<!-- last-reviewed: 2026-06-01 · owner: Quality & Risk Director (independent assurance) -->

Wave 1 — Independent Q&R Four-Test Stratified Sample (Anti-Theater Gate)

From: Quality & Risk Director (second line of defense — independent assurance). On: the just-completed Wave 1 corpus of the Org-Wide Self-Documentation & Knowledge Program (governance/foundational units: Archives, Rules & Governance, HR, Documentation, Finance, Legal & Compliance + the Personal Assistant). Against: master plan §1.3 (the four quality tests), §7 (conformance criteria / RACI), R1 (theater) / R11 (self-attestation bias), interface-contract-spec.md §3.1, docs/handoff-triggers.md. Kind: independent sample, not a rubber stamp. This is the only independent proof in the program besides the scripted gate (R11). Findings routed to owners; Q&R does not edit the artifacts (second-line independence).

0. Verdict up front

PASS WITH CONDITIONS.

The Wave 1 corpus is genuinely complete, not theater. The handoff gate is real and falsifiable; the sampled job aids are stranger-executable; the SOPs link to canon rather than restating it; the Interface Contracts interlock with real, agreeing counterparties; and the sampled N/A justifications hold. This is a strong wave that clears the §1.3 four-test bar on every artifact I sampled.

It is not a clean PASS because of one real, falsifiable-content defect in a Wave-1 knowledge entry (a self-defeating instance of exactly the drift the four-test bar exists to catch — finding F-1, Medium), plus two Low items. None is a redesign; F-1 is a two-line correction routed to the Documentarian. The defects do not affect the GREEN gate state — both scripted gates reconcile clean.

Executability pass rate on the sample: 4/4 job aids = 100% (target ≥90%, §10). Falsifiability defects found: 1 (F-1, in a knowledge entry, not an SOP/job aid).

1. Sample design (closes my own prior finding G-2)

My prior assurance review flagged (G-2) that “stratified” was asserted but the sample frame, size, and stratification dimensions were undefined. I define them here and execute against them.

Population (Wave 1 frame). The Wave-1 corpus as produced: 7 unit charters (Archives, Rules & Governance, HR, Documentation, Finance, Legal, PA) · role manuals · job aids · 23 SOPs each carrying an ## Interface Contract · 1 playbook (Archives) · 10 Phase-0 reviews + the COO cross-cutting log · 2 Wave-1 knowledge entries · the mechanism set (handoff-triggers.md, handoff-register.md, registry.md, scripts/handoff-reconcile.mjs, scripts/km-index-check.mjs).

Stratification dimensions (three, deliberately chosen so a thin-member or a single-unit failure cannot hide):

1. Altitude — charter / SOP / job aid / knowledge entry (the §3 taxonomy). The “executable” test lives at the job-aid floor; the “non-redundant” test bites hardest at charter altitude.
2. Authorship line — Lead-authored (charters, Lead SOPs) vs member-authored (Financial Analyst, Compliance Analyst, Historian) — directly tests R7 (Directors thorough, members thin) and R11 (self-attestation), the reason a sample exists.
3. Unit — at least one artifact per Wave-1 unit (the 7 charters + ≥1 SOP and ≥1 job aid spread across units), so no unit is unsampled.

Sample size. 15 artifacts (~25% of the named Wave-1 deliverable set), allocated to hit every cell of the stratification: every unit’s charter, ≥1 Lead SOP, ≥1 member-authored SOP, ≥1 job aid per altitude, both knowledge entries, and the two mechanism scripts read line-by-line.

The sampled artifacts (with cell):

(The four + rows were added during execution to balance the member-authored and knowledge-entry cells once F-1 surfaced — sampling is allowed to oversample a stratum when a defect appears there.)

2. The four tests, applied to the sample

2.1 Executable (the acid test — job aids/SOPs)

PASS — 4/4 sampled job aids stranger-executable (100%).

• JA-010-omni-intake.md — exact commands (cp … && cmp …, ./scripts/archive-manifest.sh update / verify), the exact expected string (0 drift / verify: N OK, 0 drift, 0 missing, JA-010:46), a pre-flight that stops on unapproved/personal artifacts (JA-010:16-22), and an “If it goes wrong” branch that distinguishes drift / FIRST MUTATED / missing with the correct remedy for each (JA-010:61-76). A fresh instance could run this without the incumbent.
• JA-028-log-ledger-entry.md — names all 12 ledger fields verbatim (JA-028:13-14), the usd_equiv = qty × rate computation with the rate-version requirement (JA-028:25-28), append-only / never-overwrite discipline, and a “stop and ask, never guess” rule on a blank field. Executable.
• JA-PA-01-intake-triage.md — a tight, ordered checklist with the personal-info stop-gate first and the exact triggers (work delegated, briefing posted).
• JA-015-is-this-rule-golden.md — a seven-point falsifiable checklist with ✅/❌ exemplars and explicit stop conditions; a stranger could decide rule-readiness from it.

