Org-Wide Documentation & Knowledge Program — Consolidated Evaluation & Improvement Roadmap

From: Process Engineer (Operations — process, integrity machinery, optimization). To: the Principal. What this is: the single consolidated roadmap, synthesizing the three C-suite evaluations (CPTO / COO / CGEO) plus my own process/efficiency lens, de-duplicated and prioritized. It is an improvement backlog, not a victory lap. Source memos: reports/program-evaluation/cpto-evaluation.md · reports/program-evaluation/coo-evaluation.md · reports/program-evaluation/cgeo-evaluation.md. Grounding: reports/2026-06-01-program-assurance-signoff.md (OI-1…OI-5); reports/risk-register.md (R-001/R-003/R-004/R-006); scripts/handoff-reconcile.mjs; .github/workflows/ci.yml; docs/documentation-program/tracker.md. Scope discipline: I synthesize and own the mechanism recommendations. Items that belong to other owners (rules, foundational content, the archive record, business strategy) are surfaced as proposals to their owners or as Principal decisions, not as directives. This report touched no archive/ content and no source memo.

1. Executive summary — the honest verdict

The program is substantively real, not theater — and its operating machinery is thinner than the sign-off implies. All three heads converge on the same headline, and it holds: the anti-theater bar caught two hollow-greens (the 47-seam identity gap and the C-1 parse-drop), and the response to C-1 hardened the gate permanently (the malformed-edge guard at handoff-reconcile.mjs:240-301,536-540 now turns the gate RED on a present-but- broken edge). That is the thesis validating itself, and I will not undersell it. But the machinery underneath the GREEN is the roadmap’s real story, and it factors into three honest gaps the sign-off’s framing under-weights: (a) no wired cadence — every scheduled control (staleness sweep, reconcile re-run, KM check) still depends on one human remembering at a checkpoint, because AR-003 is a no-op (R-004), so “standing operation” has no automated heartbeat; (b) known gate blind-spots remain open — the deleted-producer fan-in sibling (R-003/OI-4) still reads GREEN while hollow, and the IDENTITIES table that hid 47 seams is hand-maintained out-of-band from ORG.md with nothing checking the two against each other; and © instruments cited across the corpus do not exist as files — docs/knowledge/growth/flywheel-model.md and docs/brand/ (CGEO), docs/ai/model-selection.md

eval harnesses (CPTO’s GR-1 control gap), docs/legal/, and reports/coo-risk-log.md are all referenced-but-absent, and the reconciler structurally cannot see a doc that “cites a home with no file.” The program proved the org can document itself once, under a freeze, in a day; it has not yet proved the corpus stays true on its own. Closing that gap — wire the heartbeat, close the blind-spots, create the load-bearing files — is the entire roadmap, and none of it is hard; all of it was known and deferred.

2. Consolidated recommendations (de-duplicated, grouped, prioritized)

Priority: P0 = do first / blocks honest “standing operation”; P1 = next; P2 = opportunistic. Effort: S ≤ half a day · M ≤ a few days · L = a real chunk of work. “Source” cites the memo(s) that raised it (PE = my own process lens). Where two or three memos named the same thing under different IDs, I merge to one row and cite all.

Theme A — Integrity-machinery hardening (the gate’s blind-spots)

