Task Tracker

§How to use this

Ids run four and five levels deep — M0.2.1 is a subtask, M31.1.1.3 a step within one. Put the id in the commit message and the traceability file so progress is a query rather than a meeting.

Ticks are stored in this browser only, so each person tracks their own view. Use Export to produce a JSON snapshot for the traceability file or to share with the team.

M0Foundation and repository

• M0.1Repository and tooling
  • M0.1.1Private GitHub repo, branch protection, CODEOWNERS on the three core files08 Sept
  • M0.1.2uv project, pyproject, locked dependencies, Python version pin08 Sept
  • M0.1.3Ruff and mypy strict config, pre-commit hooks08 Sept
  • M0.1.4Directory layout: gate, agents, connectors, knowledge, memory, console, ext, tests08 Sept
  • M0.1.5Task runner: dev, test, migrate, seed, lint, invariants08 Sept
• M0.2Core type system
  • M0.2.1Principal model: id, kind, employment, not_after08 Sept
  • M0.2.2Scope model as jsonb predicate, evaluator, conjunction-only composition08 Sept
  • M0.2.3Capability string grammar, registry table, validator08 Sept
  • M0.2.4EntitlementSet type and ent_hash computation, stable and order-independent08 Sept
  • M0.2.5TypedResult envelope: entity tag, id, nested arrays, Pydantic base08 Sept
  • M0.2.6ToolDefinition: name, args schema, result contract, required capability, side effect, identity mode08 Sept
  • M0.2.7Error taxonomy: denied, absent, unresolved, degraded, failed08 Sept
• M0.3Database foundation
  • M0.3.1PostgreSQL 18 with pgvector, pg_trgm, fuzzystrmatch, unaccent08 Sept
  • M0.3.2Alembic setup, naming convention, migration template08 Sept
  • M0.3.3Non-superuser application role with NOBYPASSRLS09 Sept
  • M0.3.4PgBouncer transaction-mode pool for the application09 Sept
  • M0.3.5PgBouncer session-mode pool for the worker, for LISTEN and NOTIFY09 Sept
  • M0.3.6Per-profile settings: shared_buffers, work_mem, autovacuum_work_mem set explicitly09 Sept
  • M0.3.7Schema namespaces: auth, gate, agent, know, mem, obs, proj, er, ops09 Sept
• M0.4Compose and local development
  • M0.4.1docker-compose.lite.yml09 Sept
  • M0.4.2docker-compose.full.yml09 Sept
  • M0.4.3Documented environment example with every variable explained09 Sept
  • M0.4.4Seed command that builds the synthetic company09 Sept
  • M0.4.5Reset command that drops and rebuilds09 Sept
• M0.5CI pipeline
  • M0.5.1Lint, format, type check09 Sept
  • M0.5.2Unit tests with a coverage floor09 Sept
  • M0.5.3Migration forward and rollback against production-shaped data09 Sept
  • M0.5.4Schema sweep: row-level security on every entity table09 Sept
  • M0.5.5Schema sweep: no foreign key from any grant table to connector10 Sept
  • M0.5.6Registry sweep: tool naming grammar10 Sept
  • M0.5.7Dependency audit: licence allowlist, last-release age, archived check10 Sept
  • M0.5.8Traceability check: nothing proven without a test id10 Sept
• M0.6Test fixtures
  • M0.6.1Synthetic company: four departments, twelve users, one contractor with expiry, one partner, one dual-department user, one mid-transfer user10 Sept
  • M0.6.2Entitlement spread including see-record-not-money and see-neither personas10 Sept
  • M0.6.3Canary records with improbable strings in restricted fields on every entity type10 Sept
  • M0.6.4Golden questions: twenty questions across three personas with known answers10 Sept
  • M0.6.5Connector cassettes with recorded responses per source system10 Sept
  • M0.6.6Adversarial corpus: injection attempts in documents and tool results10 Sept
  • M0.6.7Factory helpers for principals, scopes and grants10 Sept

M1Identity, users, roles, permissions

• M1.1Keycloak integration
  • M1.1.1Realm setup script and exported realm config in the repo15 Sept
  • M1.1.2OIDC login, token validation, JWKS caching15 Sept
  • M1.1.3Claim mapping from subject to principal15 Sept
  • M1.1.4SAML federation for a client identity provider15 Sept
  • M1.1.5Group and role sync from the IdP15 Sept
  • M1.1.6Session handling, refresh, logout propagation15 Sept
  • M1.1.7Service-account authentication for API callers15 Sept
• M1.2Principal model
  • M1.2.1principal table: id, kind, employment, not_after, disabled_at15 Sept
  • M1.2.2principal_identity mapping channel identities to a principal15 Sept
  • M1.2.3Disable and re-enable with cascade to sessions15 Sept
  • M1.2.4Partner principal with zero standing entitlement15 Sept
  • M1.2.5Break-glass session: time-boxed, separately audited, notifies15 Sept
• M1.3Role model
  • M1.3.1Six roles as a compiled constant, not editable rows15 Sept
  • M1.3.2role_grant with scope required for dept_admin and approver15 Sept
  • M1.3.3Deputy flag, thirty-day maximum, depth-one enforcement16 Sept
  • M1.3.4Super Admin floor of two, refuse to revoke the last16 Sept
  • M1.3.5Constraint: a role may never be the subject of a capability grant16 Sept
• M1.4Entitlement system
  • M1.4.1capability_grant: principal, capability, scope, granted_by, reason, not_after16 Sept
  • M1.4.2Revocation as deletion of the grant, never a negative grant; additive-only invariant16 Sept
  • M1.4.3capability_pack: named bundles with scope-bound assignment16 Sept
  • M1.4.4Resolver as one SQL function called by both application and trigger16 Sept
  • M1.4.5Valkey cache keyed on principal and grants_version, sixty-second TTL16 Sept
  • M1.4.6grants_version bump on any write with immediate invalidation16 Sept
  • M1.4.7policy_epoch increment on every entitlement mutation16 Sept
  • M1.4.8Audit row on every grant, revocation and pack assignment16 Sept
• M1.5Teams
  • M1.5.1team table within a department16 Sept
  • M1.5.2Team membership, and scope predicates that may reference a team16 Sept
  • M1.5.3Team as a grant subject alongside the individual16 Sept

M2Departments and scopes

• M2.1Scope engine
  • M2.1.1scope table: slug, predicate jsonb, department flag15 Sept
  • M2.1.2Predicate evaluator compiling to a SQL where clause15 Sept
  • M2.1.3Conjunction-only grammar validator so a scope can never widen15 Sept
  • M2.1.4Scope composition for multi-scope principals15 Sept
  • M2.1.5CI check: no agent slug or tool object collides with a scope slug15 Sept
• M2.2Department structure
  • M2.2.1department table under company15 Sept
  • M2.2.2Department admin assignment with scope not null15 Sept
  • M2.2.3Department creation wizard with starter scopes15 Sept
  • M2.2.4Cross-department behaviour: intersect, state the gap, offer request-access15 Sept

M3The gate

• M3.1Pipeline skeleton
  • M3.1.1GateContext carrying trace id, principal, entitlements, hash, lane, channel, traffic class15 Sept
  • M3.1.2Ordered middleware chain with explicit step boundaries15 Sept
  • M3.1.3Recorder constructed at ingress before identify15 Sept
  • M3.1.4Traffic class as a union with no default, so a new channel cannot compile without declaring it15 Sept
• M3.2Arrive and identify
  • M3.2.1Channel ingress normalisation to one internal event shape15 Sept
  • M3.2.2Dedupe by unique index on channel and external id15 Sept
  • M3.2.3Channel identity to principal resolution15 Sept
  • M3.2.4Unrecognised identity path with no entitlement and a prompt to bind15 Sept
• M3.3Entitle and intersect
  • M3.3.1Resolve entitlements from cache or database15 Sept
  • M3.3.2Compute the entitlement hash15 Sept
  • M3.3.3Channel capability intersection15 Sept
  • M3.3.4Assurance-level intersection15 Sept
• M3.4Screen
  • M3.4.1Injection classifier over user input15 Sept
  • M3.4.2Risk score written to the request row15 Sept
  • M3.4.3Explicit no-block guarantee, tested16 Sept
  • M3.4.4Autonomy tier escalation on a high score16 Sept
• M3.5Cache
  • M3.5.1Key from question, entitlement hash, agent config hash, policy epoch, source epochs16 Sept
  • M3.5.2Lookup and store paths16 Sept
  • M3.5.3Hit surfaced to the user with its age16 Sept
  • M3.5.4Never-cache list for volatile question shapes16 Sept
• M3.6Route and select agent
  • M3.6.1Lane classifier from features computable without a model16 Sept
  • M3.6.2Agent selection: channel binding, then rules, then cheap classifier16 Sept
  • M3.6.3Routing decision written to the row, never inferred afterwards16 Sept
• M3.7Catalogue projection
  • M3.7.1Project tools as agent grants intersected with entitlements16 Sept
  • M3.7.2Static tool prefix with deferred loading so the provider cache is shared16 Sept
  • M3.7.3Assert projection happens in our dispatcher, never delegated to a connector16 Sept
  • M3.7.4Empty-catalogue error when a manifest declared required tools and none resolve16 Sept
• M3.8Loop and leash
  • M3.8.1Agent loop invocation with the projected catalogue16 Sept
  • M3.8.2Leash lookup for agent, target and scope17 Sept
  • M3.8.3Shadow: simulate, record, return marked as simulated17 Sept
  • M3.8.4Assisted: render artefact, suspend, await approval, resume17 Sept
  • M3.8.5Autonomous: proceed17 Sept
  • M3.8.6Three checks per call: capability, rung, mask17 Sept
• M3.9Redact, trace, answer
  • M3.9.1Invoke the redaction walker17 Sept
  • M3.9.2Emit post-redaction payload to the trace sink only17 Sept
  • M3.9.3Compose the answer with citations and freshness17 Sept
  • M3.9.4Attach the trace reference for explainability17 Sept

