PROTOTYPE-TO-PRODUCT-01 — North Star¶

Date: 2026-08-13 Standing: Fixed point produced by the 2026-08-13 flyover session (Tim + Claude, in camera; informed by the GPT analytical review of 2026-08-12 and the Alex condition review of 2026-08-11). This document records the destination and the doctrines. It is not a build specification, not a brief, and not a work order. Lower-altitude passes are tested against it; it is amended only by deliberate ruling, not by drift. Amended 2026-08-13 (same session, by Tim's ruling): §8 (the operating model) added; gate 2 extended with data residency; gate 1 substantially settled by founder statement. Amended 2026-08-14 (morning, by Tim's ruling): tile standard added to §3 (four edges, tenant-ignorance, empty-tile spec) with the third-party-ecosystem observation. (Log line added retrospectively — the librarian caught the undercount at filing.) Amended 2026-08-14 (afternoon): gate 2 closed with the fleet-study findings (three jurisdictions; migration runner ours to build; token quota 500; R2 no-versioning → offboarding is a designed process; SPIKE-P2P-01 remaining). Amended 2026-08-14 (by Tim's ratification): V-P2P-001 (three-lane ceremony — canon five gates / shared-substrate gated / scratch minimal; restoration trigger is contact, not calendar) and V-P2P-002 (second Cloudflare account for the rebuild) ratified. Gates 1 and 4 retired by ruling. Gate 2 updated with measured residency findings and the resolved isolation decision. Canonical design ceiling set: 4,000 tenants / 20,000 users (from Tim's dated read of the live TGA register, 2026-08-14: ~3,985 operating RTOs — 3,887 current, 76 re-registration pending, 22 suspended; a founder observation, dated — not a pipeline measurement; no enumeration instrument yet reproduces it). Tim's all-data-dead ruling folded into anchor one — supersedes the Radar cold-store interim. Current rulings of record live in where-we-are.md; this document carries the durable form. Amended 2026-08-14 (evening — V-P2P-012, filed at FILING-PASS-01): §1 verification vocabulary replaced with the instruments the record actually contains (the "cross-model triangulation" claim returned zero hits across the 17-document ingestion set); §5 reworded raw-first per V-P2P-011. Language note: figures quoted from the source reviews (database counts, row counts, bucket counts) are reported, not verified from this seat. Where a claim is inference rather than measurement, it is marked.

1 · The finding¶

RTOpacks is a validated prototype, not yet a product. The conceptual model — the compliance spine, the closed loop, provenance, regulatory truth versus customer assertion, audit-as-byproduct — is coherent and proven: an outside reviewer reasoned usefully about the entire product without reading a line of code, which is experimental evidence that the thinking exists independently of its implementation and can therefore be re-implemented underneath without the product changing.

The substrate beneath that thinking records the history of how the software was built, not a deliberate model of who owns data, what authority it represents, how long it must live, how it is recovered, or what it may touch. Three independent reviews (GPT, Alex, this session) converged on that diagnosis by different roads. The diagnosis is settled. Further review adds agreement, not information.

The failures found were never in the shape of the architecture. They were in three places: connective tissue that should exist and does not (no customer object, no tenancy, one god API); instruments that report they ran rather than that they worked (backups, syncs, archivers); and the written record, which has been less reliable than the system it describes.

What is sound, and stays sound: the product model, the module responsibilities, the environment-isolation discipline, the declared-bindings estate, the hard separation rule (which is correctly scoped — narrower than either reviewer believed), and the ingestion discipline built in the last weeks (machine-readable corpus, byte-level diffing, dual-instrument agreement, second-witness cross-column comparison, prediction-then-measure against frozen baselines, guard polarity proven offline before the first call, independent tripwires that fire on parses wearing a success flag, digest re-hashing at every gate). That ingestion discipline is the prototype's most valuable output — more valuable than its code or its data, both of which are now disposable.

2 · The window¶

Reported and consistent across both reviews, marked as inference until the settling query is run: the platform is deployed and substantially unpopulated. Every production customer-data bucket was reported empty; customer-state row counts were reported at fewer than five hundred rows.

