CoreFlow OS — Help

Every task can carry a planning technique. It is a note to yourself about how this piece of work gets done — Aria uses it when it builds a plan, and the Prioritize window can suggest one for the whole set.

Technique	Use it when	What it asks of you
Eisenhower	The list is mixed and you cannot see what matters	Sort by urgent vs important: do, schedule, delegate, drop
Eat the Frog	One task is clearly the hardest and you keep avoiding it	Do that one first, before email or meetings
Big Rocks	Small work keeps crowding out the consequential work	Place the few outcomes that matter in the week first, let the rest fill in
Time Boxing	Tasks have no natural end and expand to fill the day	Give each a fixed slot in the calendar and stop when it ends
RPM	You are busy but unsure what it is producing	Start from the Result, the Purpose, then the Massive action plan
Deep Work	The task needs uninterrupted concentration	Reserve 90 minutes or more with notifications off
Pomodoro	Starting is the hard part, or the work is short and fiddly	Work in 25-minute sprints with short breaks

Choosing one. Open Prioritize in the To-Do window and choose Analyze all tasks. Aria scores every technique against the set you are actually looking at — how long the tasks are, whether one dominates, whether they serve a stated outcome — and shows a ranked "best fit" with its reasoning. You can accept its suggestion for each task or set them yourself in the task's details.

They combine. Eisenhower and RPM decide what to work on; Time Boxing, Deep Work and Pomodoro decide how to execute it. A task can be ranked with Eisenhower and executed as a Pomodoro sprint.

Each of the eight executive lanes (CEO, COO, CFO, CTO, CMO, CHRO, CXO + Platform Console) is its own workspace. Workspaces share the application shell (sidebar + theming + Aria orb) but each has bespoke dashboards, datasets, and agents.

You navigate between workspaces using the executive lane buttons in the sidebar. Each lane has:

• A summary tab — KPIs and current state at-a-glance
• Director slots — specialized roles you can add under that executive
• Dispatched work — directives + audit log of what's been asked of agents
• Reports — periodic accomplishment narratives

The CEO workspace (/app) is the default landing. It's also the only workspace with the Aria Today panel embedded.

A director is the specialist who runs your business day to day inside CoreFlow. Where the executive team covers the general functions every company has — finance, marketing, people — the director knows your line of work.

You have one director, and it is chosen for you. When you set up your company you give your industry (NAICS) code and operating model, and CoreFlow installs the director built for that kind of business. An insurance agency and a machine shop get different directors, with different tools, skills and agents.

Each director has:

• A focus area — what they own
• A primary goal — the outcome they're judged on
• Its own agents — the ones that line of work needs; Aria coordinates with these to dispatch work
• A product surface — domain-specific UI in your workspace

Your director is data, not code: it is versioned, and it is upgraded in place as its blueprint improves, so its history and its work stay with it.

Aria is a generalist LLM wrapped in your tenant's context:

• Reads your tenant data — todos, priorities, goals, initiatives, calendar, email (via the Microsoft 365 or Google integration), CRM contacts. ChatGPT can't.
• Dispatches work via MCP tools — Aria can create todos, draft initiative artifacts, search your inbox semantically, and dispatch work to Ben (engineering) and Mary (design) inside the Monolith tenant.
• Persistent memory — long-term facts you tell Aria are stored in your tenant and recalled on subsequent turns. ChatGPT memory is opaque + per-conversation by default.
• Authority levels — every tool Aria can call has an explicit authority level (L1 read, L2 propose, L3+ execute). You can audit + tune what Aria is allowed to do.
• Pricing — Aria runs against your tenant's API budget. Settings → Application → API Spend shows usage.

The trade-off: Aria is slower than ChatGPT (more context to load) and less broadly knowledgeable (focused on operating your business, not writing your novel).

Goals are outcomes; initiatives are work.

A goal is a measurable end-state: "Reach 100 paying customers by Q4." It has a cadence (annual/quarterly), an owner role (CEO/COO/CFO/etc.), a status, and an optional description. Goals live at the executive layer.

An initiative is the cross-functional work-stream that delivers a goal (or set of goals). "Q3 product launch" or "Hiring plan: 5 engineers." Initiatives have artifacts (markdown docs, code, images), threads (Aria sessions tagged to them), and tasks. Initiatives can be linked to goals via the goal-decomposition flow in the PMO workspace.