M4Redaction and data protection

• M4.1The walker
  • M4.1.1Recursive depth-first walk over the typed result15 Sept
  • M4.1.2Mask computation from the field policy15 Sept
  • M4.1.3Delete keys outside the mask at any nesting depth15 Sept
  • M4.1.4Drop and log objects lacking an entity tag, failing closed15 Sept
  • M4.1.5Handle arrays, nested entities and mixed shapes15 Sept
  • M4.1.6Opaque escape hatch requiring its own capability, flagging the trace and labelling the answer15 Sept
• M4.2Field policy
  • M4.2.1field_policy: entity type, field, required capability, classification15 Sept
  • M4.2.2Default-deny for unclassified fields15 Sept
  • M4.2.3Simulate mode logging what would be withheld15 Sept
  • M4.2.4Policy epoch bump on any field policy change15 Sept
  • M4.2.5Count fields declared against the collection they count, and withheld when it is filtered15 Sept
• M4.3User-facing presentation
  • M4.3.1Structural lock rendering, identical for every viewer15 Sept
  • M4.3.2Never emit a count of hidden items15 Sept
  • M4.3.3Permission-denied indistinguishable from nothing-found at record level15 Sept
  • M4.3.4Request-access route where the owner sees the question and the asker learns nothing16 Sept
• M4.4Serialization safety
  • M4.4.1Authorization-aware serializer as the only path to a channel16 Sept
  • M4.4.2Structural prevention of returning an untyped shape from a tool16 Sept
  • M4.4.3Property-based tests over nested shapes16 Sept
  • M4.4.4Redaction counts and field names recorded, values never16 Sept

M5Models, routing, fallback matrix

• M5.1Provider layer
  • M5.1.1LiteLLM SDK integration as a driver only, never as a proxy15 Sept
  • M5.1.2Provider credentials in OpenBao15 Sept
  • M5.1.3Per-provider client with timeout and retry overrides per lane15 Sept
  • M5.1.4A separate Router instance per pool, since tag filtering is inoperative in SDK mode15 Sept
• M5.2Tier classification
  • M5.2.1Deterministic classifier over tool count, context estimate, lane, explicit request, residency touch15 Sept
  • M5.2.2routing_tier with a jsonb rule set15 Sept
  • M5.2.3Test asserting no model call occurs in classification15 Sept
• M5.3The matrix
  • M5.3.1routing_rung: tier, scope, position, role, deployment, attempts, timeout, concurrency15 Sept
  • M5.3.2Role label derived by trigger rather than typed15 Sept
  • M5.3.3Console editor for the matrix15 Sept
  • M5.3.4One attempt row per try, so the executed chain reconstructs from a join15 Sept
• M5.4Fallback and breaker
  • M5.4.1Closed trigger set for fallback15 Sept
  • M5.4.2Explicit rejection of quality-based fallback15 Sept
  • M5.4.3provider_health with live and probe ring buffers15 Sept
  • M5.4.4Open on three consecutive live failures, ratio above half, or two probe failures with no recent live evidence16 Sept
  • M5.4.5Cooldown with exponential backoff and jitter16 Sept
  • M5.4.6Half-open single-request admission via claim and return16 Sept
  • M5.4.7Background prober on a sixty-second interval16 Sept
  • M5.4.8Alert on chain depth rather than final failure16 Sept
• M5.5Residency
  • M5.5.1Residency constraint attached to scope16 Sept
  • M5.5.2Chain skips non-compliant rungs rather than degrading silently16 Sept
  • M5.5.3Provider residency registry with documented storage location16 Sept
  • M5.5.4Refusal path when no compliant rung exists16 Sept

M6Speed: fast lane, cache, streaming

• M6.1Fast lane
  • M6.1.1Fast-path rules as data rows, not code24 Sept
  • M6.1.2Rule matcher over question shape and entity type24 Sept
  • M6.1.3Database grants restricting the fast lane to projected tables only24 Sept
  • M6.1.4Empty tool catalogue for the fast lane, enforced structurally24 Sept
  • M6.1.5Zero-network test with egress blocked24 Sept
  • M6.1.6Share measurement excluding machine traffic24 Sept
• M6.2Caching layers
  • M6.2.1Answer cache keyed on entitlement hash and epochs24 Sept
  • M6.2.2Plan cache storing tool ids only, filtered through projection at execution24 Sept
  • M6.2.3Retrieval cache with scope in the key24 Sept
  • M6.2.4Embedding cache keyed on content hash24 Sept
  • M6.2.5Projection freshness cache24 Sept
  • M6.2.6Explicit prohibition and test: no semantic answer caching24 Sept
• M6.3Streaming and perception
  • M6.3.1Server-sent events for the answer lane24 Sept
  • M6.3.2Named progress steps in user language at tool-input-start24 Sept
  • M6.3.3Step labels scrubbed of scope-revealing detail25 Sept
  • M6.3.4Citations streamed before prose25 Sept
  • M6.3.5Reasoning never streamed to consumers25 Sept
  • M6.3.6Cache hits shown as instant with the reason25 Sept
• M6.4Prompt efficiency
  • M6.4.1Static tool prefix ordering for provider cache sharing25 Sept
  • M6.4.2Prompt caching structure with the stable prefix first25 Sept
  • M6.4.3Output-length instruction separate from effort setting25 Sept
  • M6.4.4Per-lane effort pinning to avoid cache invalidation25 Sept

M7Knowledge, assets, document parsing

• M7.1Asset ingestion
  • M7.1.1Upload endpoint with size and type limits21 Sept
  • M7.1.2Extract-from-link ingestion21 Sept
  • M7.1.3Virus and content scanning before parse21 Sept
  • M7.1.4Original storage in the object store with lifecycle policy21 Sept
  • M7.1.5Ingestion queue with backpressure21 Sept
• M7.2Parsing
  • M7.2.1Docling integration for layout-aware extraction21 Sept
  • M7.2.2Table extraction preserved through chunking21 Sept
  • M7.2.3Tika fallback for unsupported formats21 Sept
  • M7.2.4OCR path for scanned documents21 Sept
  • M7.2.5Parse failure handling with a visible error naming the cause21 Sept
  • M7.2.6Memory-bounded parse worker with a hard container limit21 Sept
• M7.3Chunking and embedding
  • M7.3.1Chunking strategy with overlap and size bounds21 Sept
  • M7.3.2Chunk metadata carrying document, scope, owner and position21 Sept
  • M7.3.3Local embedding via Qwen3 through the inference server21 Sept
  • M7.3.4Batch embedding with a queue22 Sept
  • M7.3.5Re-embedding on model change with a rebuild command22 Sept
• M7.4Knowledge model
  • M7.4.1knowledge table: content, scope, owner, verified_by, verified_at, review_by, state22 Sept
  • M7.4.2Company, department and personal visibility levels22 Sept
  • M7.4.3Publishing flow: uploading never widens scope22 Sept
  • M7.4.4Promotion to company scope requires the gated path22 Sept
  • M7.4.5Supersession: a newer version marks the older superseded22 Sept
  • M7.4.6Scheduled job opening re-verification tasks from review_by22 Sept
  • M7.4.7Verification badge surfaced in the answer22 Sept
• M7.5Field-level classification within documents
  • M7.5.1Column classification for tabular knowledge such as price lists22 Sept
  • M7.5.2Sell price visible while cost and margin are restricted22 Sept
  • M7.5.3Classification editor in the console22 Sept

M8Provenance, abstention, escalation

• M8.1Citations
  • M8.1.1Row citations naming record and field with read time21 Sept
  • M8.1.2Document citations deep-linking to the passage21 Sept
  • M8.1.3Freshness and staleness state on every citation21 Sept
  • M8.1.4Citation assembled from the tool trace, never from the model21 Sept
• M8.2Abstention
  • M8.2.1Four distinct states: nothing retrieved, retrieved but not answering, nothing connected, not entitled21 Sept
  • M8.2.2Scope statement naming what was searched21 Sept
  • M8.2.3Not-entitled path indistinguishable from nothing-found21 Sept
  • M8.2.4Refusal when no citation exists, configurable per agent21 Sept
• M8.3Escalation
  • M8.3.1Escalation as an authored step in a skill, not a model judgement21 Sept
  • M8.3.2Handoff payload: who asked, what, what was tried, what is needed21 Sept
  • M8.3.3Delivery into the approver's own channel21 Sept
  • M8.3.4Timeout and expiry behaviour on every escalation21 Sept
  • M8.3.5Takeover signal fed to the circuit breaker21 Sept

M9Chat and conversation

• M9.1Conversation model
  • M9.1.1conversation and message tables with scope and principal21 Sept
  • M9.1.2Thread continuity across channels21 Sept
  • M9.1.3Conversation search restricted to the asker21 Sept
  • M9.1.4Export of a single conversation21 Sept
• M9.2Answer composition
  • M9.2.1Answer assembly from typed results21 Sept
  • M9.2.2Locked-field rendering21 Sept
  • M9.2.3Follow-up handling with retained context21 Sept
  • M9.2.4Correction handling that feeds the learning signal21 Sept

M10Channels

• M10.1Adapter contract
  • M10.1.1Channel adapter interface with normalise, send, capabilities21 Sept
  • M10.1.2Capability declaration per channel: ephemeral, cards, streaming, attachments21 Sept
  • M10.1.3Per-channel sensitivity policy: which classes may be carried21 Sept
  • M10.1.4Registration and health check per adapter21 Sept
  • M10.1.5An adapter must render a payload label or refuse to send, so the opaque escape hatch cannot lose its warning21 Sept
• M10.2Lark
  • M10.2.1Webhook receipt and signature verification21 Sept
  • M10.2.2Message and mention handling21 Sept
  • M10.2.3Interactive cards for approvals21 Sept
  • M10.2.4Card patching within the rate limit, with a text fallback21 Sept
  • M10.2.5Ephemeral messages for per-viewer bodies21 Sept
  • M10.2.6Group and direct-message handling21 Sept
• M10.3Identity binding
  • M10.3.1Outward-only binding: nonce minted in an authenticated web session21 Sept
  • M10.3.2Binding expiry and single use21 Sept
  • M10.3.3Unbound identity behaviour21 Sept
  • M10.3.4Unbinding and rebinding on device change22 Sept
• M10.4Group-chat safety
  • M10.4.1Room envelope computed at the floor of everyone present22 Sept
  • M10.4.2Per-viewer body via the channel's ephemeral mechanism22 Sept
  • M10.4.3Degradation ladder ending at a web link where the gate re-runs22 Sept
  • M10.4.4Room membership change invalidating a pending render22 Sept
  • M10.4.5Async delivery re-running entitlement at send time22 Sept
• M10.5Further channels
  • M10.5.1Slack adapter22 Sept
  • M10.5.2Microsoft Teams adapter22 Sept
  • M10.5.3WhatsApp adapter with template and session-window handling22 Sept
  • M10.5.4Telegram adapter22 Sept
  • M10.5.5Web widget with session minting and abuse guard22 Sept
  • M10.5.6Email adapter, inbound and outbound22 Sept
  • M10.5.7REST API with key management22 Sept

