An independent red team of the portfolio-architecture-how design against every architecture ask Fede, Sean and Gera raised in the Sep 8 founders' standup. Five lenses, 104 findings, 60 new stress cases, 12 decisions for a human.
2026-09-08 · run by Agent Smith at Gera's request · five parallel reviewer agents, one synthesis · findings handed to the claude-arch-design session for ingestion into the design page
Verdict: the design held on paper and broke on the one decision it recommends. The row model can express almost every shape the standup named — the hybrid number, Yale's three calendars, region defaults with sub-market overrides, the in-house handyman, one login across two orgs. But D3-A puts Yale under JP&Co (the owner) as the runner, and in this design the runner holds the policy root, the lock, the admin seat and every conversation. Sean, Fede and Gera all said the opposite: the property manager sets policy; the owner can't force it. Three of five lenses hit that seam independently. Nothing in the catalog is proven correct by anything that runs today — zero of 151 cases — so "stood the test of time" is a claim about prose, not about code.
| Bucket | What it means | L1 Yale | L2 Visibility | L3 Regions | L4 Control | L5 Edges | Total |
|---|---|---|---|---|---|---|---|
| HELD-EXECUTED | a running test proves it | 0 | 0 | 1 | 1 | 1 | 3 |
| HELD-ON-PAPER | the design answers it in rows/prose; nothing executes | 4 | 5 | 3 | 3 | 10 | 25 |
| HELD-WITH-CHANGE | answers it only after a named change | 1 | 5 | 7 | 5 | 6 | 24 |
| BROKE | cannot express it, or contradicts the business rule | 9 | 4 | 3 | 9 | 4 | 29 |
| NO-ANSWER | the design is silent | 6 | 7 | 2 | 5 | 3 | 23 |
| Findings | 20 | 21 | 16 | 23 | 24 | 104 | |
All three HELD-EXECUTED rows prove the disease (per-building duplication is live today), not the cure. The executed-vs-paper audit of the whole catalog is at the bottom.
| # | The standup said | The design does | Lens |
|---|---|---|---|
| 1 | "ConAm owns the policy. The owner can't force ownership over a pet fee. Who's the admin? One of that property's." (Sean, Fede, Gera) | Inverted. D3-A makes JP&Co the runner of Yale. POLICY keys are writableAt: org = JP&Co; locked lets JP&Co refuse ConAm's pet-fee write by name; Yale's admin is a JP&Co org_admin; JP&Co reads every Yale conversation by being the runner. ConAm's region chain cannot contain Yale at all (in_group requires the group's org = the runner). The design gates WHERE a key may live, never WHO may write it. | L1 · L3 · L4 |
| 2 | "If they want to relinquish control to a local apartment, or to the owner, they have to decide that." (Gera) | No row. Authority is role × scope × tool; policy is key × tier × lock. Nothing carries key + node + person. "Relinquish" appears nowhere in the design. Scoping a person to a building gives her every key there and excludes nobody above her; locked is the only exclusion and it points the wrong way (owner down, not manager out). | L4 |
| 3 | "Cito's has three leasing people — they can move tours around between them and reassign them." (Fede) | Missing. No ST case, no mutation in the 18-row operator catalog, no row for what happens to TOUR#{assignedPersonId, calendarIds}. ST-63 states the opposite: a booked tour's assignment is frozen. And every calendar case gates at step 8, in the backlog after the committed scope ends Nov 24–Dec 25 — after Yale onboards. | L5 |
| 4 | "All three of those organizations have the ability to see what's going on at Yale." (Sean, present tense) | Monthly. Owners get a pushed REPORT#pid#period row. Today's E8 widened the grant list to five projections; only reports has a carrier row (the design admits this). A live thread, a mid-flight work order, today's tours — unserved. The widened grant is a wider promise over the same one narrow row. | L2 |