#	Recommendation	Pri	Owner	Effort	Source
A1	Producer-presence CI complement (CC-1 / OI-4 / R-003). Add a reconciler/CI assertion that every declared fan-in sink trigger has ≥1 live producer, so a silently deleted producer turns the gate RED — matching the parse-drop guard. The only open High integrity gap on the machinery; one CI step retires Q&R’s compensating hand-trace.	P0	Process Engineer	S	CPTO §2.1/§3.2/C6; COO §2.4/C-3; Q&R OI-4; R-003
A2	Validate `IDENTITIES` against `ORG.md`. Derive (or superset-assert) the reconciler’s `IDENTITIES` array (`handoff-reconcile.mjs:104-159`) from the roster so a role in `ORG.md` with no identity pattern is a build error, not a silent `pending`. This is the mechanism that hid 47 real seams; today the table is the single point of truth for “who exists,” maintained out-of-band, with nothing cross-checking it. Falsifiable test: add an `ORG.md` role + wire an edge to it without touching `IDENTITIES` — today the edge resolves `pending` and the gate stays GREEN.	P0	Process Engineer (mechanism); CPTO review	M	CPTO §2.1/recs; COO §2.4
A3	File / cross-link existence check — a NEW blind-spot class. Add a gate step that fails when a doc cites a home that has no file (e.g. SOPs pointing at `docs/knowledge/growth/flywheel-model.md` or `docs/brand/` that do not exist). The handoff reconciler structurally cannot see this* — it matches declared edges, not whether a referenced path resolves. CGEO’s finding proves it slipped under a GREEN: 21 artifacts cite two files that do not exist. This is a different control from A1/A2 and is the cheapest way to stop “stub referencing void” from reading as done.	P0	Process Engineer	M	CGEO §2.1/§4 (the finding); PE (it is a new control class)
A4	Machine-attest the gate (OI-1). Have `ci.yml` upload the literal `handoff-reconcile.mjs` + `km-index-check.mjs` stdout (plus one RED break-test) as a build artifact, and link it from the G3-class checkpoint record. Today the headline GREEN in the sign-off is traced, not executed (Q&R has no shell — R-006); the completion memo’s “runs in CI” is true per-push but the checkpoint record itself rests on a trace plus a generated write-out. Make it a one-line artifact upload, not a human copy-paste.	P1	Process Engineer / PMO	S	CPTO §3.1; COO §2.2/C-1; Q&R OI-1; R-006
A5	Scope the structured-schema + lint-on-author migration. The gate is a string-matching parser over hand-maintained tables — the right bootstrap, the wrong long-term design. All three run-time defects share the signature “the parser couldn’t see a thing that was really there.” The durable fix is to make the Interface Contract block structured (frontmatter / typed fenced block) with a schema validator that rejects a malformed edge at authoring time, and counterparties become enum references to the roster (which structurally eliminates the A2 drift class). This is a cross-cluster architecture decision (SOP-041 territory): scope it now, build later — the bootstrap works today, this is the next correctness tier, not a fire.	P2	Process Engineer (scope); CPTO/Engineering (schema)	L	CPTO §2.2

Theme B — Maintainability & cadence (the missing heartbeat)

#	Recommendation	Pri	Owner	Effort	Source
B1	Wire AR-003 — the keystone. Move the reconciler + KM check + staleness/`last-reviewed` sweep onto a `schedule:` trigger (or `daily-reports.yml`), so the scheduled cadence fires on a clock, not on a human at a checkpoint. Today the per-push gate fires on commit, but the between-pushes drift sweep does not exist (R-004). This single change converts every manual integrity gate, the quarterly cadence (B2), and the single-runner continuity risk from “human remembers” to “machine fires.” Treat it as a gate on declaring true standing operation, not a carry-forward.	P0	Process Engineer (flag → Principal for any secret/wiring)	M	COO §2.1/O-2/C-4 (keystone); CPTO §3.1; R-004
B2	Wire the quarterly review cadence. The README RACI sets “quarterly” for SOP/job-aid/playbook freshness and “on change” for charters — but it is asserted, not wired, and depends on B1. Without AR-003, the quarterly review is another manual-discipline control with no heartbeat, and OI-2 (the prose-staleness class open since Wave 2) will not clear on schedule.	P1	Process Engineer (mechanism) + Documentarian (freshness)	S	COO C-8; Q&R OI-2
B3	`parked-until=<platform-launch\|business-model>` front-matter marker. Add a single machine-findable marker convention for platform/business-model-gated artifacts, so (a) the freshness sweep skips them instead of flagging them stale, (b) inert-by-design SOPs (e.g. SOP-088/089/090 whose happy path is currently unreachable) are labeled parked, not operating, and © the deferred set is enumerable in one query. Today the gating is buried in prose (“stub-first as of 2026-06-01”) and will read as staleness at the first `last-reviewed` sweep — this is OI-2’s tail.	P1	Process Engineer (convention); CGEO units (apply)	S	CGEO §3/rec-3; Q&R OI-2