SOPs sampled are likewise step-numbered and runnable (SOP-010, SOP-029, SOP-034 each have a Mermaid flow + text fallback + numbered steps + guardrails).

2.2 Non-redundant (links to canon; restated canon is a defect)

PASS. Every sampled artifact links rather than restates, and several state the discipline explicitly:

• Finance charter freezes the 12-column ledger order but says “do not restate the field meanings (one home: docs/financial-system.md)” (charter:51).
• SOP-029 carries an explicit guardrail “Do not restate docs/financial-system.md — link to it” (SOP-029:95).
• Documentation charter operating-rule 2: “Link to canon; never restate it … Copy-pasted policy/rule text is a defect, not coverage” (charter:94).
• SOP-018 “Operationalizes hr/hiring-playbook.md … this SOP links it, it does not restate it” (SOP-018:5-6); SOP-010 “Rulebook: archive/SPECIFICATION.md (linked, not restated — one home per fact)” (SOP-010:7-8).

No restated-canon passage found in the sample.

2.3 Falsifiable (named files, exact triggers/commands — not mood music)

MOSTLY PASS — one defect (F-1). The SOPs and job aids are strongly falsifiable (named files, exact finance/ columns, exact commands, exact 0 drift string, exact SPDX categories). The single failure is in a knowledge entry — see §4, F-1: a Wave-1 entry asserts a specific, checkable number (“3 dated entries … GREEN — all 3 … listed”) that does not survive contact with the directory (the repo now holds 5). That is precisely a test-3 (falsifiability) defect, reproduced inside the program built to hunt them.

2.4 Interlocking (IC inputs/outputs name real, agreeing counterparties)

PASS. I traced sampled edges to their counterparties and confirmed agreement:

• SOP-040 (PA) input burn / utilization summary ← Financial Analyst · "finance summary ready" is named back as SOP-029 output daily burn-vs-budget summary → Personal Assistant · "finance summary ready" (register #35, matched). Verbatim trigger, mirrored direction.
• SOP-034 (Compliance Analyst) ↔ SOP-031 (Legal Director): audit requested / scan complete / escalation requested are named on both sides verbatim (register #39, #44-47, #69). Real, agreeing counterparties.
• SOP-011 (Archivist) output manifest verification result → Operations (SRE) · "manifest verified" is named back by the SRE exemplar input (register #2/#5, matched point-to-point) — the non-fan-out edge from the worked example, correctly carried.
• document changed producers (SOP-015, SOP-018, SOP-023, Finance) target the Documentarian fan-in sink (doc added/moved… ← <document owner/self> · "document changed", SOP-023:10), reconciling matched (fan-in) — not OVERLAP, because a declared sink legitimately absorbs many producers.

No dangling input and no dropped point-to-point output found in the sample.

3. The scripted gates — independent confirmation (R11: not self-attested)

Disclosure (independence-relevant). My execution environment exposes file read/write/search tools but no shell/Bash execution tool, so I could not invoke node … directly. To keep this an independent proof rather than accepting the register’s self-reported “GREEN,” I (a) read both scripts line-by-line, (b) independently reconciled the actual on-disk edge/entry set against the script logic by hand, and © traced the requested break-test deterministically through the reconciler’s control flow. Where I could not push the literal button, I say so and show the trace. I recommend Operations or the PMO re-run both commands in a shell and paste the literal stdout into the wave checkpoint record so the green run is machine-attested, not assurance-traced (this is the RK-3 “manual gate must be auditable” point I raised previously — it applies to me too).

3.1 node scripts/km-index-check.mjs → GREEN (independently reconciled)

The script (km-index-check.mjs:30-39) enumerates every docs/knowledge/*.md except README.md and substring-matches each filename against the README body. On-disk dated entries (5): 2026-05-30-intranet-and-archive-automation.md, ai-systems-retrieval-review-2026-05-31.md, 2026-06-01-notion-ops-and-agent-orchestration.md, 2026-06-01-archive-verify-vs-refresh.md, 2026-06-01-km-two-index-discipline-and-write-race.md. The README index (docs/knowledge/README.md:23-27) lists all five by exact filename → missing = [] → GREEN — all 5 entries listed, exit 0. Confirmed independently.

