25 minutes. For an audience that will ask how it's built and try to break it.
The thesis: the interesting thing here is not the data pipeline — it's that
every assumption is a row, not a constant. Governance is the architecture. Lead with that and the rest follows.
1 · 5 min
The settings cascade
https://apps.ukacq.com/define-game
83 settings across three apps today: define-game 54, company-card 21, fountainhead 8.
Show the cascade order: fixed > user > admin-default > schema-default.
The four governance axes — this is the part that is not standard practice:
On — does the setting apply at all
Shown — does the user see it exists
Change — may they move it
Scope — may they alter its bounds
Demonstrate the lock: a setting with user_editable=false returns 403 on a user PUT. It is enforced server-side, not hidden in the UI.
"Four axes, not one boolean. I can ship a setting that's on but invisible, or visible but locked, or changeable only between bounds I set. Most systems have one flag — 'is it configurable' — and everything else is a constant in a file."
2 · 4 min
The `open` status — the bit people argue with
Three statuses: ratified · proposed · open.
19 settings are currently open — meaning no value, and a written question in the row.
Two database CHECK constraints make this structural rather than cultural:
status='open'requires a non-null open_question
every setting must declare feeds and blast_radius — 0 nulls
"A setting with no declared blast radius is still an assumption — you've just moved it somewhere prettier. So the schema won't accept one. And 'open' is a legal state: the system carries the question instead of inventing a default."
Expect pushback: "isn't an unset config just a bug?" The answer: an invented
default is a decision nobody made, taken silently, that becomes load-bearing. An open row is the
same uncertainty, visible and greppable. Show GET /api/settings/open.
3 · 5 min
Provenance and disclosure
https://company.ukacq.com
9 levels, Public → Companies House → Forensic → NDA → Full DD → Absorbed → Operating → Reporting → Exit.
A level records which door opened — not a completeness score, not a field quota. That distinction is deliberate and worth explaining.
3 source classes — public / private / privileged — with a disclosure matrix governing which class may render at which level.
Show the honest label: employee history reads "provenance unverified" where untraceable, "Filed accounts" where traceable. 575,487 of 6,848,125 rows (8.4%) qualify.
Be straight about the gap: the disclosure matrix has 0 rows and the
level→block map is currently all-blocks-at-all-levels. The machinery is built and negative-tested; the
curation is a human decision that hasn't been made. So today it enforces nothing. Say so — a technical
audience will check.
Model per call-site, not per phase — opus/sonnet/haiku chosen per step with a stated rationale.
Expected vs elapsed panel: the expectations are percentile_cont(0.5) over observed
step_run rows. Real medians, zero seeded constants. Show the view definition if they want it.
Measured engine medians, n=15 complete runs: min 13 m 52 s · median 20 m 35 s · max 35 m 32 s.
The honest defects, volunteered before they're found:
9 of 23 steps never write wall_sec — the forecast panel is blind on them.
6 of the 14 steps it does cover rest on 2 samples. A median of two numbers is a midpoint.
Search is not wired. Reports run from model memory, so citations are sparse. The evidence gate correctly flags this rather than passing it.
The evidence gate detects source-shaped tokens, not evidence. A fabricated report flips to PASS with one added Source: line. It's a floor against emptiness, not a truth test — and that's declared in the config, not discovered.
"I'd rather tell you where the instruments are weak than have you find it. The gate is a floor, not a proof. When search lands it'll start saying PASS a lot more, and that PASS will mean less, not more."
5 · 5 min
Verification discipline — the part I'd want reviewed
Every check in this system has a proven failure mode. The rule is: a green check that cannot go red proves nothing.
verify_authz.sh — spins a disposable non-admin, asserts 403 on all five admin endpoints, deletes it. Live, not mocked.
check_route_guards.py — CI rule that every mutating route is authorized and audited. It found a gap a hand-built audit table missed.
gate_selftest.py — asserts the gate blocks for the stated reason, after a self-test that passed with the config deleted.
"We shipped a fix, a probe confirmed it, and both were measuring the wrong thing — four of nine mutating endpoints had no authorization call at all. So now every verification has to demonstrate it can fail."
Strong close for this audience: "There's no human-authored benchmark anywhere
in this system. We found we'd been grading model output against other model output and calling it a standard,
and we retracted it in writing. That's the kind of thing I'd want to know about a system I was evaluating."