M11Connectors, federation, projection

• M11.1Connector framework
  • M11.1.1Connector interface: capabilities, tools, health, credential binding21 Sept
  • M11.1.2MCP transport adapter21 Sept
  • M11.1.3REST and OpenAPI transport adapter driven by a spec plus field mapping21 Sept
  • M11.1.4Database transport adapter restricted to allowlisted read-only views21 Sept
  • M11.1.5Custom code transport adapter running sandboxed21 Sept
  • M11.1.6Connector registration, enable, disable, upgrade21 Sept
  • M11.1.7Manifest hash pinning so a silent redefinition fails closed on reconnect21 Sept
• M11.2Credentials
  • M11.2.1Credential reference model, never a value in configuration21 Sept
  • M11.2.2OpenBao storage with per-run leases21 Sept
  • M11.2.3Scope-at-connect: one folder or one pipeline rather than everything21 Sept
  • M11.2.4Read-only by default with write as a separate deliberate grant21 Sept
  • M11.2.5Identity mode per tool: requester credentials by default, service credentials declared21 Sept
  • M11.2.6Rotation without redeploy21 Sept
• M11.3Rate limiting
  • M11.3.1Per-connector token bucket21 Sept
  • M11.3.2Circuit breaker per connector22 Sept
  • M11.3.3Retry policy with backoff and jitter22 Sept
  • M11.3.4Metrics: requests per second and minute, concurrency, 429 rate, latency, error rate22 Sept
  • M11.3.5Configured ceilings per source, matching documented limits22 Sept
• M11.4Projection
  • M11.4.1proj.record table with source, entity type, identifiers and hot fields22 Sept
  • M11.4.2Twelve-field cap per entity kind enforced by the manifest validator22 Sept
  • M11.4.3Five-clause projectability test enforced at manifest review22 Sept
  • M11.4.4PII deny-list blocking email, phone, address, identity numbers, bank and salary22 Sept
  • M11.4.5Visibility predicate stored, never a resolved ACL22 Sept
  • M11.4.6Change-signal subscription: webhook, CDC or updated-since cursor22 Sept
  • M11.4.7No change signal means no projected fields, enforced22 Sept
  • M11.4.8Backfill job with rate-limit awareness22 Sept
  • M11.4.9Staleness surfaced in the answer22 Sept
• M11.5Federation
  • M11.5.1Live fetch path with an eight-hundred-millisecond timeout22 Sept
  • M11.5.2Parallel fan-out across independent sources with one critical path23 Sept
  • M11.5.3Global and per-source call budgets23 Sept
  • M11.5.4Thundering-herd protection on cache miss23 Sept
  • M11.5.5Graceful degradation naming what could not be fetched23 Sept
• M11.6First connectors
  • M11.6.1Laravel MySQL via read-only views23 Sept
  • M11.6.2Freshdesk23 Sept
  • M11.6.3Lark Base23 Sept
  • M11.6.4Lark Wiki23 Sept
  • M11.6.5Xero23 Sept
  • M11.6.6HubSpot23 Sept
  • M11.6.7Google Drive or Microsoft 36523 Sept

M12Tools, skills, capability registry

• M12.1Tool registry
  • M12.1.1tool_definition table with the closed naming grammar21 Sept
  • M12.1.2Required capability per tool21 Sept
  • M12.1.3Side-effect classification driving default leash21 Sept
  • M12.1.4Result contract declaration: typed or opaque21 Sept
  • M12.1.5Registration validation at startup21 Sept
  • M12.1.6Registry sweep in CI21 Sept
• M12.2Skills
  • M12.2.1SKILL.md folder format parser with frontmatter validation21 Sept
  • M12.2.2Import from GitHub with a pinned commit21 Sept
  • M12.2.3Import from URL21 Sept
  • M12.2.4Import from uploaded archive with path-traversal validation21 Sept
  • M12.2.5Imported state that is not executable until reviewed21 Sept
  • M12.2.6Review queue with diff view21 Sept
  • M12.2.7Version locking per agent21 Sept
  • M12.2.8Progressive disclosure: names and descriptions first, body on demand21 Sept
  • M12.2.9run_skill_script as the single execution tool, sandboxed and leashed22 Sept
  • M12.2.10SOP import accepting messy Word and Confluence documents22 Sept

M13Agents and templates

• M13.1Agent model
  • M13.1.1agent table: persona, scope, model tier, visibility level24 Sept
  • M13.1.2Global, department and personal visibility24 Sept
  • M13.1.3Audience separated from authority, asserted by test24 Sept
  • M13.1.4Agent enable, disable and archive24 Sept
  • M13.1.5Ownership transfer when a creator leaves24 Sept
• M13.2Template model
  • M13.2.1Signed, versioned, immutable manifest24 Sept
  • M13.2.2Manifest schema with identity, persona, skills, tools, connectors, scope, tier, leash, golden set, placeholders24 Sept
  • M13.2.3Instance as a pinned reference plus an overlay24 Sept
  • M13.2.4Per-path field ownership tracking who last set each field24 Sept
  • M13.2.5Materialised effective document with a hash feeding the cache key24 Sept
  • M13.2.6Five sealed paths enforced by a check constraint24 Sept
  • M13.2.7Blank template so a hand-built agent uses one code path24 Sept
• M13.3Install
  • M13.3.1Six-step wizard generated from the manifest JSON Schema24 Sept
  • M13.3.2Connector binding step with readiness indicators24 Sept
  • M13.3.3Placeholder collection: SOP, price list, escalation contact25 Sept
  • M13.3.4Golden-set run as the installing principal25 Sept
  • M13.3.5Golden-set run as a low-privilege fixture user25 Sept
  • M13.3.6Incomplete state with an amber badge listing what is missing25 Sept
  • M13.3.7Pin to Shadow when required connectors are absent25 Sept
• M13.4Versioning and upgrade
  • M13.4.1Publishing a new version changes nothing observable25 Sept
  • M13.4.2Upgrade badge on the instance25 Sept
  • M13.4.3Three-column diff of conflicting paths only25 Sept
  • M13.4.4Opt-in accept with per-path resolution25 Sept
  • M13.4.5Decline forever without nagging25 Sept
• M13.5Template catalogue
  • M13.5.1Business Analyst25 Sept
  • M13.5.2Pre-Sales25 Sept
  • M13.5.3Project Manager25 Sept
  • M13.5.4UI Designer25 Sept
  • M13.5.5UX Designer28 Sept
  • M13.5.6HTML Developer28 Sept
  • M13.5.7WordPress Developer28 Sept
  • M13.5.8Laravel Developer28 Sept
  • M13.5.9Shopify Developer28 Sept
  • M13.5.10Content Uploader28 Sept
  • M13.5.11Tester28 Sept
  • M13.5.12Internal Helpdesk28 Sept
  • M13.5.13Site Health Sentinel28 Sept
  • M13.5.14Support Ticket Agent28 Sept
  • M13.5.15Project Status Reporter28 Sept
  • M13.5.16Capacity and Hours Analyst28 Sept
  • M13.5.17Quote and Proposal Drafter28 Sept
  • M13.5.18AR and Renewal Chaser, Shadow-pinned thirty days28 Sept
  • M13.5.19Accountant Agent, Shadow-pinned29 Sept
  • M13.5.20SEO Agent29 Sept
  • M13.5.21SEM Agent, Shadow-pinned, human commits budget changes29 Sept
  • M13.5.22SMM Agent29 Sept
  • M13.5.23Knowledge Gap Curator29 Sept
• M13.6Client-authored templates
  • M13.6.1Save any agent as a private template29 Sept
  • M13.6.2Literal extraction and parameter hoisting29 Sept
  • M13.6.3Leak report with accept or redact on every unclassified literal29 Sept
  • M13.6.4Publish blocked until every item is dispositioned29 Sept
  • M13.6.5Memory never exported under any setting29 Sept
  • M13.6.6Visibility: private, organisation, catalogue29 Sept