Theme C — Toil / optimization (mechanize the recurring chores)

#	Recommendation	Pri	Owner	Effort	Source
C1	Fix the `archive-manifest.sh` defects, then ship one-command `archive-register`. Two real write-bugs in the integrity tool itself, both confirmed on disk: (i) `--log` computes the log-region insert point in a loop then `pass`es and discards it, appending the row at EOF instead (`:53-59`); (ii) `update`/`refresh` do `re.sub(r"[0-9a-f]{64}", h, line, count=1)` (`:43`), which silently mis-updates the first hash on any multi-hash `latest` row. Fix these first (the tool that guards write-once memory must not carry a write bug), then wrap register → refresh `latest/` + MANIFEST → `verify` into one `archive-register <batch>` pass. This is the highest-toil recurring step (OI-3’s Phase-2 batch was still landing at G3 sign) and the most mechanizable. Note GR-8: the tool must never mass-rewrite `first/` rows or bypass `verify`.	P1	Operations + Archivist (tool); Engineering (C1 fixes)	M	CPTO §3.3/C1; COO O-1; PE
C2	`program-status` one-command roll-up. One command that runs reconcile + KM check + archive verify + coverage count and prints one screen, so a checkpoint is one command, not four manual steps recorded by hand. Pairs with A4/B1.	P1	Operations	M	COO O-5
C3	Instrument AI-cost / subagent efficiency for the next program. This program ran many subagent passes with no telemetry on its own model spend — the AI-usage ledger feed (H4 seam) is documented but the runtime producer is unbuilt (R-005), so the cost is estimated, not measured. Treat “instrument the AI-usage feed” as a prerequisite for any future program of this scale so the next one can be measured. (Also feeds GR-1 enforcement — see D2.)	P2	D&A + AI Systems (feed); CPTO (coherence)	M	CPTO §3.4; PE

Theme D — Completeness gaps (referenced-but-absent files & missing artifact classes)

#	Recommendation	Pri	Owner	Effort	Source
D1	Create the two CGEO load-bearing files as thin real headers now. `docs/knowledge/growth/flywheel-model.md` (five arcs + “binding constraint: not yet measurable, ADR-0006”) and `docs/brand/voice-and-tone.md` (promote the concept’s voice). Confirmed absent on disk; cited by ~21 artifacts. Header-only is honest and cheap, un-breaks every citing doc, and converts “stub→void” into “header-first real file.” Full fill follows the business-model decision (F1) / launch. Pairs with A3 — A3 is the gate that prevents the void recurring; D1 fills today’s instance.	P1	Growth Dir (flywheel) + Creative Dir (brand); CGEO commissions	S	CGEO §2.1/§4/rec-2
D2	Build the GR-1 control: model-selection matrix + eval harness. `docs/ai/model-selection.md` is promised “(to author)” and confirmed absent; GR-1 (“always the best available model”) is a rule with no enforcement — a silent model downgrade in any of the 41 agent defs or future prompts passes every gate today (the reconciler does not look at `model:` fields, no eval scores prompt quality). This is stub-first against the org’s own governing rule, which ranks it above product-layer stubs.	P1	AI Systems Director; CPTO review; Q&R (control-gap)	L	CPTO §2.3/C3
D3	Stand up the missing artifact classes: `docs/legal/` (license-inventory, ai-compliance, privacy, IP — greenfield, absent from the canon Index) and threat models (the org has no threat-model artifact class at all; the risk register explicitly scopes security/privacy threat out).	P2	Legal / Documentarian (legal); Engineering + Security/Principal (threat models)	L	CPTO C4/C5
D4	Normalize SOP-001–005 filenames. SOP-010+ follow `SOP-NNN-slug.md`; SOP-001–005 do not — confirmed on disk they live as `change-management.md`, `gate-quorum.md`, `registry.md`, `secrets-management.md`, `access-request.md`, `deploy-intranet.md`. The registry maps them, but a reader or a future filename-keyed tool cannot find SOP-005 by name. Low risk; it is exactly the “inconsistent naming” class the program normalized everywhere else — finish the job.	P2	Operations (Process Engineer)	S	COO C-7
D5	Build the R12 throughput/WIP model — or formally down-scope it. A throughput model (per-wave WIP limits + a tracked review/curate/preserve queue) was assigned and never built; the program got away with it only because all five waves landed same-day under a roster freeze. A program over real elapsed time will hit the Documentarian/Archivist serialization R12 predicted. Either add WIP limits + a queue to `tracker.md`, or down-scope R12 with a recorded reason.	P2	PMO	M	COO §2.3/O-4/D5

