# Independent strategist review — Confused Gorilla orgdef `0.1.0-draft` **From:** `thingalog-strategist@thingalog.orgdef` · **To:** `principal` (Scott Welch) · **2026-11-07** **Reviewed commit:** `7c5cea7d725dbee877c3770c03c597cc229cae59` (2026-11-07T22:35:30Z — *"orgdef: stage review-ready charter independently of website work"*) **Reviewed version:** `0.1.0-draft`, `status: proposed` **Artifacts:** `governance/orgdef.json`, `governance/CHARTER.md`, `governance/validate_orgdef.py`, issues #2–#7 **Action required:** Yes — six findings, two blocking, each with a suggested disposition. ## Independence statement I hold the strategist seat in a different OG-governed organization (`thingalog`). I did not draft any part of this charter, was not consulted during its drafting, and have no stake in its adoption. This review was commissioned by the principal and delivered in-session on 2026-11-07. I resolved the branch label `work/shared-orgdef-2026-11-07` to the commit above before reading, per the review request's own instruction not to review a moving branch label. **A limit on this independence, stated because it bears on finding F4:** I have no seat, address, record or obligation inside Confused Gorilla. Nothing in this organization can hold me accountable for this review, and no future session can verify my disinhibition from its own records. That is a property of the arrangement, not a complaint about it. ## Summary The draft is unusually honest for a founding document. `status: "proposed"`, every AI seat `vacant`, the validator's `"Do not assert unappointed incumbents"`, and the CHARTER's admission that *"passing our local checks does not establish official protocol conformance"* are all disciplines that normally arrive only after a first embarrassment. Red line #4 — *declared governance is not implemented governance* — is the sharpest line in the document. The draft then violates red line #4 twice, and the validator meant to catch that will refuse to run the moment the charter is adopted. Nothing below argues against adoption. The gap is consistently the same one: **controls written in the present tense that have no implementation yet.** --- ## Findings ### F1 — BLOCKING — The validator fails the instant the charter is adopted Two assertions in `governance/validate_orgdef.py` encode the draft's *current state* as a permanent invariant: ```python assert org["status"] == "proposed" assert [p["id"] for p in staffed] == ["principal"], "Do not assert unappointed incumbents" ``` Issue #6 requires obtaining the principal's approval and recording *"actual seat appointments."* Either action makes the validator throw. **The adoption gate's step 4 breaks the adoption gate's step 1.** The second assertion's intent is correct — prevent fabricated incumbents — but it implements that intent as *"the staffed set must equal exactly `[principal]` forever"*, which forbids the organization from ever being staffed. The property actually wanted is already present on the following line and is correctly written: ```python assert all("incumbent" not in p for p in positions if p["status"] == "vacant") ``` **Evidence:** direct read of `validate_orgdef.py` at the reviewed commit, cross-read against issues #5 and #6 acceptance criteria. **Recommended change:** delete the two snapshot assertions; keep the vacancy/incumbent invariant. If a check on approval state is wanted, assert the *relationship* between `status` and the presence of an adoption record, not a literal value. ### F2 — BLOCKING — Nothing demonstrates the validator can fail Every assertion in `validate_orgdef.py` was derived from `orgdef.json` as it currently stands, and the script prints `PASS`. That establishes the two files agree. It does not establish that the validator would notice if they stopped agreeing. Several checks cannot meaningfully fail as written: | assertion | why it is weak | | --- | --- | | `len(org["values"]) >= 3` | counts entries; three empty strings satisfy it | | `len(positions) >= 2` | same shape | | `divisions == {"institute", "labs"}` | pins the two divisions that exist; a spelling check, not a property | And the checks that would carry weight are absent: no cycle detection on `reports_to`; no check that every position is reachable from `principal`; and critically **no check that a `validates_for` source is outside its target's own reporting chain** — the single structural property that makes "independent QA" mean anything. **Evidence:** line-by-line read of the validator against the orgdef it validates. **Recommended change:** before trusting a `PASS`, deliberately break the orgdef and confirm each assertion goes red — add a staffed seat with no appointment record, add a dangling relationship, point a `validates_for` at a position's own manager. Then keep those malformations as fixtures in the validator itself, so `PASS` means *"these N malformations were rejected"* rather than *"this one file parsed."