M14Entity resolution

• M14.1Canonical model
  • M14.1.1er.canonical: canonical entity with type and created provenance24 Sept
  • M14.1.2er.alias: every observed name form with source and first-seen24 Sept
  • M14.1.3er.identifier: hashed join keys by type with source24 Sept
  • M14.1.4er.link: source record to canonical mapping with confidence24 Sept
  • M14.1.5merged_into forwarding pointer so an issued id resolves forever24 Sept
  • M14.1.6Resolved alias view giving the current surviving entity24 Sept
• M14.2Normalisation
  • M14.2.1Case folding and whitespace collapse24 Sept
  • M14.2.2Punctuation stripping24 Sept
  • M14.2.3Suffix stripping: Pte Ltd, Pte, Sdn Bhd, Inc, LLC, Limited, Ltd, Co24 Sept
  • M14.2.4Accent folding via an immutable wrapper so it can be indexed24 Sept
  • M14.2.5Minimum length guard: under four characters routes straight to review24 Sept
  • M14.2.6Singapore UEN format validation24 Sept
• M14.3Match cascade
  • M14.3.1Stage one: hard identifiers including UEN, tax id, verified domain, verified phone24 Sept
  • M14.3.2Stage two: normalised name requiring corroboration from a second field24 Sept
  • M14.3.3Stage three: trigram similarity with an upper and lower threshold25 Sept
  • M14.3.4Stage four: human review for the band between thresholds25 Sept
  • M14.3.5Weight table exported from offline calibration25 Sept
  • M14.3.6Additive scoring evaluated in plain SQL for millisecond online cost25 Sept
  • M14.3.7Free-mail domain blocklist rather than low weighting25 Sept
  • M14.3.8Daitch-Mokotoff rather than Soundex, weighted low, for non-English names25 Sept
• M14.4Calibration
  • M14.4.1Splink offline job against a DuckDB export25 Sept
  • M14.4.2Expectation-maximisation training of match and unmatch probabilities25 Sept
  • M14.4.3Weight export to the online table25 Sept
  • M14.4.4Weekly schedule with a review of drift25 Sept
  • M14.4.5No Python ML dependency in the request path, asserted25 Sept
• M14.5Merge and unmerge
  • M14.5.1Pre-image capture of every affected link, alias and identifier before any change25 Sept
  • M14.5.2Merge as a pointer move, never a source-record change25 Sept
  • M14.5.3Unmerge restoring from the pre-image25 Sept
  • M14.5.4Full audit of who merged, when, on what evidence28 Sept
  • M14.5.5Cache, memory and projection invalidation on merge28 Sept
  • M14.5.6Money-boundary rule: never auto-merge entities carrying financial records28 Sept
• M14.6Guardrails
  • M14.6.1Blocked values table for known junk and shared mailboxes28 Sept
  • M14.6.2Per-identifier caps on distinct values per entity28 Sept
  • M14.6.3Identifier priority order for collisions28 Sept
  • M14.6.4Review queue UI with weighted evidence shown in plain language28 Sept
  • M14.6.5Unresolved behaviour: state the ambiguity, never guess, offer the review link28 Sept
• M14.7People and projects
  • M14.7.1The same cascade applied to people across HubSpot, Freshdesk and Lark28 Sept
  • M14.7.2The same cascade applied to projects28 Sept
  • M14.7.3Privacy: hashed join keys only, never full contact records28 Sept

M15Knowledge retrieval and RAG

• M15.1Row plane
  • M15.1.1Typed tool per entity with a parameterised query21 Sept
  • M15.1.2Column projection compiled from capabilities before the query runs21 Sept
  • M15.1.3Assertion that no model ever writes SQL21 Sept
  • M15.1.4Query plan test proving the scope predicate is inside the query21 Sept
• M15.2Document plane
  • M15.2.1Postgres full-text index with tsvector and weighting21 Sept
  • M15.2.2pgvector column and index strategy21 Sept
  • M15.2.3Iterative scan enabled, or a per-scope partial index instead21 Sept
  • M15.2.4Test proving a narrow-scope user gets results rather than a near-empty set21 Sept
  • M15.2.5Hybrid fusion by reciprocal rank21 Sept
  • M15.2.6Scope filter inside the query, never applied afterwards21 Sept
  • M15.2.7Row-level security as the second wall21 Sept
• M15.3Retrieval quality
  • M15.3.1Reranking evaluated and adopted only if it earns its latency21 Sept
  • M15.3.2Chunk-level and document-level result assembly21 Sept
  • M15.3.3Deduplication across planes21 Sept
  • M15.3.4Retrieval logging for the learning signal22 Sept

M16Memory and learning

• M16.1Memory stores
  • M16.1.1Session memory in Valkey with thread lifetime24 Sept
  • M16.1.2Persistent memory table with scope and capability tags24 Sept
  • M16.1.3Adaptive memory table with confidence and decay24 Sept
  • M16.1.4Capability set recorded at formation and re-checked at read24 Sept
  • M16.1.5Never authoritative over the database, asserted by test24 Sept
• M16.2Signal capture
  • M16.2.1Question re-asked in different words within a window24 Sept
  • M16.2.2Answer copied24 Sept
  • M16.2.3Contradicting follow-up24 Sept
  • M16.2.4Escalation to a human24 Sept
  • M16.2.5Human takeover of an Assisted action24 Sept
  • M16.2.6Ticket reopened within a window24 Sept
  • M16.2.7Approval rejected with a reason24 Sept
  • M16.2.8All signals logged from the first migration24 Sept
• M16.3Learning tiers
  • M16.3.1Tier zero: session, silent24 Sept
  • M16.3.2Tier one automatic: preferences, retrieval boosts and demotions, corroborated entity links, all negative signals25 Sept
  • M16.3.3Tier two shadow-then-promote: fast-path rules and procedural shortcuts25 Sept
  • M16.3.4Tier two agreement threshold and promotion job25 Sept
  • M16.3.5Tier three gated: scope widening, company knowledge, leash increase, money-boundary merge, capability addition25 Sept
  • M16.3.6Blast-radius classifier deciding the tier automatically25 Sept
• M16.4Decay and correction
  • M16.4.1Time decay reducing confidence below the retrieval threshold25 Sept
  • M16.4.2Supersession on contradiction, marked rather than deleted25 Sept
  • M16.4.3Source truth wins immediately, memory demoted and flagged25 Sept
  • M16.4.4Entitlement expiry: memories stop matching when capabilities change25 Sept
• M16.5Human surfaces
  • M16.5.1Weekly digest of tier one and two learning with one-click undo25 Sept
  • M16.5.2Per-agent memory tab listing what was learned, the evidence, the confidence and a delete control25 Sept
  • M16.5.3Department admin view of department memory25 Sept
  • M16.5.4Tier three review queue with a budget alarm when it grows25 Sept

M17Automation and the task lane

• M17.1Job model
  • M17.1.1Job table with state machine, attempts, and scheduling30 Sept
  • M17.1.2Procrastinate integration on Postgres30 Sept
  • M17.1.3Worker pool with per-class concurrency30 Sept
  • M17.1.4Cancellation and timeout30 Sept
  • M17.1.5Dead-letter handling with an operator surface30 Sept
• M17.2Durable execution
  • M17.2.1LangGraph checkpointer on Postgres30 Sept
  • M17.2.2Our own re-drive driver for crash recovery30 Sept
  • M17.2.3Checkpoint at every side-effect boundary30 Sept
  • M17.2.4Resume after restart with state intact30 Sept
  • M17.2.5Entitlement re-check at every resume point30 Sept
• M17.3Idempotency
  • M17.3.1Idempotency key on every side-effecting operation30 Sept
  • M17.3.2Operation state machine: pending, sent, unknown, verifying, succeeded, failed30 Sept
  • M17.3.3Verification read-back per connector30 Sept
  • M17.3.4Connectors without read-back restricted to read-only, declared in the manifest30 Sept
  • M17.3.5Kill-after-side-effect test proving exactly-once01 Oct
• M17.4Automations
  • M17.4.1Trigger types: schedule, connector event, webhook01 Oct
  • M17.4.2Named outcome templates rather than a blank canvas01 Oct
  • M17.4.3Automation principal resolving the owner's live entitlements at each run01 Oct
  • M17.4.4Suspension when the owner loses a required entitlement01 Oct
  • M17.4.5Timeout and expiry on every approval step01 Oct
  • M17.4.6Run history with cost per run01 Oct
• M17.5Outbound webhooks
  • M17.5.1Postgres outbox with retry and backoff01 Oct
  • M17.5.2Signing and delivery guarantees01 Oct
  • M17.5.3Subscriber management in the console01 Oct

M18Multi-agent execution

• M18.1Decomposition
  • M18.1.1Planner proposing subtasks and data dependencies30 Sept
  • M18.1.2Subtask contract: objective, output schema, tool hints, scope predicate30 Sept
  • M18.1.3Schema validation on every subtask result, failure rather than merge input30 Sept
  • M18.1.4Prose explicitly disallowed as a subtask contract30 Sept
• M18.2Fan-out gate
  • M18.2.1Dependency graph with cost and coupling weights30 Sept
  • M18.2.2Six arithmetic conditions evaluated before any child starts30 Sept
  • M18.2.3Collapse to a single loop as the default when any condition fails30 Sept
  • M18.2.4Gate inputs and verdict recorded for audit30 Sept
• M18.3Delegation
  • M18.3.1Child grant computed in SQL as parent intersect agent intersect subtask30 Sept
  • M18.3.2Database trigger rejecting any non-subset delegation row30 Sept
  • M18.3.3Orchestrator has no grant verb, asserted30 Sept
  • M18.3.4Depth cap of two and per-run concurrency cap of eight30 Sept
  • M18.3.5Global parallelism budget across all runs30 Sept
• M18.4Merge and report
  • M18.4.1Merge step writing the final answer from validated inputs30 Sept
  • M18.4.2Per-subtask cost and duration surfaced to the user01 Oct
  • M18.4.3Partial-failure handling with a stated gap01 Oct

M19Browser and computer use

• M19.1Runner
  • M19.1.1Ephemeral gVisor container per run05 Oct
  • M19.1.2Playwright for Python with Chromium05 Oct
  • M19.1.3Worker owning the CDP session and snapshot serialisation05 Oct
  • M19.1.4Accessibility-tree snapshots rather than screenshots05 Oct
  • M19.1.5tmpfs-only writable layer, destroyed at run end, never reused05 Oct
  • M19.1.6Per-run network namespace05 Oct
• M19.2Control plane
  • M19.2.1Planner that never reads page content, asserted by test05 Oct
  • M19.2.2Envelope compilation: plan intersected with capabilities and skill ceiling05 Oct
  • M19.2.3Envelope storage and approval record05 Oct
  • M19.2.4Target registry with declared surface maps05 Oct
• M19.3Guard
  • M19.3.1Enforcer with policy compiled at container start and immutable after05 Oct
  • M19.3.2Reference validation against the snapshot just produced05 Oct
  • M19.3.3Origin allowlist check per action05 Oct
  • M19.3.4Write verb and count checks against the envelope05 Oct
  • M19.3.5mitmproxy sidecar as the sole route out06 Oct
  • M19.3.6Second independent check in the control plane on every returned result06 Oct
• M19.4Credentials
  • M19.4.1Placeholder resolution at the tool-execution boundary06 Oct
  • M19.4.2Origin binding so a secret only substitutes on its own domain06 Oct
  • M19.4.3TOTP generation server-side from a stored seed06 Oct
  • M19.4.4Outbound scrubbing from message history06 Oct
  • M19.4.5Vision disabled so a credential cannot be read off a screenshot06 Oct
• M19.5Verification
  • M19.5.1Rubric generated from the goal before seeing the trajectory06 Oct
  • M19.5.2Two-pass scoring: actions only, then with screenshots06 Oct
  • M19.5.3Agent's own success claim ignored06 Oct
  • M19.5.4Tuned for low false-positive rate, accepting false negatives06 Oct
  • M19.5.5Out-of-band read-back from the system of record where possible06 Oct
• M19.6Scheduling and safety
  • M19.6.1Global browser concurrency limit06 Oct
  • M19.6.2Per-domain concurrency limit06 Oct
  • M19.6.3Per-agent limit07 Oct
  • M19.6.4Memory and CPU caps per session07 Oct
  • M19.6.5Global kill switch07 Oct
  • M19.6.6Full session recording with retention policy07 Oct
  • M19.6.7Skill loader refusing a browser skill where an API tool exists, unless exempted with a named approver and expiry07 Oct
• M19.7Read then write
  • M19.7.1Read-only capability shipped first07 Oct
  • M19.7.2Write capability behind envelope approval07 Oct
  • M19.7.3Assisted ceiling on writes unless a per-surface exception is signed07 Oct

