'
def link(label,url): return ''+E(label)+''
def page(id,label): return link(label,'https://chatgpt.com/space/'+id)
section('Decision brief',para('The enterprise has a substantial control design and growing product portfolio, but its operating effectiveness and IP resilience are not yet demonstrated. The highest priority is to turn existing requirements into accepted, tested work. Adding more charters will not resolve missing execution, identity, evidence, or recovery.')+para('This is an initial evidence-based audit and implementation plan, not a completed audit of every enterprise record, a legal opinion, an independent IA conclusion, or a certification of security. Preparation, management verification, independent assurance and customer outcomes remain separate. No enterprise-wide performance score is assigned.')+para('Your objective is preserved: exceptional performance while remaining privately held. Zero unauthorized access and zero unrecoverable loss are operating objectives, not promises that theft or loss is impossible. The 30% superiority target becomes a set of comparable, independently evidenced measures below.'))
section('What was examined and what remains open',table(['Source population','Actual work','Limit'],[['Chats','29 identified ChatGPT conversations; 332 returned turns across two retrieval rounds','12 conversations still have older-page cursors. The recent-task listing is limited to 50 unpinned tasks plus pinned tasks; older undiscovered conversations remain outside the census.'],['Pages','23 listed; 22 enterprise Pages retrieved in full; one introductory Pages guide excluded','Targeted analysis of governance, learning, controls and activities; the largest Pages contain extensive historical records. Retrieval is not proof every underlying attachment was examined.'],['Linked Library records','12 selected references attempted; 10 returned readable content','Enterprise register and ETV charter archive were unsupported formats. The complete Library asset population is not accessible through a general Library-list tool here.'],['Sites','24 currently returned sites; access policies inspected','22 custom access, 2 public. No access-history, content exposure, backup or vulnerability test is implied.'],['Drive','Foresixa Independent Recovery folder located; one direct child listed','A recovery handoff text is not a complete, tested independent enterprise backup.'],['Local workspace','No prior enterprise files found under the available Documents/Codex search','Files elsewhere, host services and offline vaults are not presumed absent.']])+para('The source register preserves stable IDs, dates, Page versions, reference outcomes and remaining chat cursors. The reported 1,535 Library assets and 12 enabled automations come from earlier enterprise records and have not been independently recounted here. Complete enterprise coverage remains unknown, not 100%.'))
findings=[
['F01','Urgent assurance gap','IP monitoring population differs from live source','Hourly IP Control Test reports 22 custom-access Sites and no public Sites. Current Sites response returns 24: 22 custom and 2 public.','Reconcile IDs, account, scope and cutoff; distinguish approved public content from restricted IP. Public access is not itself proof of theft.','Security/IP + Records; Manager coordinates'],
['F02','Critical prerequisite','Crown-jewel custody and recovery unverified','BOD record adopts a P4 exclusion from ChatGPT and separately controlled encrypted custody. No current vault, key-custody or recovery-test evidence obtained.','Establish sanitized asset/custody metadata and tested recovery; do not import P4 content into this audit.','Security/IP + Founder + qualified legal reviewer'],
['F03','High','Scheduled check is not continuous protection','Hourly IP record reports 85- and 107-minute test intervals and missing security telemetry.','Add independent missed-run detection, real event logs, escalation receipts and fallback response.','Technology/Security; ED resolves capacity'],
['F04','High','Assignments and reviews often stop at preparation','Manager, LGC and IA records identify unaccepted handoffs, absent receipts and untested operating controls.','Test one real assignment-to-review-to-correction route, with accepted identities and evidence.','Manager → VP; ED for enterprise barriers'],
['F05','High','Role labels overstate operating capacity','Latest BOD/ED records do not evidence a persistent accepted worker and backup for all 26 functions.','Publish an actual staffing/capability roster: human, on-demand AI, scheduled worker, vacant.','ED + People/Technology'],
['F06','High','Release readiness is fragmented','ETV and VraiSkill histories distinguish drafts, local tests, commerce setup and released learner access; earlier deadlines were missed.','Use exact-version customer-journey acceptance and original-date performance. Recheck latest ETV receipt before asserting current delivery state.','Product owners + Manager + QC'],
['F07','High','Ownership and authority conflicts survive in records','Sales charter target rules were superseded by Oct 7 policy; Manager reporting changed; VraiSkill authorship scope has conflicting historical summaries.','Maintain one effective authority/version map, preserve original history, resolve only conflicting fields.','Records + Manager + domain owners'],
['F08','High','Backup evidence is narrower than the enterprise','Source recovery and local packages exist; full independent restoration of data, assets, identities, configuration and dependencies is unverified.','Run a scoped recovery drill with measured restoration time, data loss window and functional checks.','Technology/Security + Records'],
['F09','High','Financial and customer outcomes lack current consolidated baselines','Oct 7 financial record lists 34 planning rows and 0/34 verified approved models at that cutoff. No current reconciled enterprise cash/outcome population obtained.','Reconcile seller, offer, costs, delivery capacity and actual cash; separate forecasts and financing from earned revenue.','Finance + product owners'],
['F10','High','Learning is recorded but reuse outcomes need proof','Learning Library explicitly requires successful application before counting a lesson as a win.','Link each material correction to a subsequent reuse test and recurrence observation.','Records/LL + owner; IA assesses independently']]
section('Findings requiring action',table(['ID','Priority','Finding','Evidence and boundary','Closure test','Accountable function; acceptance pending'],findings)+para('These IDs are local audit references. Map them to existing enterprise action IDs before adopting them into the authoritative register. No existing finding is closed by this report.'))
