Eleven projects.
Five deployed, two killed on their own bars, two papers,
one engine underneath.

All content lives as structured JSON: components, fault codes, procedures, compliance facts, configurations, Q&A entries, cross-links, and search aliases. A deterministic Python assembler compiles that data into a dependency-free HTML file that runs from a file share with no network calls. The same input always produces the same md5, and every build passes a battery of checks before it ships. An authored concept and intent router sits in front of a scored literal matcher with alias mapping and typo tolerance; the build-side audit tooling and the shipped JavaScript are parity-tested against each other, so the test harness and the product provably rank results the same way.

344 per-fact citation bindings, each resolving to a page image of its source document; builds fail hard on any stale or unknown reference. Attribution carried as data: every fact is tagged document-sourced, verified field knowledge, field knowledge supplementing a document, or industry background, with a precedence model governing conflicts (field experience leads on troubleshooting procedure; documents are absolute on specs, limits, and warranty conditions). Gated ingestion with regression baselines covering search relevance, link integrity, reachability, terminology, and an enforced contact whitelist. Coverage gaps are declared instead of hidden.

The deterministic search router doubles as the retriever, and the model synthesizes answers under a system prompt built from the tool's own trust rules: answer only from the provided material, never affirm or deny warranty coverage, escalate when the material is thin. In its first measured evaluation it scored a 1.0 retrieval hit rate and a 0.0 false-confidence rate on the curated test battery; every out-of-scope and wrong-product probe was declined instead of answered. The corpus ships with its own evaluation infrastructure, a generated bank of 1,466 field-realistic test questions tagged with expected answers.

California homeowners reviewing rooftop solar proposals receive economic projections that frequently assume legacy NEM 2.0 economics, despite the state having transitioned to NEM 3.0 / NBT in April 2023, under which export credits fell roughly 75% on average. Independent verification has historically required either paying a competing installer for a counter-bid (same incentive bias) or hiring an engineer ($1,500+, weeks of turnaround). The Installer's Lens automates the verification workflow at a fraction of the cost and turnaround.

Single-user Streamlit UI wrapping a Python backend that parses unstructured intake (utility bills via vision-model OCR, Green Button XML, panel photos, installer proposal PDFs), orchestrates parallelized API queries across 16 authoritative public data sources, runs a 10-lens analytical framework, and generates client deliverables via template-driven PDF rendering with full audit trail. Sources span solar resource modeling (NREL NSRDB, PVWatts, PySAM), roof geometry (Google Solar API), equipment validation (CEC), installer verification (CSLB, CFPB, CourtListener, SEC EDGAR), environmental context (EPA AirNow, CAL FIRE, CPUC PSPS), and utility-specific NBT rate schedules.

Sole architect and product owner, directing full implementation through an LLM coding agent under written standing instructions, with human approval gating each merge; every architectural decision, data model, and release passed a structured multi-role design review before build. Safety and integrity are structural: fail-closed vision-based PII redaction on every document format before any data leaves the machine, a six-gate intake validation system, copy-fidelity canaries that fail the build if rendered prose drifts from approved text, and a principal-verification seam that makes it mechanically impossible for machine-drafted judgments to reach a client without human approval. Verified by a 1,200+ test suite with typed contracts and in-code API budget guards. Local-first storage (SQLite + per-engagement file structure) for audit defensibility. Fifth extraction of the PIE primitives: baseline-measurement intelligence applied to system-level economic verification.

The site launched on a conventional small-business stack (managed hosting, a commercial theme builder, the usual retinue of plugins) and was then fully replatformed: the live site today is hand-coded on the Astro static site generator with a custom CSS design system, no theme, no page builder, and no plugins, version-controlled on GitHub and continuously deployed to Cloudflare Pages, with the DNS migration executed live on an operating domain without dropping business email. The rebuild took the stack from a dynamic PHP application with a database and login surface to pre-rendered static files behind a global CDN: sub-second page loads, green Core Web Vitals, zero visitor cookies (no consent banner required because nothing is tracked), and minimal attack surface. Frontier LLMs handle content synthesis, document review, and operational reasoning against vendor criteria enforced contractually: no training on client data, encryption in transit and at rest, time-bounded retention. Three specialized AI workstreams (site and editorial, engine, social) coordinate through one canonical operating record: an append-only, source-tagged decision log past 1,150 entries with read-before-write conflict protocol. Every article passes a documented production discipline: a per-article research pass anchored to primary sources, a factual-claims audit log with per-claim re-verification schedules, and a locked voice specification with mechanical screening for AI-generated prose patterns; a site-wide register audit eliminated 284 punctuation and phrasing tells in a single reviewed sweep. Professional liability and cyber coverage carried; the practice is structured so that AI-produced work product is defensible to clients, regulators, and counsel. Payments, banking, insurance, and trademark all stood up solo.