M20Verz Studio, the builder

• M20.1Form composer
  • M20.1.1Seven sections: identity, persona, knowledge, skills, tools, leash, tests24 Sept
  • M20.1.2Forms generated from the manifest JSON Schema via react-jsonschema-form24 Sept
  • M20.1.3AI co-author proposing accept or reject diffs24 Sept
  • M20.1.4Draft, save and version handling24 Sept
  • M20.1.5Everything re-derived server-side, so an authored list is intent not authorisation24 Sept
• M20.2Canvases
  • M20.2.1Read-only trace graph over completed runs using React Flow24 Sept
  • M20.2.2Bounded procedure canvas outputting a SKILL.md24 Sept
  • M20.2.3Five node kinds with scope predicates as the only conditional grammar24 Sept
  • M20.2.4No code node, enforced24 Sept
• M20.3Rehearsal
  • M20.3.1Run against the real gate, leash and redactor24 Sept
  • M20.3.2Cassette replay so no real side effect fires24 Sept
  • M20.3.3Per-persona rehearsal showing what each user would see24 Sept
  • M20.3.4Measured cost per run from the rehearsal24 Sept
• M20.4Publish gate
  • M20.4.1System-authored permission canaries that can block24 Sept
  • M20.4.2Author-written tests advisory forever25 Sept
  • M20.4.3Grant-widening demotes to Shadow and requires a second approver25 Sept
  • M20.4.4Instruction edits publish without demotion25 Sept
  • M20.4.5Router collision check25 Sept
  • M20.4.6Publish record with who, when and the diff25 Sept

M21Cost, budgets and metering

• M21.1Budget model
  • M21.1.1Company budget with hard ceiling and alert thresholds30 Sept
  • M21.1.2Department budget as a share, with explicit transfer only30 Sept
  • M21.1.3User daily and monthly allowance with a fair-share cap30 Sept
  • M21.1.4Per-agent per-run and per-day ceilings30 Sept
  • M21.1.5All levels as versioned, audited rows30 Sept
• M21.2Enforcement
  • M21.2.1Pre-flight cost estimate from lane, tier, tool count and retrieval size30 Sept
  • M21.2.2Refusal or degradation before tokens are spent30 Sept
  • M21.2.3Post-hoc accounting against principal, department, agent, model and lane30 Sept
  • M21.2.4Estimator correction from actuals30 Sept
  • M21.2.5Degradation ladder: cheaper tier, no fan-out, queue, refuse30 Sept
  • M21.2.6Message naming which budget was hit and who can raise it30 Sept
• M21.3Reporting
  • M21.3.1Spend by department, user, agent, model and lane30 Sept
  • M21.3.2Machine traffic excluded and labelled30 Sept
  • M21.3.3Cost per answer with the distribution, not only the mean30 Sept
  • M21.3.4Most expensive agents and question shapes01 Oct
  • M21.3.5Budget consumption against pace01 Oct
  • M21.3.6Every refusal and degradation with its cause01 Oct

M22Admission control and capacity

• M22.1Admission controller
  • M22.1.1Global budgets: concurrent model calls, source calls per connector, browser sessions, long-running tasks, document jobs, embedding jobs, tokens per minute21 Sept
  • M22.1.2All budgets as configuration rows21 Sept
  • M22.1.3Priority behaviour under pressure per lane21 Sept
  • M22.1.4Queue with visible position and expected wait21 Sept
  • M22.1.5Shed-load policy naming what was deferred21 Sept
• M22.2Workload isolation
  • M22.2.1Three classes: interactive, background, batch21 Sept
  • M22.2.2Separate connection pools per class21 Sept
  • M22.2.3Per-class resource budgets21 Sept
  • M22.2.4Ingestion throttling so a bulk parse cannot slow the chat21 Sept
• M22.3Capacity model
  • M22.3.1Peak concurrency targets rather than daily volume21 Sept
  • M22.3.2Little's law sizing recorded per profile21 Sept
  • M22.3.3Load test at peak concurrency21 Sept
  • M22.3.4Documented first bottleneck at ten and one hundred times21 Sept

M23Rate limiting and abuse

• M23.1Request limits
  • M23.1.1Per-principal sliding window in Valkey21 Sept
  • M23.1.2Per-channel limits21 Sept
  • M23.1.3Per-agent limits21 Sept
  • M23.1.4Widget session minting with an abuse guard21 Sept
  • M23.1.5Backoff response with a retry hint21 Sept
• M23.2Abuse detection
  • M23.2.1Anomalous volume detection per principal21 Sept
  • M23.2.2Repeated permission-denied pattern alerting21 Sept
  • M23.2.3Automated traffic identification and exclusion from metrics21 Sept

M24Audit, compliance, legal hold

• M24.1Audit log
  • M24.1.1Hash-chained append-only audit table15 Sept
  • M24.1.2Verification job proving the chain is unbroken15 Sept
  • M24.1.3Every grant, deny, leash change, merge, publish and break-glass recorded15 Sept
  • M24.1.4Actor, timestamp, changed field names, reason code; never field values15 Sept
  • M24.1.5Client-visible audit view with filters15 Sept
  • M24.1.6Export in a defensible format15 Sept
• M24.2Compliance surfaces
  • M24.2.1Legal hold flag suspending deletion15 Sept
  • M24.2.2Sensitive-topic interception for HR, grievance and whistleblowing15 Sept
  • M24.2.3Data processing record per connector15 Sept
  • M24.2.4PDPA breach assessment workflow with the correct clock15 Sept

M25Retention, deletion, export, DSAR

• M25.1Retention
  • M25.1.1Retention policy per data class30 Sept
  • M25.1.2Metadata ledger long retention30 Sept
  • M25.1.3Payload store thirty-day expiry30 Sept
  • M25.1.4Trace and recording lifecycle30 Sept
  • M25.1.5Automated enforcement with a report30 Sept
• M25.2Deletion and DSAR
  • M25.2.1Subject access request assembling every store: rows, projections, memory, traces, recordings, backups30 Sept
  • M25.2.2Deletion propagating to cache, index, memory and projection30 Sept
  • M25.2.3Backup deletion policy and its honest limits30 Sept
  • M25.2.4Deletion certificate with what was removed and when30 Sept
• M25.3Export
  • M25.3.1Conversation export per user30 Sept
  • M25.3.2Bulk export for eDiscovery with an audit row and a required reason30 Sept
  • M25.3.3Knowledge export preserving scope metadata30 Sept

M26Joiner, mover, leaver

• M26.1Joiner
  • M26.1.1Provisioning from the identity provider30 Sept
  • M26.1.2Role and starter capability pack assignment30 Sept
  • M26.1.3Department assignment with scope30 Sept
  • M26.1.4Welcome path with three department-scoped starter questions30 Sept
• M26.2Mover
  • M26.2.1Entitlement re-resolution on the next request30 Sept
  • M26.2.2Personal agents following the person30 Sept
  • M26.2.3Delegations re-evaluated and suspended rather than narrowed30 Sept
  • M26.2.4Cached answers unreachable by construction30 Sept
  • M26.2.5Memories tagged with the old capability set no longer replayed30 Sept
  • M26.2.6Knowledge access changing with no reindex30 Sept
  • M26.2.7Test covering every one of the above30 Sept
• M26.3Leaver
  • M26.3.1Immediate disable with session termination30 Sept
  • M26.3.2Owned agents flagged for adoption30 Sept
  • M26.3.3Automations suspended30 Sept
  • M26.3.4Personal knowledge and memory disposition policy01 Oct
  • M26.3.5Audit record retained regardless01 Oct

M27Console, reports, observability

• M27.1Telemetry
  • M27.1.1Trace id minted at ingress before identify24 Sept
  • M27.1.2Metadata ledger with no content, long retention24 Sept
  • M27.1.3Payload store with a separate role and an audit row before every read24 Sept
  • M27.1.4Client-side masking before any span leaves the process24 Sept
  • M27.1.5Per-request fields: principal, agent version, policy epoch, entitlement hash, lane, model, provider, time to first token, tokens in and out, tool count and latency, connector, cache hit, redaction count, fallback count, retry count, status24 Sept
  • M27.1.6Traffic class declared at ingress with no default24 Sept
• M27.2Operate screens
  • M27.2.1Company overview, the landing screen with honest counting24 Sept
  • M27.2.2Live runs24 Sept
  • M27.2.3Model matrix and provider health24 Sept
  • M27.2.4Connector health24 Sept
  • M27.2.5Knowledge coverage and staleness24 Sept
  • M27.2.6Queue and automations24 Sept
• M27.3Govern screens
  • M27.3.1People and grants24 Sept
  • M27.3.2Scopes and departments24 Sept
  • M27.3.3Agents and leash state with promotion and demotion history25 Sept
  • M27.3.4Skills and templates with the review queue25 Sept
  • M27.3.5Knowledge library across every department, with per-item visibility scope25 Sept
  • M27.3.6Learning review across every department, tiers separated and tier one undoable25 Sept
  • M27.3.7Artifacts produced, with provenance and retention25 Sept
  • M27.3.8Memory viewer with change history25 Sept
  • M27.3.9Audit25 Sept
• M27.4Report screens
  • M27.4.1Questions and gaps25 Sept
  • M27.4.2Usage and cost25 Sept
  • M27.4.3Quality and canaries25 Sept
• M27.5Console security
  • M27.5.1Console reads are tool calls with required capabilities25 Sept
  • M27.5.2Console rows entity-tagged so the redactor applies to reports25 Sept
  • M27.5.3Report audience intersected with the caller's scope, never unioned25 Sept
  • M27.5.4Three planes of visibility: existence, configuration, content25 Sept
  • M27.5.5Super Admin self-grant writes a loud audit event and notifies the steward28 Sept