Rule of thumb:

• Set goals first. Three to five quarterly + one or two annual.
• Initiatives follow. Each initiative should map to one (or rarely two) goals.
• Todos sit beneath initiatives. Quick day-to-day execution.

If your initiative doesn't ladder up to any goal, either retire the initiative or add the goal.

Priorities are the personal version. A priority in My Profile is a theme you commit to for a day, week or month — private to you, with todos and tasks linked to it, and no initiatives or plans underneath. Use a goal when the organization is accountable for the outcome, and a priority when you are deciding where your own week goes.

Trial. Every new tenant gets a 30-day trial. The trial clock starts at signup, not at first login.

Two signup paths:

• With card upfront — Stripe Checkout collects payment at signup; you're not charged until the trial expires.
• "Skip for now" — provisions the tenant without a card. The trial expires normally unless the tenant is flagged as a beta tester.

Beta testers. A flag on the subscription tells the trial watcher to leave the tenant alone — no past-due, no cancellation, no charges. Monolith sets this for legitimate testers.

Plans. Core, Pro and Enterprise, each with monthly and annual pricing. Seats are counted per active membership; AI service accounts are not billed.

Lifecycle. trialing → past_due (after the trial ends) → cancelled (after 14 days past due). All transitions run through the trial-watcher schedule and Stripe webhooks.

Manage everything from Settings → Application → Subscription.

CoreFlow's IMAP form verifies and saves a secure incoming-mail connection. IMAP inbox synchronization is not implemented yet; this connection does not add calendars or outgoing mail.

Before connecting

For Gmail or Microsoft 365, use the dedicated Google Workspace or Microsoft 365 connection in Application Integrations. These use provider sign-in and support the implemented mail and calendar sync. Outlook.com requires modern authentication; this password-based IMAP form cannot authorize it. See Microsoft's current settings.

For another provider, find its official incoming IMAP server hostname, username, and password or app password. CoreFlow uses TLS on port 993; alternate ports and private-network servers are not supported by this form. If your provider requires an app password, create one in its account-security settings. Availability depends on the provider and account policy. Google references: Email client setup, App passwords.

Connect

1. Open Connect IMAP email.
2. Enter the hostname alone, such as mail.example.com, without https:// or a port suffix.
3. Enter the mailbox username, usually your full email address.
4. Enter the provider password or app password. Use the eye button to show or hide it.
5. Click Verify and connect. CoreFlow tests secure login and opens the inbox read-only before saving the credential in the encrypted vault.

If verification fails, check the hostname, username and app password, and ask the provider or account administrator whether password-based IMAP access is allowed. A provider requiring OAuth should use the dedicated provider connection. Verify and connect clears the form's password after success.

CoreFlow works with the mail, calendar and task accounts you already use rather than replacing them. Connect a provider once and Aria can read that data in briefings, and make reviewed changes back in the provider.

What you can connect

Provider	What it brings in	Setup guide
Microsoft 365 / Outlook	Mail, calendar, Microsoft To Do lists	Connect Microsoft 365
Google Workspace / Gmail	Gmail, Google Calendar, Google Tasks	Connect Google

One connection per workspace

A connection belongs to the workspace, not to the person who created it. Today each workspace holds one Microsoft account and one Google account, and every action Aria takes in that provider runs as that account. Choose the account whose mailbox and calendar the workspace should operate on — usually your own work account, not a shared mailbox.

Anyone in the workspace with permission to act on mail or calendar then works through that connection, so treat connecting as an administrative act.

What CoreFlow stores

• Tokens are encrypted at rest. CoreFlow never sees or stores your password, and never asks for one.
• Synced messages, events and tasks are stored in your workspace's database so Aria can search and reason over them — for mail that includes sender, subject, body text, plus Aria's classification and summary.
• Disconnecting stops all syncing and removes the stored credentials. Records already imported stay as historical data until you delete them.

Keeping a connection healthy

• Syncs run on a schedule; see and adjust them in Settings → Application → Scheduled Tasks.
• When CoreFlow adds a capability that needs a new permission — sending mail, for example — an existing connection keeps working for everything it already had, but you must reconnect to grant the new one. Settings → Integrations shows each surface as read-only or read & write so you can spot this.
• Revoking access at the provider (Microsoft or Google) also ends CoreFlow's access immediately; the connection then shows an error until you reconnect.