If the inference holds, two things follow, pointing in opposite directions. Every tenancy exposure is currently theoretical, which is the safety margin. And this is the cheapest the restructuring will ever be, because there is nearly no live state to migrate — which is the clock. Both expire the day the first real customer arrives.

The settling query — row counts on client files and billable seats — has not been run. It is the cheapest certainty available and precedes everything.

3 · The destination¶

The commercial product is a plane architecture. Stated as bands, from the front desk down:

Control plane. One place that knows who every customer is, what they have bought, what they may reach, where their resources live, what schema version they run, and what lifecycle state they are in. Tenants, identities, memberships, subscriptions, entitlements, product instances, resource registry, schema/migration state, provisioning state. Identity is layered and immutable: client id, product-instance id, domain ids — never derived from names. Billing, tenancy, and offboarding are one problem living here, not three. This plane is where the money is, and it has never existed; that is why billing has always felt unanswerable.

Product planes. One sealed operational plane per RTO per product. The physical unit is one RTO, never one feature: an RTO's courses, people, learners, assessments, policies, workflows, compliance state, provenance, and output metadata are one business system — transactionally coherent, backed up together, exported together, offboarded together, owned by one authority. InstaLearn is a separate sealed plane even for the same customer: no cross-plane domain joins, no implicit person matching. The hard separation rule cuts between rooms, never through one.

The backplane (shared platform truth). The read-only reference layer every tile draws from, InstaLearn excepted where the separation rule requires. It keeps the kinds of truth distinct because they carry different authority, provenance, and recovery demands: mirrored (TGA — units, quals, RTOs, CVIGs, and release history), standards, observed (what we saw, dated, append-only), authored (what we wrote), derived (what machines produced, clearly labelled). Owner-writes discipline throughout; no tenant-owned state ever lives here. Published as versioned editions, never silently mutated.

Operations plane. Telemetry, diagnostics, security, jobs — and the truth rail: the mechanism that reads the system's own output back to it. This small box answers the deepest finding of the review cycle and carries more weight than its size suggests. Every product instance moves through a standard lifecycle: provision → migrate → verify → operate → recover → suspend/reactivate → export/offboard. Offboarding is a first-class stage, because in a regulated market it is law, not politeness. Humans manage exceptions, not tenants.

Analytics sits downstream, fed by events and pipeline — never by querying thousands of live tenant databases. This constraint exists from day one because Radar at fleet scale lives or dies on it, and it shapes how tenant planes emit events from their first schema.

Traffic follows the planes. The single internal API is retired as a destination. Reachability is not authority: capability-oriented seams, one narrow contract per plane — control speaks entitlement and provisioning; the tenant gateway grants access to the selected tenant only; backplane services are read-mostly reference; operations is separately privileged and heavily audited. Not microservice sprawl: the right number of API surfaces is the number of plane contracts, roughly four or five, each written down. A worker's bindings are its permissions; least privilege becomes physics, not policy.

Each tile has four edges, and only four (amended 2026-08-14, Tim's ruling — the tile standard). Truth edge: the backplane, read-only, versioned editions. Tenant edge: the tile's operational state. Integration edge: external I/O — the UCCA engine across the fence, model services, SCORM packagers, per the EXT-API rule — and the only edge where bespoke I/O may appear, every filled slot declared in the tile's manifest, never buried in code. Operations edge: the face the user never sees — telemetry out, health checks answered, lifecycle commands in, test hooks, usage instrumentation. Each edge maps to one plane.

Tiles are tenant-ignorant. A tile never resolves a customer, never knows where tenant resources live, never touches routing. The control plane resolves user, client, and entitlement into a ready-made tenant context — database handle, bucket, permitted capabilities — and hands it through the tenant edge. Every tile is therefore written as if the product has exactly one customer; multi-tenancy is something the surrounding machinery does to tiles, solved once, in one place. Billing is not a tile concern: entitlement is settled at the front desk before tile code runs.

