Glossary and architecture decision records¶
Purpose¶
One vocabulary for the whole system, and the record of the decisions that shaped it — so that a new engineer can read a sibling doc without guessing what a word means, and so that revisiting a decision starts from why it was made.
Scope / Non-scope¶
- In scope: terms used across docs 00–17, and the ten founding ADRs.
- Non-scope: product marketing vocabulary (see the PRD) and Seachonks lore.
Glossary¶
| Term | Meaning |
|---|---|
| Sea Suite | The product, and the roster of Chonk managers (in the C-suite sense). |
| AMS / MaaS | Agentic Management System / Management as a Service — the category. Sea Suite runs the management function of an org as a service, priced per managed person. |
| MaaS Market | The planned marketplace of managers: hire one Chonk, a crew, or the whole suite; later, third-party managers on the charter standard. |
| Harness | The orchestrator: schedules and triggers runs, routes work between managers, enforces policy, audits everything. Event-sourced; every run replayable. |
| Org Model | Versioned graph of Person, Role, Org, Goal, Project, Cadence, Policy, Decision and typed edges. Every change carries reason and actor. |
| Manager / Chonk | A role-scoped agent: role charter + voice + tool allowlist + sub-agents (planner, writer, chaser, analyst). |
| Role charter | What a manager owns, what it escalates, what it never touches. |
| Function service | Deterministic service the agents call for math: planning solver, capacity model, scheduling solver, calibration engine, budget ledger, escalation router. |
| Autonomy class | AUTONOMOUS (act, log, explain), PROPOSE_CONFIRM (recommend with receipts, wait for a human), HUMAN_ONLY (prepare a packet; a human decides; agents can never execute). |
| Hard line | An owner-set invariant ("never discount below 20%") that clamps every rule beneath it. Platform hard lines (the HUMAN_ONLY list) cannot be loosened by any tenant. |
| Decision pipeline | Observe → Propose → Pre-check → Act / route → Verify → Record. Mandatory for every consequential action. |
| Receipts | The evidence bundle on every recommendation or decision: sources, data snapshot, rule evaluations, model rationale, confidence. |
| Blast radius | People affected × reversibility × money × external visibility; gates autonomy and quorum. |
| Novelty | Whether the harness has performed this action shape in this tenant before; first-of-kind actions are never autonomous. |
| Closed-loop risk mitigation | Every control is Detect → Contain → Correct → Learn, with an owner, signal, threshold, and a learning step that changes rules or tests. |
Circuit breaker (BRK-*) |
A per-function automatic containment: trips on a signal, freezes or narrows the function, requires reset criteria. |
Kill switch (KS-L0…L3) |
Global containment levels from "pause outreach" to "stop all agent action and hand to humans". |
| Trust budget | Per-tenant, per-function score that earns graduation and loses it on incidents and overrides. |
| Graduation | SHADOW (acts only in a log) → PROPOSE → AUTONOMOUS, per tenant per function, with automatic regression. |
| Listening period | The first two weeks after onboarding: read, meet everyone, propose the first plan; no autonomous action. |
| Manager of record | The named human escalation owner for an org. ICs can always reach them in one message; the harness cannot suppress it. |
| Quiet HR | PTO, expenses, policy questions and documents handled in-thread, with the HRIS as system of record. |
| Atoms mode | The configuration for physical businesses: shifts, locations, inventory, safety, SMS and voice surfaces. |
| Tone dial | Per-tenant control from "full New Chonk City" to plain professional; what never changes is grounding and candor. |
| Outreach cap | Maximum manager-initiated messages per person per day/week; enforced in the outreach service. |
| Simulation org | Synthetic tenants used in evaluation: chonk-test-co (software, 40 people) and chowder-house (restaurants, 3 locations). |
| Manager thread | The single conversation each managed person has with their manager (Slack/Teams/SMS/app). |
| Owner Console | The owner/investor surface: direction, health, weekly update, approvals inbox, ask-anything, portfolio view. |
Architecture decision records¶
ADR-001 — Guarantees live in the harness, not in prompts¶
Decision. Autonomy classes, hard lines, outreach caps, budgets and audit are enforced by code paths the model cannot bypass. Prompts describe behaviour; the harness constrains it. Why. A prompt is a suggestion. A company's legal exposure cannot rest on one. Consequences. Every write goes through the outreach/action services; the model never holds raw credentials; policy evaluation is a deterministic function with tests.
