Lifecycle spec: discovery and post-development

Proposed design, Astra-reviewed; of its modules only the schedule and the collector are built (increments 1 and 2, each independently reviewed). Reproduced from <local evidence archive> (Astra round 3 PASS); only its two archive paths are made absolute, and its one anchor into src/intelligence.ts follows the line it cites (695 in the spec, 709 since increment 1 and main's step 1 increment 3 each added one declaration above it). Increment 0 (§9) declares the planned modules in the Intelligence registry and builds none of them; its three Astra tasks are declared blocked until increment 7, since no effort is yet established on codex exec (why). Increment 1 builds the Lifecycle schedule on fixtures with a fake clock and passed independent review (Astra round 4 PASS); nothing runs on a schedule. Increment 2 builds the collector, Discovery sources, tested only against a loopback corpus; it passed independent review (Astra round 5 PASS); its own proposed bounds are listed in that reference. The owner decisions in §11 stay open: where increment 0, 1 or 2 uses a default, it is a proposal, not a signed commission.

Status: proposal for owner decision, 29 September 2026, Claude (Opus 5.5), at main e62abe6. Base: token-economy, with grafts from evidence-first and owner-minimal (<local evidence archive>). Nothing is built or scheduled; all 27 epics stay open. Assumptions [An] are listed in §12. Revised after Astra r1 and r2; Astra r3 PASS (<local evidence archive>).

1. Principles

1. Code decides what code can: fetching, dedup, provenance, scoring, rules, statistics, schedules, budgets. Model output is data until a named check accepts it.
2. Models only make admission harder: they triage, draft or challenge; never admit, select, publish or expose.
3. Deltas only: a model sees content with a new hash; results are cached by (content hash, policy digest); a no-change day makes no call.
4. Research is not a customer interview (docs/design.md:9): web-only Evidence admits a validation Slice, never a feature Slice.
5. Unknown is never zero; a Budget is never extended.
6. One short owner queue: ≤ 5 items a week, four classes (§6); silence is never consent.
7. Subscriptions only: Claude sign-in via claude, ChatGPT sign-in via codex, on this Mac.

2. Modules

Domains: Pl Planning, Gr Growth, Op Operations. Gates read complete / valuable.

No new module for docs (same Slice, docs/design.md:101), verification (Assurance) or cleanup (planning/propose-improvement, fed the retirement inventory).

3. The loop

Portfolio: Product, Objectives, Capabilities, owner-confirmed brief
  -> lifecycle-schedule: daily basic | weekly full occurrence
    -> discovery-sources: Captures, Citations, coverage              [no model]
      -> signal-intake: Signals, Clusters                            [efficient; Astra audit]
        -> opportunity-synthesis (only if a Cluster crosses)         [frontier]
          -> opportunity gate: rules -> challenge (only lowers) -> owner (4 classes)
            -> backlog -> Planning selects into a Slice (freezeSlice + contract + docs scope)
              -> product gate -> Candidate (code + docs) -> Assurance Verdict -> integrate-local
                -> growth: draft pack + claim trace -> owner gate (Action grant) -> owner-sourced Receipt
                -> outcome-validation: frozen contract -> window -> Assessment
                  -> outcome Signal + calibration -> next synthesis and gate thresholds
capability-retirement (weekly) -> same gate -> Planning or owner -> staged removal Slices

A Capture in a delivered Opportunity's Cluster is recurrence after change, not a duplicate.

4. Interface sketch (type names only)

• lifecycle-schedule: Rhythm, OccurrenceId, Occurrence, OccurrenceStatus (completed | partial | deferred | unavailable), DeferralReason (usage-limit | budget-exhausted | sign-in-needed | volume-unmounted | logged-out), ScheduleCommission, CapacityLedger, LedgerEntry, UsageLimitObservation.
• discovery-sources: ResearchBrief, Source, SourceStatus, Capture, CaptureNovelty (new | changed | repeat | unchanged), Citation (Evidence kind sf-citation/1), CoverageRecord.
• signal-intake: Signal, SignalKind (problem | request | competitor-move | praise | noise | outcome), SourceClass (customer-voice | competitor | press | first-party), ProblemKey, Cluster, QuoteSpan, TriageRequest, TriageResult, SearchProposal, AuditSample, AuditResult.
• opportunity-synthesis: ClusterScore, Watermark, PriorDigest, SynthesisDelta, Opportunity, OpportunityAmendment.
• planning/opportunity-gate: GatePolicy, GateRuleId, Disposition (admitted | admitted-validation-only | parked | rejected | owner-routed), OpportunityDecision, ChallengeFinding, CalibrationRecord.
• owner-decisions: EscalationBundle, OwnerItem, OwnerItemClass, OwnerAnswer, ActionGrant, OwnerSourcedReceipt.
• growth: ReleaseFact, DraftPack, DraftBlock, ClaimTrace, StaleClaim.
• outcome-validation: MeasurementContract, ExperimentDesign, PowerCalculation, SampleRatioCheck, Readout, and a new outcome-evidence evaluator binding release and exposure identity, the frozen contract and independently checked observations. deriveAssessment (src/delivery-records.ts:340) judges only local acceptance (declared values or check results) and is not customer benefit.
• capability-retirement: CapabilityInventory, RetirementCandidate, RetirementCase, RetirementStage.
• Reviewed edits: src/intelligence.ts: Transport gains "codex-cli"; Allowance gains "discovery-window"; ClaudeResearchProfile; Sonnet 5 qualified in MODEL_TIERS. src/claude-producer.ts: the transport and commission accept only CLAUDE_MODEL (:358, :1865), so extending them to Sonnet 5 is a reviewed edit with wrong-model refusal tests.
• Tasks: signal-intake/triage, /search, /audit; opportunity-synthesis/propose; planning/challenge-opportunity; growth/draft-pack, /review-pack; capability-retirement/draft-case.
• Reused unchanged: SliceNeed, freezeSlice (src/product-gate.ts:531), Observation, Verdict, Attention's owner-blocker rule (src/attention.ts:179-181).