| 5 | "How are we making sure the employees aren't like, wait, the org set this policy but we're overriding it." (Gera) | Data, no reader. setBy and MAPLOG# hold who/when; no key-centric diff view, no override count, no notify hook. AC11 closes the illegal override at write; the intern writes a legal PARAMETER row. setBy.userId is optional. MAPLOG keys on mapVersion, which a value edit doesn't bump. Step 7 backfills per-property columns into per-building rows with no hoist-identical step — we manufacture Cito's "not on purpose" divergence ourselves. | L3 · L4 |
{value, setAt, locked, maskedBy} — a direct answer to "which node set it and what did it mask."ScopePath.chain up to five nodes), so region-default + sub-market-override is expressible inside one org — better than the page's own "regions are tags" sentence admits. quiet_hours is already a registered PARAMETER; Fruita-8am / org-7am resolves with no new concept.phone_line.greeting read via lookupVia:'line'. Yale's three calendars are two PERSON# calendar rows plus one PROP# calendar, picked by a pure function.The design's error is not the graph. It fused three jobs into one node — the isolation wall, the billing unit, and the policy root — and the first customer where those come apart (Yale) is the one it recommends onboarding under the wrong root. Sean's labels are the missing vocabulary, not a missing mechanism. The lenses converge on seven changes; five are small.
| # | Change | Closes | Size | When |
|---|---|---|---|---|
| 1 | Authority follows managed_by, not the wall. Two putAttachment refusals — (k) an ancestor lock on a key a live managed_by row grants is refused, naming the row; (l) a settings/policy_authority term in managed_by.grants makes the manager's org the top rung for the keys it names. Separately, put the wall question (who runs Yale, who pays) to Sean this week while Yale holds no data — flipping the runner is cheap now and costs TCPA re-consent for every resident after go-live. | Broke #1 | 2 refusals + 1 resolver term | before 6a; the commercial half now |
| 2 | A delegation attachment kind: <node>/ATTACH#delegation#<key>#<startedAt> {to, grantedBy}. Rides the dated/HIST/MAPLOG/Undo machinery unchanged. Makes "relinquish" a countable row — which is also the counterweight to "too customizable." | Broke #2 | 1 kind, 1 refusal, 1 chip | 2a/2b |
| 3 | Tour reassignment mutation + a Yale/Cito's calendar slice pulled forward from step 8 (CRED# + person calendar + assignment + schedule + findTourCandidates; no LRB, areas, cross-sell). Precedent: the Situs slice already pulled from steps 7–8. | Broke #3 | minority of step 8's 10–13 days | before Yale |
| 4 | Work orders event-grained for owner parties (second party_push instance, same ConditionCheck); rename the other grants to what they deliver; drop conversations from grantable until it has a row. Save cross-org selections as PERSON#/VIEW# — Sean's label, done as a view. | Broke #4 | 1 row family + 1 day | after S-B |
| 5 | The intern instrument: MAPLOG SK re-keyed to a shared counter (irreversible once rows exist), setBy.userId required + setByRole, an overrides projection + FF overrides-inventory, and a collapseKey verb that hoists identical per-building values to the org. | Broke #5 | ~2–3 days inside steps 1–2b | step 1 |
| 6 | Sean's vocabulary on the group row: {label, walked, rank} instead of kind:'chain' + per-edge integers, plus a cross-building order refusal (today two buildings can rank the same two groups oppositely, silently). locked → {belowTier} with true as alias. | Fede's litmus; L3 BROKE | 2 read sites + 1 write query; 1 registry field | before D2 is signed |
| 7 | Registry hygiene before D2: register maintenance.spend_cap (PARAMETER, org/group/property) and make visibleToGrantee a real KeySpec field or delete it. poolingConsent defaults to ['leasing_line'] on owned_by rows whose owner is purpose:'owner_party' (a non-customer). | Smaller breaks | registry lines | this week |
Consolidated from the five lenses. To be raised on the Decisions tab by the claude-arch-design session, which owns this design's ledger — none raised at publish time. Recommendation first, on purpose.