section('Portfolio coverage map',para('The 34 financial planning rows are modules and activities, not necessarily 34 separate companies. The 19-line historical portfolio, 26 functions, 34 planning rows and 24 hosted sites must be mapped by stable parent/child IDs rather than added together.')+table(['Activity group','Activities covered by the review','Next operating proof'],[
['Learning and AI services','ETV courses and website/app services; LavaLearning and TurboTax; Kids; VraiSkill adults, teens, Red Alert and Model Life courses; Learn_Anglais','Exact course scope, competent review, rights, age-appropriate safeguards, real learning transfer and purchase-to-access evidence.'],
['Professional and software services','BPA; Semajes Studio, Marketplace and BPA integration; CornerFlow/DishLoom; Serene; Spindle; Maison Contour; Swifty','Tenant isolation, permissions, professional scope, customer contracts, tested production journey, recovery and reconciliation.'],
['Creative and physical products','Sleepy Face; Atelier; Design/Creative Studio; Model Life; Fiefé; OsezArt','Authorship/rights chain, exact supplier or asset specification, physical samples where needed, authorized image/likeness use and full fulfillment economics.'],
['Media and intellectual assets','LesPetitFilms; Dance Of Animatic Cut; QzoticMusic/Saturday Lounge; Tomato Chronicles; Natur-ai-Vox','Editable masters and dependencies preserved, distribution/performer/music rights, accepted creative revision and tested restore/playback.'],
['Hospitality and personal services','S’otality cleaning, chef, editorial, Tomato Odyssey, interiors, concierge and Liberia scope','Accepted service model, staffing, permits/insurance applicability, quality, customer safety and measured delivery.'],
['Finance and infrastructure','FinBot/InFinBot, trading/signal service, Qzotic Command, Sovereign Core, Personal Assistant','Preserve private authorization boundary; verify integrated interfaces and real host evidence without assuming excerpts describe the whole system. Paper tests are not live trading results.'],
['Research, agents and governance','MasterMind; Mark, Adrianna, Matrix, Penelope, Lucy, Genius, Leonidas and Macedonia; 26 enterprise functions; Learning Library','Actual runnable identity, permitted tools, accepted owner/backup, logs, independent evaluations and measured outputs. Bot specifications are not active staffing.']]))
section('IP protection: prevention, detection and recovery',para('Use the existing Board classification policy. P4 content stays outside ChatGPT under that policy; this audit should handle only sanitized identifiers and control evidence. Other classifications require an approved handling matrix. Merely naming a folder “private” or a role “Security” does not establish isolation.')+table(['Control','Implement and verify','Evidence to retain'],[
['Inventory and chain of title','Register code, source art, designs, inventions, courses, datasets, prompts, models, domains, media masters, licenses and contracts. Record creator, legal owner, classification, canonical version, location, permitted use and retention.','Sanitized inventory IDs, assignment/license evidence, version hash and custodian acceptance.'],
['Identity and access','Use separate authenticated identities, strong MFA, least privilege, approved service scopes, timely offboarding and periodic access review. Preserve Founder recovery access without a single untested point of failure.','Allowed/denied access tests, permission exports, recovery-owner acknowledgment and review dates.'],
['Secrets and restricted material','Keep credentials in a secret store and P4 in the separate controlled vault. Scan only in an approved local environment; return redacted findings. Suspected credential filenames do not prove exposure.','Redacted scan disposition, secure rotation evidence where an actual exposure is confirmed, and custody controls.'],
['Disclosure and commercial rights','Before disclosure, verify recipient, purpose, minimum content, authority, confidentiality/non-use terms, rights and expiration. Counsel determines patent, copyright, trademark and trade-secret strategy by jurisdiction.','Exact approved disclosure package, recipient receipt, agreement and registration/deadline record where applicable.'],
['Detection and incident response','Collect identity, sharing, export, permission, code and backup events; monitor missing telemetry as a failure. Use a named incident owner, alternate and tested contact route.','Time-stamped alerts, acknowledgment, containment decision, preserved evidence, recovery and incident review.'],
['Recoverability','Maintain versioned encrypted backups across independent failure domains, with an offline or immutable copy and separately controlled recovery keys. Include data, configuration, source, assets and dependency manifests.','Restore into an isolated destination, compare hashes and records, then run critical workflows. A successful backup job alone is insufficient.'],
['Lifecycle and exit','Set lawful retention, legal holds, vendor exit, account succession, archive and deletion procedures. Do not delete the last copy or migrate sensitive IP until destination, custody and restore are verified.','Approved retention/transfer disposition, restore proof, recipient custody and deletion receipts where applicable.']])+para('This control structure is consistent with '+link('NIST CSF 2.0','https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework')+'. Backup and restore priorities follow '+link('CISA’s ransomware guidance','https://www.cisa.gov/stopransomware/ransomware-guide')+'. Trade-secret protection depends on actual reasonable protective measures and applicable law; '+link('WIPO explains the protection criteria','https://www.wipo.int/en/web/trade-secrets/protection')+'. These references guide the plan and do not certify compliance.'))
