- 1
The approval threshold HUMAN GATE
Work proceeds by default after twenty-four hours without an answer from me only if all four hold: it is reversible, it costs under five dollars, it involves no contact with anyone outside the system, and it touches no patient information. Anything failing any one condition waits, however long that takes.
Why. The two failure modes of a founder-run fleet are approvals that cannot be given in time and builds abandoned when the founder is called away. This rule lets cheap, safe work continue and makes the expensive, irreversible work wait — explicitly, not by accident.
- 2
No cost estimate, no run ENFORCED IN CODE
Every dispatched task carries a finite estimated cost. The worker refuses a task without one. A daily spend cap and a per-task auto-approve ceiling read that estimate.
Why. An estimate that defaults to zero is indistinguishable from a deliberate zero, so the field is never defaulted — a missing value is a refusal, not a free pass. Discovered the hard way when the fleet's own repair tasks were silently killed for lacking the field.
- 3
Nothing settles as done without proof ENFORCED IN CODE
A task may settle as done only with a registered artifact bound to it, or as failed with a stated reason. "Done" with nothing attached is refused by the settle gate.
Why. Before the gate, sixty-four tasks had settled as done with nothing to show; the honest-failure path had never been used once. A queue where failure is impossible is a queue that cannot tell you anything.
- 4
Value is realized only when measured and verified by a different party ENFORCED IN CODE
Value rows carry a confidence. Only rows marked measured, and verified by a registered party other than the one that produced them, are summed into realized value. Estimates and self-reports are recorded and displayed, never totaled.
Why. Any system that pays attention to claimed value gets claimed value. The ledger is built so that inflating it is structurally pointless.
- 5
Prior art is bound before work starts ENFORCED IN CODE
When a task is claimed, the registry of previous artifacts is searched and matching prior work is attached to the task. Each task carries a deduplication key so the same job cannot be dispatched twice.
Why. The dedup machinery existed for months and was never wired into the claim path — the registry held a hundred artifacts and zero tasks had ever been bound to any of them. The rule is only real at the moment of claim.
- 6
The PHI boundary SEPARATE DATABASE
Patient information lives only in the HIPAA-isolated project, under its own credentials. Agents hold no credentials for it. Site forms state that they must not receive patient information. Clinical write-back requires a provider's approval per action and keeps an append-only history with rollback.
Why. Row-level policy in a shared database fails silently; a separate database fails loudly, because the key is either present or it is not. Loud is the property I want here.
- 7
Code lands as a pull request, never a push HUMAN GATE
Agents work on a branch inside an allow-listed workspace, run the tests, and open a pull request. I merge. Production deploys only from the main branch. No secrets in repositories; committed ones are rotated, not just deleted.
Why. A push to main is a production deploy across live sites. The merge is the last human step before a change reaches a patient-facing page.
- 8
One measurement ID per domain, chosen by hostname ENFORCED IN CODE
Each domain has exactly one canonical analytics property in the registry. Sites select the measurement ID from the hostname at runtime; a daily watch files a task if a live tag drifts from the registry or a domain goes quiet. Search Console is repointed to the canonical property rather than worked around.
Why. One site was "dark" for six weeks because its tag reported to a retired shared property. The drift watch exists so that never takes six weeks again.
- 9
Sessions are counted only after a human signal ENFORCED IN CODE
The analytics tag is not fetched until the browser produces a pointer, key, touch or scroll event, and never for a self-declared crawler. Declared crawlers, including AI answer engines, are still allowed to crawl — they simply do not open a session.
Why. Eighty to ninety-five percent of sessions across the portfolio came from datacenter scanners running real browsers. Every engagement and conversion rate was fiction until this landed.
- 10
Cheapest sufficient option; paid dependencies justified on capability MY CALL
If an owned machine or a free tool fully does the job, it does the job. A paid service is adopted only for a capability the owned option lacks, and the reason is recorded with the decision so an agent cannot reach for the paid path when the work gets hard.
Why. Convenience is a cost that recurs monthly forever. Capability is a cost you can price once.
- 11
Every revenue idea carries a budget, a deadline and kill criteria MY CALL
An idea enters the pipeline with a spend cap, a decision date and a written condition under which it is killed. Ideas past their date without a decision are surfaced, not left to accumulate.
Why. At one point nine ideas sat at "proposed", none launched, none killed, one with any kill criteria at all. A pipeline without expiry is a list of wishes.
- 12
Pricing is ruled once, recorded, and supersedes MY CALL
A pricing decision is written to a single record with its conditions and definitions; earlier offers are marked superseded so nothing re-implements them.
Current ruling, DrSupport denial recovery. A one-time implementation fee tied to defined deliverables, plus fifteen percent of recovered cash — defined as cleared payer funds actually received on an in-scope claim after DrSupport's first documented recovery action, less refunds, reversals, recoupments and chargebacks, and never routine collections. That definition is the offer. It supersedes every earlier retainer and contingency structure.
Stated as unfinished
What the rules do not yet cover.
Naming the gaps is part of the logic. These are open as of the date on this page.
Node identity is self-asserted
A shared publishing secret lets any node publish as any node, and two nodes can verify each other's value rows. Per-node credentials with a server-side mapping are the fix, and they change how the fleet authenticates — so it is a deliberate change, not a patch.
The settle gate runs in warn mode
It flags hollow completions rather than blocking them until the identity question above is closed; otherwise a forged artifact could manufacture settlement proof.
Two control planes
The governed hub and an older local engine each hold task history the other cannot see. Which one is authoritative for approvals, reusable artifacts and value events is a decision in progress.
The practice-management bridge has not run against a live practice
It is production-ready and gated behind the PHI project's upgrade and a synthetic end-to-end proof. This quarter is spent on that go-live, accepting that it pays nothing until it is done.