The empty tile is a specification — the paved road every new capability starts from, with all four edges pre-built, tested, and constrained, so the work of a new tile is the domain logic in the middle. Its acceptance ritual: can what we've scoped get everything it needs from the standardised edges? If not, either the scoping is wrong or the standard is amended by ruling, for every future tile at once. A tile's manifest declares everything it touches, so anyone — human or agent — knows a tile's full reach without opening its implementation. The empty-tile spec is a natural early descent and the paper every future brief sits on.

Dated observation, not a commitment (2026-08-14): the tile standard, built rigorously for ourselves, makes a third-party tile ecosystem a future option at near-zero additional architectural cost — the same manifest-and-sandbox discipline that constrains our tiles would let outside developers build against documented edges without exposure of the platform's internals. Parked; noted because the option is free and affects how the platform is valued.

A tile built against these edges needs no knowledge of the whole system, which is what makes one-tile-at-a-time work real, and what makes a three-seat company sufficient.

4 · The doctrines¶

Learned this cycle, held from now on.

The truth-kind litmus. Before keeping, moving, or protecting any data, ask: can it be regenerated from things we still hold, at equal or better quality? Regenerable → disposable, rebuild it clean. Observed (the world as it was on a date) → irreplaceable by nature; sacred, or deliberately and explicitly abandoned as a business judgment, never lost by accident. Customer-owned → isolated, exportable, offboardable.
Rebuild over migrate. Mirrored truth is never migrated; it is re-ingested into the right shape. A foundation born from a scripted end-to-end ingestion has its reconstructibility demonstrated at birth — the pipeline is the asset, and rebuild-from-source certifies the pipeline where restore-from-backup only certifies the past.
A capability described and never exercised is indistinguishable, in the record, from one that exists. Recovery, backup, and every claimed capability must be demonstrated experimentally before being relied upon. (Alex's general form; adopted verbatim.)
Boundaries are enforced by the substrate, not by discipline. A boundary that exists only in conversation is a paraphrase, and paraphrases drift. Planes become physical: bindings, schemas, permissions — crossing one is impossible, not impolite.
Measure outcomes, not execution. A job that reports its own control flow rather than its effect on the world is a defect, whoever wrote it. Nothing certifies itself; the operations plane reads outputs back.
Editions, not mutation. Truth presented to users changes on a visible cadence with recorded supersession — the sector's own grammar of releases and versions. This is the correct translation of the retired "immutable, never touch" rule: it was always about trust, never about the bytes.
Demand-driven schema. New stores begin with one row and grow columns as the consuming tile demands them; the ingester is written last, against the discovered shape. The inverse of prototype accretion.
Seams live where explanations break. A boundary is well placed when one side can be fully explained without explaining the other. The stranger test is the acceptance test: the rebuild is done when an outsider can predict how tenancy behaves without knowing our history.
A measurement names its population (existing rule, re-earned this cycle at cost). An intelligence product's absence claims are only as good as the completeness of the population watched. Data built over a wrong population is not partially valuable; it is poisoned.
The record is read back. Discipline applied to work as it is produced and never as it is cited is how three load-bearing numbers went wrong. Figures carried between documents are re-derived or dated, and the operating model includes a loop that audits its own paperwork.

5 · The two anchors¶

The order of work is forced by the dependency structure, not by preference.

Anchor one — rebuild the backplane. Fresh, scripted ingestion from TGA of units, quals, RTOs, CVIGs, and release history, captured raw first into a clean machine-readable Pith with provenance stamped on every row (source url, fetch date, body hash, run id); parsing follows as separate, re-runnable passes through parsers proven per dataset, each publishing its own derived editions. Published as versioned editions. This work sits entirely in known territory — our upstream, measured transport, and verification instruments proven on both polarities — and touches nothing in the frozen estate: zero blast radius. Decisions already taken within it:

The KN enriched corpus is dropped, not carried. Generated by an inferior model against an incomplete Pith; irreplaceable but not valuable — a sunk cost, not an asset. The new Knowledge Navigator is rebuilt later against the clean corpus by the one-row method, and rehydrated by an ingester written against the discovered schema. The old data is deleted only at the rewire-and-drop stage, never before.
The "KN immutable" rule is retired by translation, not deletion. Its true content — text must not shift under the user's feet — survives as the editions doctrine and now governs the whole backplane. To be filed as a recorded ruling when filing resumes; noted here so a future reader finds a decision, not a contradiction.
Radar's machinery and its observation history are both retired (all-data-dead ruling, 2026-08-14, superseding the cold-store interim). The history was gathered against an incomplete register from an unreliable extraction; its holes cannot be quantified or repatched, so measuring them is waste. Deliberately abandoned as a business judgment — doctrine 1's abandonment clause, exercised in writing. Radar's first complete, enriched pass over the true register becomes both its dataset and its demo, sequenced after the new Pith is proven complete.