| Decision | Options | Recommendation | Owner · by |
|---|---|---|---|
Who holds settings authority on a building with a live managed_by row? | (a) the runner, always (today) · (b) the manager, via refusals (k)+(l) · (c) per-key authority term | (b) — smallest change that matches the standup; keeps one rule | Fede + Gera · before 6a |
| Who runs Yale — JP&Co or ConAm — and who pays? | (a) D3-A, owner runs · (b) ConAm runs, JP&Co is owner_party · (c) D3-A + authority moves with the relationship | (c) now; put (b) to Sean as a commercial question this week — cheap while Yale is empty, TCPA re-consent after | Sean + Fede · this week |
| Does "relinquish" get a row? | (a) delegation kind · (b) widen locked to a mode · (c) not in v1, said loudly | (a) at 2a/2b | Gera · before 2a |
| Owner visibility: period- or event-grained? | (a) monthly, renamed honestly · (b) all event-grained · (c) work orders only | (c), (b)'s shape reserved; never ship the widened grant list without (a)'s renaming | Gera · before the grant ships |
| Pull the intern instrument forward of 6a? | (a) all three · (b) MAPLOG only · (c) defer | (a); (b) is not optional — the SK is irreversible once rows exist | Gera · step 1 |
| Pull a Yale-shaped calendar slice forward of step 8? | (a) leave it; Yale on one umbrella calendar · (b) the slice + reassignment · (c) one calendar, gap documented | (b) | Fede + Gera · before Yale |
locked: boolean or {belowTier}? | (a) boolean, lock at the group · (b) {belowTier} · (c) defer | (b), before D2 — a registry edit now, a sweep later | Gera · before D2 |
| Group vocabulary: job or word; rank per edge or per group? | (a) status quo · (b) {label, walked, rank} + order refusal · (c) group-level rank only | (b) | Gera · before 6a |
Default poolingConsent for non-customer owners? | (a) refuse and name · (b) fall through · (c) default on for owner_party | (c); Situs-held stock still needs an explicit row, typed once | Fede · before Sep 12 |
| Cross-org headline: fold owned-not-run buildings? | (a) keep ST-138, separate tile · (b) fold a REPORT#-sourced leg with a typed basis | (b), typed basis as precondition; never "5 properties" over a 3-property compute | Gera · A6 |
Register maintenance.spend_cap and visibleToGrantee before D2? | yes / no | yes — D2 is the one irreversible artifact | Gera · before D2 |
| Tell Fede the 24h voice back-test is not v1? | text-or-carrier-fork only | say it plainly before the ramp plan is promised to Cito's | Smith → Fede · follow-up, not yet done |
| Bucket | Count | Note |
|---|---|---|
| Total ST ids | 151 | ST-01…145 with no gaps + 6 ST-H, in 170 rows (the page's own "146 ids, 165 rows" in A5 §42 disagrees with its §5/§68) |
| Executed — green | 8 | gauntlet T4/T10/T11/T12 PASSES + ST-143/144 existing unit tests |
| Executed — red | 28 | 21 A7-cited + 7 gauntlet FAILS / CANNOT-EXPRESS — each a running assertion that the bug is still there |
| Paper only | 114 | |
| Open | 1 | ST-76 |
60 cases minted across the lenses (L1 13 · L2 14 · L3 9 · L4 12 · L5 12), numbered ST-146+ per lens — they collide and are renumbered on ingest by the arch session. Each names the standup quote, the bench, what must happen, the rows that prove it, and the closing step. The headline ones: the manager writes pet_fee on a managed building and the owner's lock is refused (L1); a building with 20 owned_by rows (L2); two buildings rank the same two groups oppositely (L3); the delegation row lets one person set one key at one node and nobody else (L4); a booked tour is reassigned between leasing people and the calendar event moves (L5).