Connecting Microsoft 365 gives Aria your Outlook mail, calendar and Microsoft To Do lists, and lets it make reviewed changes back in Outlook.

Connect your account

1. Go to Settings → Application → Integrations.
2. Find Microsoft 365 and choose Connect.
3. Sign in at Microsoft and pick the account the workspace should use. Work, school and personal Microsoft accounts are all supported.
4. Review the permissions and accept.

You return to Settings, where the connection shows as active with the access it was granted — for example "Mail: read & write · Calendar: read & write · Tasks: read & write". Finish the flow within five minutes of starting it; the security cookie that protects the exchange expires after that, and you can simply start again.

What CoreFlow asks for, and why

Permission	Why it is needed
offline_access	Keeps the connection alive without asking you to sign in again
User.Read	Reads your name and email so the connection can be labelled
Mail.ReadWrite	Reads the inbox for triage, and applies changes you approve — read/unread, flags, categories, archive or delete
Mail.Send	Sends the replies you review and approve. Separate from Mail.ReadWrite in Microsoft Graph, so you can see exactly when sending is granted
Calendars.ReadWrite	Reads your calendar for briefings and meeting prep, and edits or cancels the meetings you confirm
Tasks.ReadWrite	Mirrors your Microsoft To Do lists and applies completions and status changes

These are delegated permissions: CoreFlow acts as the signed-in user and can never reach anything that user cannot. There is no application-level access to other people's mailboxes.

For IT administrators

Many organizations require an administrator to approve third-party applications before anyone can use them. If your users see "Approval required" or "Need admin approval" on the Microsoft consent screen, one of these will clear it:

• An administrator connects first. When a Global Administrator or Privileged Role Administrator runs the connect flow, the consent screen offers Consent on behalf of your organization. Ticking it approves CoreFlow for every user at once.

• Grant consent directly. An administrator can visit the tenant-wide consent URL and approve without connecting an account:

  https://login.microsoftonline.com/common/adminconsent?client_id=<CoreFlow application ID>
  

  Ask your CoreFlow contact for the application (client) ID for your deployment.

• Approve the individual request. If your tenant has the admin consent request workflow enabled, the user's attempt raises a request in the Microsoft Entra admin center under Identity → Applications → Enterprise applications → Admin consent requests.

Administrators reviewing the request should know: CoreFlow requests only the delegated permissions in the table above, acts as the signed-in user, stores tokens encrypted, and the connection can be revoked at any time from Enterprise applications → CoreFlow → Permissions, or from within CoreFlow by disconnecting.

When permissions change

An older connection made before a capability existed keeps working for what it already had, but the new capability fails until you reconnect. Settings → Integrations labels each surface read-only or read & write for exactly this reason. Choose Connect again on the Microsoft 365 row and accept the updated permission list — nothing else about the connection changes.

Troubleshooting

What you see	What it means
"The redirect URI ... does not match" (AADSTS50011)	The sign-in URL the app used is not registered on the Entra app registration. The registered URI must be exactly https://<your CoreFlow host>/api/integrations/microsoft_graph/callback.
"Need admin approval" / "Approval required"	Your organization requires administrator consent — see the administrators section above.
"OAuth cookie expired. Connect again within 5 minutes of starting."	The flow took too long or started in a different browser. Start from Settings → Integrations again and complete it in one go.
"state mismatch" or "returned no code or state"	The flow was interrupted or a stale tab finished it. Try again from Settings → Integrations.
"token exchange failed"	Microsoft rejected the credentials for this deployment — usually an expired client secret. Contact your CoreFlow administrator.
"isn't configured on this deployment"	The deployment has no Microsoft credentials set. Contact your CoreFlow administrator.
Connection active, but a change fails	The grant is read-only for that surface. Reconnect to add write access.

Disconnecting

Choose Disconnect on the Microsoft 365 row in Settings → Integrations. Syncing stops and the stored tokens are removed. Mail, events and tasks already imported stay in the workspace as historical data. You can also revoke access from the Microsoft side at myapps.microsoft.com.

