Brigade House Handoff Review — phdata-brigade-house-2026-07-06.zip

Founder ask (iMessage 2026-07-07 00:06): "did some major work to the brigades to improve the UX — identify the improvements, and is there anything else I should prepare before moving it to my work machine?"

Bundle: 46.6MB zip (received via Discord after the iMessage transfer stalled at 0 bytes), built on his personal machine (/Users/baw/Downloads/handoff/). Contents: phdata-ai-wf-plugins (branch brigade-consolidation @ 0847097), phdata-caf-snowflake-frontend (branch build-manifest-port @ 42e4eec), cellar/, data/jobs.db, HANDOFF-README.md + HANDOFF-DECISION-TRACE.md (both authored 23:59 on 7/6).

Verdict: this is a genuinely port-ready consolidation. Every claim I could check on the mini checked out. The runbook in his README covers the mechanical port; my additions below are mostly Snowflake-account work and a handful of known-debt items to carry knowingly.

The improvements (what his session actually did)

1. Consolidation: five zips → three pieces, one marketplace

• All brigades now live as plugins in ONE marketplace repo: ab-assessment, ab-company-research, ab-sales-collateral, ab-skill-factory, ab-registrar, plus copilot-studio-agent-builder and snowflake-cli (7 plugins; his README says "six" — doc drift, see below).
• jobscraping repo dissolved: the scraping core (~4.8k of 24k lines — library, ATS detector, nine routed scrapers) vendored into ab-company-research; ML/analysis cruft and the 16k-row corpus deliberately dropped (retention CLI added). An engine-port approach was built first, then killed same-day as a deliverable-blocking workspace dependency — the right call.
• ACF absorbed via git subtree (history preserved). caf plugin deleted — canonical framing locked: assessment brigade = CAF phases 1-4; phases 5-8 = delivery.
• ab- naming scheme (his coined "Agent Brigade" prefix) — deliberately decoupled from churning org names (not di-/phd-/caf-), groups brigades in any sorted listing.

2. ab-registrar — the first HOUSE ROLE (the steward, extracted)

• Front-of-house is now its own plugin with read-only verbs orders + registry; identity = PMO/librarian (founder's "clear over cute" naming rule — rejected maître d'/sommelier).
• No fire lane (fire = kitchen-side only), scan-on-demand registry (no materialized index), publishes NO menu (v1 stance, revisit if inter-house federation needs it).
• Kitchen-brigade vs house-role split codified in BRIGADE-INTERFACE.md: house role = mise + role verbs; no service/lock/stations/menu.

3. Rail + canon machinery hardened

• rail_adapter 1.1.0: pull() takes walker scope (allowed_artifacts + brigade) — fixes a live cross-brigade mis-pull on the shared rail; out-of-scope tickets skipped untouched; regression tests pin the exact incident; targeted ticket_id pulls stay unscoped for pass_driver resume. (Closes the "parameterized pull" item from our 7/3 follow-up ledger.)
• cellar.py canonized: one CELLAR-SPEC adapter at ab-skill-factory/adapter/cellar.py — the three vendored copies had drifted 77-122 lines; reconciled as a union, vendored in place (import path preserved), sha256-stamped with mise checks. Frontend scripts/cellar.py stays a separate port by design.
• C1 pre-signature (c1_presigned: {approver, provenance}): human sign-off recorded at enqueue so walks advance without mid-run pauses; malformed presign still escalates; the no-approval-always-escalates property is regression-tested.

4. Publish flow (new capability, strong UX)

• One idempotent ab-website lane assessment-publish: doctor → mandatory blocking release-status sweep (never exclude-and-ship) → ingest --with-files → runtime verify → durable publish record at assessments/<caf-id>/publish/.
• The C1-presignature pattern reused: manifest commit IS the publish approval; symmetric per founder ruling (released collateral reaches the rep with zero extra handoff). Publish-debt reconciliation scan = the pull-based event-bus substitute (no daemon watches the cellar — "auto-hang" explicitly disqualified).
• Doctrine split that kills the redeploy tax: content publish = ingest + refresh only; snow app deploy = code only (remote build is ~45min — you don't pay it for content).
• Held line intact: collateral PRODUCTION is never auto-wired; manifest commit stays a human act.

5. Snowflake leg (new)

• Environment-as-code: scripts/snowflake_deploy.py (provision / deploy-proc / ingest / status) + verify doctor (6 checks) + grants tiers; idempotent DDL derived from the ingest contracts; auth stays entirely with snow CLI — founder types secrets, never the agent.
• The marketplace is LIVE in Snowflake via App Runtime: https://iqztfm-ovfciqq-kmb25927.snowflakecomputing.app (service CORTEX_TEST.CORTEX_SCHEMA.CAF_SNOWFLAKE_SITE, his personal sandbox KMB25927).
• Env-collision fix with a live-failure regression test: MARKETPLACE_DATABASE/SCHEMA/STAGE win everywhere; App-Runtime-injected SNOWFLAKE_* honored only outside containers. All API routes ported through the DataPort.

