Commit Graph

6 Commits

Author SHA1 Message Date
Claude
aa024703fc
Business Viability Kit: discovery-phase operating artifacts
Saves the DEALIX_BUSINESS_VIABILITY_KIT.md (Weeks 4-12 customer discovery
operating manual) and produces only the operational artifacts it explicitly
names. Per the kit's Appendix C: no new plan documents, no Wave A-E work,
no features without customer pull.

Added:
  Customer Viability operating artifacts
    - docs/customer_learnings/hypotheses.yaml - 12 hypotheses tracked
      to SUPPORTED/FALSIFIED/AMBIGUOUS with interview-log citations
    - docs/customer_learnings/interviews/_template_ar.md - 45-min Arabic
      discovery script + post-call log schema
    - docs/customer_learnings/interviews/_template_en.md - English version
    - docs/customer_learnings/founder_dashboard.md - weekly Monday printable
      dashboard (kit Sec 8)
    - docs/customer_learnings/pricing_discovery.md - Van Westendorp PSM +
      value-based sanity check + A/B model matrix
    - docs/customer_learnings/unit_economics.md - per-customer economics,
      LTV/CAC ratios, 12-month scenario template
    - docs/customer_learnings/defensibility_scorecard.md - 5 moats x 2
      questions, quarterly re-measurement

  Registry updates
    - docs/registry/TRUTH.yaml customer_validation section: hypothesis
      counters + discovery-interview counter + kit reference
    - docs/customer_learnings/README.md updated to link new artifacts

Gates after change:
  architecture_brief.py       40/40
  release_readiness_matrix  102/102  (added 8 new BVK artifact checks)
  v005_truth_registry_audit   19/19 SUPPORTED

Agent scope going forward per kit Appendix C: customer-surfaced P0 defects,
UX polish appearing in 2+ interviews, perf issues on staging, pentest
remediations. No new plans. No Wave tasks.
2026-04-17 11:26:32 +00:00
Claude
3ef62652aa
Phase 2 Execution Waves: 90-day plan + Verification Protocol scaffolding
Saves the DEALIX_PHASE2_EXECUTION_WAVES.md 90-day plan and scaffolds every
artifact the coding agent can produce. Wave A-E execution is explicitly
blocked until the Week-12 Phase Gate (§3) returns Green.

Added:
  §1 Verification Protocol (V001-V007)
    - scripts/v001_secret_scan.sh — trufflehog + gitleaks full-history scan
    - backend/tests/security/test_rls_fuzz.py — 10K cross-tenant fuzz
    - docs/verification/V003_pentest_engagement.md — vendor RFP + scope
    - docs/verification/V004_no_founder_demo_test.md — 3-tester protocol
    - scripts/v005_truth_registry_audit.py — independent audit tool
    - infra/load-tests/baseline.js — k6 perf baseline
    - frontend/tests/a11y/baseline.spec.ts — Playwright+axe baseline
    - docs/baselines/README.md + docs/verification/README.md

  §2 Founder Decision Sprint (FD001-FD005)
    - docs/internal/legal_entity_decision.md — MISA/DIFC/Delaware brief
    - docs/internal/trademark_status.md — SAIP filing kit tracker
    - docs/hiring/{design_engineer, backend_engineer, head_of_cs}.md

  §3 Customer Validation (CV001-CV004)
    - docs/customer_learnings/pilot_agreement_template.md
    - docs/customer_learnings/pilot_template/success_criteria.md
    - docs/customer_learnings/pilot_template/kickoff_checklist.md
    - docs/customer_learnings/friction_log.md + feature_requests.yaml
    - docs/customer_learnings/weekly_review_template.md

  Truth registry updates
    - docs/registry/TRUTH.yaml — new verification_protocol,
      founder_decision_sprint, customer_validation sections

