TA-B - Commercial proof in miniature

This chapter is part of the Track-A appendix: the marketing organism, carded as engineering and method, never as a UNI science capability. It documents the one place where the program's "no autonomous server-side LLM" thesis met a paying client and a real deadline, and it is written to the same rule as the rest of the encyclopedia: every PASS is shown standing next to the negative that travels with it, and no figure is stated above the evidence class recorded in the ledger.

The honest position up front. There is a real, reproducible, deterministic clustering engine that does one marketing judgment without any language model. It is anchored at the machine-exact level (Class A). And, in the same breath: it proves exactly one judgment layer of a four-layer vision, the domain-transfer probe that argues the math is general ran only on synthetic data (Class B), and zero of the commercial epics carry a Class-A end-to-end runtime observation, so the client-facing honesty status bar caps every epic at AMBER. The miniature is genuine. It is also small, and the smallness is stated, not softened.

What was actually built and measured

The flagship commercial artifact is the MarketingWright SOW-01 clustering engine (ledger row TA11, Class A). On the canonical fixture it takes 7 events and produces 2 clusters (agriculture and arts). Three independent algebraic forms of the clustering score agree to 0.00e+00 (the "three-forms equality" check), the clustering beats the all-singletons baseline by an uplift of +4.20 nats, the result decomposes into six reconstructable sub-scores rather than a bare scalar, and the run is pinned by a deterministic run_hash. There are zero LLM imports on the core path, enforced in CI. A 62-agent forensic audit (~107 minutes, 0 failures) confirmed 13 held Class-A results under adversarial pressure: a byte-identical run_hash across re-runs, a coverage gate that stayed fail-closed 18/18 against paraphrase, case, and substring attacks, a BagIt seal that rejects a 1-bit tamper, and live Postgres row-level-security isolation 5/5 PASS. The falsifier is operable and specific: re-run with the pinned environment and fail to reproduce the three-forms equality, the +4.20 nats, or the run_hash; or show the coverage gate admitting an attack; or recover a stored secret without the master key.

The engine does not stand alone. It is wrapped by a per-client multi-tenant portal (TA12, Class A): a shared clients.solutionwright.com root where each client is a namespaced basePath, Next.js 14, PIN to HS256 JWT with a 12-hour TTL and a constant-time compare, data reaching the surface only through a read-only MCP allowlist of 17 tool:action pairs with no write surface. The owner explicitly rejected a redirect shortcut that would have locked the subdomain to a single client; tenant separation is the bright line. The falsifier: a tenant sees another tenant's data, or a raw fetch()/<a href> bypasses the basePath, or the JWT compare is shown not constant-time.

Two further commercial surfaces are carded Class A: the 2026-Q2 Ideation Explorer enterprise launch (TA15) with all 41 phases green, a 12/12 cross-tenant OODA isolation matrix PASS (Postgres RLS on 38 tables, non-superuser ie_app, FORCE RLS, cross-tenant requests returning 404 not 403 to mask existence), 7/7 production QA gates, and six-tier per-client RBAC live on a single Clerk-plus-Odoo identity source of truth; and the IntelligenceLabs.UNI public demo (TA17) building clean cold at 21/21 pages, exit 0. The honesty discipline itself is a Class-A surface: the honesty-RAG status bar (TA13) derives Red/Amber/Green from feature/AC evidence class and never from ticket percentage, after ticket-percent was caught reading 96% then drifting to 85.7% (and, separately, an already-percentage value once rendered as 8570%). GREEN requires Class-A runtime evidence; AMBER means Class-E; RED is where a falsifier fires.

The Class-E rows are carded as test-covered, not feature-working, exactly per the DONE rule. The public preprint (TA14, Polzin et al. 2026, Zenodo DOI 10.5281/zenodo.19785799, MIT) has a complete Layer-1 audit (87 pytest assertions plus 11 demos, multi-OS, Python 3.11 to 3.13) and its verified DiscreteTime engine with three precision knobs is ported verbatim into the public Precision Lab. It is fenced exactly as the red lines require: unrefereed; Layer-2 human expert review PENDING; the mathematical foundation only, never proof that the underlying theory is correct. KMS secrets-at-rest (TA16) uses AES-256-GCM with PBKDF2-SHA256 at 100K iterations per encrypt so each row derives an independent key, and it closed a prior cleartext-secret P0 negative. Cell Lab Stories F and G (TA18) shipped with 28 cell suites plus tsc green.