Anchor two — design the control plane. Tenancy, billing, and offboarding as one entity-shaped problem. Working hypothesis: one tenant D1 and one tenant R2 per RTO product instance, canonical schema across the fleet, control plane routing and entitling access. Held as hypothesis, not decision, pending the two gates below. Nothing in anchor one prejudices anchor two.

The prototype's code is reference material. Conceptually sound, programmatically pre-tenancy. Existing implementations serve as executable specifications of what each tile does; production tiles are written against the backplane with tenancy native. Nothing conceptually wrong, everything programmatically mortal.

6 · The horizon¶

One RTO, run start to finish: signup → provisioning → course design in Studio → workforce in People → evidence in Record → generated artefacts → audit output → export/offboarding — through every plane, across every seam. That thread is the definition of "first customer," the acceptance test of the whole architecture, and the point on the horizon all lower-altitude passes steer toward. Nothing in the estate has ever run end to end. When one thing has, the product exists.

7 · The gates¶

Open questions that bound the design. Each is named with what it settles. None is blocked; all are cheap relative to what they de-risk.

The population query — row counts on client files and billable seats. Settles whether the window in §2 is real. Substantially settled 2026-08-13 by founder statement: no clients, ever; only synthesised test clients in the dev client db. Residual: a one-line confirm from Alex that production stores match that statement, converting it to a measurement for the record.
The Cloudflare fleet study — CLOSED 2026-08-14 (Driver-seat measurement; findings filed in repo, fleet-study-close-01). Residency: D1 and R2 offer three jurisdictions — eu, fedramp, us — none Australian. The oc location hint is ruled as the create-time default for every new D1 and R2 (no documented means of change after creation), best-effort placement only, never to be described to a customer as a residency guarantee. D1 read replication cannot be geographically bounded without a jurisdiction — enabling it is a residency decision, not a performance one. Isolation (V-P2P-002, ratified): D1/Workers tokens are account-scoped only, so a shared account can never give a physics wall — the rebuild runs in its own account ("RTOpacks Product", created 2026-08-14); the old account is a read-only morgue; domains move once, at cutover, five gates. Fleet mechanics: no platform fleet-migration path exists — the migration runner is ours to build (resumable, rate-limit-aware, own applied-migrations ledger); token quota 500/account → isolation carried by bindings, never token-per-tenant; R2 has no object versioning — retention is built from immutable keys, lifecycle rules and bucket locks, and a locked bucket cannot be emptied, so tenant offboarding is a designed process. Remaining: the Workers-for-Platforms spike (a documented capability is not a demonstrated one — SPIKE-P2P-01 converts it; scratch lane, new account, awaiting token). Design ceiling for all limit checks: 4,000 tenants / 20,000 users.
The regulated/general boundary ruling — the minimum participation facts required for regulated operation versus broader learner-state concepts. Partly legislative interpretation; Tim's ruling, no other seat's. Settles the exact wall between the regulated plane and InstaLearn, and what the shared front desk may hold about a person.
The Radar population test — RETIRED 2026-08-14 by Tim's all-data-dead ruling. The test's outcome was derivable without measurement: the history was gathered against a register known incomplete, extracted from a non-machine-readable source, and its chronology cannot be reconstructed. Deliberate abandonment under doctrine 1, properly exercised — not loss by accident. Radar restarts with a complete fresh pass over the true register.
The KN readers census — what, besides the Navigator interface, reads the enriched columns today. Converts "dropping it is safe" from an absence claim into a measurement before the rewire stage.
The capture-depth check — whether our byte-capture history of TGA covers what the current mirror accumulated, or whether any part of the old mirror is quietly observed-truth. Settles the last carve-out in "rebuild everything fresh."