Position B (AI in standard production, principal verifies all judgments) encoded consistently across Privacy Policy, Terms of Service, Engagement Agreement, and service-page FAQ. No-named-AI-tools rule in public materials: vendor selection criteria are durable; vendor names will churn. Nine-dimension content audit run against every public-facing draft. Editorial firewall against reviewing proposals from any installer TIV has consulted to within a defined recent window. Four-pillar service architecture with explicit "what TIV cannot do" scope.

Trademark / prior-art vetting pre-commit. Formal legal-docs drift audit against v1 Privacy Policy and Terms identified eight material drifts (sole proprietorship → LLC, Position A → Position B, a payment-processor change, voice register, AI use disclosure missing) and v2 drafts produced with changelog. Engagement Agreement routed for attorney review with directed-attention notes to Limitation of Liability (CA Civil Code §1668), Indemnification reasonableness, and Governing Law. Affiliate-bias falsifiability test caught and rewrote my own original About-page draft as false once affiliate revenue was on the roadmap.

I direct AI systems the way a general contractor directs trades: specify in plain language, let the model draft the artifact (code, copy, contract, design), review against domain knowledge, and approve or redline before anything ships. Site code is written by AI agents working inside the repository under a written standing-instructions file that encodes the brand system and the hard rules (no deploy without human approval, no invented copy, no tracking, legal pages locked), so each session starts already knowing the house rules. I review diffs, run the build, and push from a Linux terminal; a git push is the entire deployment pipeline. The same pattern governed the replatform itself: the migration plan, the DNS cutover sequence, the new codebase, and the post-launch audits were all AI-drafted, human-verified, and shipped in reviewable increments.

An FAE-scoped SOP with on-site capture requirements, a pass/fail site qualification system, a program workbook serving as system of record (site tracker, live hardware roll-up, structured form build specifications), Voice of Customer instruments for installers and homeowners, a per-site process record, and an illustrated field photo guide. Legacy tracking modernized from an 80-column tracker to 36 purposeful fields, with static pivot reporting replaced by live formulas.

All documents produced through AI-assisted programmatic generation (Node.js docx, Python openpyxl, vector illustration pipelines), with iterative direction, domain review, and final technical judgment retained by the principal. Weeks of drafting compressed into days, with cross-document alignment enforced by the pipeline itself, including identical checklist content between the SOP appendix and the live workbook tool.

Browser-based: Web Audio API for real-time pitch and rhythm, MediaPipe Hands for body mechanics, Basic Pitch (Spotify) for audio-to-MIDI. Five stateful coaching personas route to different LLM prompting and feedback styles. Welford-based individual baselines with z-score classification against the player's own history. DALD monitors divergence between AI-claimed session quality and the player's independently-measured improvement trajectory. VTACA detects breath-holding patterns during cognitive load. PBITE gates interventions on practice-quality signal.

Persona system as a structural product decision: each persona routes to different prompting and recommendation libraries. April 2026 triage: 22 modules KEEP for consumer use, 10 SIMPLIFY, 30 REMOVE (retained in reference repo), 6 REFERENCE-ONLY. Shipped the hand-written browser port first rather than waiting for full-engine integration, prioritizing real sessions over architectural purity.

Two live practice sessions in April 2026 with real audio capture, verifying VTACA breath-hold detection and PBITE intervention gating worked in production rather than in simulation. Caught mic-clipping (sessions 1–6 corrupted due to laptop mic proximity), traced to input sensitivity rather than engine failure. Forced the distinction between "commercially credible" and "commercially viable" and admitted FretMind achieved the first but not the second. None of PIE's core functional claims (quality score validity, PBITE gating, DALD, BAIV, CAAD, AICV) have been empirically validated on real deployment data.

