360° Organizational Review — 2026-05-30 (second review)

Prepared by: External Review Partners (retained advisor, independent) For: the Principal Engagement: permanent retainer · second 360° review Prior report: reviews/2026-05-30-360-review.md (first 360, same day)

1. Scope & method

Read of the canonical state: ORG.md (now 7 units, 10 employees), CLAUDE.md (Golden Rules), docs/methodology.md, docs/concept.md; the three new agents (.claude/agents/{project-manager,process-engineer,innovation-lead}.md); the people system (hr/employee-handbook.md incl. “The Standard”, hr/policies/*, hr/access/requests.md); the knowledge/docs system (docs/canon.md, docs/sop/*, docs/knowledge/*, docs/adr/ADR-0001..0009, templates/*); the intranet product (intranet/ — Astro portal + scripts/sync-content.mjs + deploy posture in ADR-0006/0008/0009 and docs/sop/deploy-intranet.md); records/automation (scripts/archive-manifest.sh, .github/workflows/{ci,daily-reports}.yml); the pre-deploy reviews/2026-05-30-security-audit.md; history/chronicle.md (27 milestones); and the plan-phase finance/ERP docs. Assessed top-down, unit-by-unit, cross-unit, bottom-up, and outside-in.

What’s changed since the first 360 — prior findings, addressed vs. open

Net: the two HIGH operational risks from the first review (activation, manifest toil) are resolved — genuinely good. The strategic HIGH (process-over-product) is improved but not resolved.

2. Headline reassessment — scaffolding-to-output ratio

Verdict: improved from the first review, but the org still out-builds the product, and the “output” so far is a portal that displays the org to itself.

The good news is concrete and real:

• The intranet is genuine, working code, not a stub. intranet/scripts/sync-content.mjs reads the repo at build time and generates a Dashboard, Docs browser, Chatter, and People view (intranet/src/pages/*.astro). It treats the repo as the single source of truth (no duplicate datastore — a deliberate, lean choice, ADR-0006).
• It is shipped through a real pipeline: CI builds it on every push (ci.yml), a deploy decision is made (Vercel, single-user auth, ADR-0008), a security audit cleared it (reviews/2026-05-30-security-audit.md), and deploy cost is actively managed (ADR-0009, intranet/scripts/vercel-ignore.sh).

That is a meaningful step up from “company built, product not started.”

But look hard at what the product is. Every surface of the intranet is the org looking at itself: documents archived, agents on roster, units, commits, and inter-agent chatter. The KPI cards on the dashboard literally read "Scaffolding → output ratio: tracking" and "AI spend / deliverable: plan-phase" (sync-content.mjs lines 107–111). None of it touches docs/concept.md — the “show the work” channel, the rubric for “good,” the chunk library, the retrieval-first learning loop, the dual flywheel. The first 360’s core finding — the founding concept has not been advanced — still stands. The org built an internal admin portal for itself, which is useful infrastructure, but it is not the venture.

And the denominator grew. Since the first review the org added 4 employees and 3 units (PM, Process Engineer, Innovation Lead; Delivery, Operations, Innovation) plus a large documentation surface: 9 ADRs, 4 SOPs, 7 policies, 7 templates, a knowledge base, a user manual, a job aid, an operating model, two ERP/finance plan docs. So while the numerator finally became non-zero, the org also built more org. The honest read: the ratio moved from ~0 to positive but still scaffolding-dominant, and a large fraction of the new “output” is process artifacts about how to produce output.

3. Strengths (genuinely good)

• The two worst operational risks were fixed. Activation gap closed (merged to main); manifest toil automated and CI-gated. The org acted on the first review.
• The intranet is lean and correctly architected. Static, repo-as-source-of- truth, no premature datastore, three runtime dependencies. The vercel-ignore.sh budget guard and path-gated builds (ADR-0009) show real operational thrift.
• Security discipline is above peer norm. A pre-deploy audit that found and fixed a real issue (External Reviewer over-privileged, S-1), hardened .gitignore, confirmed no secrets/PII in the bundle, and gated the deploy on Vercel auth because the bundle publishes the whole corpus. This is the system working.
• Least-privilege tooling is being practiced, not just preached. The Archivist’s GitHub grant (ADR-0007, AR-001) is narrow (no merge/delete/admin), logged in an auditable register (hr/access/requests.md), and entered via the access SOP.
• Plan-phase restraint on ERP/finance is correct. docs/erp-needs-analysis.md explicitly recommends staying repo-first and adding a datastore “only when a surface needs persistence.” That is the right GR-4 answer and it resisted the urge to build the cathedral.
• The new agents internalize the prior critique. All three new JDs carry “heed the 360 review / lean / don’t build the cathedral to test the doorbell” guardrails.