Full reports live on the mini at ~/redteam-standup-2026-09-08/L1..L5-*.md and were handed to the claude-arch-design session (70690853-5b94-4113-98e2-bf555c46d0b8) for ingestion into the design page. Verdict paragraphs below.
D3-A inverts the standup's business rule on Yale, and it does so structurally, not by oversight. Under D3-A, JP&Co — the owner — is the runner, and the runner holds every lever the standup assigned to the manager: POLICY keys are writableAt org = JP&Co; the locked bit lets JP&Co refuse ConAm's building-level pet-fee write at write time; the admin of Yale is a JP&Co org_admin; JP&Co reads every Yale conversation by being the runner. managed_by.grants is an invitation authorisation, not a write gate — nothing in putAttachment's refusal list consults a relationship. ConAm's org- and region-level policy cannot reach Yale at all. Where the design beats Sean's label graph: labels carry no precedence, so they cannot answer "which pet fee wins" — the resolver's fixed fold can, and names the node that set it. The design's error is fusing three jobs into one node — the isolation wall, the billing unit, and the policy root.
The design wins the isolation argument outright and Sean's label-graph should not replace it. Sean is right about something else, and the design half-misses it: his labels are about seeing what is going on, present tense, and the push model delivers a monthly row. Of the five projections granted on Sep 8, only REPORT# has a designed carrier row. Hugo is served — he is a member of both orgs and A6 folds two member orgs into one combined headline. The gap is one shape over: an owner who is not a member of the runner org — the design's own Situs President — whose owned buildings are "never in the compute." Sean's best idea already exists unnoticed: the Selection is his label (cross-org, zero rows, narrowing-only); it is just ephemeral. Save it as a named view.
The geometry is better than the page's own prose says and worse than it admits in two places. Better: a building can sit in several walked chain groups at once, so region-default + sub-market-override is expressible within one runner org, and quiet_hours is already a registered PARAMETER. Worse: in_group requires the group's org to be the runner, so under D3 ConAm's chain cannot contain Yale; precedence is per-edge with only an intra-building tie refusal, so two buildings can order the same groups oppositely, silently; and step 7 backfills per-property columns into per-building rows with no hoist-identical step — we manufacture Cito's "not on purpose" divergence ourselves. No key-centric diff view exists for the intern question. Keep the substance, take Sean's vocabulary: {label, walked, rank}, a cross-building order refusal, a collapseKey verb.
The design models where a value may live and never who may put it there. No row carries key + node + person — the exact triple Gera's "relinquish" sentence is. GRANT# = 0 rows; "relinquish" appears nowhere. Under D3-A the owner's org_admin tops Yale's walk, writes every POLICY key, and can evict ConAm's staff. MAPLOG is the right shape, wrong key — a values-only override bumps valuesVersion, not mapVersion, so it logs under a counter it didn't move. Role work lands 6a = Nov 24–Dec 25; the first customer is live Sep 12 — ten to fourteen weeks on the simple matrix. The smallest vocabulary a non-technical admin can hold: "org decides / buildings may differ / this person decides here" — the third word needs the delegation row.
The row model can express almost every edge the standup named — the hybrid number is one transact, the greeting is a per-line attribute, Yale's three calendars have rows. That is the design's real win, and nearly the whole of it: exactly one of 24 findings is HELD-EXECUTED, by a lane CI never runs. Four break: a booked tour cannot be reassigned between leasing people (Fede's verbatim Cito's requirement; ST-63 states the opposite); the 24h cowboy back-test is inexpressible; the floating PM has zero hosts on homes without pooling consent, at go-live; there is no break-glass that hands a call back to a human. The structural finding is a date: every calendar case gates at step 8, in the backlog after the committed scope ends Nov 24–Dec 25. Yale onboards first.
role-matrix.ts may already refuse an arm, the finding is that the design does not say so — enough to block D2, not enough to say the product is wrong.