74-module JavaScript core (v8.32.0, ~971 KB, SHA-pinned) wrapping six statistical primitives: Welford incremental moments, Bayesian Online Changepoint Detection, Normal-Inverse-Gamma baselining, hierarchical shared-factor arrays, weighted heteroscedastic baselines, and distribution-fitting under AIC / BIC / tail-weighted criteria. Five-layer stack: Engine → HSAPI open-standard query interface → reference app (FretMind) → vertical adapters → AI infrastructure. Specialized modules: DALD (deceptive-alignment divergence), VTACA (vitals-triggered cognitive-assessment), PBITE (practice-quality intervention gating), GRS (ground-truth labeling), RETRO (retroactive baseline construction).

Individual-baseline-only commitment: every module computes against Welford moments of one entity's history; no population priors anywhere. Moat ordering: dataset > hardware > implementation > network effects > patents, patents fifth on purpose. HSAPI as an open standard with a published patent pledge, licensable implementation underneath. Identity Separation Rule (Validator §45) keeping processor, scope, and obligation distinguishable in every output.

27 experiments pre-registered with SHA-256 hashes before any run script existed. Six honest losses to specialist baselines (Omori, ARIMA, others) documented rather than buried. Failed experiments forced API redesigns: AIC bias produced the DFB criterion API; BOCPD startup artifacts produced CPB burn-in routing; null-saturation produced three first-class null procedures. Comprehensive trademark, prior-art, and IP vetting across the engine; pulled USPTO PAIR export to verify the 43 provisionals were on file, caught an entity-status error and an RFC 3161 temporal-attestation gap. OSS license audit and SBOM confirmed no GPL / AGPL contamination.

Most measurement systems compare a subject to a population. This works for triage, selection, and placement. It fails for a different class: has this specific subject changed? Is the gap between what this subject claims and what this subject does growing? For those questions the subject is the reference, not the population. IBTR is the methodological proposal for what first-class infrastructural support for self-reference looks like.

Two signals: stated capability (what the subject claims) and demonstrated capability (what independent measurement records). Signed divergence accumulates as a per-subject baseline via Welford's online algorithm (O(1) memory, O(1) update; no need to store raw observations). After enough observations the baseline locks; new observations score against it via standard z-thresholds. The math is decades old; the contribution is the architectural commitment, not the equations.

Five worked-through domains in the paper share the same Welford accumulator and same z-classifier; only the sensor pipeline is domain-specific: music performance (intent vs. execution), surgical performance (procedural plan vs. motor control), AI alignment (model self-report vs. AI-affected reality), industrial machinery (reported state vs. sensor measurement), and geophysical monitoring (model prediction vs. measurement). One measurement substrate, five domains. The empirical content of the domain-agnostic claim.

Python module on a primitives stack: Welford running statistics, multi-scale rolling-window baselines, bin-keyed conditional accumulators, per-turbine integrated baseline, CUSUM changepoint detector. Wind-domain layer using pvlib for atmospherics, IEC 61400 density correction, turbulence intensity, sector classification, wake-affected flagging. Validation harness ran against the CARE-to-Compare labeled dataset (Wind Farm A, 22 labeled events).

IBTR commitment (individual baseline only, no population comparison in the primary detection path) against the easier fleet-mean path. Pre-registration discipline applied to my own validation, as strictly as to claims I would make to others. SHA-256-hashed pre-registration locked hypothesis and decision rules before analysis. Held-out test split locked before any peek. Direct comparison against fleet-mean (peer) detection treating the IBTR architectural premise as the thing on trial.

Python engine for module-level power electronics (MLPE) telemetry built on pvlib. Three-layer detection stack: PeerComparator (MAD-based robust z-scores) as primary detector, ConditionalImprovedBaseline (per-module conditional baselines on irradiance × ambient temperature) for characterization, CoherenceBaseline for multivariate joint divergence across voltage/current/power. ImprovedHybridBaseline composes NIG conjugate Bayesian inference, Welford master statistics, RobustEWMV with outlier clipping. Failure-mode profiles (soiling, cell crack, inverter capacitor aging) encode solar-domain knowledge as first-class configuration. Synthetic substrate built independently using pvlib solar geometry and Sandia cell temperature models, with failure signatures parameterized from PV reliability literature.