M28Evaluation, canaries, regression

• M28.1Eval harness
  • M28.1.1promptfoo driven through our gate, never against a bare model24 Sept
  • M28.1.2Golden corpus of real questions per persona24 Sept
  • M28.1.3Scoring and threshold configuration24 Sept
  • M28.1.4CI integration blocking merge on regression24 Sept
• M28.2Permission canaries
  • M28.2.1Same question as three synthetic personas, answers diffed24 Sept
  • M28.2.2Canary string absence assertion across trace and payload stores24 Sept
  • M28.2.3Catalogue projection assertion per persona24 Sept
  • M28.2.4Scheduled production canary run with alerting24 Sept
• M28.3Annotation loop
  • M28.3.1Department lead flags a bad answer from the console24 Sept
  • M28.3.2One click converts it into a permanent regression test with mocked tools24 Sept
  • M28.3.3Two-tier quality: automated evaluation on every request, human annotation on a daily sample24 Sept

M29Extension points

• M29.1Interfaces
  • M29.1.1Channel adapter interface30 Sept
  • M29.1.2Connector and tool provider interface30 Sept
  • M29.1.3Skill interface30 Sept
  • M29.1.4Template interface30 Sept
  • M29.1.5Model provider interface30 Sept
  • M29.1.6Retriever interface30 Sept
  • M29.1.7Field classifier interface30 Sept
  • M29.1.8Entity resolver interface30 Sept
  • M29.1.9Verifier interface30 Sept
  • M29.1.10Guard interface30 Sept
  • M29.1.11Storage backend interface30 Sept
  • M29.1.12Notification sink interface30 Sept
  • M29.1.13Identity provider interface30 Sept
  • M29.1.14Approver surface interface30 Sept
  • M29.1.15Export format interface01 Oct
  • M29.1.16Scope pack interface01 Oct
• M29.2Plugin lifecycle
  • M29.2.1Manifest schema: identity, version, required capabilities, config schema, core compatibility range01 Oct
  • M29.2.2Registry tables01 Oct
  • M29.2.3Install, enable, disable, upgrade, rollback01 Oct
  • M29.2.4Drain on upgrade so in-flight work finishes on the old version01 Oct
  • M29.2.5Isolation tier per point: in-process, sidecar, sandbox01 Oct
  • M29.2.6Core contract test: a plugin cannot see an unredacted result it did not produce, and cannot widen entitlements01 Oct

M30Hosting, delivery and recovery

• M30.1Deployment
  • M30.1.1Coolify deployment of the compose stack05 Oct
  • M30.1.2Traefik routing and automatic TLS via Coolify05 Oct
  • M30.1.3Cloudflare Tunnel option for zero inbound ports05 Oct
  • M30.1.4Per-install variables file in a separate private repo05 Oct
  • M30.1.5Secrets minted per install, never copied between clients05 Oct
• M30.2Pipeline
  • M30.2.1GitHub Actions: lint, types, tests, migrations, canaries05 Oct
  • M30.2.2Container image build and signing05 Oct
  • M30.2.3Registry publication05 Oct
  • M30.2.4Pull-based deployment so the server needs no inbound access05 Oct
  • M30.2.5Per-client release pinning05 Oct
  • M30.2.6Migration backward compatibility for one release05 Oct
  • M30.2.7Rollback by re-pinning the previous tag05 Oct
  • M30.2.8Install checklist covering platform project files, temporary CLI state, git remotes and scheduled jobs05 Oct
• M30.3Backup and recovery
  • M30.3.1pgBackRest with continuous WAL archiving, daily incremental, weekly full05 Oct
  • M30.3.2restic for object store and configuration06 Oct
  • M30.3.3Off-host destination, mandatory06 Oct
  • M30.3.4Encryption at rest with a client-held key06 Oct
  • M30.3.5Retention: thirty daily, twelve weekly, twelve monthly06 Oct
  • M30.3.6Weekly automated restore into a scratch container06 Oct
  • M30.3.7Smoke query and permission canary against the restored copy06 Oct
  • M30.3.8Measured RTO recorded from the drill06 Oct
  • M30.3.9Console recovery panel with last backup, last verified restore and a one-click drill06 Oct
  • M30.3.10Alert on backup age exceeding the profile RPO06 Oct
  • M30.3.11Louder alert on a failed verification06 Oct
• M30.4Failure readiness
  • M30.4.1Failure-mode matrix covering every component06 Oct
  • M30.4.2Operation classification: safe to retry, unsafe, retry after verification, needs a human06 Oct
  • M30.4.3Chaos suite: kill Postgres, provider, connector, browser, worker06 Oct
  • M30.4.4Malformed responses and 429 injection06 Oct
  • M30.4.5Disk-full behaviour07 Oct
  • M30.4.6Policy change during an active task07 Oct
  • M30.4.7User disabled during an active task07 Oct
  • M30.4.8Kill after every side-effect boundary with exactly-once verification07 Oct
  • M30.4.9Two-box split rehearsed without application change07 Oct
• M30.5Service levels
  • M30.5.1SLO definitions per lane and per stage07 Oct
  • M30.5.2Measurement wired to the ledger07 Oct
  • M30.5.3Dashboard against target07 Oct
  • M30.5.4RPO and RTO per profile written into the client agreement07 Oct

M31Application scaffold and runtime

• M31.1FastAPI application
  • M31.1.1Application factory and lifespan
    • M31.1.1.1App factory with settings injection08 Sept
    • M31.1.1.2Lifespan startup: database pool, Valkey, OpenBao client, model registry08 Sept
    • M31.1.1.3Lifespan shutdown with graceful drain08 Sept
    • M31.1.1.4Health endpoint separating liveness from readiness08 Sept
    • M31.1.1.5Readiness gated on database, cache and secret store all reachable08 Sept
  • M31.1.2Uvicorn and process model
    • M31.1.2.1Uvicorn worker configuration per profile08 Sept
    • M31.1.2.2Graceful shutdown honouring in-flight requests08 Sept
    • M31.1.2.3Signal handling for container stop08 Sept
    • M31.1.2.4Request timeout middleware distinct from the model timeout08 Sept
  • M31.1.3Middleware chain
    • M31.1.3.1Correlation id assignment before anything else08 Sept
    • M31.1.3.2Structured logging with the trace id on every line08 Sept
    • M31.1.3.3Exception handler mapping the error taxonomy to responses08 Sept
    • M31.1.3.4CORS policy for the console and widget only08 Sept
    • M31.1.3.5Security headers08 Sept
  • M31.1.4API surface
    • M31.1.4.1Versioned route prefix and deprecation policy09 Sept
    • M31.1.4.2OpenAPI generation with auth documented09 Sept
    • M31.1.4.3Error response schema shared across every endpoint09 Sept
    • M31.1.4.4Pagination convention applied uniformly09 Sept
• M31.2SQLAlchemy and Alembic
  • M31.2.1Model layer
    • M31.2.1.1Declarative base with naming convention09 Sept
    • M31.2.1.2Session management per request and per job09 Sept
    • M31.2.1.3Async engine configuration against PgBouncer transaction mode09 Sept
    • M31.2.1.4Separate session-mode engine for the worker09 Sept
    • M31.2.1.5Model mixins: timestamps, soft delete, audit fields09 Sept
  • M31.2.2Migration discipline
    • M31.2.2.1Alembic environment reading settings, not hardcoded URLs09 Sept
    • M31.2.2.2Autogenerate review rule: never merge an unreviewed autogenerated migration09 Sept
    • M31.2.2.3Backward-compatibility test for one release09 Sept
    • M31.2.2.4Data migrations separated from schema migrations09 Sept
    • M31.2.2.5Migration run order at deploy, before traffic09 Sept
• M31.3Configuration and secrets
  • M31.3.1Settings
    • M31.3.1.1Pydantic settings with per-environment overlays10 Sept
    • M31.3.1.2Every variable documented in the example file10 Sept
    • M31.3.1.3Fail-fast on a missing required variable at startup10 Sept
    • M31.3.1.4Config as data in Postgres for anything an operator tunes10 Sept
  • M31.3.2OpenBao
    • M31.3.2.1Deployment and unseal procedure documented for the client10 Sept
    • M31.3.2.2Policy per role: application, worker, browser runner10 Sept
    • M31.3.2.3Dynamic lease issuance for connector credentials10 Sept
    • M31.3.2.4Lease revocation on run end10 Sept
    • M31.3.2.5Rotation without redeploy10 Sept
    • M31.3.2.6Audit device enabled and shipped to the ledger10 Sept

