-budget signals
CI/CD
Build status, release records and rollback plans
Incident Management
Incident timelines, ownership and action items
Delivery Metrics
DORA and quality data at authorized team scope
Cloudflare AI Gateway
Model routing, aggregate usage and spend
ServiceNow
Changes, tickets and service ownership
SAP
Finance, procurement and supply-chain data
Salesforce
Authorized member and partner CRM records
Snowflake
Governed analytics and aggregate reporting
MCP Server Portals
Team-specific MCP servers are discovered through organization portals; authorization remains scoped to the caller.
Engineering tools
Repository, CI and review capabilities
Operations
Incidents, on-call and change tracking
Customer experience
Member journeys and service feedback
Supply chain
Supplier and fulfillment insights
Finance
Aggregate budgets and approved spend
People operations
Role-based policy and onboarding context
Organization Context
Shared, versioned knowledge available to authorized workspaces across Costco — not tied to one role.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
company-strategy.md
Mission, operating model and outcome definitions
brand-and-member-communications.md
Voice, accessibility and member-facing communication
security-standards.md
Identity, secure development and protective controls
engineering-codex.md
Design review rules, ownership and architectural constraints
architecture-principles.md
Resilience, service design and review templates
sre-slo-standards.md
Service level objectives, error budgets and game days
incident-response-playbook.md
Blameless reviews, escalation and evidence handling
data-classification.md
Data types, retention and authorized use
responsible-ai-standard.md
Model evaluations, risk tiers and human approval
privacy-and-member-data.md
Member privacy and sensitive data boundaries
member-experience-playbook.md
Membership journey and service standards
supply-chain-procedures.md
Procurement, suppliers, inventory and fulfillment
hr-policies.md
People operations, onboarding and employee policies
financial-reporting.md
Budgeting, financial controls and reporting
Skills
Reusable organization-wide workflows. A human owner stays accountable for every output.
Illustrative prototype. Scenarios, connections and metrics are simulated; no Costco systems or live customer data are connected.
| Name | Description | Group | Source |
|---|---|---|---|
| meeting-prep | Build an agenda from authorized calendar, CRM and document context | General | Prototype library |
| weekly-operating-review | Summarize decisions, owners, risks and open follow-ups | General | Prototype library |
| incident-response | Assemble scoped evidence and draft a blameless review | Security | Prototype library |
| vendor-assessment | Compare suppliers against approved security requirements | Security | Prototype library |
| compliance-evidence | Collect authorized control evidence for human review | Security | Prototype library |
| architecture-review | Draft an architecture decision with Codex criteria | IT & Architecture | Prototype library |
| codex-pr-review | Check pull requests and design docs; flag human decisions | IT & Architecture | Prototype library |
| change-impact | Map service dependencies before a proposed change | IT & Architecture | Prototype library |
| api-catalog | Document services, endpoints, owners and health | IT & Architecture | Prototype library |
| peak-readiness | Review SLOs, game days and rollback approvals | Operations | Prototype library |
| runbook-automation | Turn approved steps into deterministic checks | Operations | Prototype library |
| supplier-scorecard | Summarize supplier quality and delivery at authorized scope | Operations | Prototype library |
| model-evaluation | Compare model quality, latency and task-level risks | Data & AI | Prototype library |
| ai-usage-review | Analyze model traffic and team budgets | Data & AI | Prototype library |
| member-insights | Summarize aggregate, permitted member experience signals | Member Experience | Prototype library |
| service-feedback | Synthesize support trends and actionable themes | Member Experience | Prototype library |
| budget-analysis | Explain budget variances from approved finance aggregates | Finance | Prototype library |
| cost-optimization | Identify infrastructure cost opportunities for review | Finance | Prototype library |
| job-posting-draft | Draft role descriptions from approved people policies | HR | Prototype library |
| onboarding-guide | Assemble approved team and policy onboarding references | HR | Prototype library |
| policy-compare | Surface changes for legal and compliance owners | Legal | Prototype library |
| contract-brief | Prepare an authorized summary for legal review | Legal | Prototype library |
Profile
Illustrative account information for this public prototype.
Account
Demo User
No personal information is stored
Display name
Demo User
User ID
demo.user@example.com
AI Gateway
Illustrative scenario data for simulated model routes, controls, and usage — one console.
Illustrative scenario. Providers, models, traffic, latency, spend, users, teams, budgets, and controls are simulated; they do not describe Costco systems or activity.
Tokens
342M
Est. spend
$9,120
Cache-hit
27%
Error rate
0.6%
p50 latency
480 ms
Illustrative Model Traffic
This month| Model | Route | Tokens | Spend | Share | p50 latency |
|---|---|---|---|---|---|
| Llama 3.3 70B | Workers AI | 156M | $2,140 | 310 ms | |
| Claude | via AI Gateway | 98M | $3,980 | 720 ms | |
| GPT-4o | via AI Gateway | 61M | $2,510 | 640 ms | |
| Workers AI embeddings (bge) | Workers AI | 27M | $490 | 40 ms |
Spend vs. Budget
1 day remaining$9,120spent of $12,000 cap
76%
On track · ~$2,880 left with 1 day
Illustrative Users
Demo User 0142M tok $1,180
Demo User 0231M tok $960
Demo User 0328M tok $840
Demo User 0422M tok $610
Illustrative Usage by Workspace / Team
342M tokens totalData & AI
121M tokens · $3,240
Central Engineering
89M tokens · $2,460
Member Experience
62M tokens · $1,510
Merchandising & Supply Chain
41M tokens · $1,020
Security & Compliance
29M tokens · $890
Governance
Illustrative guardrail settings modeled with Gatekeepers + AI Gateway, resource-scoped access, audit trails, and human approval.
Illustrative settings. Every model, limit, retention period, approval, and control below is simulated; no Costco policy or configuration is connected.
Per-team allowed models
Restrict which providers each workspace can call.
Monthly spend caps
Hard limits per team; agents stop before overrun.
Data & AI $4,000Central Engineering $3,000Merchandising & Supply Chain $2,000Security & Compliance $2,000
PII redaction
Strip sensitive fields from prompts before they leave.
Enabled
Prompt / response logging
Full request logs retained for audit & review.
Enabled · 90-day retention
Rate limits
Per-team request ceilings to protect budgets.
600 req / min|burst 1,000
Raise Merchandising & Supply Chain cap to $3,000
Simulated change queued by an agent — needs a human sign-off.
Requires approval