Continuous Improvement OS — v3

Continuous Improvement OS — v3

Operating system for continuous, mostly-autonomous improvement of the estate's apps. Composed from plan v1 + two independent external red-team reviews (2026-08-28). CEO touchpoints: monthly priorities, one weekly digest, "prod-it" / "revert-it".

Roles

Layer	Surface	Notes
Sense	Orchestrator crons + QC suite + [App Host] logs + uptime probes	Deterministic filters first; a model reads only anomalies
Triage/Spec	Orchestrator	Dedupe, rank, severity per the human-authored rules below; writes one-shot fix specs with exact file paths + acceptance criteria
Fix	Flat-rate coding agents	Execute specs; PRs staged on the test lane; label ai-fix
Review	The other coding model + QC + deterministic scanners	Never self-review; must restate the bug from raw sensing evidence, not the spec
Audit	Large-context model, monthly diff-scoped, quarterly whole-repo	Explicit output includes pruning stale/conflicting facts
Approve	CEO	Weekly digest, ≤5 real decisions

Severity tiers (human-authored; agents apply, never author)

• Sev1 — prod down, auth/billing broken, data exposure, core funnel blocked. Page CEO immediately; single-item hotfix PR; revert-to-last-known-good is standing-approved (execute, then notify).
• Sev2 — feature broken with workaround; security dep patches. 48h mini-digest, single prod-it.
• Sev3 — UX, copy, polish, refactors. Weekly digest.
• A misfiled Sev1 is the worst failure of this system; when in doubt, classify up.

Ship protocol

1. One claim per PR (directive rule). Fix agents work from a spec containing file paths + acceptance criteria; max 2 attempts per item, then human queue.
2. Review: cross-model, restate-from-evidence, plus a second security-focused pass on any auth/RLS/billing/payment diff. Reviewers must name concrete risks (perf, N+1, security), not just approve.
3. QC/test changes are their own PR class (qc-spec), always needs-CEO, never bundled with a fix. Agents never edit tests to make a fix pass.
4. Visual check before digest: screenshot test vs prod, human-quality visual diff by the orchestrator.
5. Merge train: one batch prod-it authorizes the train; merge one PR at a time, rebase, re-run QC after each, halt on red.
6. Post-merge watch: 2–4h of error-rate + funnel delta monitoring after each train; revert on regression without waiting for chat, notify immediately.
7. Revert-it: CEO command word for instant revert to last known good (git revert + redeploy; no new PR cycle).

Must stay human

Pricing/billing logic · auth & security posture · schema migrations (destructive ops human-spec only; schema PRs red-flagged in digest) · data deletion · customer-facing messaging · the severity classification rules · QC spec changes · this document.

Digest contract (weekly)

≤5 real decisions. Opens with sensing heartbeat ("sense crons ran N/N"). Sections: staged PRs w/ test links, shipped since last, killed/expiring needs-CEO items (auto-expire 60d, "killed unless you object"), spend + token health, anomalies. Trivial class (copy, CSS, dependency patches that pass QC + visual check) ships without pre-approval, listed post-hoc.

Zero-token gates

Secret scan (gitleaks) + SAST (semgrep) in CI on every PR · dependency updates via Dependabot feeding the fix→review lane (security patches = Sev2) · grep/threshold pre-filters on all log sensing · spend-anomaly threshold on orchestrator credit burn.

Hygiene

Every live prod/DB mutation recorded via the portal prod-change log, or the audit audits fiction. Traps written once to the facts store (≤160 chars). Monthly audit prunes stale/conflicting facts. Quarterly canary drill: plant one known defect; the suite must find it.