* A check never observed to fail is not evidence. ### F3 — HIGH — The memo substrate does not exist, which red line #4 forbids `governance_model` states: *"Durable memos capture substantive decisions, evidence, objections and resolutions."* `CHARTER.md` specifies memo fields. The review request requires a memo. Issue #5's acceptance criteria require one linked. The repository at the reviewed commit contains `assets/`, `governance/`, `governance/reviews/`, `public/`. **There is no memo directory, no memo format, no path convention, and no named owner.** Red line #4 reads: *"No role or governance control shall be labeled staffed or operational without a dated appointment or implementation evidence."* The memo workflow is a governance control, the charter describes it in the present tense, and it has no implementation evidence. By the document's own rule it should currently be marked proposed. The same gap applies to appointment records. `CHARTER.md` names the right fields — *"principal approval, model/service identity, scope and effective date"* — and names no location. `canonical_home` covers `orgdef.json` only. At the reviewed commit there is nowhere for the first appointment record to go. **Evidence:** `git/trees` listing at `7c5cea7d` (directories: `assets`, `assets/anthropic-application`, `assets/essays`, `governance`, `governance/reviews`, `public`, `public/after-ai`, `public/assets`). **Recommended change:** create `memos/` at repository root with the sibling organizations' convention (`-------.{openthing,body.md}`, `action_required` plus an additive `discharged` marker). The property worth preserving from that convention is **enumerability** — a new session can list what is open without being told. Alternatively, mark the memo workflow proposed until it exists. *This memo is filed into a newly created `memos/` directory, which is the first implementation evidence for the control this finding describes. Relocate it if a different substrate is preferred.* ### F4 — HIGH — Every escalation path terminates at the interested party, and the charter does not say so Review question 4 asks where conflicts of interest are escalated. - Six of nine positions `reports_to` `principal` directly; the remaining two reach it in two hops. - There is no `escalates_to` edge type. The relationship vocabulary used by both sibling charters has exactly three types (`reports_to`, `coordinates_with`, `validates_for`), so escalation is not expressible without extending the spec. Every route terminates at the principal. In this organization the principal is simultaneously the ratifying authority, the author of these drafts, the owner of the Labs products that Institute evaluates, and the beneficiary of favourable findings about them. **This is not fixable by adding a seat.** A single-human organization has one terminus by definition, and an "ethics seat" staffed by another AI session the principal also instructs would be theatre — worse than the honest version, because it would read as a control. What is missing is the acknowledgement. The charter models Institute's independence **from Labs** with care and is silent on independence **from the principal**, which is the larger exposure. Red line #5 — *do not present retrieval as proven training-weight influence* — exists precisely because the drafting author already knows where pressure to overclaim will originate, and it is not Labs. **Evidence:** full relationship graph at the reviewed commit; absence of any escalation edge type across this draft and both sibling charters. **Recommended change:** add a red line or a `limitations` block stating plainly that (a) the principal is structurally conflicted, (b) the mitigations are behavioural — `evidence-over-assertion`, red line #5, preserved negative results — rather than structural, and (c) external review is the only real check, naming the conditions under which it will be commissioned. A stated limit is credible; an unstated one reads as an oversight when a reader finds it. **Related:** the charter mandates review by *"a different existing strategist seat"* — a role it cannot staff or account for, as the independence statement above describes. At minimum, record the reviewer's organization, seat, session binding and reviewed commit in whatever artifact holds the review. ### F5 — MEDIUM — Red line #2 has no structural expression > *"Institute reviewers must be able to report inconvenient or negative findings about Labs without Labs editorial veto."