Theme E — Live risk (the one live external exposure)

#	Recommendation	Pri	Owner	Effort	Source
E1	Close H2 / R-001 — the Slack ToS code fix. The `app_uninstalled` deletion failure is silently swallowed (`intranet/src/pages/api/slack/events.ts:303-305`); the `channel_category`/`archived_at` migrations + deletion-fallback job are unbuilt, so on uninstall, mirrored messages may not be deleted as ADR-0017 requires. The program documented and contained this (cron disabled, ACCEPT disposition) but did not fix it — it is the one item with live external-compliance risk. Engineering lands migrations + fallback job; Security confirms posture; only then does the cron re-enable.	P0	Engineering (code) + Security/Principal (posture)	M	CPTO C4; COO §2.6/C-2; R-001

Theme F — Principal decisions (only the Principal can resolve)

#	Decision	Pri	Owner	Source
F1	Decide the business-model direction (Direction A — monetize the channel / Direction B — AI-for-Good pipeline / explicit both-with-priority). `docs/concept.md` leaves it unresolved. This is the keystone unblock-er for the entire CGEO cluster: audience segments, revenue-lever sequencing, brand voice register, and success metrics all block on it. Documenting them before this is fiction; after it, they are roughly a week of real work. CGEO surfaces the framing + a recommendation; the Principal decides.	P0	Principal (CGEO frames)	CGEO §2.2/C4/rec-1
F2	Commission the External Review of Q&R (OI-5 / SR-1). Q&R self-reviewed its own Wave-3 artifacts (its charter, SOP-085/086/087, the assurance sign-off, the registers). The anti-theater instrument itself cannot be independently assured by the unit that owns it. Commission External Review Partners (third line) for one pass on the Q&R unit specifically.	P1	Principal (commission, via COO)	CPTO C8; COO §2.6/C-5; Q&R OI-5
F3	Fix the COO’s own coherence gap. `reports/coo-risk-log.md` is named by the COO cluster operating model as the home for cross-Director structural risk and does not exist (confirmed on disk). Either create it for standing operation or correct the operating model that promises it — a promised-absent artifact is the same theater the program hunts. (COO-owned; surfaced here for completeness.)	P2	COO	COO §2.5/C-9

3. My own process lens — additions not in the three memos

These are mine as the Process Engineer; they are not in any of the three evaluations.