Gates (post-change):
  architecture_brief.py     40/40
  release_readiness_matrix  94/94 (added 30 new scaffold checks)
  v005_truth_registry_audit 19/19 SUPPORTED
2026-04-17 11:13:27 +00:00
Claude
40ab7b86c2
feat(dealix): Phase 1 completion + Phase 2 foundation scaffolded
PHASE 1 COMPLETION:

TASK-005 — Live gitleaks scan:
  Scanned 146 commits with gitleaks v8.20.1
  Result: 1 finding — FALSE POSITIVE (model name llama-3.1-70b-versatile
    in test fixture, not an API key)
  Added to .gitleaksignore
  rotation_log.md updated with scan results
  VERDICT: No real secrets in git history — repo clean for extraction

TASK-006 — Legal templates (bilingual):
  docs/legal/templates/IP_ASSIGNMENT_AGREEMENT.md — bilingual IP assignment
  docs/legal/templates/PRIVACY_POLICY_EN.md — PDPL/GDPR-aware template
  docs/legal/templates/PRIVACY_POLICY_AR.md — Arabic privacy policy
  docs/legal/templates/TERMS_OF_SERVICE_EN.md — SaaS ToS with MENA pricing
  docs/legal/templates/DPA_EN.md — Data Processing Agreement with annexes
  All marked as "DRAFT — must be reviewed by Saudi counsel before use"

TASK-006 — Trademark Filing Kit:
  docs/legal/templates/TRADEMARK_FILING_KIT.md
  Covers: DEALIX (Latin) + ديلكس (Arabic) + logo
  Classes 9, 42, 35 across KSA, UAE, Egypt, Jordan, Kuwait
  Application text ready to paste into SAIP + equivalents
  Agent recommendations (AGIP, Saba, Bird & Bird, Al Tamimi)
  Budget: ~90-120K SAR for full MENA coverage

Founder Decision Package:
  FOUNDER_DECISION_PACKAGE.md — single file with 4 decisions:
    1. GitHub org name (recommend: dealix-io)
    2. Entity structure (MISA vs DIFC vs ADGM)
    3. Saudi counsel engagement (15-30K SAR)
    4. Trademark filing (30-50K SAR initial)
  Total founder time to unblock: ~1 week + ~50K SAR

PHASE 2 FOUNDATION:

DEALIX_PHASE2_BLUEPRINT.md — 18-month category leadership plan:
  10 parallel streams (Frontend, Product, AI, Enterprise, Integrations,
    Scale, Commercial, Customer Platform, Trust, Category POV)
  Executable NOW vs Requires External Services vs Wait-for-PMF
  Phase 2 completion criteria (NPS >=50, NRR >=120%, etc.)

TASK-F201 — Design System foundation (scaffolded):
  packages/design-system/tokens/primitive.json — W3C Design Tokens format:
    Brand palette (50-900), neutral (50-950), critical/warning/success/info
    Space, radius, motion (duration + easing) tokens
    Typography with Arabic fontFamily + arabic-adjustment (1.15) for size
    Arabic line-height (1.8) for diacritics
  packages/design-system/tokens/semantic.json — light + dark themes:
    surface, fg, border, interactive, status semantic layers
  packages/design-system/README.md — principles + integration guide

TASK-CAT1340 (prep) — @dealix/arabic-ui package (scaffolded):
  packages/arabic-ui/src/normalize.ts:
    Diacritic-insensitive search (fatha/kasra/damma stripped)
    Hamza variants normalized (أ/إ/آ → ا)
    Waw-hamza, ya-hamza, taa-marbuta, alef-maksura handled
    arabicMatch() + arabicCompare() helpers
  packages/arabic-ui/src/numerals.ts:
    Western/Arabic-Indic/Eastern Arabic-Indic conversion
    formatCurrency() for SAR/AED/EGP/USD/JOD/KWD
    formatNumber() with locale awareness
  packages/arabic-ui/src/direction.ts:
    detectDirection() via Unicode bidi algorithm
    isolate() using U+2068/U+2069 for mixed-direction content
    isRTL() locale check
    hasArabic() presence check
  Future: release as OSS after 12 months of internal use

