Continuous Improvement OS — v3

Continuous Improvement OS — v3

North star: The estate's apps improve continuously and mostly on their own, with the CEO deciding only a few real things per week. Hard gates (never bend): severity rules, pricing/billing, auth and security, schema migrations, data deletion, customer-facing messaging, QC spec changes stay human; Sev1 classify up; no self-review; secret scan and SAST on every PR Everything else is a default. Try a better or unusual way when it serves the north star; record what you changed and why in the change log. Change log: bottom of this page (who, when, why).

Operating system for continuous, mostly-autonomous improvement of the estate's apps. Composed from plan v1 + two independent external red-team reviews (2026-08-28). CEO touchpoints: monthly priorities, one weekly digest, "prod-it" / "revert-it".

Roles

Layer	Surface	Notes
Sense	Orchestrator crons + QC suite + [App Host] logs + uptime probes	Deterministic filters first; a model reads only anomalies
Triage/Spec	Orchestrator	Dedupe, rank, severity per the human-authored rules below; writes one-shot fix specs with exact file paths + acceptance criteria
Fix	Flat-rate coding agents	Execute specs; PRs staged on the test lane; label ai-fix
Review	The other coding model + QC + deterministic scanners	Never self-review; must restate the bug from raw sensing evidence, not the spec
Audit	Large-context model, monthly diff-scoped, quarterly whole-repo	Explicit output includes pruning stale/conflicting facts
Approve	CEO	Weekly digest, ≤5 real decisions

Severity tiers (human-authored; agents apply, never author)

• Sev1 — prod down, auth/billing broken, data exposure, core funnel blocked. Page CEO immediately; single-item hotfix PR; revert-to-last-known-good is standing-approved (execute, then notify). Revert covers code and deploy only; never auto-revert a schema or data change, send it to the human.
• Sev2 — feature broken with workaround; security dep patches. 48h mini-digest, single prod-it.
• Sev3 — UX, copy, polish, refactors. Weekly digest.
• A misfiled Sev1 is the worst failure of this system; when in doubt, classify up. Example: checkout fails for some users with no workaround = Sev1 (billing, core funnel), not Sev2.

Ship protocol

1. One claim per PR (directive rule). Fix agents work from a spec containing file paths + acceptance criteria; max 2 attempts per item, then human queue.
2. Review: cross-model, restate-from-evidence, plus a second security-focused pass on any auth/RLS/billing/payment diff. Reviewers must name concrete risks (perf, N+1, security), not just approve.
3. QC/test changes are their own PR class (qc-spec), always needs-CEO, never bundled with a fix. Agents never edit tests to make a fix pass.
4. Visual check before digest: screenshot test vs prod, human-quality visual diff by the orchestrator.
5. Merge train: one batch prod-it authorizes the train; merge one PR at a time, rebase, re-run QC after each, halt on red.
6. Post-merge watch: 2–4h of error-rate + funnel delta monitoring after each train; revert on regression without waiting for chat, notify immediately.
7. Revert-it: CEO command word for instant revert to last known good (git revert + redeploy; no new PR cycle).

Must stay human

Pricing/billing logic · auth & security posture · schema migrations (destructive ops human-spec only; schema PRs red-flagged in digest) · data deletion · customer-facing messaging · the severity classification rules · QC spec changes · this document.

Digest contract (weekly)

≤5 real decisions. Opens with sensing heartbeat ("sense crons ran N/N"). Sections: staged PRs w/ test links, shipped since last, killed/expiring needs-CEO items (auto-expire 60d, "killed unless you object"), spend + token health, anomalies. Trivial class (non-customer-facing copy, CSS, dependency patches that pass QC + visual check) ships without pre-approval, listed post-hoc. Customer-facing messaging is never trivial (see Must stay human).

Zero-token gates

Secret scan (gitleaks) + SAST (semgrep) in CI on every PR · dependency updates via Dependabot feeding the fix→review lane (security patches = Sev2) · grep/threshold pre-filters on all log sensing · spend-anomaly threshold on orchestrator credit burn.

Hygiene

Every live prod/DB mutation recorded via the portal prod-change log, or the audit audits fiction. Traps written once to the facts store (≤160 chars). Monthly audit prunes stale/conflicting facts. Quarterly canary drill: plant one known defect; the suite must find it.

Change log

Who changed this framework, when, and why. Rows before 2026-11-08 predate the log, so no reason was recorded.

When (UTC)	Who	Version	What	Why
2026-11-08 16:15	1099:claude-chat-c1d3	v2	Added north star + hard gates header; Trivial class now excludes customer-facing messaging.; Revert-it scope: code and deploy only, schema and data go to the human.; Added a Sev1 vs Sev2 example.; loosened to defaults: Max 2 attempts per item, then human queue; Post-merge watch fixed at 2-4h	Owner-requested north-star review (2026-11-08): 'Copy' shipped without approval contradicted 'customer-facing messaging must stay human'. Doc is human-only, so needs CEO sign-off.; A git revert cannot undo a migration; auto-reverting data could lose records.; Classifying up is the key rule but readers had no sample of the boundary.; rules loosened so agents can try better ideas where no safety, money, legal or data gate applies
2026-08-28 12:46	1099:viktor-cowork-7f2a	v1	Continuous Improvement OS — v3	not recorded (before change log)