Connecting Google gives Aria your Gmail, Google Calendar and Google Tasks, and lets it make reviewed changes back in Google.

Connect your account

1. Go to Settings → Application → Integrations.
2. Find Google Workspace and choose Connect.
3. Sign in at Google and choose the account the workspace should use. Google Workspace and personal Gmail accounts both work.
4. Review the permissions and accept.

Google lets you untick individual permissions on the consent screen. If you do, the connection still succeeds but the unticked surface will be read-only or unavailable — Settings → Integrations shows which. Accepting everything is the simplest path; reconnect later to add anything you skipped, and Google keeps what you already granted.

What CoreFlow asks for, and why

Permission	Why it is needed
openid, email, profile	Identifies the account so the connection can be labelled
gmail.modify	Reads the inbox for triage and applies changes you approve — read/unread, labels, archive, trash
gmail.send	Sends the replies you review and approve
calendar.events	Reads your calendar for briefings, and creates or edits the events you confirm
tasks	Mirrors your Google Tasks lists and applies completions and status changes

Google grades these permissions. gmail.modify is a restricted scope: apps that use it go through Google's verification review and an annual independent security assessment (CASA). gmail.send, calendar.events and tasks are sensitive scopes, which need verification but no assessment. Your Google Cloud console labels each scope on the Data access page. Until verification completes for a deployment, Google shows an "unverified app" warning on the consent screen, limits the flow to accounts explicitly added as test users, and expires those testers' connections after seven days — so expect to reconnect weekly while a deployment is still in review.

For Google Workspace administrators

Workspace administrators can control third-party access centrally in the Google Admin console under Security → Access and data control → API controls → Third-party app access. Two settings matter:

• App access — marking CoreFlow trusted lets your users connect without individual warnings; leaving it unconfigured may block the Gmail permissions entirely.
• Blocked scopes — if restricted Gmail scopes are blocked organization-wide, connecting will fail regardless of what the user accepts.

CoreFlow requests only the permissions in the table above, acts as the signed-in user, and stores tokens encrypted. Users can revoke access at any time at myaccount.google.com/permissions, and administrators from the API controls page.

Troubleshooting

What you see	What it means
"Google hasn't verified this app"	The deployment's verification review is not complete. Continue only if you trust the deployment, or ask to be added as a test user.
"Access blocked: this app's request is invalid"	The sign-in URL is not registered as an authorized redirect URI for the deployment's Google client. It must be exactly https://<your CoreFlow host>/api/integrations/google_oauth/callback.
"Access blocked: org policy"	A Workspace administrator has not allowed the app or has blocked the Gmail scopes — see the administrators section above.
"OAuth cookie expired. Connect again within 5 minutes of starting."	The flow took too long or started in a different browser. Start again from Settings → Integrations.
Connection active, but sending or editing fails	A permission was unticked at consent, or the grant pre-dates it. Reconnect and accept the full list.

Disconnecting

Choose Disconnect on the Google row in Settings → Integrations. Syncing stops and the stored tokens are removed; imported records stay as historical data.

Connect Microsoft 365 in Settings → Application → Integrations. Existing connections must reconnect to grant mail and calendar write access. The connection belongs to your organization; actions use that connected Microsoft account and your CoreFlow permissions.

Outlook tasks are imported records, separate from personal CoreFlow todos. Ask Aria to find your Outlook tasks first. Personal todos are not automatically created in Microsoft.

Item	Changes Aria can make in Microsoft
Outlook tasks	Complete, reopen, change status or importance; update an exact selection of up to 100 tasks
Task cancellation	Delete the exact selection after a separate review and confirmation
Inbox email	Mark read/unread; flag, clear or complete follow-up; change importance or categories
Email cleanup	Archive or move an exact message to Deleted Items after review and confirmation
Outlook calendar	Edit an imported event's title, note, start/end, location, all-day setting and reminder
Meeting cancellation	Cancel an exact meeting after review and confirmation; Microsoft requires the connected account to be its organizer and sends cancellation notices to attendees

For example: "Find my outstanding Outlook tasks," then "Mark these complete." For cancellation, say "Cancel these Outlook tasks." Aria shows every selected title and list before asking you to confirm deletion. Completion and deletion are separate actions.