PATAS v3: customer-first validation and benchmark-gated build

[kiku-jw]

Result

Validate and sell one bounded PATAS historical spam-campaign audit before
building a new v3 runtime. The benchmark is the paid pilot's acceptance
contract, not a pre-customer implementation phase.

Context

• The durable product and architecture source is
  docs/v3/BRIEF.md.
• The current market, competitor, economic, data-access, technical, and
  anti-slop synthesis is
  docs/v3/research/README.md.
• The current Core is a reference baseline, not a clean production foundation.
• PATAS is historical pattern/control discovery; TAS remains the separate live
  filtering concept.

Decisions

• Conditional GO for a paid customer/data validation; NO-GO for a new v3 build
  until both gates pass.
• First-cohort hypothesis: a company-backed UGC/support operator with paid
  staff, recurring cross-message campaigns, an authorized abuse-plus-legitimate
  export, and a PostgreSQL-backed review/control surface.
• Founding money probe: a scoped $500 offline audit after metadata-only data
  preflight, with one frozen PostgreSQL replay adapter and no live integration.
• Exact, character, entity, and sparse methods are baselines. Dense semantics
  is a challenger and is removed if it adds no future-slice control yield.
• Rules remain typed, cited, replayed, and human-approved. No raw LLM SQL or
  automatic production enforcement.
• Data possession or de-identification alone does not establish processing
  rights; provenance, authorization, purpose, retention, and deletion are
  separate.
• Owner authorization for the bounded customer-validation sprint was granted
  on 2026-07-17: up to 20 individually verified first touches, at most two per
  day, one follow-up per contact, asynchronous qualification, and up to five
  identical $500 offers after all qualification gates pass.

Acceptance

• Critical market, competitor, economics, data-access, technical, and
  adjacent-use-case research is published.
• Buyer qualification, fixed artifact contract, benchmark contract, and
  prospect/cohort kill rules are documented.
• Bounded customer-validation execution is owner-authorized.
• At least 5 of 15 qualified operators confirm the owner-set pain threshold.
• At least 3 of 10 data-qualified prospects can provide usable authorized
  abuse and legitimate history with future replay coverage.
• At least 1 of 5 concrete paid founding-pilot offers is accepted.
• One paid pilot produces a deployed control or review shortcut with
  measured work reduction under the buyer's legitimate-error ceiling.
• Three customers share 70-80% of the pipeline and at least one wants a
  repeat audit before broader v3/platform work.

All numeric thresholds above are owner-set falsifiers, not market statistics.

Current handoff

• State: In progress on 2026-07-28 after eight of 20 authorized first touches. Today used two of two first-touch slots. Three single follow-ups, two automated acknowledgements, one substantive human platform-boundary reply, zero verified bounces, and zero qualified buyers are recorded.
• Outcome: Gmail returned and a fresh All Mail, Spam, Sent, bounce, and duplicate scan found no new substantive reply or verified bounce. MoneySavingExpert and Pavilion received their final in-thread follow-ups; NodeBB accepted its final form follow-up. The Student Room and Digital Spy received bounded end-user currentness probes.
• Evidence: PATAS-TAS/PATAS@cc11e07, docs/v3/research/PROSPECT-COHORT-30.md, knowledge/completions/2026-07-28-customer-validation-mailbox-resumed.md, and the private execution ledger.
• Remaining: Mumsnet opens for one final follow-up on 2026-07-29; PistonHeads on 2026-08-03; The Student Room and Digital Spy on 2026-08-04. NodeBB, MoneySavingExpert, and Pavilion now close after a reply or silence. McNeel remains blocked by Spain LSSI; Best Practical by the US postal-address signature requirement; Netmums by channel and sensitive-data ambiguity; Communiteq, AVForums, and BleepingComputer by CAPTCHA.
• Next: On the next run, scan every contacted recipient and classify replies or bounces. Do not send another first touch on 2026-07-28. From 2026-07-29, send the single final Mumsnet follow-up only if no reply or bounce cancels it, and verify the next productizable end-user route without lowering the gates.
• Gate: No customer rows, contract deviation, production access, custom development, price or scope change, or new v3 implementation before payment, metadata fit, processing terms, and explicit data authorization.
• Source: PATAS-TAS/PATAS@cc11e07c07c376c866a0d640fa373172d8f9bad0 on main.

[kiku-jw]

The durable v3 brief and fresh-session handoff source are now published in commit 2e22f73.

Start with docs/v3/BRIEF.md. It records the reproduced v2 audit, settled PATAS/TAS boundaries, benchmark contract, research questions, phased v3 path, migration gates, and the exact first-session output.

The implementation gate remains: no production v3 service before a rights-cleared campaign-level benchmark and baseline comparison exist.

[kiku-jw]

Critical market and technical research is published in f636f04.

Verdict: conditional GO for customer/data validation; NO-GO for a new v3 build
until one qualified operator makes a paid commitment and passes the
usable-authorized-data gate. The research rejects generic anti-spam AI,
universal-platform positioning, and semantic-cluster-to-SQL shortcuts. It
freezes one PostgreSQL replay contract, makes cheap deterministic/lexical
methods the baseline, and treats semantics as a removable challenger.

The adversarial pass corrected the old build-first sequencing, separated
processing rights from sanitization, qualified current price/vendor claims,
split prospect disqualifiers from cohort kills, and reconciled the $500 money
probe with the larger benchmark. No customer outreach or data request was sent.

[kiku-jw]

The first-customer outreach roster is published in commit ad2e22b.

It names eight first-wave contacts across direct buyers and reusable platform channels, gives an official contact path and exact problem-specific first touch for each, and separates four boundary interviews plus explicit no-contact/skip cases. No public prospect is represented as ready for the $500 offer: every first message is a currentness or channel probe, and the paid offer remains gated on current workload, native-tool failure, an existing PostgreSQL-backed control path, retained abuse-plus-legitimate history, processing authority, and a budget owner.

The adversarial pass removed forbidden forum solicitation, reduced every first touch to one question and 50-80 words, and closed the first cohort against new plugins or platform-specific adapters. No customer outreach or data request was sent.

[kiku-jw]

Published the paid design-partner response playbook in fbfc3d9.

It maps likely first-wave replies to explicit advance or stop actions, puts the metadata-only preflight before scope and invoicing, and defines a paid partner as a named operator plus budget/data authority, full $500 payment, bounded review work, and a deploy-or-reject decision. It also preserves the no-custom-adapter, no-free-audit, one-analyst-day, and one-follow-up boundaries.

Current public DNS shows patas.app is configured for inbound routing but is not yet a verified authenticated outbound human mailbox. The tiny first wave should therefore use the existing authenticated human Gmail account manually; a permanent nick@patas.app sender remains gated on an outbound provider plus passing SPF, DKIM, and DMARC headers. The two proposed external skill repositories were reviewed but not installed. No customer message or data request was sent.