6. Novo Nordisk served end-to-end (the proof run)

Intake → steward-verified identifiers → research walk (382 jobs indexed; a SuccessFactors scraper BUILT mid-serve rather than skipping coverage) → assessment C1-C4 → human manifest commit → six collateral kinds passing invariant gates first try → website render with zero code change → live Snowflake deploy. All tickets filed, close-outs signed, rail left empty, delivery debt zero.

7. Portability engineered, not hoped for

Machine-default paths purged everywhere → fail-loud env (CELLAR_ROOT/COMPANY_JOBS_DB raise named errors with remedies); mise env-agreement checks in every brigade; the four station skills now ship INSIDE the factory plugin with plugin-relative mise targets (closes the gap found 7/6); zip restore-tested before he sent it.

My verification (run on the mini — a third machine, which is itself a portability test)

Pre-port prep list (beyond his own runbook)

Snowflake (the real work):

1. Nothing exists on any phData account — the App Runtime deploy lives on his personal sandbox. On the work target: snow connection add (his hands), verify the account is App-Runtime-enabled (public preview — origin account happened to be pre-configured), then snowflake_deploy.py provision → deploy-proc → ingest → status. snow CLI ≥3.19 required (origin used 3.21.0 via uv tool; PATH assumption ~/.local).
2. Sharp edge to respect: snow app setup/deploy is cwd-sensitive — run from repo root or it uploads the whole house (cellar included) to the code stage. Happened once on origin; killed and stage dropped. Review artifacts.ignore first. Remote build ~45min.
3. 2-minute check before porting: confirm the live App Runtime render — the trace's "Ben confirms live render" item was never recorded done. Cheaper to catch a render bug on the working origin deploy than to chase it on the work machine.

Plugin installs: 4. Only ab-assessment was ever installed post-rename. The fresh-marketplace install test for ab-skill-factory, ab-company-research, ab-sales-collateral, ab-website is unproven — make it the first thing after the copy, before any service session. Also uninstall any stale pre-rename skill-agent-brigade install.

Known debt riding along (carry knowingly, don't chase): 5. The two execution-eval workflow files still hardcode mini paths (execution-eval-generate-tests.run.js:26 → ~/.claude/skills/generate-tests; execution-eval-variance-analysis.run.js:28 → old ray-plugins path) — neither target is in the bundle. If execution-eval is wanted on the work machine, the generate-tests skill zip from the 7/6 iMessage thread needs landing + a repoint; those files also still carry the known node:fs Workflow-tool incompatibility (3 files total). Eval-only; nothing operational touches them. 6. ab-sales-collateral/tests/test_kind_checklists.py:18 hardcodes the old mini cellar path for the Quest exemplar anchors — those tests now skip everywhere (suite went 174+15 → 164+28) since the exemplar corpus was dropped in the cellar reset. Re-point to $CELLAR_ROOT and re-land exemplars when competencies/ repopulates. 7. Cross-brigade enqueue has no CLI flag — --allowed-artifact missing, python API only (documented gotcha). 8. From our 7/3 follow-up ledger: walker-scope/pull parameterization = closed by 1.1.0; node:fs run.js debt = open (above); duplicate-id two-layer tolerance and subject: null string read-back = not addressed (minor, still open).

Docs (one-liners): 9. README drift: says "Six plugins" (misses ab-registrar) and the "Gap found: station skills" paragraph is stale (they shipped in 7e6792e). Two one-line fixes on the work machine.

Git safety: 10. Both branches are unpushed and exist only in the zip's .git — the zip IS the backup. First day on the work machine: get the repos a remote (phData Bitbucket) so the consolidation stops being single-copy.

Env notes: the three .claude/settings.local.json files ship in the zip with /Users/baw/... values (runbook step 2 re-points them; SEC_USER_AGENT travels in two of them). data/jobs.db = the fresh Novo index only (380/382 rows backfilled).

Supersessions for our own state

• This bundle supersedes the entire 7/03-04 five-zip port set (and the 📌 founder-push-×3 reminder) — jobscraping and ACF no longer exist as separate workspaces; the mini's ~/Projects/phdata-private/ copies are now historical.
• The station-skills and generate-tests zips sent 7/6: station skills = integrated ✅; generate-tests = NOT integrated (item 5 above).