From 477701fea284bfca28db9e5a298c5e81bc532b1c Mon Sep 17 00:00:00 2001 From: mathias Date: Wed, 3 Jun 2026 20:44:19 +0000 Subject: [PATCH] docs: revise Stage 0 gate to "useful to me or a friend" (behavioural) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the original "useful to me, specifically" gate with "me OR a friend returns unprompted in >=2 separate weeks" — friendly-user signal counts, but the test stays behavioural (return usage) not feedback-based, to resist politeness bias. Folds the old Stage 1 ("a trusted user returns") into the new Stage 0 (they were near-identical), renumbers hardening to Stage 1, and updates the drift signals (the gate can be softened by mistaking polite feedback for evidence; multi-user shipping ahead of the gate was a recorded exception per ADR-012, not a precedent). Rationale recorded in ADR-016. --- VISION.md | 62 +++++++++++++++++++++++++++++++------------------------ 1 file changed, 35 insertions(+), 27 deletions(-) diff --git a/VISION.md b/VISION.md index a73400b..56c9170 100644 --- a/VISION.md +++ b/VISION.md @@ -44,50 +44,54 @@ fallback — their key, their choice. ## Who it is for -- **Now (the first customer):** the maintainer — one person, their own subscriptions, - summaries delivered to their own store and brain. -- **Soon (Future B):** a small number of known, trusted users (friends / beta) — each with - their own account, isolated data, optional BYO-AI. +- **Now (the first customers):** the maintainer and a small number of known, trusted + friends — each with their own account, isolated data, optional BYO-AI. The maintainer is + the first customer; friendly users provide the earliest real-world signal. - **Maybe (Future C, explicitly not built yet):** a public multi-tenant service. Deferred - until there is evidence of sustained personal use **and** real demand. Building for C - before that evidence is a known anti-goal. + until there is evidence of sustained use **and** real demand. Building for C before that + evidence is a known anti-goal. ## Definition of Success Success is staged. Each stage has a single, falsifiable headline test. We do not advance to the next stage's ambition until the current stage's test passes. -### Stage 0 — Useful to me (the gate) +### Stage 0 — Useful to me or a friend (the gate) -> **Headline test:** For four consecutive weeks, the maintainer reads Tapir-produced -> summaries for their own subscriptions at least weekly, and at least once acts on a -> summary (watches / skips / saves a video *because of* the summary). +> **Headline test:** Over a 3–4 week window, *either* the maintainer *or* at least one +> onboarded friend returns to Tapir **unprompted** and reads/acts on summaries in **≥2 +> separate weeks**. The test is *return usage* (behavioural), not stated approval. -- Captions-first summarization works end-to-end for the maintainer's real subscriptions. -- Summaries land in the maintainer's store and (optionally) brain. +- Captions-first summarization works end-to-end for real subscriptions (the maintainer's + and onboarded friends'). +- Summaries land in each user's own store and (optionally) brain. - Local-first AI produces summaries of acceptable quality without manual intervention most of the time. -- **This is the gate.** Multi-user, BYO-AI-for-others, and any SaaS ambition stay deferred - until Stage 0 holds. (Ties to the 2026-07-01 self-use check-in.) +- **Why behavioural, not feedback.** Friend *feedback* is gathered and genuinely valuable — + but it is **not** the gate. Asked-for feedback from friendly users is the least reliable + signal in product development (politeness bias); whether they *come back on their own* is + the thing we actually care about. So the gate measures returns, not nice words. +- **Why "me OR a friend".** This replaces the original "useful to *me*, specifically" gate + (2026-06-03 decision, recorded in DECISIONS.md ADR-016). Getting signal from friendly + users is valuable enough to count — but the bar stays behavioural so it can't be cleared + by a polite reaction. (Ties to the 2026-07-01 check-in.) +- **This is the gate.** Hardening (Stage 1) and any SaaS ambition stay deferred until this + behavioural signal exists. Note: multi-user machinery was deliberately built *ahead* of + this gate (ADR-012) with isolation enforced — that was an explicit, recorded call, not a + sign the gate had passed. The gate is about *evidence of use*, which is still open. -### Stage 1 — Useful to a few (Future B) - -> **Headline test:** At least one trusted user other than the maintainer connects their -> own account and, within their first month, keeps using it (returns to read summaries in -> ≥2 separate weeks) without the maintainer hand-holding each summary. - -- Multiple users, each with isolated accounts, credentials, and summaries. -- A new user can self-connect a YouTube/Vimeo account and get summaries with no code change. -- Optional BYO-AI works per-user. -- No cross-user data leakage — demonstrable, not assumed. - -### Stage 2 — Trustworthy at rest (hardening, still Future B) +### Stage 1 — Trustworthy at rest (hardening, Future B) > **Headline test:** Credentials (OAuth tokens, BYO-AI keys) are encrypted at rest via the > homelab's existing secrets convention; a documented, rehearsed recovery path exists; and > a deliberate isolation test (user A cannot read user B's data) passes in CI or a > documented manual drill. +- Per-user data isolation is enforced and tested (delivered early via ADR-012 RLS). +- Per-user credentials are encrypted at rest (ADR-015 envelope encryption; build in infra#89). +- A new user can self-connect a YouTube/Vimeo account and get summaries with no code change. +- Optional BYO-AI works per-user. + ### Non-goals (current) - Public sign-up / billing / a marketing surface. @@ -98,7 +102,11 @@ to the next stage's ambition until the current stage's test passes. ## How we will know we are drifting -- We are building Stage 1+ machinery before the Stage 0 gate has passed. +- We declare the Stage 0 gate "passed" on the strength of polite feedback rather than + behavioural return-usage (the politeness-bias trap the gate is designed to resist). +- We build Stage 1 hardening or Future C machinery while the Stage 0 use-evidence is still + absent. (Multi-user machinery already shipped ahead of the gate via ADR-012 — a recorded, + deliberate exception, not a precedent for more.) - A user's content reaches a third-party model without that user's explicit, per-user opt-in. - "Brain ingestion" starts dictating the architecture instead of being one sink behind an interface.