Records live in <local discovery journal> [A9]; <local Portfolio journal> only gains coverage and usage Observations through a collector.

5. Discovery schedule

Local time [A8]; the owner's sessions share the usage window [A6], so runs stagger 20 minutes per Product within 02:00–05:00.

Occurrence IDs discovery/<product>/basic/<date> and …/full/<iso-week> are stable; each transition (admit, defer, reconcile, resume, settle) has its own deterministic command ID under the occurrence, and a retried transition replays its receipt (src/journal.ts:234-241). deferred is not terminal; each occurrence settles once. Missed windows coalesce. Discovery debits a new discovery-window allowance, a Factory admission limit only: the subscription's headroom is shared with the owner's sessions and unknown, so no provider capacity is reserved. An unknown call stays debited at its bound. Beyond the weekly ceiling (decision 6) occurrences are deferred budget-exhausted.

Failure rules, every task:

• F1 A usage limit is unavailable usage-limit with a checked resetsAt [A2]; the occurrence is deferred, its Signals unknown.
• F2 No retry inside the window; resume the same occurrence at the first slot after resetsAt by its resume transition, reconciling remote: unknown first and never re-dispatching an unknown effect.
• F3 Never switch model, provider or tier; never probe a limit.
• F4 isUsingOverage: true fails closed. It is seen only after contact, so it cannot prove no charge: any provider contact, qualification probes included, needs S1's current record that paid overage is off, otherwise unavailable.
• F5 401 or 403 is an owner blocker, "sign-in needed".
• F6 Malformed output takes the fallback.

The five external Products have no brief, so no discovery runs for them until one is confirmed.

6. Decision gate

A versioned Policy; thresholds are proposals [A7]. Rules run first, in order, at no token cost.

Then admit when the deterministic score (distinct domains × recency × severity × Objective weight × weeks recurring, less cost class) clears the threshold; the marginal band (± 15%) or a guidance conflict goes to the challenge.

Who decides:

• Rules reject and park. Parked items re-enter on new Signals; after 8 quiet weeks they are rejected, reason kept.
• The challenge (Astra xhigh; a drafter in phase plan, since a verifier presumes a Candidate) returns fixed reason codes citing Citations, and the gate re-runs the checkable ones. It may only lower admit to park; if unavailable, the item parks.
• Planning admits within existing Objectives: admission is reversible, inspectable (docs/human-interface.md:11) and never selects. Planning ranks within the WIP cap, recording rejected alternatives and opportunity cost (E14).
• The owner answers four classes only: an outward Action (publish, post, contact, live traffic, release, spend); expanding Authority (first delivery grant, new Objective); customer-visible retirement; one-time commissions. Each item shows objective, trade-offs, recommendation, effect and Evidence one click away. Overflow parks as owner-queue-full; an unanswered item returns once, then parks as owner-unanswered.

Calibration: delivered admits later Supported; rejected Clusters that kept growing; challenge parks confirmed versus overturned. Thresholds change only by reviewed Policy revision, calibrated against Assessments, never admission counts.

7. Post-development gates

8. Transport and confinement per role

Never: Platform keys, --bare, --fallback-model, setup-token, codex login --with-api-key or --with-access-token, exported sign-ins, --max-budget-usd as a control.

Before any live scheduled run:

• L1 Claude T0 qualified: the chosen remedies as a new rules revision (argv, environment and policy digests) independently reviewed; an owner-signed completeness audit saying complete: true for that profile, since qualification refuses otherwise; the owed traces and named acceptances; a fresh qualification and commission receipt.
• L2 The selector's implicit-retries refusal (src/intelligence.ts:709, one request per invocation) lifted only by a commission establishing one request per invocation, or by a reviewed selector change after O5.
• L3 Each efficient task (triage, search, draft pack) measured separately against Opus 5.5 low on its own owner-labelled corpus by cost per completed task (docs/agents/intelligence.md:81); each goes live only on its own result.
• L4 F1–F6 fixture-proved; a live limit event recorded in a manual run.
• L5 One owner-launched manual occurrence proves sign-in from the LaunchAgent.
• L6 Applicable docs/self-improvement.md proofs: a restart gives one occurrence; a seeded attractive proposal is rejected.
• L7 A confirmed brief and allow-list.
• L8 A two-week shadow that admits nothing.

