Sanderson Group · Sales Reporting — Remediation
Six phases from "we can't prove what we shipped" to "provable by construction". Each phase is planned in detail only when the previous phase's real results exist — the plan refuses to pretend it knows the future.
Program position: Phase 0, 50% by task count. Later phases show 0% because their tasks don't exist yet — they are minted at each replan gate from real receipts (the ratified plan: "exact leaf tasks after Phase 0 would be fiction"). This rail is also the program-level critical path — phases are strictly sequential by design, each gated by the previous phase's receipts. For the live task-level critical path inside Phase 0, see Build Progress →
control plane 4/4 · investigation spikes 6/6 · verification harness 3/6 · release manifest 0/1 · product fixes 0/6 · enforcement gate 0/1 · history census 0/1 · Phase-1 replan 0/1 · 16a re-accept 0/1 · phase exit 0/1
Make 'done' and 'delivered' PROVABLE. Until now the system could produce a good report but couldn't prove the file a human checked is the file that ships. This phase builds the measuring instruments everything later is judged by.
The false-acceptance family (the #1 finding): checked-file ≠ delivered-file; unprovable completion; forgeable sign-offs.
The control plane (task ledger, receipts, un-forgeable authority) → six read-only investigations → the verification harness (HAR) → a release manifest (MAN) → the worst product-precision fixes (VRT) → enforcement gate + history census → the Phase-1 replan → Adam's two decisions.
GATE-001 proves every criterion; Adam signs D-16A (re-accept the held 16a report) and D-P0-EXIT.
WEEKLY REPORTS RESUME — the production pause lifts at Phase-0 exit, not at the end of the program.
control plane 4/4 · investigation spikes 6/6 · verification harness 3/6 · release manifest 0/1 · product fixes 0/6 · enforcement gate 0/1 · history census 0/1 · Phase-1 replan 0/1 · 16a re-accept 0/1 · phase exit 0/1
Full live detail — critical path, work journal, tap-through task cards: Build Progress →
Stop the system from ever silently destroying or losing data. Today a crash mid-write, a deleted email, or an expired sync token can quietly corrupt what's stored.
Tombstones/410 recovery, crash-safe database writes (the six D1-incompatible transactions get their proven batch/CAS redesigns), retention/versioning, a protected census & repair of history.
Exact tasks are minted by RPL-001 using Phase-0's receipts — 7 owner tasks for orphaned wrong-tests are already drafted, and the D1 redesign proof (SPK-010) feeds straight in.
All charter Phase-1 criteria; Adam receipt required before any protected migration/repair runs.
The stored record becomes trustworthy under failure — the foundation identity work needs.
Task IDs for this phase do not exist yet — they are minted at its replan gate from real receipts. Everything above is banked input, not a promise.
Replace 'the code guesses from strings' with typed business truths, one vertical at a time. This is where the frozen person-identity work (the two-Susan-Joneses / wrong-Brian class of bug) comes back to life as a first-class typed authority.
String-driven status/stage/money/week parsing; person identity & collision handling; movement/loss fact transport.
CRM status is deliberately first (smallest, well-understood). Each vertical dual-runs new logic beside old, switches one caller, deletes the old parser, and dispositions its history — no big-bang rewrite.
Every vertical proven equivalent-or-better, old parsers deleted, history dispositioned.
Buyer identity becomes provable — the root cause of the report's precision bugs is gone.
Task IDs for this phase do not exist yet — they are minted at its replan gate from real receipts. Everything above is banked input, not a promise.
Today there are FOUR different ways a weekly report can be produced (fresh, offline replay, editorial, acceptance) that can silently disagree. This phase collapses them into one pipeline with one pure renderer.
The four-path render fork — the root that made false acceptance possible in the first place.
One assemble/enrich service; one final-view pipeline; a pure renderer; DOM-equality proof; then DELETE the forks.
Canonical document parity (or typed 'unavailable'), DOM equality, old paths deleted.
What you review is provably what everyone gets, by construction.
Task IDs for this phase do not exist yet — they are minted at its replan gate from real receipts. Everything above is banked input, not a promise.
Treat AI output like untrusted input from the internet. Every claim the AI writes into a report must carry a verified quote from real evidence; failures become visible quarantine, never silence.
Hostile-input framing, atom/receipt verification, visible retry/quarantine, cost budgets, subject-scoped tools.
Exact request envelope + source/ownership verifier first; recorded replay for regression; live model calls separately authorized.
Charter hard gates green on recorded replay.
AI-written content becomes auditable evidence, not prose to take on faith.
Task IDs for this phase do not exist yet — they are minted at its replan gate from real receipts. Everything above is banked input, not a promise.
Pay down the structural debt so the system stays healthy: split the god modules, delete superseded code, and turn the engineering rules into mechanical gates that fail the build when violated.
Dependency law, the 500-line module gate, zero anonymous exceptions, superseded surfaces deleted.
Dependency/size baseline once the real seams exist; split by use-case; shrink the exception list to zero.
All rulers green; every earlier phase's receipts still green.
The codebase future agents inherit is one they can't quietly rot.
Task IDs for this phase do not exist yet — they are minted at its replan gate from real receipts. Everything above is banked input, not a promise.
Live Phase-0 board (tap any task): Build Progress →
The five governing documents: Documents Reader →