TASK-CAT1310 — Manifesto (bilingual draft):
  marketing/manifesto.md — 4 principles in Arabic + English:
    1. Arabic first, not Arabic translated
    2. Decisions backed by evidence, not opinion
    3. AI recommends, systems commit, humans approve
    4. Saudi compliance built-in, not bolted on
  Publication target: dealix.io/manifesto + dealix.io/بيان

TASK-CAT1320 — Dealix Labs (scaffolded):
  docs/labs/README.md — research program structure:
    Annual State of Arabic Enterprise AI report
    Quarterly Arabic LLM Benchmarks
    OTel semantic conventions proposal
    Open source: @dealix/arabic-ui + @dealix/design-system

TRUTH.yaml updated:
  Added Phase 2 capabilities section (all as 'partial' or 'roadmap')
  Added ISO 27001/17/18 and bug bounty to security_claims (all false)

All gates GREEN:
  Architecture Brief: 40/40
  Release Readiness Matrix: 71/71 (up from 53/53)
  Release Readiness Gate (blueprint): PASS
  Truth Registry Validator: VALID

https://claude.ai/code/session_01W1rJthWDkasijTdXCfxVHs
2026-04-17 10:52:28 +00:00
Claude
fee51ffb06
feat(dealix): execute ALL automatable blueprint tasks
TASK-001 (prep) — Repository Extraction Script:
  scripts/extract_dealix_repo.sh — automates git filter-repo extraction
  of Dealix-only paths to new GitHub org. Preserves commit history.
  Awaits founder decision on org name.

TASK-003 — Python Dependency Modernization:
  backend/pyproject.toml — full project spec with pinned versions:
    - fastapi, pydantic, sqlalchemy, asyncpg pinned
    - OpenTelemetry packages now included
    - pytest==8.3.4, pytest-asyncio==0.24.0 (stable)
    - Dev group with ruff, mypy, testcontainers
  Ready for uv sync to generate uv.lock.

TASK-004 — Node Dependency Hygiene:
  frontend/package.json — pinned packageManager=pnpm@9.12.0
    and engines.node >=20.10.0 <21.0.0

TASK-005 — Secrets Audit Infrastructure:
  .pre-commit-config.yaml — gitleaks + detect-private-key + detect-aws
    + ruff auto-fix + truth-registry-validator local hook
  docs/internal/rotation_log.md — rotation tracking template with
    scan commands (gitleaks, trufflehog3) and forbidden practices

TASK-006 — Legal Foundation Tracker:
  docs/internal/legal_status.md — tracks:
    - Company incorporation options (MISA vs DIFC vs ADGM)
    - IP assignment requirements
    - Privacy Policy / ToS / DPA review status
    - Trademark filing (KSA, UAE, Egypt, Jordan)
    - PDPL / ZATCA / NCA / SDAIA regulatory status
    - Professional indemnity + cyber + general insurance

TASK-010 (complete) — Truth Registry Tooling:
  scripts/validate_truth_registry.py — validates TRUTH.yaml structure,
    status values, and claims_registry.yaml alignment
  .github/workflows/truth-validation.yml — CI workflow on changes to
    truth registry or claims registry

TASK-101 — Release Readiness Gate (blueprint-spec):
  scripts/release_readiness_gate.py:
    - Required artifacts check (11 files)
    - TRUTH.yaml field validation
    - Forbidden claims scan in public docs
    - Architecture brief sub-gate
  Complements release_readiness_matrix.py (runtime checks).