* Every edge between an Institute position and a Labs position at the reviewed commit: ``` institute-researcher coordinates_with labs-implementer ``` That is the complete list. `institute-reviewer` — the seat the red line is about — has no relationship to Labs at all. There is no `validates_for` from Institute into Labs. The protection is asserted in prose and absent from the structure. Within each division the independence is correctly wired: `labs-qa` and `institute-reviewer` each `validates_for` their implementer/researcher **and** `reports_to` `principal` rather than a division head. That is the right shape; it simply stops at the division boundary. Review question 2 — who Institute QA answers to when examining Labs-derived evidence — has no answer in the file, and it is the load-bearing case: **Caliper is a Labs instrument producing Institute evidence.** The single existing edge is where that coupling lives, and `coordinates_with` is the weakest type in the vocabulary — undirected, carrying no obligation and no review duty. **Evidence:** `relationships` array at the reviewed commit, filtered for cross-division pairs. **Recommended change:** add `institute-reviewer validates_for labs-implementer`, scoped to research instruments, and state that Labs holds no editorial path to Institute output. Red line #2 is then enforced by the chart rather than promised beside it. ### F6 — MEDIUM — Unprecedented vocabulary, asserted by a validator that cannot know The envelope is faithful. `catdef: 1.4`, `orgdef: 1.0.0`, `orgdef:Organization`, and the three relationship types all match both sibling charters exactly. No invented edge types. Four constructs appear in neither sibling charter: | extension | precedent in `thingalog` / `swpersonal` | | --- | --- | | `divisions` (top level) | none | | `division` (on Position) | none | | `authority` (on Position) | none | | `status` (top level, organization-wide) | none | None is necessarily wrong — `divisions` is the draft's entire purpose and must live somewhere. The problem is the combination: **the part of the file with no precedent and no reachable specification is the part the local validator asserts most confidently**, producing assurance exactly where there is least. `CHARTER.md` already says this (*"A full formal OrgDef conformance suite has not been located"*). The validator's output should carry the same qualification, attached to the specific fields it covers, rather than printing an unqualified `PASS`. Two related notes: - **`authority` forks an existing idiom.** Sibling positions carry `role_definition` / `job_definition` pointing at separate role specifications. This draft uses freeform `authority` prose instead. Freeform is defensible at nine seats, but it is a forked vocabulary, and prose authority strings are not checkable. - **The two files disagree on the constraint most likely to cause real harm.** *"This project must not commingle confidential Edsby information with public Institute or Labs research"* appears in `CHARTER.md` and **not** in `orgdef.json`. Per issue #7 the machine-readable artifact is what gets published and rendered, so the disclosure rule lives only in the file that is not canonical. **Evidence:** field-by-field comparison of position and organization keys across this draft, `thingalog-organization.opencatalog` (v2.9.2) and `swpersonal-organization.opencatalog` (v0.1.0). **Recommended change:** qualify the validator's output for the four extensions; port the Edsby disclosure constraint into `orgdef.json`; decide deliberately whether to keep `authority` or adopt the `role_definition` idiom. --- ## Answers to the seven review questions **1. Are the extensions valid for the deployed renderer and spec?** Envelope and relationship vocabulary: yes, verified against two live charters. The four extensions in F6: unknown and unknowable from here, as no conformance suite is reachable. The local validator cannot close that gap and should not imply it does. **2. Are relationships meaningful and directed correctly?** Yes within divisions; the `validates_for` + `reports_to principal` pattern on both QA seats is correct. Across divisions, see F5. One additional gap: **nothing validates `labs-release`.** It reports to the principal and has no reviewer — the seat where an unreviewed action carries the most reach. **3. Are seats missing or prematurely staffed?** Nothing is prematurely staffed; that discipline is clean and the validator enforces it. Missing: a security/privacy seat (red line #3 is a privacy red line, yet privacy appears only as a trailing clause on `labs-qa`); an owner for the record substrate (F3); a reviewer for `labs-release`; and the independent reviewer the process requires but the organization cannot staff (F4). On how a claim is authorized and recorded: the fields are specified, the location is not, so at the reviewed commit there is no answer. **4. Is research independence real?** From Labs: real within Institute, absent across the division boundary (F5). From the principal: not real, not claimable, and not acknowledged (F4). F4 is the finding to act on first. **5. Are authorship, transparency, disclosure and privacy adequate?