Pro

Free does everything, one step at a time. Pro is the deterministic referee: it adds enforcement, atomic bulk apply, and verification with teeth, on the same live model.

This page explains what Pro is. For plans and pricing, see the pricing page. Nothing here is a trial: every capability in Semanticus works on the free tier one edit at a time, and turning Pro off returns those flows to one-at-a-time mode with your models untouched.

#The thesis: Pro is the referee, not the editor

The Semanticus engine runs no inference and holds no AI credentials. The intelligence is your own assistant, on your account. So Pro does not sell you better AI. It sells the one thing an editing agent cannot honestly give itself: an independent, deterministic verdict on what it just did to your model. An agent that verifies its own edit is marking its own homework. A referee that could not have made the edit is the product. Separation of powers: the editor is your assistant, the referee is the engine.

Free is genuinely complete for single-edit work. Pro adds three things a free user has to do by hand, every time:

• Enforcement. The checks become a precondition of the operation, engine-checked on both doors, instead of a prompt you hope the assistant followed.
• Atomic bulk apply. A reviewed batch lands as one undoable transaction, not a hundred separate edits you babysit.
• Verification with teeth. Evidence is gathered, recorded to a permanent trail that cannot be quietly rewritten, and surfaced at the moment you ship.

#Verified Edits (Model CI)

Verified Edits is CI for your semantic model: Semanticus independently checks an AI edit and will not let one that moved your numbers ship without your sign-off. It has four parts.

#Verified Mode intercepts risky edits

Verified Mode is a human-controlled, Pro-gated toggle enforced at the engine's mutation path, so a lazy agent cannot silently skip verification when you have asked for it. Turning it on is a Pro feature; the switch is yours to hold, and turning it off mid-work is a deliberate, recorded act. Today it enforces strict validation on single-edit DAX (creating or setting the DAX of a measure, calculated column, calculated table, calculation item or function): an invalid expression or a reference to an unknown table, column or measure is refused before it can land.

Every AI edit is auto-classified off the semantic diff and runs the matching pipeline, delivered as explicit, evidence-gated operations:

#The accountable checkpoint at apply and deploy

Shipping is never physically blocked, because a hard wall frustrates people and is bypassable anyway. Instead, a red verdict pauses the apply or deploy and shows the reasons. deploy_live runs the deploy gate before it writes; shipping past a red gate takes an explicit written reason, recorded before the model is serialized so the override record travels inside the artifact it authorized. apply_plan carries the same reason-required override path. You can always ship. You just cannot ship blind or unaccountably.

#The audit trail no one can quietly rewrite, with evidence you can see

Every verified operation, override and deploy is recorded to a permanent trail stored on the model itself, so it travels with a reload, a git commit or a deploy. Records are only ever added, each one locks in the record before it, and the trail checks itself: edit or delete a past entry and it reports exactly where history was altered. A record cannot be erased by an undo. Reading the trail (list_verified_edits) is free; exporting it as a shareable report or CI JSON (export_verified_edits) is a Pro feature. In the Edit History tab the evidence renders as real UI, not a blob: the optimize race as candidate DAX side by side with the winner highlighted, the mismatch table as a grid, benchmark bars, the before-and-after grid for a baseline comparison, and the gate state for a deploy.

#Baselines for value-capture at edit start

The load-bearing primitive under restructure and remove is capturing value before you touch anything. capture_baseline takes the object's lineage-derived blast radius (the downstream measures) and freezes their measured values over a probe grid into a session-held store. After the edit, compare_baseline re-evaluates the same grid on the live model and reports per measure: unchanged, moved (with the exact contexts and before-and-after values), or missing (the measure no longer resolves, which is an impact, never a silent skip). It is honest about its window: it reads the live model, so edits made since capture are covered only once deployed, and the result says so.

#Enforced workflows

A workflow is a user-editable playbook: an ordered set of steps, each with instruction text the assistant reads and an optional gate. A gate has required inputs the caller must answer or decline with a reason, and verify checks the engine runs against the real model, never self-graded by the assistant. The engine-evaluated checks include DAX probes (a known-good number against the live result), equivalence proofs (the recorded pre-rewrite original against the current expression over an answered grid), and best-practice and readiness re-scans (the active findings diffed against a start-of-run snapshot, so a step is never blamed for pre-existing violations). Where a check needs a live connection and there is none, it is honestly recorded as skipped, never silently passed.

Semanticus ships 32 stock playbooks across the modelling journey, from design and build to quality, security and ship, and you can copy one to customise or author your own. Reading a playbook is free (the library is open content, and following it by hand costs nothing): list_workflows and get_workflow are free on both doors. An enforced run is the Pro chokepoint: start_workflow requires Pro when any step's gate enforces. A workflow whose gates all resolve to off runs free, because what Pro sells is enforcement, not the playbook text.

Pro also lets a team require a workflow for a task: set_workflow_binding routes a bare operation (say, create_measure) to the team’s reviewed playbook, refusing it outside the workflow’s own authoring step with a plain explanation of where to go instead. The requirement is recorded beside the model, travels with the repository, reads independently of the strictness toggle (relaxing gates never silently removes a mandate), and get_workflow_policy reports the whole picture in one free call.

#The learning loop's compounding layer

Semanticus captures your work as experience: the change bus, plan reports, workflow runs and waivers are teed to a plain local log, and distilled insights are kept in a knowledge store keyed to your model's fingerprint. Capture and recall are free for everyone, because it is your own data and the recall banner ("you have been here before") is where the value shows itself: recall_experience and reading the store cost nothing.

The compounding machinery is Pro: distilling a verified run into a reusable, parameterized workflow, and then running that learned workflow with enforcement. Before a learned workflow is trusted it passes an admission layer that parses it, dry-runs it against the live operation catalog to check every step resolves to a real op (check_workflow), and replays its deterministic steps against the originating snapshot (replay_check_workflow). That is the guardrail against a learned workflow that quietly rots. The safety results, and the lift results as they land, are published on the benchmarks page: numbers we publish are reproducible or they do not ship.

#Change plans: a pull request for your model

A change plan turns "fix everything" into a reviewable, reversible artifact. propose_plan analyses the model and assembles proposed changes without mutating anything; deterministic and best-practice fixes come fully specified before-and-after, and AI-content items arrive with grounding for your assistant to fill. You review it item by item as a real diff (red-and-green for DAX, generated descriptions inline-editable), approve or reject each one, and nothing changes until you apply. On apply, DAX rewrites carrying a verify matrix are proven equivalent first and skipped if the numbers would move.

Applying the approved subset as one undoable transaction is the Pro gate: apply_plan with more than one item is the atomic bulk primitive, so a single undo reverts the whole batch. Working the plan one item at a time stays free, and it is still fully reviewable, verified and dual-drive; nothing about review, diff or verification is paywalled. The same atomic gate is what makes the one-click bulk operations Pro, among them fix-all for the Best Practice Analyzer, apply-all safe fixes, make-the-model-AI-ready, and build-from-spec.

#Licensing mechanics

A Pro license is an offline, ECDSA P-256 signed token. You paste it into the semanticus.licenseToken setting (or set the SEMANTICUS_LICENSE environment variable, or drop it at ~/.semanticus/license). The engine ships only the public half of the key and verifies the token locally: there is no phone-home, no account, and it works air-gapped. Verification fails closed to the free tier and never throws, so a missing or expired token degrades gracefully rather than breaking your tools.

Consistent with the first principle of the whole tool, the engine holds zero AI credentials and performs no inference or network calls of its own. Your assistant, your account, your data. See the pricing page for plans, renewals and the money-back guarantee.