Blueprint saved:
  DEALIX_EXECUTION_BLUEPRINT.md — authoritative execution doc

Updated:
  release_readiness_matrix.py — now 53/53 checks (was 41/41)
  docs/execution_log.md — full task tracking

All 3 gates GREEN:
  Architecture Brief: 40/40
  Release Readiness Matrix: 53/53
  Release Readiness Gate: PASS

Remaining P0 founder decisions (cannot be automated):
  - TASK-001: GitHub org name + run extraction
  - TASK-006: Entity incorporation + counsel engagement

https://claude.ai/code/session_01W1rJthWDkasijTdXCfxVHs
2026-04-17 10:39:21 +00:00
Claude
38e9d02075
feat(dealix): close ALL 4 Tier-1 runtime gaps (Programs E, F, G, K, J)
Program F — Multi-Tenancy RLS (Row-Level Security):
  alembic 20260417_0002_add_rls.py: Enables RLS on 23 tenant-scoped tables.
  database_rls.py: set_tenant_context() helpers for SET LOCAL app.tenant_id.
  middleware/tenant_rls.py: Extracts tenant_id from JWT on every request.
  Default-deny when no context. PostgreSQL only (CI safe on SQLite).
  Result: OWASP A01:2025 — access control enforced at DB layer.

Program G — Idempotency Standard:
  models/idempotency_key.py: IdempotencyKey table with TTL + SHA256 hash.
  services/idempotency_service.py: get_existing/store with request fingerprint.
  middleware/idempotency.py: HTTP middleware on POST/PUT/PATCH.
  Result: Duplicate side effects prevented on retry.

Program E — Persistent Durable Execution:
  models/durable_checkpoint.py: DurableCheckpoint with sequence_num + status.
  services/durable_runtime.py: start_run/checkpoint/complete/resume/list_incomplete.
  Result: Workflows survive crashes — resume from last persisted checkpoint.

Program K — OpenTelemetry:
  observability/otel.py: init/span/inject_correlation_id with graceful
    degradation when OTel packages absent.
  openclaw/gateway.py: Wraps execute() in span, binds correlation_id to
    trace_id. Bridge between business correlation and production observability.

Program J — Release Gate Hardening:
  docs/governance/release-gates.md: Documents 3 mandatory gates.
  .github/workflows/dealix-ci.yml: Adds release_readiness_matrix as CI step.
  release_readiness_matrix.py: Updated to check 41/41 components.

Verification:
  architecture_brief.py:     40/40 PASS
  release_readiness_matrix.py: 41/41 PASS

https://claude.ai/code/session_01W1rJthWDkasijTdXCfxVHs
2026-04-17 10:12:04 +00:00
Claude
11e0beb294
feat(dealix): wire ALL 17 schemas + Saudi workflow + release gate
Structured Output Producers (structured_output_producers.py):
  Wire ALL 17 Pydantic schemas to live code:
  - LeadScoreCard: from real Lead model (score, tier, signals)
  - QualificationMemo: from lead score + deal data
  - ProposalPack: from real Deal model (value, terms)
  - PricingDecisionRecord: with discount approval logic
  - HandoffChecklist: sales-to-onboarding transition
  - PartnerDossier, EconomicsModel, ApprovalPacket: (golden path)
  - TargetProfile, ValuationMemo, SynergyModel: M&A track
  - ExpansionPlan, StopLossPolicy: expansion track
  - ExecWeeklyPack, BoardPackDraft, ICMemo, PMIProgramPlan: (executive)
  All with Provenance (trace_id, confidence, freshness).

Structured Outputs API (POST /api/v1/structured-outputs/...):
  11 endpoints exposing schema-bound producers.

Saudi Sensitive Workflow (POST /api/v1/saudi-workflow/share-partner-data):
  Live PDPL-controlled partner data sharing workflow:
  1. Data classification (internal/confidential/restricted)
  2. PDPL consent verification
  3. Cross-border export rules check (GCC allowed)
  4. Class B+ approval with 12h SLA
  5. Audit trail via domain events
  6. Evidence pack auto-assembly
  Blocks if no consent or export restricted.

Release Readiness Matrix (scripts/release_readiness_matrix.py):
  26 checks covering governance + services + APIs + trust + sales.
  SCORE: 100.0% (26/26) = RELEASE READY: YES

https://claude.ai/code/session_01W1rJthWDkasijTdXCfxVHs
2026-04-17 06:27:15 +00:00