ProjectMan began with a demanding invariant: Org text should survive a parse, database persistence, and render cycle in a stable canonical form. Org-mode is therefore not a temporary import format. It remains a durable representation and an escape hatch, ensuring richer application features do not trap the user's planning data inside a proprietary interface.

The database adds stable identity, ordered hierarchies, multiple notebooks, structured scheduling, lifecycle state, source evidence, and point-in-time history. Bronze records preserve what arrived, Silver models validated current state and versions, and derived Gold-style projections can be rebuilt. Lineage connects a visible heading or projection back to the import and transformation that produced it.

All interfaces share the same domain operations. The workbench, REST API, CLI, and MCP adapter do not each invent their own rules for moving, clarifying, scheduling, or completing work. Requests pass through common validation and audit boundaries, making automation easier to inspect and preventing interface-specific shortcuts from silently corrupting the underlying hierarchy.

Privacy follows the data through these layers. Agent- and client-facing surfaces default to safe projections, while unrestricted history and source evidence require a bounded, higher-trust path. Model-assisted workflows exclude ineligible private material before a provider call, generate an ephemeral draft, validate its shape, and apply it only through the established operation kernel. Portability, provenance, privacy, and human review are treated as product features rather than cleanup work.