ADR-002 — Event-sourced runs with replay¶
Decision. Every run is a sequence of immutable events; state is a projection; any run can be replayed against a new rule set or model. Why. Debuggability, "what would this rule have done last quarter", and audit demand a complete history. Consequences. Storage cost; idempotency keys on every side effect; compensating actions instead of in-place edits.
ADR-003 — Deterministic function services for the math¶
Decision. Planning, capacity, scheduling, budget arithmetic and calibration are ordinary services with explainable outputs. Models propose and explain; they do not compute. Why. Numbers must be reproducible and defensible to owners and, in Atoms mode, to labor law. Consequences. Model outputs are structured requests to services; service outputs carry their own receipts.
ADR-004 — The Org Model is a versioned graph¶
Decision. A typed property graph with edge cardinalities and invariants, versioned per change with a reason and an actor. Why. Management questions are graph questions (who reports to whom, what blocks what, who owns which goal) and history questions (what was true on the 14th). Consequences. Migrations are first-class; identity merging is a transaction; every read can be "as of".
ADR-005 — Autonomy can only be narrowed by tenants¶
Decision. Tenants can move actions from AUTONOMOUS to PROPOSE_CONFIRM or HUMAN_ONLY, never the other way; the platform HUMAN_ONLY list is immutable.
Why. The product's credibility and legal posture depend on lines that cannot be talked past by an eager owner.
Consequences. An "authority lint" rejects widening configs; the sales conversation includes what the product will not do.
ADR-006 — Shadow first, then propose, then act¶
Decision. Every function in every tenant graduates SHADOW → PROPOSE → AUTONOMOUS on measured agreement and trust, and regresses automatically on incident.
Why. Trust is earned per function, per company; a mistake in week one should cost scope, not the deployment.
Consequences. Shadow logs are a product surface; graduation criteria are documented and visible to owners.
ADR-007 — Receipts on everything¶
Decision. No recommendation, decision or message about a person ships without a receipt bundle citing Org Model data. Why. Explainability for owners, symmetry for ICs, evidence for audits, and a hard check on hallucination. Consequences. Grounding rate is a first-class metric; ungrounded claims are blocked before send.
ADR-008 — Hash-chained, append-only audit log¶
Decision. All decisions, messages and data access are logged to an append-only, hash-chained store with offline verification and export. Why. Employment disputes and compliance require proof that the record was not altered. Consequences. Audit write failure is a stop-the-world condition for consequential actions (see runbooks).
ADR-009 — The Chonks are the interface, with a tone dial¶
Decision. Managers ship as characters with stable voices; tenants dial tone from full Seachonks to plain, but grounding and candor rules are constant. Why. Characters make consistency legible, give permission for candor, never pretend to be human, and are the distribution engine. Consequences. The content engine is a core component, not a marketing add-on; brand-fit risk is handled by the dial, not by removing the characters.
ADR-010 — Price per managed person¶
Decision. The billing unit is the managed person per month, with Owner Console seats free and Atoms as a per-location add-on. Why. It is the honest unit, it maps to the cost being replaced, and it aligns incentives with the IC experience. Consequences. Metering counts active managed people; expansion is Org → Full Suite, not seat upsell.
Open questions¶
- Should ADR-005 allow a time-boxed, logged, owner-signed exception for
PROPOSE_CONFIRMthresholds during declared incidents? - Do third-party managers in the MaaS Market run inside the same harness with the same charter standard, or as isolated tenants of the harness?