8 · The operating model¶

The company is a plane architecture too. A three-seat operation running a fleet-scale SaaS is only possible if the organisation applies to itself the same doctrines it applies to the substrate. Adopted by Tim's ruling, 2026-08-13.

The fourth seat is the test suite. Verification that routes through humans does not scale; the gate model — a human reading bytes — is the artisanal version of what must be industrialised. Every seam contract, every doctrine, and every tile is born with automated tests that run on every change. The gates do not disappear: they move up a level, from re-reading the work to auditing the tests that read the work. Human review remains for canon, for judgment, and for what tests cannot see. A test is a gate that runs in seconds, never tires, and lets two agents work in parallel without the human holding both in his head.

The founder is de-bottlenecked by design, not by endurance. Tim is currently the organisation's god API — every instruction, approval, and relay routes through him. That was correct for the prototype, for the same reason the single internal API was: the boundaries were not yet known. They are now, and the same refactor applies. Agents receive bounded autonomy within planes, guarded by substrate-enforced boundaries and the test suite; Tim manages exceptions, rulings, and direction, not traffic. The founder does not scale; the system must. Where a task requires the founder's presence to be done safely, that is a defect in the system, not a duty of the founder.

The platform is itself a regulated entity. ASQA regulates the customers; the Privacy Act and the notifiable data breaches scheme regulate us, because the platform holds learners' personal information — enrolments, USIs, LLND results, assessment evidence. Buyer diligence will ask two questions before any signature: where is my data physically stored, and what happens when you are breached. Both need prepared answers; the first is gated on the residency finding in gate 2.

Support is a product surface, not an inbox. Thousands of clients generate questions at a volume that eats a solo operator alive if support means answering things. It is designed instead: self-serve documentation, in-product guidance, a status page, and agent triage of the queue — planned from the start, because it is vastly cheaper as architecture than as crisis response. Humans manage exceptions, not conversations.

Users are instrumented as well as systems. The operations plane observes whether systems work; it must also observe whether users succeed — what gets used, where people stall, what nobody touches. At a hundred customers this data replaces guesswork about what to build next. It obeys the observed-truth logic: it cannot be retroactively collected, so it is in the plane from day one.

Continuity has an answer. A regulated-sector supplier with a bus factor of one will eventually be asked by a serious buyer what happens to their compliance records if something happens to the founder. A modest, documented continuity answer closes deals that silence loses. To be drafted once, kept current, and never needed.

The catch-22 — a second human must be funded from sales, and sales require the capacity a second human would provide — is resolved in one direction only: automation is the second hire. The seat being run here is a new kind of role, learned on the job; the luxury of time to train and explain is bought by leaning into automation for everything that permits it.

9 · What does not change¶

The estate is frozen: nothing moves, nothing is deleted, no briefs are cut against this document. The KN migration stays parked. Old databases die only at the rewire-and-drop stage, when nothing binds to them — deletion is the last event in the programme, never the first, which is also why nothing can break the interface on the way. The fence protocol, the hard separation rule, the ops-surface rule, and the ext-api rule all survive into the destination architecture — several of them finally gain the physical enforcement they always deserved. Canon edits arising from this document (the KN rule translation; in due course, the plane model itself) are filed as recorded rulings through the normal gates when filing resumes.

10 · How this document is used¶

Each descent from this altitude picks one problem, works it against this document, and produces its own decisions and eventually its own briefs. Where a descent finds this document wrong, the document is amended by ruling and the change is dated — it is a fixed point, not a sacred one. The flyover is not repeated; the diagnosis is not relitigated; the reviews that fed it (GPT 2026-08-12, Alex 2026-08-11) are the record and this is the takeaway.

Least sure, and what would make it wrong: the window. Everything strategic — design-on-paper, clean sweep, rebuild-over-migrate — hangs on the platform being substantially unpopulated, and that remains an inference from empty buckets and unbuilt signup. One query settles it. If meaningful customer state exists anywhere the reviews did not look, this document overstates our freedom and the sequencing in §5 must be revisited before anything else is.