Peer-first detection as the primary architecture: reversing PIE's original individual-baseline commitment based on direct evidence from WindPIE that peer comparison won 5×. Environmental conditioning instead of output conditioning, to avoid the cascade-detection problem where any output-affecting failure makes other metrics look anomalous because their baselines were conditioned on the now-shifted output. Structural separation between synthetic generator and failure-mode profiles: both parameterized from PV reliability literature independently, never coupled, specifically to prevent closed-loop validation where synthetic data is tuned to make the detector look correct. Variance shift detection disabled by default despite being in the primitives, re-enabled per profile only with explicit justification.

Reference architecture, not finished product. Documentation is the primary deliverable; code illustrates the documentation. Licensees take the architecture and build their own production systems against it. EU AI Act Articles 5, 9, 10, 12, 13, and 14 in scope across six functional module groups (core primitives, governance, audit, monitoring, oversight, transparency). Articles 11, 15, 17 explicitly excluded: Articles 11 and 17 as different problem space; Article 15 as different discipline and vendor category. Exclusions documented as deliberate boundaries.

Reference-architecture positioning: inverting the typical documentation-to-code ratio to match what sophisticated EU AI Act buyers actually want during the Goldilocks period. Three-reference claim discipline: every architectural claim required specification, illustrative implementation, and tests before any external use; claims without all three were removed. Multi-path commercial strategy preserved rather than committed prematurely: direct license, audit firm partnership, strategic partnership, acquisition. Grant-back clause: any licensee improvements grant back non-exclusively. IP integration with 43 USPTO provisional filings.

After the May 7, 2026 foundation session produced full handoff documentation, scope, commercial strategy, and three identified warm EU contacts, the next gate before any outreach was a competitive landscape ultrareview I commissioned myself. It surfaced Microsoft Agent Governance Toolkit (AGT), released MIT-licensed and free on April 2, 2026, addressing substantially overlapping ground. I killed Cardinal on or around May 8, 2026, within ~24 hours of the discovery. No EU contacts were ever approached. The discipline rule the kill produced: competitive landscape ultrareview is a gate before commercial commitment, not a checkbox after sophisticated build.

State-of-the-art deception detection (mechanistic interpretability, activation-based methods such as LAT and POSER, self-monitoring architectures) shows 89–98% accuracy in controlled settings but all require model internals access, training infrastructure, or controlled evaluation environments. None work for the increasingly common case: a deployed AI accessed through an API, with no access to weights, where what we want to know is whether this specific deployment is producing genuine helpfulness or has converged toward a satisfying-but-not-helping pattern with this specific user over time.

Per-user baselines of the divergence between AI-stated outcomes (c, what the AI claims about its effect) and independently-measured demonstrated outcomes (d, what actually happened). Sustained anomalous drift (high stated outcomes paired with flat or declining demonstrated trajectories) produces a MISALIGNED classification. The signature cannot be faked by the AI alone. The AI controls c; the AI does not control d. The user's baseline trajectory accumulates from observations made independently of the AI's presence. The math is the IBTR substrate (Welford accumulators, z-score thresholds); the architectural commitment is that alignment evaluation can be read from the human the AI affected, without needing access to the AI itself.

DALD does not compete with mechanistic interpretability: interpretability cannot operate where the model is not accessible; DALD can. Conversely, interpretability identifies the specific circuit; DALD cannot. The two are complementary. Activation-based methods are vulnerable to recent prompt-level adversarial defeat (Daniels et al. February 2026, reducing auditor accuracy from 100% to 1–3% while auditor confidence stayed high). Trajectory-level signals require coordinated long-horizon manipulation across a specific user's history, a substantially harder optimization target than single-output adversarial defeat.

DALD was first implemented in FretMind (P-03). AI guitar coaching system; c is the AI's claimed session quality; d is the user's independently-measured timing, pitch, and rhythm accuracy from the audio analysis pipeline against the score's reference signal, measured without consulting the AI's claim. Per-user baselines accumulate across sessions. The detection signature is high mean c paired with flat or declining baseline trajectory of d. The classical sycophancy failure mode mapped to a coaching context.