4. Findings & risks — ranked by severity

F-1 — Strategy: the venture still hasn’t started · HIGH

Evidence: docs/concept.md describes a “show the work” content engine + a retrieval-first learning platform with a rubric and dual flywheel. None of it exists. The methodology (docs/methodology.md) defines Ideate→Plan→Build→Grow→ Operate seeded by a JSON ideation spec — but specs/ideation-spec.draft.json is still a draft contract, no spec has been injected, and no venture has traversed even the Ideate gate. The one thing built (the intranet) is internal tooling, not the concept. The Innovation unit exists to own “the front of the funnel” but has produced no hypotheses, experiments, or evidence yet (its only visible output is a seed chatter message). Why it matters: the company can run flawlessly and still deliver nothing the concept promised. Eight months of this and the asset is a self-referential admin portal. Recommendation: timebox all further org/doc work. Inject (or hand-write) one real ideation spec and drive it through Ideate to a rubric for “good” and one “chunk” of show-the-work content — the smallest artifact in docs/concept.md. Make “advanced the concept” the definition of done for the next session, not “improved the org.”

F-2 — Right-sizing: 10 agents / 7 units for a solo, pre-revenue venture · HIGH

Evidence: ORG.md shows 7 units, each with exactly one Lead (six are single-person units), plus 7 more planned units (Finance, Legal, Security, Engineering, Growth, Quality & Risk, Customer Success). The three newest hires (PM, Process Engineer, Innovation Lead) arrived as a batch “as the intranet build begins” (chronicle #21) — i.e. staffed ahead of demonstrated load, the exact pattern the staffing policy and the first 360 warned against. For a one-person static-site build, a dedicated Project Manager and a Process Engineer and an Innovation Lead is heavy; the work could be one builder plus the existing Documentarian/Archivist. Why it matters: every unit is standing overhead — JDs to maintain, coordination ceremony (“telepathic communication,” daily cadence), and an ORG.md that grows faster than the product. Ceremony is outpacing need. Recommendation: declare a staffing freeze until the venture clears its first real gate. Do not stand up any of the 7 planned units speculatively. Treat the “standard-business-function coverage map” as a checklist of concerns, not a roster to fill.

F-3 — Documentation surface is compounding faster than product · MEDIUM-HIGH

Evidence: 9 ADRs, 4 SOPs (access-request, change-management, secrets-management, deploy-intranet), 7 policies, 7 templates, a canon, an operating model, a user manual, a job aid, a knowledge base, plus erp-plan / erp-needs-analysis / financial-system. Several govern things that barely exist yet (a full change-management SOP and DoD for a repo with one product file tree; a financial system with two ledgers and a cross-rate that is entirely plan-phase). “The Standard” (handbook) now obliges every agent to read the canon each session and contribute to docs/knowledge/ — more standing process per head. Why it matters: documentation has a carrying cost (it must stay truthful or it rots). CLAUDE.md itself is still a placeholder-laden scaffold (Purpose, Primary users, Architecture, Coding Conventions, Testing all TODO) while peripheral SOPs are fully fleshed — effort is going to the edges, not the core. Recommendation: freeze net-new SOP/ADR/policy creation unless a current activity demands it. Fill in CLAUDE.md’s core TODOs (Purpose, Primary users, Architecture) before writing the next SOP. Apply GR-4 to documents as well as tools: write the doc the work needs, not the doc the org might need.

F-4 — Deploy/ops fragility & integration debt · MEDIUM

Evidence: the daily-reports automation (daily-reports.yml) is a gated no-op — it exits early until ANTHROPIC_API_KEY/NOTION_TOKEN/NOTION_REPORTS_PAGE are set (AR-003 is pending). The handbook’s “Session lifecycle” promises SessionStart/SessionEnd MCP reconciles and Notion posting that do not actually run (a bash hook can’t call MCP; the handbook says “the agent does it” — i.e. manual, unenforced). The cron is hand-tuned for EDT with a written reminder to shift +1h for EST — a latent correctness bug twice a year. So the published “operating cadence” is partly aspirational, echoing the first 360’s “narrative-not-mechanism” caution. Why it matters: documented automations that silently no-op create false confidence; someone believes the briefing went out when it didn’t. Recommendation: either wire AR-003 and make the cadence real, or mark the briefing/report cadence explicitly “not yet active” in the handbook and on the dashboard. Don’t let the handbook describe behavior that doesn’t execute.