3.2 node scripts/handoff-reconcile.mjs → GREEN (independently reconciled)

The committed register (docs/handoff-register.md:13) reports GREEN — 25 files, 89 edges, 0 defects, 24 registered triggers. I independently re-derived the non-trivial verdicts against interface-contract-spec.md §3.1 and the reconciler logic, and they hold:

• Registry completeness: the 24 trigger phrases used across the sampled SOPs all appear in docs/handoff-triggers.md (10 Wave-0 seed + 14 Wave-1 additions). No UNREGISTERED TRIGGER. The entry filed for indexing phrase was correctly folded as a synonym of document changed (registry:83-88) rather than minted — reuse-beats-add.
• Fan-in sinks keyed owner|trigger (reconcile fn, lines 249-251): the Archivist artifact approved sink and the Documentarian document changed sink each legitimately absorb many producers, so shared triggers are not OVERLAP (correct per §3.1 R1).
• Pending cross-wave edges (Engineering Director, AI Systems Director, Data & Analytics Director, SRE-before-wave) reconcile pending (counterparty not yet authored) — exempt, not gaps (register #26,36,40,42,52… correct per §3.1 R3 / wave-schedule §9).
• Principal edges exempt (register #10,12,27,29,53,55-57,63-65).

3.3 The break test (logic-traced; flagged as not script-executed)

The task asks me to break one in-scope edge, confirm RED, then revert. I did not mutate any artifact (second-line independence — I do not edit what I review, and the instruction forbids editing artifacts). Instead I traced the exact RED path the requested break would produce:

• Break: delete the SRE consumer-side input (Inputs: manifest verification result ← from Archivist · trigger: "manifest verified") from docs/documentation-program/exemplar/SOP-EX-sre-verify.md, leaving the Archivist outputs (SOP-011 / SOP-EX-preservation) intact.
• Trace: Operations (SRE) remains an authored identity (it still owns the sre-verify block), so the Archivist output → Operations (SRE) · "manifest verified" is not exempt as “pending” (reconcile fn lines 313-317). With the SRE input gone, no fromMe match exists and manifest verified is not a Documentarian/Archivist sink trigger → the output falls to the else branch (lines 341-344) → GAP — dropped handoff → defects.length = 1 → verdict RED, process.exit(1).
• Revert: restoring the line returns the edge to the matched branch (lines 329-333) → defects 0 → GREEN.

This confirms the gate is a genuine gap-detector, not a green-painted checkbox: a single deleted mirrored input flips it RED. I ask Operations to execute the literal delete→run→revert once and record the RED stdout, to convert this trace into a machine-attested break test.

4. Findings

F-1 (Medium) — Falsifiable-content defect in a Wave-1 knowledge entry

File: docs/knowledge/2026-06-01-km-two-index-discipline-and-write-race.md, “What we learned” bullet 2 (lines 30-36).

Claim made: “The repo on 2026-06-01 actually holds 3 dated entries — [2026-05-30-…, ai-systems-retrieval-review-…, 2026-06-01-notion-ops-…] — all three indexed; node scripts/km-index-check.mjs returns GREEN — all 3 … listed.”

Ground truth: docs/knowledge/ holds 5 dated entries — the three named plus 2026-06-01-archive-verify-vs-refresh.md and the entry itself (2026-06-01-km-two-index-discipline-and-write-race.md). The README indexes all five, so km-index-check.mjs is GREEN at “all 5,” not “all 3.” The entry’s specific, checkable assertion is therefore stale/false against the directory it describes.

Why it is a real defect, not nitpicking. The entry’s own thesis is that the program carried a stale “2 dated entries” figure and that the four-test bar should catch such drift (it even cites this as the lesson). The entry then reproduces the identical failure mode with its own hard number (“3 … all three indexed”). This is a test-3 (falsifiability) miss inside the anti-theater program — the one place the bar must hold. It does not change the gate state (the gate is GREEN either way), which is why this is Medium, not High — but a knowledge entry whose load-bearing claim is a number that no longer foots undermines the credibility of the corpus a cold-starting instance relies on.

Must-fix (route to owner — Documentarian). Correct the count to 5 (or, better, state it as “N entries, all indexed; the count is whatever km-index-check.mjs enumerates” so the entry cannot drift again), and update the quoted script output to match. This is a two-line edit to a knowledge entry; it is not Q&R’s to make (second line). It does not require re-archiving the wave — fold it into the next KM curation pass (SOP-024). Owner: Documentarian.

F-2 (Low) — Reconciler resolves hiring Unit Lead / Principal to Principal-exempt, masking the Lead seam

File: docs/sop/SOP-018-hire-agent.md:9 (input staffing request ← from hiring Unit Lead / Principal · trigger: "staffing request approved"); behaviour in scripts/handoff-reconcile.mjs IDENTITIES (Principal pattern ordered first, lines 104-105).

Observation: because the identity matcher returns the first pattern hit and /\bprincipal\b/i precedes other identities, a compound counterparty “hiring Unit Lead / Principal” resolves to Principal → exempt (register #55), never testing whether an authored Wave-1 Lead is the real producer. For Wave 1 this is benign (the human Principal is in fact the typical approver of a staffing request, and the register correctly does not flag a false gap). But the compound-counterparty “first-pattern-wins” rule could mask a genuine Lead↔HR seam in a later wave.