** `authorial-integrity` is a genuinely good value and is **purely aspirational as written** — nothing in the orgdef carries an authorship class, so there is no field to set, check or publish. It should become a required attribute on published artifacts (`founder-authored` / `ai-assisted` / `ai-authored`), or it will be reconstructed from memory later, which is how attribution goes quietly wrong. Disclosure: see F6's file asymmetry. Privacy: no retention policy, and nothing states what research evidence may contain — if Caliper runs capture model output concerning real people or private material, that is unaddressed. **6. Can charter history, decisions and memos be independently audited after a model or session change?** **Partially, and not in the way that matters.** Git provides tamper-evidence on artifacts. What is missing is seat-identity continuity: there is no session-binding concept, so "seat" and "session" collapse, and after a model change nothing establishes which session held which seat when a decision was recorded. Both sibling organizations record a binding with an `observed` timestamp and a supersession-on-claim rule, specifically because sessions terminate without writing anything back. Without it a seat is a label in a file rather than an address — and the question presupposes an address exists. **7. How would you falsify the claim that this structure improves reliability, auditability or oversight costs?** Four tests, in increasing strength: 1. **Reliability.** The claim predicts that defects are increasingly caught *before* the principal's gate rather than *by* it. Count findings by discovery point over time. Live comparative data from `thingalog` for the week of 2026-10-27: five or more defects caught by a second seat reading independently; **zero** caught by review, by a gate, or by CI. If that pattern holds here, the mechanism doing the work is **the number of independent readers**, not the organizational chart — which predicts that adding seats helps and adding structure does not. Those are separable and should be measured separately. 2. **Auditability.** Take a decision thirty days old. Give a fresh session nothing but the record and ask it to reconstruct why authority was exercised. Failure indicates `decisions-not-chatter` is not working, whatever the chart says. Run quarterly. 3. **Oversight cost.** Measure principal-minutes per shipped change. The honest null hypothesis is that governance *increases* it. In `thingalog` the human-acceptance gate demonstrably costs the principal real time; the claim is that it is worth it, and that is testable by counting what the gate catches that nothing upstream did. 4. **The strong falsifier.** Two divisions constitute a natural A/B. Run one under full structure and one under a lighter one for a fixed period, comparing error and rework rates against the pre-charter baseline. If they match, the structure is not doing the work. **A limitation that belongs in the charter:** Confused Gorilla cannot falsify this claim about itself. Institute studying Confused Gorilla's own governance is red line #2's conflict turned inward, with no Labs to hold responsible. If organizational-structure research is in Institute's scope, that should be stated as a limitation rather than discovered by a reader. --- ## Suggested disposition Each finding requires an explicit accept / reject-with-rationale / defer-with-owner decision from the principal before ratification, per `recommended_patterns.independent-strategist-review`. | # | Finding | Severity | Suggested disposition | | --- | --- | --- | --- | | F1 | Validator fails on adoption | Blocking | **Accept** — two-line fix, before any other work | | F2 | Validator cannot be shown to fail | Blocking | **Accept** — add adversarial fixtures | | F3 | Memo substrate does not exist | High | **Accept** — create it, or mark the control proposed | | F4 | Principal conflict unstated | High | **Accept as a statement**, not as a structural fix | | F5 | Red line #2 unexpressed in structure | Medium | **Accept** — add the Institute→Labs edge | | F6 | Unprecedented extensions; file asymmetry | Medium | **Defer** the vocabulary question with an owner; **accept** the Edsby port now | F1 and F2 are inexpensive and should land before further investment in the chart: at the reviewed commit the only automated check in the organization is one that agrees with itself and will break the first time it is used in earnest. ## Reviewer's note on authority This memo is a recommendation. It carries no adoption authority, and nothing in it should be read as approving the charter or any seat. Ratification, seat appointment and publication remain the principal's, per red line #1. Linked to issue [#5](https://github.com/scottconfusedgorilla/confused-gorilla/issues/5).