F-5 — Single points of failure / solo-operator concentration · MEDIUM

Evidence: the deploy posture (ADR-0008) ties visibility to a single Vercel account; the daily cadence depends on one Principal’s timezone and one set of secrets; the PA is the sole holder of personal info and inherits all tools (security audit S-3, still Open — Principal decision) — the broadest blast radius in the org concentrated on one agent. There is no second human and the agent “workforce” is all one model behind one account. Why it matters: for a one-person venture this is partly unavoidable, but S-3 (an unscoped all-tools grant on the most sensitive agent) is a choosable risk left open. Recommendation: resolve S-3 explicitly — either consciously accept the broad PA grant in writing (security/confidentiality policy) or scope it. Close open audit findings rather than letting them sit.

F-6 — Finance/ERP: still entirely unbuilt, but correctly deferred · LOW

Evidence: docs/financial-system.md and docs/erp-plan.md are plan-phase; erp-needs-analysis.md recommends staying repo-first. The dashboard KPI “AI spend / deliverable” reads “plan-phase · ledger not yet live.” Why it matters: low — this is the right deferral. The only risk is that the plan docs keep getting elaborated instead of left alone until the build gate. Recommendation: leave it. Do not invest further in finance/ERP docs until a venture is actually spending money worth tracking. Flagged only so it isn’t mistaken for pending work.

F-7 — Minor: governance numbering drift · LOW ✓ RESOLVED

Evidence: the commission references “GR-1…GR-7” and the seed chatter references a draft “GR-8 (experts, educated, equipped),” but CLAUDE.md defines only GR-1 through GR-6. “The Standard” (experts/educated/equipped) lives in the handbook, not as a numbered Golden Rule. Why it matters: small, but governance artifacts citing rules that don’t exist is exactly the drift the Rules unit exists to prevent. Recommendation: reconcile — either finalize the experts/educated/equipped rule as GR-7 with the co-creation process (GR-3) or stop referencing it as a numbered rule. Keep CLAUDE.md the single source of truth for rule IDs. Resolution (2026-05-30, B-3): decided not to promote to a numbered Golden Rule. “The Standard” is HR policy (handbook), not an AI-facing rule; GR-1…GR-6 remain the complete set. The dangling GR-8 chatter reference was corrected in commit 104dda1. No document now asserts GR-7 or GR-8 as a numbered rule.

5. Prioritized recommendations

Do now:

1. Start the venture (F-1). Inject/write one ideation spec; drive it to a rubric for “good” + one show-the-work chunk. Make concept progress the next session’s DoD.
2. Freeze staffing and unit creation (F-2). No new units/hires until the venture clears its first gate. The work is one builder, not three managers.
3. Freeze net-new process docs (F-3). Fill CLAUDE.md’s core TODOs before authoring the next SOP/ADR/policy.

Do next: 4. Make the cadence honest (F-4). Wire AR-003 or mark the briefing/report and Notion reconcile as “not active” in the handbook and dashboard. 5. Close S-3 (F-5). Decide the PA tool scope in writing. 6. Reconcile the Golden Rule numbering (F-7).

Explicitly STOP doing:

• Stop building org to support building org. No more coverage-map-driven unit creation, no speculative planned units.
• Stop elaborating the finance/ERP plan docs until real spend exists (F-6).
• Stop adding process surface ahead of the activity it governs — change-mgmt DoD, secrets SOP, etc. are sufficient; don’t pre-author the rest.
• Stop describing automations in the handbook that don’t execute — it manufactures false confidence (F-4).

6. Verdict

Rating: B / B+ — “the org listened, fixed its worst operational risks, and shipped real product code; now it must point that capability at the actual venture.”

This is genuine progress over the first 360: the activation gap is closed, manifest toil is automated and CI-gated, a security audit cleared a real deploy, and the intranet is honest, lean, working code. The operating machine is now not just designed but running.

The unchanged core problem: the machine is still mostly running itself. The intranet shows the org to the org; the founding concept in docs/concept.md — the reason the company exists — remains untouched, and the org grew faster than the product it was built to ship. The scaffolding-to-output ratio improved from zero, but the output is largely more capable scaffolding.

The single highest-value move is unchanged from the first review and now more urgent: convert this excellent machinery into venture output. Freeze the org, freeze the docs, inject one spec, and ship one real chunk of the concept. We recommend the next review be gated on concept progress — not org progress.

— External Review Partners