diff --git a/decisions/open-unknowns.md b/decisions/open-unknowns.md new file mode 100644 index 0000000..63572da --- /dev/null +++ b/decisions/open-unknowns.md @@ -0,0 +1,35 @@ +# Open unknowns + +Deferred decisions, unvalidated assumptions, and domain-standard considerations a grill did not +reach. Appended by `/grill-with-docs` at the confirmation gate; never rewritten in place. + +The third bucket is a checklist of considerations the grill skipped — **not** a guarantee of +blind-spot coverage. An empty bucket is a legitimate result. + +--- + +## 2026-08-01 — employer-evidence boundary for public FDE artifacts (wayfinder #321) + +Ruling: day-job material is publishable only as de-identified engineering patterns passing the +**stranger test**, enforced by a denylist lint sourced from gitignored `personal-knowledge/`. +HEAD scrubbed on decision; history rewrite staged. See `adr:employer-evidence-boundary`, +`adr:boundary-enforced-by-construction`, `adr:staged-history-remediation`. + +**Deferred decisions** +- Git-history rewrite of the 10 commits carrying the protected strings (earliest 2026-06-25) — unblocked by: in-flight PRs landing (#337 among them) plus an agent-quiescent window. Force-pushing `main` against ~23 live agent sessions and 3 worktrees is the risk being deferred around, not the rewrite itself. +- Whether the denylist lint covers sibling public repos (`daily-logger`, `shell`, `core-library`, `landing`) or only `core` — unblocked by: the lint's roadmap-slice scoping. +- Whether GitHub support is asked to GC unreferenced objects after any rewrite — a rewrite alone leaves objects reachable by SHA. +- Whether the primary day-job corpus (unmounted external volume, never inspected) is ever examined. Nothing from it can be ruled publishable until someone has looked at it. + +**Unvalidated assumptions** +- ~~That the employer's employment agreement and publication policy permit de-identified, pattern-level technical writing.~~ **RESOLVED 2026-08-01 — operator confirmed** ("I am good on employment agreement"). The ruling in `adr:employer-evidence-boundary` no longer rests on an unread policy. Recorded rather than deleted: this was the load-bearing assumption, and a future reader should be able to see that it was closed by operator confirmation rather than by document review. +- That the stranger test is actually satisfiable for the adoption story specifically — no draft exists yet, and none has been tested against a cold reader. +- That a term denylist is sufficient protection. It catches names; it does not catch situational fingerprints (a distinctive metric, an unusual org shape, a dated incident). +- That the 9 remaining bare-alias files pass the stranger test now that the binding is removed. Reasoned, not reader-tested. + +**Standard considerations not covered** +- Non-git surfaces were never swept: published daily-logger articles, Notion, selfco exports, and the Vercel-hosted sites may carry the same strings. Only the git surface was checked. +- LinkedIn, X, and résumé name the employer by design and sit outside this boundary entirely — no ruling was made on how they interact with de-identified public artifacts that a reader could correlate. +- No human review step for future narrative drafts before publish, beyond the mechanical lint. +- ~~`core-library/public/graph/selfco.json` — untracked, not gitignored, in a public repo.~~ **FIXED 2026-08-01** — `core-library@ccbf853` ignores `public/graph/` wholesale. The git vector is closed. +- **Open, and larger than the one just fixed: `core-library` serves the vault graph at runtime.** `apps/web/src/main.ts:82` fetches `/graph/selfco.json`, and the vault-ingest Vite plugin regenerates it into `publicDir` on every build. The repo is not currently deployed (no `vercel.json`, no `.vercel`, no `netlify.toml`), which is the only reason this is contained. **If core-library is ever deployed, the build republishes the entire private vault graph to a public URL, and `.gitignore` does nothing to stop it.** Under `adr:boundary-enforced-by-construction` this wants a build-time guard (de-identify at ingest, gate the fetch behind local-only, or exclude protected nodes from the graph), not a note. Decision, not yet made — deploying core-library is currently blocked on this. diff --git a/decisions/research/2026-08-01-fde-deliverables-audit.md b/decisions/research/2026-08-01-fde-deliverables-audit.md index eec8fad..ea191ff 100644 --- a/decisions/research/2026-08-01-fde-deliverables-audit.md +++ b/decisions/research/2026-08-01-fde-deliverables-audit.md @@ -69,7 +69,7 @@ Every role definition across all five segments centers the full arc; harness art 1. (#328) Should the public narrative lead with the one genre the market screens hardest (eval frameworks) or with the rarer combined artifact (full-arc case study)? 2. (#327) Does dive-briefing's roadmap need an explicit "engagement simulation" slice (discovery doc + stakeholder/plumbing narrative) to cover genre 3/4, or is that a separate artifact? -3. (#321) Is the pr-quiz buy-in story tellable at pattern level without SAP specifics — and does SAP policy allow even that? +3. (#321) **RESOLVED 2026-08-01** (`adr:employer-evidence-boundary`): tellable at pattern level under the stranger test — de-identified, no employer or system name, no team size, no internal metrics. Whether employer policy permits it is an unvalidated assumption recorded in `decisions/open-unknowns.md`. 