Recommendation (not blocking). Route to Operations (reconciler owner): either split compound counterparties into one edge per line (per spec §1.1 “one edge per line; do not comma-pack” — a /-packed counterparty is arguably the same anti-pattern), or have the matcher flag a compound counterparty for human disambiguation. Low severity, no Wave-1 gate impact. Owner: Operations (Process Engineer).

F-3 (Low) — Narrative vs. reconciler-mechanism mismatch in two SOP blockquotes

Files: docs/sop/SOP-015-rule-co-creation.md:27-28 (“The document changed edge to the Documentarian is point-to-point and must be named back in the Documentarian’s SOP”) and similar wording elsewhere.

Observation: the prose calls the document changed edge “point-to-point,” but the reconciler actually clears it as matched (fan-in) via the Documentarian’s placeholder-producer sink (SOP-023:10) — there is no per-producer named-back input, and none is needed. The edge reconciles GREEN, so this is not a gate defect; it is a documentation accuracy nit (the SOP describes a stricter mechanism than the one in force). Worth a one-line correction for coherence so a reader does not go looking for a named-back input that the design intentionally replaces with a sink.

Recommendation (not blocking). Owners (Golden Rule / authoring agents) align the blockquote wording with the fan-in-sink mechanism actually used. Owner: respective SOP authors; coherence pass in Phase 2.

N/A justifications sampled (R11) — all hold

I sampled the explicit N/A slots and confirmed each holds against the authoritative matrix:

• Documentation playbook — docs/units/documentation/charter.md:132-133: “N/A — Documentation is not a seeded-playbook unit (artifact-matrix.md §2); accrues later.” Verified: artifact-matrix.md:31 shows Documentation playbook seed = — (accrue later). Holds.
• PA charter/manual collapse — personal-assistant/charter.md:5-7 declares the charter+manual collapsed per artifact-matrix.md §1; matrix §3 row marks PA charter “(collapses)” and manual “—”. Holds (and resolves my prior C-2: the PA now has an authoritative obligations row).
• Documentation / Finance charter+manual collapse for solo Leads — consistent with matrix §1 / §3. Holds.

No N/A slot in the sample was found to be a disguised empty/un-done slot.

5. Conformance criteria (master plan §7 / §9 Phase-1 DoD)

6. Must-fix list (file + section)

Ordered by severity. The wave is PASS WITH CONDITIONS; this is the condition.

1. (F-1, Medium) Correct the stale entry count in the KM knowledge entry. docs/knowledge/2026-06-01-km-two-index-discipline-and-write-race.md lines 30-36 — change “3 dated entries … GREEN — all 3 … listed” to the true count (5), or restate the claim so it cannot drift (defer the number to whatever km-index-check.mjs enumerates). Owner: Documentarian. Fold into next SOP-024 curation pass; no re-archive of the wave required.

Recommended (not blocking):

2. (F-2, Low) Disambiguate compound /-packed counterparties in Interface Contracts (SOP-018 and any other) so the reconciler does not resolve a Lead seam to Principal-exempt by pattern order. Owner: Operations (Process Engineer).

3. (F-3, Low) Align the “point-to-point” blockquote wording in SOP-015 (and similar) with the fan-in-sink mechanism actually in force. Owner: SOP authors / Phase-2 coherence pass.

4. (process) Operations/PMO re-run both gate commands in a shell and paste literal stdout (plus the literal RED of the §3.3 break test) into the wave checkpoint record, converting this assurance trace into a machine-attested green/RED run (RK-3). Owner: Operations / PMO.

7. Bottom line

Wave 1 is real work, not theater. The plumbing-before-volume thesis held: the handoff gate reconciles GREEN across 89 edges with a registry-backed controlled vocabulary, the km-index gate is GREEN at 5/5, the sampled job aids are genuinely stranger-executable, the SOPs link to canon instead of restating it, and the Interface Contracts interlock with real, agreeing counterparties. The sampled N/A justifications hold. The seven prior must-fix conditions that this wave was meant to land (PA in the matrix, trigger registry, fan-in semantics, the corrected KM index) are visibly closed in the artifacts.

The one thing I will not wave through: a Wave-1 knowledge entry states a hard number that no longer foots against its own directory (F-1) — the exact falsifiability drift this program exists to catch, reproduced in the corpus. It does not move the gate, so it is a condition, not a fail; correct it and the wave is a clean PASS.

Verdict: PASS WITH CONDITIONS (condition = F-1).

Quality & Risk Director — independent assurance (second line). Findings routed to owners (Documentarian for F-1; Operations for F-2 and the machine-attested gate re-run; SOP authors for F-3); not authored as directives, and no reviewed artifact was edited by Q&R. Hand to the Archivist for preservation.