The owner signs: S1 schedule commission (timezone, times, ceilings) and the owner's dated record of each account's subscription sign-in and disabled paid overage, stale after 30 days or any sign-in change [A13]; S2 Claude T0 commission and route acceptances; S3 Codex commission after its audit; S4 research profile (last); S5 each brief and allow-list; S6 loading the LaunchAgent plist; S7 any first delivery grant.

9. Increment plan

Each increment: independent Astra review, both module pages, a receipt, rebuilt site.

10. First one-Product end-to-end proof

Product: software-factory (decision 11), the only Product with focus-objective text and guidance; its Objective, Capabilities and scope still need records (increment 3b) and a commission (S5). It has no customers, so its customer-outcome Assessments can only be Inconclusive; a local deriveAssessment result is not customer benefit. Delivery needs handover step 1 [A12].

Run: offline on the recorded corpus, then live for 14 days (12 basic, 2 full, 2 synthesis occurrences) with an injected restart and scripted usage limit.

Passes when:

1. Each occurrence settles once with coverage and a token ledger; restart and limit resume the same occurrences.
2. Unchanged re-fetches make no model call; every Citation re-verifies from recorded bytes.
3. At least one Opportunity maps to an Objective; every disposition names its rule, challenge or answer.
4. One admit is frozen into a Slice, delivered through the product gate and Verified locally.
5. A release-notes draft passes the claim trace, a seeded stale claim is rejected, and the draft waits at the owner gate.
6. The contract is frozen and the read-out scheduled.
7. Astra reviews the trace.

This proves mechanism, not value; it advances E01, E14 and E24 and closes none.

11. Open owner decisions

1. Small fast model. Default: claude-sonnet-5 low, measured against Opus 5.5 low; Haiku 4.5 only if qualification settles --effort.
2. Synthesis model. Default: claude-opus-5-5 high, one pin with deferral; Fable 5.1 needs a transport change and ran out of usage on 28 September.
3. OpenAI transport. Default: add codex-cli and re-point openai to it; keep openai-producer.ts accepted but unpinned. Alternative: two transports per provider.
4. Small OpenAI model. Default: none; Astra xhigh audits and challenges, keeping drafter and checker on different providers.
5. Timezone and times. Default: Europe/London, as §5.
6. Capacity. Default: discovery-window; weekly ceiling at shadow p95 × 1.25, never extended; a Factory admission limit, not a provider reservation.
7. Retries. Default: O5 for tool-free roles once Tr2, Tr8 and Tr9 show a finite bound (visible retries fail; wall-clock deadline), with the reviewed selector change L2 names.
8. Owner email (M13). Default: accept O2 for tool-free roles; search needs Alternative B.
9. Admission autonomy. Default: Planning admits within existing Objectives; for each Product's first 8 weeks the bundle carries a read-only admit digest the owner may overrule. Alternative: the owner approves every admit while calibrating.
10. Bundle cap. Default: five a week, one reminder, then owner-unanswered.
11. First Product. Default: software-factory, then one external Product with a confirmed brief.
12. External briefs. Default: the owner writes or confirms a one-paragraph public brief and allow-list; the Factory drafts one only under a granted read.
13. Sources. Default: public pages only; no login, paywall or sites forbidding automated access; 15-word quotes; 35-day cache.
14. A/B guardrail stop. Default: every start grant pre-authorises one stop-to-control.

12. Assumptions

• A1 A LaunchAgent reaches the Claude Keychain sign-in and CODEX_HOME.
• A2 The live limit event matches the fake rate_limit_info {status, rateLimitType, resetsAt, isUsingOverage} (test/helpers/claude-events.ts:101).
• A3 claude-sonnet-5 --effort low works through claude-cli on the subscription.
• A4 codex exec -m gpt-6-astra --output-schema runs headless on ChatGPT sign-in (only --help read).
• A5 WebSearch works under --restricted --tools WebSearch.
• A6 Scheduled runs share the owner's usage window; token counts are estimates, billing unknown.
• A7 Every threshold (3 Signals, 2 domains, 30 days, Jaccard 0.6, SimHash 3, 90 days, 8 weeks, ± 15%, 80%, the 30-day overage record) is a proposal.
• A8 The owner's timezone is Europe/London.
• A9 A separate discovery.sqlite journal is acceptable.
• A10 Products will export measurements; until then validation is Inconclusive.
• A11 --skip-git-repo-check may be needed for an empty -C directory; the audit decides.
• A12 Handover step 1 (delivery composition) lands before increment 9.
• A13 Each subscription lets paid overage be turned off and shows that setting to the owner; not established. If not, every model role stays unavailable.

13. Out of scope

Publishing, posting or contacting customers; surveys and interviews; advertising and spend; live traffic or release without an Action grant; Product-side instrumentation; logged-in, paywalled or paid sources; embeddings; Platform keys or exported sign-ins; models in CI or the cloud; automatic Objectives or customer-visible retirement; the Factory's nightly tools research; customer-value claims from local proof; closing any epic.