4. (follow-up cycle, if warranted) The skeptic sweep this cycle lacked: FDE-critical sources, attrition lore, buyer-side outcome evidence. ## Key sources diff --git a/decisions/wayfinder/fde-operating-presence.md b/decisions/wayfinder/fde-operating-presence.md index 8e7003b..6006109 100644 --- a/decisions/wayfinder/fde-operating-presence.md +++ b/decisions/wayfinder/fde-operating-presence.md @@ -16,10 +16,11 @@ published FDE-genre deliverables (discovery documents, eval harnesses with measu deployment runbooks, process-understanding artifacts of the "McKinsey consultant" kind), and a **running content flywheel** — BlogEngine emitting to GitHub + Medium + blog.jim.software + LinkedIn + X + Instagram + a new dedicated tech-blog domain — fed by **scheduled trend ingestion** -(thought leaders, model releases, harness-architecture changes) into selfco. TeamBot at SAP is the -day-job instance of the same posture ("if SAP paid Anthropic, what would an FDE team of 3 -deliver, working with a McKinsey consultant for process understanding"); this map covers the -personal-stack half only, with the employer boundary explicitly decided. Offers are a lagging +(thought leaders, model releases, harness-architecture changes) into selfco. The day job is the +enterprise-scale instance of the same posture ("what would an FDE team of 3 deliver, working with +a McKinsey-style consultant for process understanding"); this map covers the personal-stack half +only, and the employer boundary is decided in `adr:employer-evidence-boundary` — day-job material +enters public artifacts only de-identified, at pattern level. Offers are a lagging indicator, not the success object. Serves `ns:l2-ojfbot#P1` (usable surfaces — the published artifacts ARE surfaces shown where they live), `ns:l2-ojfbot#P2` (work is legible — the flywheel publishes the legibility), and `ns:l3-shared#P1` (a stranger can be shown the cluster doing real @@ -49,6 +50,12 @@ work end-to-end). its credibility ceiling); `wiki/synthesis/value-proposition-canvas-bmc-fit` and `concepts/value-proposition-design` (positioning-narrative instrument for the venue-map ticket). +- **#328's ticket body is partly invalidated by #321's ruling (2026-08-01).** Its proposed public + frame names the employer, which `adr:employer-evidence-boundary` now forbids; and the re-audit's + §2.11 (paired non-engineering engagement owner, convergence 4) shows the consultant-pairing + instinct is right but the role assignment inverted — the FDE is the *engineer* in that pair, so a + narrative owning ROI and value cases pitches the Technical Deployment Lead role instead. The venue + map half of that ticket is unaffected. Re-author the frame; do not trim it. - Ingestion automation must respect the sequential-research rule (one deep-research cycle at a time; 2026-06-05 saturation failure) and shadow-first discipline (observe-only sweeps before unattended vault writes — ADR-0089 idiom). @@ -64,14 +71,15 @@ Pre-map rulings (grilled at charting, recorded here — not closed tickets): Closed tickets: -- Primary-source FDE checklist built (6 genres; eval frameworks = the hiring gate, "not a demo role"); H1 cost-orchestration REFUTED as FDE deliverable, H2 eval-gating MIXED (core supported, pr-quiz sub-claims unevidenced, capture loop runs vendor-ward), H3 customer-facing core SUPPORTED — FDE deliverables checklist + fleet re-audit (#320) → decisions/research/2026-08-01-fde-deliverables-audit.md +- Primary-source FDE checklist built (6 genres; eval frameworks = the hiring gate, "not a demo role"); H1 cost-orchestration REFUTED as FDE deliverable, H2 eval-gating MIXED (core supported, pr-quiz sub-claims unevidenced, capture loop runs vendor-ward), H3 customer-facing core SUPPORTED — FDE deliverables checklist + fleet re-audit (#320) → decisions/research/2026-08-01-fde-deliverables-audit.md (+ independent second cycle, corroborating and correcting → decisions/research/2026-08-01-fde-deliverables-audit-cycle-2.md) +- Day-job material is publishable only as de-identified patterns passing the **stranger test**, enforced by denylist lint (not discipline); HEAD scrubbed on decision, history rewrite staged — TeamBot public-evidence boundary (#321) → `adr:employer-evidence-boundary`, `adr:boundary-enforced-by-construction`, `adr:staged-history-remediation` ## Tickets | Ticket (title, refer-by-name) | Type | Blocked by | Status | |-------------------------------|------|------------|--------| | FDE deliverables checklist + fleet re-audit (#320) | research | — | closed | -| TeamBot public-evidence boundary (#321) | grilling | — | open | +| TeamBot public-evidence boundary (#321) | grilling | — | **closed** | | Flywheel first loop (#322) | grilling | — | open | | Ingestion source roster + cadence (#323) | grilling | — | open | | Ingestion runtime + host (#324) | grilling | Ingestion source roster + cadence | open | @@ -81,6 +89,7 @@ Closed tickets: | Positioning narrative + venue map (#328) | grilling | FDE re-audit; Public identity + domain; TeamBot boundary | open | | BlogEngine distribution seam (#329) | grilling | Flywheel first loop; Public identity + domain | open | | Account provisioning (#330) | task | Public identity + domain | open | +| Sanitized pattern-flow loop (#342) | grilling | — | open | Frontier at charting: FDE re-audit, TeamBot boundary, Flywheel first loop, Ingestion source roster, Handle availability survey. Account provisioning is **user-performed** (agents never @@ -99,9 +108,8 @@ create accounts or handle credentials); Handle availability survey is survey-onl pipeline"; the Destination ruling (presence, not business) leaves the commercial question unstated, not ruled out. Revisit after the narrative lands; graduating or ruling it out is the operator's call. -- **TeamBot↔personal-stack pattern flow** — whether sanitized TeamBot patterns become fleet - artifacts (and vice versa) as a standing loop; statable only after the TeamBot boundary is - decided. +- ~~**TeamBot↔personal-stack pattern flow**~~ — **graduated to a ticket 2026-08-01**: the boundary + ruling (#321) made the question statable. Now "Sanitized pattern-flow loop" (#342). ## Out of scope