M32Component deployment and wiring

• M32.1Langfuse
  • M32.1.1Deployment
    • M32.1.1.1Compose service set: web, worker, ClickHouse, Redis, S3-compatible store21 Sept
    • M32.1.1.2Resource limits per service so it cannot starve the application21 Sept
    • M32.1.1.3Retention configuration on traces and observations21 Sept
    • M32.1.1.4Profile flag so the lite install runs the ledger only21 Sept
  • M32.1.2Safe integration
    • M32.1.2.1Client-side masking before any span leaves the process21 Sept
    • M32.1.2.2Assertion test that no canary string reaches the payload store21 Sept
    • M32.1.2.3Environment vocabulary fixed at first ingest and asserted against the database enum21 Sept
    • M32.1.2.4Separate Keycloak role for payload access21 Sept
    • M32.1.2.5Audit row written before every payload read21 Sept
• M32.2Presidio and PII detection
  • M32.2.1Wiring
    • M32.2.1.1Presidio analyzer configured with the recognisers we need21 Sept
    • M32.2.1.2GLiNER for entities the default recognisers miss21 Sept
    • M32.2.1.3Singapore recognisers: NRIC, FIN, UEN, local phone formats21 Sept
    • M32.2.1.4Chinese, Malay and Tamil name handling21 Sept
  • M32.2.2Correct role
    • M32.2.2.1Used only for scrubbing free text before third-party egress21 Sept
    • M32.2.2.2Explicitly never an authorisation boundary, asserted by test22 Sept
    • M32.2.2.3Detection results logged as telemetry, never as a block22 Sept
    • M32.2.2.4Performance budget measured on the client CPU22 Sept
• M32.3Object storage
  • M32.3.1SeaweedFS
    • M32.3.1.1Deployment and volume configuration22 Sept
    • M32.3.1.2Bucket layout: assets, recordings, exports, backups22 Sept
    • M32.3.1.3Lifecycle policy per bucket22 Sept
    • M32.3.1.4S3-compatible credentials issued from OpenBao22 Sept
  • M32.3.2Alternative path
    • M32.3.2.1Client-provided S3 or R2 as a configuration option22 Sept
    • M32.3.2.2Storage backend behind the extension interface so either works22 Sept
• M32.4Durable execution runtime
  • M32.4.1Primary
    • M32.4.1.1Procrastinate on Postgres for the job queue22 Sept
    • M32.4.1.2LangGraph checkpointer configuration22 Sept
    • M32.4.1.3Our re-drive driver for crash recovery22 Sept
    • M32.4.1.4Worker deployment with per-class concurrency22 Sept
  • M32.4.2Fallback seam
    • M32.4.2.1Hatchet evaluated and documented as the swap22 Sept
    • M32.4.2.2Adapter interface so the swap changes one file23 Sept
    • M32.4.2.3Decision recorded with the trigger that would cause it23 Sept
• M32.5Console frontend
  • M32.5.1Scaffold
    • M32.5.1.1React and Vite project with typed API client generated from OpenAPI23 Sept
    • M32.5.1.2Routing and layout shell23 Sept
    • M32.5.1.3Auth integration with Keycloak23 Sept
    • M32.5.1.4Theme with light and dark23 Sept
  • M32.5.2Component library
    • M32.5.2.1TanStack Table for every grid, with server-side pagination and filters23 Sept
    • M32.5.2.2react-jsonschema-form for all generated forms23 Sept
    • M32.5.2.3React Flow for the trace graph and procedure canvas23 Sept
    • M32.5.2.4Shared chip, badge and status primitives23 Sept
• M32.6Optional automation canvas
  • M32.6.1Activepieces
    • M32.6.1.1Deployment as an optional sandboxed container23 Sept
    • M32.6.1.2Egress allowlist and no database credentials23 Sept
    • M32.6.1.3Custom piece calling our tool API so the gate still runs23 Sept
    • M32.6.1.4Enabled per client by configuration, not a fork23 Sept
  • M32.6.2Boundary
    • M32.6.2.1Documented rule: deterministic automations only, never agent control flow23 Sept
    • M32.6.2.2Test proving a flow cannot reach data outside the caller's entitlements23 Sept

M33Role-specific surfaces

• M33.1Super Admin
  • M33.1.1Company oversight
    • M33.1.1.1All agents, skills, knowledge and connectors, filterable by department and user24 Sept
    • M33.1.1.2All activity with the same filters24 Sept
    • M33.1.1.3Company budget and consumption24 Sept
    • M33.1.1.4Global kill switch24 Sept
  • M33.1.2Governance actions
    • M33.1.2.1Publish and retire global agents24 Sept
    • M33.1.2.2Approve department publication requests24 Sept
    • M33.1.2.3Confirm role nominations24 Sept
    • M33.1.2.4Disable a principal24 Sept
    • M33.1.2.5Self-grant path that writes a loud audit event and notifies the steward24 Sept
• M33.2Department Admin
  • M33.2.1Department oversight
    • M33.2.1.1Everything within their scope, same shape as the Super Admin view24 Sept
    • M33.2.1.2Department activity24 Sept
    • M33.2.1.3Department budget against pace24 Sept
    • M33.2.1.4Department knowledge coverage and gaps24 Sept
  • M33.2.2Governance actions
    • M33.2.2.1Approve department publications24 Sept
    • M33.2.2.2Grant within their scope only25 Sept
    • M33.2.2.3Adopt orphaned agents when someone leaves25 Sept
    • M33.2.2.4Lower a leash, never raise beyond the ceiling25 Sept
    • M33.2.2.5Appoint a deputy with a maximum thirty-day expiry25 Sept
• M33.3Member
  • M33.3.1Personal surfaces
    • M33.3.1.1Their own agents25 Sept
    • M33.3.1.2Their own knowledge and uploads25 Sept
    • M33.3.1.3Their own conversation history and export25 Sept
    • M33.3.1.4Their own memory with a delete control25 Sept
    • M33.3.1.5Their own usage against allowance25 Sept
• M33.4Auditor
  • M33.4.1Metadata plane only
    • M33.4.1.1Full audit trail including Super Admin activity25 Sept
    • M33.4.1.2Grant and leash history25 Sept
    • M33.4.1.3Redaction and refusal statistics25 Sept
    • M33.4.1.4Explicit absence of any content access, asserted by test25 Sept
• M33.5Connector Admin
  • M33.5.1Credential custody
    • M33.5.1.1Install and configure connectors25 Sept
    • M33.5.1.2Bind and rotate credential references28 Sept
    • M33.5.1.3Set permission-sync capability per connector28 Sept
    • M33.5.1.4No agent or knowledge access by virtue of the role28 Sept
• M33.6Approver
  • M33.6.1Approval queue
    • M33.6.1.1Pending approvals within their own entitlement28 Sept
    • M33.6.1.2The artefact rendered, not the tool call28 Sept
    • M33.6.1.3Approve, reject with a reason, or take over28 Sept
    • M33.6.1.4Timeout visibility and expiry behaviour28 Sept
• M33.7Installing partner
  • M33.7.1Break-glass
    • M33.7.1.1Zero standing entitlement28 Sept
    • M33.7.1.2Time-boxed elevation with a stated reason28 Sept
    • M33.7.1.3Separate immutable audit chain28 Sept
    • M33.7.1.4Client notification on every elevation28 Sept
    • M33.7.1.5Automatic expiry and revocation28 Sept

M34Onboarding and adoption

• M34.1Day-one experience
  • M34.1.1Seeded first answer
    • M34.1.1.1First connector chosen so a real question is answerable before any document is uploaded30 Sept
    • M34.1.1.2Three department-scoped starter questions generated from what actually indexed30 Sept
    • M34.1.1.3Answers verifiable against a system the client already trusts30 Sept
  • M34.1.2Coverage instead of progress
    • M34.1.2.1Per-scope statement: record counts and last sync30 Sept
    • M34.1.2.2Explicit not-connected state per department30 Sept
    • M34.1.2.3Shopping list for the champion rather than a progress bar30 Sept
• M34.2Trust building
  • M34.2.1Verification ritual
    • M34.2.1.1Each department lead verifies five documents in week one30 Sept
    • M34.2.1.2Verification badge visible in answers30 Sept
    • M34.2.1.3Re-verification nag on the review date30 Sept
  • M34.2.2Feedback surfaces
    • M34.2.2.1Correction path in every channel30 Sept
    • M34.2.2.2Wrong-sources feedback distinct from wrong-answer, so retrieval and reasoning bugs separate30 Sept
    • M34.2.2.3Unanswered question log as the connector roadmap30 Sept
• M34.3Documentation
  • M34.3.1For staff
    • M34.3.1.1What it can and cannot see, in plain language30 Sept
    • M34.3.1.2The privacy posture stated openly30 Sept
    • M34.3.1.3How to ask well, with examples from their own department01 Oct
  • M34.3.2For admins
    • M34.3.2.1Runbook per console screen01 Oct
    • M34.3.2.2Grant and scope cookbook with worked examples01 Oct
    • M34.3.2.3Incident playbook per failure mode01 Oct
  • M34.3.3For the installing team
    • M34.3.3.1Install checklist including the four hidden production links01 Oct
    • M34.3.3.2Per-client variables reference01 Oct
    • M34.3.3.3Upgrade and rollback procedure01 Oct
    • M34.3.3.4Restore drill procedure01 Oct

M35Localisation and accessibility

• M35.1Language
  • M35.1.1Interface
    • M35.1.1.1English and Simplified Chinese interface strings30 Sept
    • M35.1.1.2Locale-aware dates, numbers and currency30 Sept
    • M35.1.1.3Right-to-left readiness deferred with a stated trigger30 Sept
  • M35.1.2Retrieval
    • M35.1.2.1CJK tokenisation for lexical search so Chinese queries do not silently retrieve worse30 Sept
    • M35.1.2.2Mixed-language document handling30 Sept
    • M35.1.2.3Language detection on ingest recorded as metadata30 Sept
• M35.2Accessibility
  • M35.2.1Streaming safety
    • M35.2.1.1Screen-reader-safe streaming: no naive aria-live on a token stream30 Sept
    • M35.2.1.2Announce on completion, not on every token30 Sept
    • M35.2.1.3Skip-to-answer control30 Sept
  • M35.2.2General
    • M35.2.2.1Keyboard navigation across the console30 Sept
    • M35.2.2.2Visible focus states30 Sept
    • M35.2.2.3Contrast checked in both themes30 Sept
    • M35.2.2.4Form labels and error association30 Sept
• M35.3Mobile
  • M35.3.1Responsive console
    • M35.3.1.1Console usable on a phone for approvals at minimum30 Sept
    • M35.3.1.2Approval cards readable without horizontal scroll01 Oct
  • M35.3.2Progressive web app
    • M35.3.2.1Installable shell01 Oct
    • M35.3.2.2Push for approvals, deferred with a stated trigger01 Oct