The negatives that travel with this proof

None of the above is citable without the bounds the same archive recorded, because the bounds are what keep the miniature from reading as the vision.

SOW-01 proves ONE judgment layer (ledger MW2). The client was shown four "minimal-prompt-in, marketing-grade-judgment-out" layers (fact-checking, strategic grouping, geographic/research judgment, cadence/tone) and asked which single one, nailed in 30 days, earns a "continue." His recorded answer was that a tool that cannot do all four is useless to him, but if forced to pick: 80% strategic grouping, 20% factual disambiguation. So strategic clustering is the proof point; the other three layers remain in the full vision and are deferred to post-checkpoint / SOW-02. The commercial shape itself is carded MW1 ($3,450, 30 calendar days, five deliverables, Checkpoint Charlie at day 30). The engine is one layer of a four-layer judgment, and the +4.20 nats prove that one layer, not the product.

The engine is NO LLM, ever, in the intelligence layer (architecture ADR-013, ledger MW3). This is not a marketing slogan; it is a defect class. A real LLM defect was found and struck: existing sandbox code used Gemini for extraction, directly contradicting the no-LLM ADRs (ledger N-GEMINI), and the ruling was to remove all LLM/Gemini code. The no-LLM claim is only honest because the program audits for and removes violations of it. The data and isolation rulings behind it are carded as method: a single Postgres engine with pgvector, a bitemporal schema, and RLS as the per-client firewall (MW7), four memory domains with no learned state crossing clients (MW6), and a compositional non-LLM narrator as the working prior art for eventual generation, which stays parked post-POC and is never carded as a delivered capability (MW11).

The domain-transfer probe is synthetic-only, Class B (ledger MW5). The argument that the clustering math is domain-independent was tested by transferring it to drug-trial (oncology Phase-II) data, where it clustered sensibly and reproducibly with a three-forms delta of 1.4e-14. That probe ran on synthetic data only, never on real clinical data, and it is carded Class B, a mechanism-plus-operator observation, not a held-out gate. It does not license any claim about real medical clustering. The grouping science underneath (Bayesian-Occam model selection, scored term-wise into six sub-scores, with the clarifying-question action held explicitly at Class C) is carded MW4 and never raised above it.

There is a hard combinatorial ceiling: N <= ~10. The clustering engine is exhaustive over set partitions (Bell numbers), so the "scales gracefully to N=12" falsifier fired: Bell(12) = 4.2M partitions exceeds the 60-second budget on the host (ledger TA-N8). The operating envelope is N <= ~10 without a beam search, a coarser prior, or a compiled loop; the Sun-Prairie demo at N=7 sits safely inside. This is a published bound, not a breakage, and it is the honest cap on the engine's reach. The same audit surfaced 7 surface defects (4 HIGH) with fired falsifiers, all in the surface contract rather than the math, each with a draft fix and none breaking the architectural posture.

Zero epics are Class-A end-to-end, so every epic caps AMBER (ledger MW9). This is the load-bearing fence. Across the commercial build, no epic carries a Class-A end-to-end runtime observation; "DONE" in the MCP means test-covered (Class E/D), not feature-working (Class A). The honest portal therefore caps every epic at AMBER, the headline is the RED provenance hard floor rather than a "85.7% done" number, and an explicit 11-row "Class-A Observation Plan" is the named path to green. The matching delivery-layer negative is the canonical exists-in-code-versus-observed-at-runtime case (ledger TA-N13): a handoff route whose verify_chain was valid on 500 events, yet the running MCP's 243K-character audit log held zero handoff/inception-bundle events, because the route was built and unit-tested but never fired against the deployed MCP. The Ideation-Explorer archive carries the matching tension: authenticated portal flows have Class-A evidence only for unauthenticated, gated, and public routes; the logged-in experience requires a real team login and was not yet observed. A separate honest incompleteness is parked, not hidden: the client's written acceptance thresholds (D1: AC1-AC5, AC7) stay OPEN, so the readiness model's ACCEPT axis is WITHHELD until the client signs (ledger MW8); it cannot be self-resolved.

