How I build · Exhibit

Automated and human QA/QC

An AI operating model is only as good as the checks on it. This one has three layers of checks and one person who rules on every finding. Each layer exists because of a specific failure the layer below it could not see.

steps inside every action — the preflight procedure, run before any deliverable ships and before any response is sent

checks across the whole project — the nightly sanity scan, unattended, every evening

mechanical checks on the system of record — the tracker audit script, plus a geography gate

human who rules on every finding, and whose catches are counted against the machine’s

The machine checks its own work three ways. The human sets the thresholds, grades the misses, and is the only control that is not self-administered.

Layer one · inside the action

A unit test for every turn

Acceptance criteria written before building. A failure pass. A mechanical check. A cold read of the finished thing from where it actually lives. A check on the response itself. Propagation of every ruling in the same turn.

Layer two · across the day

A scan for what no single turn can see

Drift between documents that were each correct when written. Numbers that should be moving and are not. Rules that strand work silently. Questions left open too long. Whether the procedures themselves ran.

Layer three · the system of record

Code, not judgment, on the CRM

A script with fixed thresholds runs against a live export of the register. It names the rows in every finding, fails loud on any value it does not recognise, and cannot skip a test or invent one.

Layer oneThe preflight procedure

Runs on the deliverable in hand and on the response about it. Every step was added for a defect that shipped.

Step	What it does	Why it exists
Session start, in order	Read the single entry point first; the newest Denver timestamp wins any disagreement. Never trust a title or a pointer alone — list the live folder by modified time and read the newest file end to end.	Four continuity documents each said “read this first” and disagreed about what was current.
Acceptance criteria	Five to eight checkable statements that must be true of the finished deliverable, written before building.	Written after the fact, they are a description of what got built, not a test.
Failure pass	Three specific ways the deliverable breaks in the receiver’s hands; guard each or state why the risk is accepted. Anything handed to a third party carries a trap that makes a silent failure detectable.	Silent failures are the expensive kind.
Mechanical check	Version strings match titles. Every reference resolves to a current document. Any length or count was measured by rendering or recomputed from the table, never estimated. A change list is produced by diffing, then annotated. Anything created in Drive is read back before it is called delivered. For a resume, a parser check runs on the real built PDF.	A create call’s success response says nothing about how the document renders; a structural read-back is not a layout read-back.
Cold read	Read the built artifact back from where it lives, not from the draft in context, against the acceptance criteria one at a time.	The draft and the thing that shipped are not the same object.
Response check, then propagation	Before any reply: every stated gate or caveat tested against the newest ruling; plain English, no internal codes; one challenge aimed at the machine’s own output first. Then every ruling is stamped and written to every surface it touches in the same turn, and anything it overtakes is marked superseded.	A ruling once landed in whichever document was open and reached nothing else.

Layer twoThe nightly sanity scan

Unattended, every evening, and on demand. It looks only for defects invisible from inside a single action, and it re-checks nothing the preflight already checks — a check duplicated in two places is two places that can disagree.

Check	What it tests	Fires when
Currency of pointers	Every document that claims to say where something lives, tested against the live folder sorted by modified time — including titles that break convention and titles beginning “Copy of”.	A pointer names a file that is not the newest of its kind, or no longer exists.
Contradiction scan	Named pairs of documents that must agree: pointer against newest file, project copy against Drive copy, parked list against the live page, memory against the standing instructions, the procedure against the scheduled task that runs it.	Any pair disagrees. The newer timestamp wins; the older is flagged, never silently reconciled.
Tracker audit	Hands the live register to the layer-three script and reports what it prints.	Whatever the script says. The scan may not re-derive the checks by hand.
Chokepoint review	Total standing-instruction load; rules whose violation produces no error; controls the machine both wrote and grades; handoffs that depend on one person’s paste; whether the model running a procedure is fit for it.	A rule is added without one retired; a silent rule has no detector; a paste has waited more than two days.
Aging open questions	Every decision the human owes, with the date raised and days open, and any work built on top of an unanswered one.	Three days open; escalates at seven.
Did the procedures run	Deliverables shipped against preflight runs recorded; rulings landed against propagation completed; errors logged against errors the human caught.	A deliverable shipped unchecked, a ruling did not propagate, or the share of errors caught by the human rather than the system rises — the health metric for the whole project.

Output is one page, findings only, ranked wrong now · trending wrong · wrong at launch. Nothing that passed is mentioned: a wall of green is how a check stops being read. If nothing fires, the report is one sentence.

Layer threeThe tracker audit script

Written after the nightly scan twice reported tracker findings that were wrong in both directions — it invented a failure from a value it did not recognise, and it skipped two checks while labelling the table as if all had run. Every check below is mechanical; none needs judgment to decide whether it fired.

Check	Fires when
Vocabulary integrity	Any status, tier or geography value the script does not recognise. An unknown value is how a check mis-scores a row, so it is a finding in itself.	Runs first; everything below depends on it.
Intake freshness	The newest arrival is more than 48 hours old, or three or more of the last fourteen days took in nothing.	The failure that started all this: intake stopped for five days and every session still passed its own checks.
Source breadth	Fewer than four active channels, or one channel above sixty percent of new rows in the trailing fortnight.	One channel going quiet would stop intake outright.
Triage coverage	Unrated rows above half the register, or rising since the last run.	Triage falling behind intake.
Duplicates	Two rows with the same normalised company and role, or the same link, with more than one survivor.	Names every row in the cluster.
Formula integrity	A rated row with no computed score, or an error value in score or tier.
Required fields	Any live row missing company, role, status, first-seen date, source or link — broken down by field, by source and by the heaviest intake day.	So the fix points at a channel, not a column.
Funnel movement, row-count reconciliation, geography gate	No application recorded in seven days; the row count falls, or sits still while intake is already stale; a live top-tier row fails the remote-or-commutable rule, or cannot yet be gated.	Each names its rows.

What this does not fix

All three layers are self-administered: the machine wrote them and the machine runs them, which is exactly the chokepoint layer two flags. The only control in this system that is not self-administered is the human, and taking load off him is what the layers are for — so the health metric is not how many defects the machine finds, but what share of the total it finds before he does. On the error ledger that share currently stands at one hundred and eight of one hundred and forty-four.

None of it will catch a claim that is simply false. That needs a source, not a checklist. And a scan that runs in the evening gives a morning defect a full day to propagate; a check that runs constantly is a check that gets muted, so the trade is deliberate and named here rather than discovered.

When a defect ships that one of these should have caught, that is a defect in the procedure, and it gets its own ledger entry and a version bump like anything else.