M36Scaling triggers and performance

• M36.1Deferred scaling work, each behind a written trigger
  • M36.1.1Ledger partitioning
    • M36.1.1.1pg_partman on the metadata ledger05 Oct
    • M36.1.1.2Partition by month with automatic creation05 Oct
    • M36.1.1.3Retention detach and archive rather than delete05 Oct
    • M36.1.1.4Trigger: ledger row count or query latency threshold05 Oct
  • M36.1.2Read replica
    • M36.1.2.1Streaming replica configuration05 Oct
    • M36.1.2.2Console reads routed to the replica05 Oct
    • M36.1.2.3Replication lag monitoring with a staleness banner05 Oct
    • M36.1.2.4Trigger: console queries affecting answer latency05 Oct
  • M36.1.3Materialised reporting views
    • M36.1.3.1Views for the heaviest report screens05 Oct
    • M36.1.3.2Refresh schedule and staleness display05 Oct
    • M36.1.3.3Trigger: a report exceeding two seconds05 Oct
  • M36.1.4Two-box split
    • M36.1.4.1Application and browser on one host, database and object store on the other05 Oct
    • M36.1.4.2Rehearsed without an application change05 Oct
    • M36.1.4.3Trigger: RAM pressure or a resilience requirement05 Oct
• M36.2Performance work, sized only after measurement
  • M36.2.1Parallel connector execution
    • M36.2.1.1Dependency graph over independent source calls06 Oct
    • M36.2.1.2Fan-out with one critical path rather than a sum06 Oct
    • M36.2.1.3Per-source and global budgets still enforced under parallelism06 Oct
  • M36.2.2Guard checkpoint collapse
    • M36.2.2.1Measure the serial cost of the three screens06 Oct
    • M36.2.2.2Collapse into a single pass where semantics allow06 Oct
    • M36.2.2.3Verify no detection coverage is lost06 Oct
  • M36.2.3Request coalescing
    • M36.2.3.1Identical in-flight requests share one execution06 Oct
    • M36.2.3.2Entitlement equality required before sharing, never similarity06 Oct
  • M36.2.4Load test
    • M36.2.4.1Peak concurrency test rather than daily volume06 Oct
    • M36.2.4.2Documented first bottleneck at ten and one hundred times06 Oct
    • M36.2.4.3Results recorded against the SLO table06 Oct

M37Migration, launch and handover

• M37.1Migration from the v1 Company Brain
  • M37.1.1Inventory
    • M37.1.1.1Catalogue what the current Company Brain holds: knowledge, prompts, tool definitions, conversation history05 Oct
    • M37.1.1.2Decide per item: migrate, rebuild or retire05 Oct
    • M37.1.1.3Map old permissions onto the new capability model, explicitly rather than by assumption05 Oct
  • M37.1.2Data movement
    • M37.1.2.1Knowledge and asset export from the old system05 Oct
    • M37.1.2.2Re-parse and re-embed rather than copying vectors, since embeddings are model-specific05 Oct
    • M37.1.2.3Entity registry seeded from existing client records05 Oct
    • M37.1.2.4Historical conversations archived, not imported, unless there is a stated reason05 Oct
  • M37.1.3Parallel running
    • M37.1.3.1Both systems answering the same questions for an agreed period05 Oct
    • M37.1.3.2Answer comparison log with disagreements surfaced05 Oct
    • M37.1.3.3Cutover criteria agreed in writing before the period starts05 Oct
  • M37.1.4Decommission
    • M37.1.4.1Old system read-only, then archived05 Oct
    • M37.1.4.2Credential revocation on every connector the old system held05 Oct
    • M37.1.4.3Scheduled jobs disabled and verified stopped05 Oct
    • M37.1.4.4Final backup retained per the retention policy05 Oct
• M37.2Replacing AnyGen
  • M37.2.1What is actually in there
    • M37.2.1.1Inventory the twelve house skills, named individually, since each is authored work and not a setting06 Oct
    • M37.2.1.2Inventory every agent with its connectors, skills, channels and availability, because an agent is a composition and not a prompt06 Oct
    • M37.2.1.3Inventory automations, which are owned by an agent there and will be owned by an agent here06 Oct
    • M37.2.1.4Export memory files, both curated and chat-extracted, with their change history06 Oct
    • M37.2.1.5List which Lark groups each agent is installed into, since that is what staff actually see06 Oct
    • M37.2.1.6Record what AnyGen produced that anyone still relies on06 Oct
  • M37.2.2Skills come across, they are not rewritten
    • M37.2.2.1Export verz-master-theme, verz-doc-letterhead, seo-audit and website-cro-audit first: they are in daily use and are the test of whether import works at all06 Oct
    • M37.2.2.2Convert the description convention, since theirs are written as router prompts beginning "Use the X skill to"06 Oct
    • M37.2.2.3Re-review every imported skill through the normal queue rather than trusting it because it worked before06 Oct
    • M37.2.2.4Diff behaviour on a real task before and after import, not just that the file parses06 Oct
    • M37.2.2.5Retire any skill that has not been invoked in ninety days rather than carrying it over06 Oct
  • M37.2.3Agents are rebuilt, deliberately
    • M37.2.3.1Rebuild each agent from a template rather than importing its configuration, because their model has no ceiling and no leash to carry across06 Oct
    • M37.2.3.2Set an explicit ceiling per agent, which AnyGen never had06 Oct
    • M37.2.3.3Start every rebuilt agent at Shadow on writes regardless of how it behaved there06 Oct
    • M37.2.3.4Map their Availability onto our availability, and their absent authority onto our entitlement, separately - conflating the two is the mistake their model makes07 Oct
  • M37.2.4Adaptive learning does not transfer
    • M37.2.4.1Their learning is one toggle over an opaque store; ours is four tiers with a review queue, and there is no honest mapping between them07 Oct
    • M37.2.4.2Read the memory files as evidence and re-derive tier one preferences rather than importing beliefs wholesale07 Oct
    • M37.2.4.3Discard anything that would widen a scope, since it was never approved by anyone under our rules07 Oct
    • M37.2.4.4State plainly in the handover that the new system starts without their accumulated learning, and why that is the right trade07 Oct
  • M37.2.5Cutover in Lark, where staff will notice
    • M37.2.5.1Install alongside, in one group first, with both bots present07 Oct
    • M37.2.5.2Agreed period answering the same questions from both, with disagreements logged07 Oct
    • M37.2.5.3Announce the switch before removing their bot, not after07 Oct
    • M37.2.5.4Remove the AnyGen bot from each group in the agreed order07 Oct
    • M37.2.5.5Keep their bot reachable read-only for an agreed window in case something was missed07 Oct
  • M37.2.6Decommission a SaaS, which is not the same as a server
    • M37.2.6.1Revoke every OAuth grant AnyGen holds - Gmail, Drive, Calendar, Sheets, Docs and the rest - because cancelling a subscription does not revoke them07 Oct
    • M37.2.6.2Remove the AnyGen app from the Lark tenant, not just from the groups07 Oct
    • M37.2.6.3Export anything with retention value before the account closes, since access ends with billing07 Oct
    • M37.2.6.4Cancel the subscription only after the export is verified restorable07 Oct
    • M37.2.6.5Record the date access actually ended, which is a different date from the last invoice07 Oct
• M37.3Pilot and rollout
  • M37.3.1Pilot
    • M37.3.1.1One department, agreed scope, named champion07 Oct
    • M37.3.1.2Twenty real questions as the acceptance set07 Oct
    • M37.3.1.3Daily review of every answer for the first week07 Oct
    • M37.3.1.4Explicit go or no-go decision with written criteria07 Oct
  • M37.3.2Departmental rollout
    • M37.3.2.1Rollout order agreed with the client07 Oct
    • M37.3.2.2Per-department onboarding session07 Oct
    • M37.3.2.3Per-department starter questions and knowledge seeding07 Oct
    • M37.3.2.4Adoption measured as real questions from real people, machine traffic excluded07 Oct
  • M37.3.3Training
    • M37.3.3.1Staff session: what it can see, how to ask, how to correct it07 Oct
    • M37.3.3.2Admin session: console walkthrough, grants, leashes, review queues07 Oct
    • M37.3.3.3Recorded and left with the client07 Oct
• M37.4Acceptance and commercial close
  • M37.4.1Acceptance
    • M37.4.1.1Acceptance criteria signed before build, not after07 Oct
    • M37.4.1.2Invariant suite green, evidenced07 Oct
    • M37.4.1.3Restore drill executed in front of the client07 Oct
    • M37.4.1.4Security review completed if the client requires one07 Oct
    • M37.4.1.5Penetration test scheduled where contractually required07 Oct
  • M37.4.2Contract artifacts
    • M37.4.2.1Data processing agreement07 Oct
    • M37.4.2.2Service level statement with the RPO and RTO from the chosen profile07 Oct
    • M37.4.2.3Support and escalation procedure07 Oct
    • M37.4.2.4Subprocessor list covering every model provider used07 Oct
  • M37.4.3Handover
    • M37.4.3.1Runbook per console screen07 Oct
    • M37.4.3.2Incident playbook per failure mode07 Oct
    • M37.4.3.3Named client owner for knowledge, grants and connectors07 Oct
    • M37.4.3.4Scheduled job registry handed over with what each one guards07 Oct
    • M37.4.3.5Thirty-day post-launch review booked at handover07 Oct
• M37.5Operational readiness
  • M37.5.1Scheduled job registry
    • M37.5.1.1Every scheduled control listed with what it guards07 Oct
    • M37.5.1.2CI assertion that each control appears in the scheduler07 Oct
    • M37.5.1.3Alert when a scheduled job has not run within its window07 Oct
    • M37.5.1.4Explicit test that no safety mechanism lacks a caller07 Oct
  • M37.5.2On-call
    • M37.5.2.1Alert routing and severity definitions07 Oct
    • M37.5.2.2Runbook per alert07 Oct
    • M37.5.2.3Escalation path to us where the client cannot resolve it07 Oct
  • M37.5.3Cost validation
    • M37.5.3.1Measured spend against the projection after thirty days07 Oct
    • M37.5.3.2Estimator correction from actuals07 Oct
    • M37.5.3.3Budget thresholds retuned with real distribution rather than assumptions07 Oct