What is NOT claimed in TA-B (Commercial proof in miniature)

• Ceiling: It is NOT shown that the program has a working commercial AI product, that the clustering engine performs marketing judgment in general, or that the engine's scoring math is proven domain-independent on real-world data. The most we claim is: one deterministic, LLM-free clustering layer reproduces three-forms score equality (0.00e+00) and +4.20 nats uplift to the machine-exact tier (Class A) on a fixture of N <= ~10 events, wrapped by Class-A tenant-isolated portals and a Layer-1-audited (Layer-2-pending, unrefereed) preprint, with the math's domain-independence argued only by a synthetic-data Class-B probe.
• Fences engaged: red line 5 (never "beats LLMs" - this is a deterministic engine, not an LLM benchmark, and the preprint trades fluency for calibration, never a fluency win); red line 6 (never inflate a synthetic-construction or synthetic-transfer result into capability - the drug-trial transfer is Class B, synthetic only); red line 7 (never raise a claim above its source class - the Class-E rows stay test-covered, not feature-working); red line 8 (substrate/engineering evidence does not imply a science gate); red line 11 (the preprint is the mathematical foundation only, fenced unrefereed, Layer-2 PENDING); red line 12 (Track-A plain-ops vocabulary - the route ledger and public copy never externalize the active-inference / EFE / free-energy framework names).
• Negatives that travel with this claim (cite alongside, never strip): the ONE-judgment-layer deferral (three of four layers parked to SOW-02, MW2); the NO-LLM-ever architecture (MW3) and the struck Gemini defect (N-GEMINI); the synthetic-only Class-B domain-transfer probe (MW5); the N <= ~10 combinatorial ceiling with its fired N=12 falsifier (TA-N8) and the 7 surface defects; the ZERO-epics-Class-A AMBER cap (MW9) with its 11-row Class-A Observation Plan still owed; the handoff-never-fired-at-runtime negative (TA-N13); and the parked client-acceptance blocker (MW8). Citing the +4.20 nats or the 13 held Class-A audit results without these bounds is an overclaim.
• Parked / owed: a Class-A end-to-end runtime observation is OWED for every commercial epic (the AMBER cap is discharged only when one lands, MW9); the client's written acceptance thresholds (D1: AC1-AC5, AC7) stay OPEN and cannot be self-resolved (MW8); a runtime-fired handoff event is owed to retire TA-N13; authenticated portal flows remain unobserved.
• One-line honest summary a skeptic could not dispute: a single deterministic, LLM-free judgment layer was built and reproduces its score to the float tier, but no commercial epic has a Class-A end-to-end observation yet, the engine only runs to about N=10, and its claimed generality rests on synthetic data.

Falsify this

Take the pinned environment (Python 3.12.10, the corrected-math reference suite), re-run the SOW-01 engine on the canonical 7-event fixture, and check three things: that the three independent score forms still agree to 0.00e+00, that the clustering still beats all-singletons by +4.20 nats, and that the run_hash is byte-identical to the recorded value. If any of the three diverges, TA11 is falsified. As a stronger test of the standing fence, point any commercial epic's honesty bar at a genuine Class-A end-to-end runtime observation: if one is produced and verified, an epic legitimately leaves AMBER for GREEN and the central owed item of this chapter is discharged.

Sources

• Curated digests (PII-redacted): curated/marketingwright-digest.md (SOW-01 engine, three-forms equality, +4.20 nats, the N<=10 ceiling, the Gemini defect, the AMBER-cap honesty status, the synthetic drug-trial transfer); curated/ideation-explorer-digest.md (2026-Q2 launch, 12/12 cross-tenant matrix, KMS secrets-at-rest, the unobserved authenticated-flow gap).
• Claim ledger (single source of truth): encyclopedia/CLAIM-LEDGER.md, Section 4.2 rows TA11-TA18 (commercial Class-A/E rows), Section 5 rows MW1-MW11 (commercial detail: scope, no-LLM architecture, synthetic-Class-B probe, the ZERO-epics-Class-A AMBER cap MW9, the parked client-acceptance blocker MW8), Section 4.6 row TA-N8 (the combinatorial bound), Section 4.8 row TA-N13 (handoff never fired at runtime), and N-GEMINI (Section 3).
• Source archives (local only, never committed; not read for this chapter per the PII fence): C--Users-mpolz-Documents-MarketingWright, C--Users-mpolz-Documents-SolutionWright-IdeationExplorer, and the worldmodels / intelligencelabs-uni / uni-precision archives for TA14/TA17/TA18.
• Authoring spec: encyclopedia/MASTER-PLAN.md, section TA-B and Part I front matter (FM-1 through FM-4).