The single-runner reconcile risk is a bus-factor, not just a cadence gap. The COO named the cadence no-op (B1) and the single-human runner; I add the sharper framing: the integrity gates are owned, run, and recorded by one role. B1 (wire AR-003) removes the forgetting failure mode, but it does not remove the single-point-of-authorship failure mode for the reconciler itself — IDENTITIES, the trigger registry, and the register write-out all flow through one mechanism with no second reviewer. A2 (derive IDENTITIES from ORG.md) is the highest-leverage de-single-pointing move because it makes a roster the second source of truth the gate must agree with. Roadmap implication: prioritize A2 not only as a defect fix but as the structural decoupling of “who exists” from “one hand-maintained array.”
Wave-orchestration efficiency: the same-day close hid the throughput model, and that is a measurement gap, not just a delivery one. All five waves + Phase 2 closed 2026-06-01 under a roster freeze (tracker §3.1). The dependency-driven sequencing (M0→M1→parallel M2/M3/M4→M5) is correct and reusable — keep it. But the freeze means the next program’s planners have no real throughput data to size WIP from. D5 (build the WIP model) is the fix; my addition is that the next program should record actual per-wave elapsed-and-queue data even under a freeze, so the WIP model is calibrated from observation, not guessed.
A parked marker (B3) plus a file-existence check (A3) together form the “honest incompleteness” control the program is missing. The corpus is very good at declaring its emptiness in prose (CGEO’s K-section praises this) but has no machine surface that distinguishes “intentionally parked” from “accidentally broken” from “stale.” A3 catches the broken (cites a missing file), B3 marks the parked (skip the sweep), and B1/B2 catch the stale (drift sweep fires). Shipped together, they convert “stub-first discipline” from a human virtue into an enforced invariant — which is the whole point of the program.
The next-program playbook. The reusable spine is proven (plumbing-before-volume, frozen exemplar, Leads-draft-first, scripted gate + independent sample, batched pushes). Before the next org-as-code program of this scale, capture it as a real playbook (docs/knowledge/ + a templates/-class program kit) with the four mechanization tools in hand: archive-register (C1), program-status (C2), the wired cadence (B1), and the AI-cost telemetry (C3). The first program proved the method; the playbook + tools are what make the second one low-toil instead of another all-hands-on-one-day sprint.

4. One-screen prioritized action list (P0 first)

The P0 set — the 3–5 things to do first (these are what turn a completed program into a standing operation, plus the one live external risk):

B1 — Wire AR-003 (Process Engineer): put reconcile + KM check + staleness sweep on a schedule: trigger. The keystone — no standing operation without a heartbeat. (M)
A1 — Producer-presence CI complement (Process Engineer): close the deleted-producer fan-in blind-spot (R-003/OI-4) — the only open High integrity gap; the gate stops being GREEN-while-hollow. (S)
E1 — Close H2 / R-001 (Engineering + Security): the Slack ToS code fix — the one live external-compliance exposure carried into operation. (M)
A2 — Validate IDENTITIES against ORG.md (Process Engineer): make a roster role with no identity pattern a build error, not the silent pending that hid 47 seams. (M)
F1 — Principal: decide the business-model direction (Principal): the keystone unblock-er for the entire CGEO cluster (audience, revenue, voice, metrics all block on it).

Also P0-adjacent and cheap: A3 — file/cross-link existence check (new blind-spot class; a doc that cites a missing file should fail the gate) — bundle it into the same CI pass as A1/A2 if capacity allows.

Then P1 (next): A4 (machine-attest the gate) · B2 (wire quarterly cadence) · B3 (parked-until= marker) · C1 (fix archive-manifest.sh, then archive-register) · C2 (program-status roll-up) · D1 (two CGEO header files) · D2 (GR-1 model-selection matrix + eval harness) · F2 (commission External Review of Q&R).

Then P2 (opportunistic): A5 (scope structured-schema migration) · C3 (AI-cost telemetry) · D3 (docs/legal/ + threat models) · D4 (SOP-001–005 filename normalization) · D5 (R12 WIP model) · F3 (create/correct coo-risk-log.md).

5. Routing & preservation

This is the consolidated roadmap synthesizing the CPTO / COO / CGEO evaluations + my process lens. It is input to the Principal’s acceptance call, not a set of directives to other clusters — mechanism items are mine; cross-cluster and Principal items are surfaced as proposals to their owners.
It touched no archive/ content and none of the three source memos.
Hands to the Archivist for preservation (artifact approved).

Process Engineer (Operations). The program’s design held and the gate is genuinely real; the machinery under it needs the heartbeat, the closed blind-spots, and the load-bearing files this roadmap names. None of the P0 items is hard — all were known and deferred. Wiring them is the difference between “documented once” and “stays true on its own.”