actions=[
['A01','Within 24 hours of accepted start','Security/IP + Records','Reconcile F01 site census against hourly watch; identify the two public sites and approved-public scope.','One 24-ID reconciliation with current access policies and explicit exceptions.','Prepared; owner acceptance pending'],
['A02','Within 48 hours','Founder + Security/IP','Confirm P4 vault and recovery custodian using metadata only; map suspected sensitive assets without opening them in ChatGPT.','Vault/custody record and approved test plan; no protected content transmitted.','Awaiting vault location'],
['A03','Within 72 hours','Records + Manager','Complete chat/charter/Library/source census; retrieve unsupported archives through an authorized file route.','Reconciled source population; every missing/inaccessible source listed with owner.','In progress; coverage incomplete'],
['A04','Within 7 days','ED + Manager + VP','Accept actual operators, alternates, capacity and review endpoints for the priority execution loop.','One real handoff, receipt, decision and escalation successfully tested.','Not implemented'],
['A05','Within 7 days','Technology/Security','Run first critical-asset backup and isolated restore drill; determine business-approved RPO/RTO.','Restored asset plus functional test, elapsed time, data-loss window and defects.','Not implemented'],
['A06','Within 7 days','Records + domain owners','Reconcile effective charters and later Founder directions, preserving conflicts and history.','Current authority map; superseded rules marked; no invented approvals.','Not implemented'],
['A07','Within 14 days','Technology/Security + ED','Connect telemetry, missed-run watchdog, alerts and incident fallback.','Simulated missed run and unauthorized request generate received alerts; recovery tested.','Not implemented'],
['A08','Within 14 days','Manager + product owners + Finance','Choose a small accepted delivery batch; map all remaining work and bottleneck capacity.','Evidence-backed completion forecast and original-date ledger.','Not implemented'],
['A09','Within 30 days','Product owners + QC + independent reviewer','Complete one adult digital-product journey and one other applicable service/product journey, after mandatory gates.','Correct access/delivery, failures, refund/reconciliation, support and recovery proven on the approved version.','Not implemented'],
['A10','Within 30 days','Finance + Records','Establish measured costs, cash and operating baselines; validate metric inputs and freshness.','Reperformable financial reconciliation and 30-day scorecard with denominator coverage.','Not implemented'],
['A11','Days 31–60','Manager + Records/LL; independent IA tests','Validate repeated operating cycles and learning reuse; remove duplicate reporting.','Two clean cycles as initial evidence, plus recurrence monitoring; not statistical certainty.','Not implemented'],
['A12','Days 61–90','ED + Finance + owners; BOD/Founder reserved decisions','Scale only proven workflows and assess external comparison readiness.','Sustained outcome evidence, capacity and cost; no critical bypass; qualified benchmark result.','Not implemented']]
section('90-day execution plan',para('These are proposed elapsed windows after accountable owners accept resources and scope. They are not promises of unverified staffing. Preserve all original enterprise deadlines, including the LGC October 21 decision checkpoint and October 23 corrections window. Do not silently replace missed commitments with these dates.')+table(['ID','Proposed window','Accountable function','Action','Definition of done','Current state'],actions)+para('Use the existing Manager ledger and approval tray as the operating system of record. This report is a preparation package for reconciliation, not a competing master ledger. Continue authorized private production while independent reviews are pending; parallelize applicable specialist review on the same frozen version. Management implements; IA independently tests and concludes.'))
metrics=[
['M01','Inventory coverage','Assets with current owner, classification, rights, canonical location and recovery mapping / reconciled in-scope assets','100% critical assets; 100% whole census goal','Unknown denominator','Daily changes; monthly census','Records/IP'],
['M02','Mandatory control completion','Passed current mandatory controls / all applicable mandatory controls due; missing evidence stays in denominator','100%; zero critical failures','Not measured','Each release/change','Owner + QC'],
['M03','Access review coverage','Due identities/access grants reviewed and dispositioned / all due grants','100% privileged and P4 custody grants','Not measured','Daily exceptions; monthly review proposal','Security'],
['M04','Recovery proof','Critical assets meeting both restoration and data-loss objectives in due drills / critical assets due for drills','100%; RPO/RTO accepted by business owners','Not measured','Daily backup health; monthly critical restore proposal','Technology/Security'],
['M05','Monitor execution reliability','Successful evidenced runs by deadline / scheduled runs due; also show maximum blind interval','100% critical runs by deadline; any miss escalated','85/107 minute gaps reported historically; full denominator unavailable','Every scheduled run','Technology/Security'],
['M06','Actual owner coverage','Active work with accepted owner, backup, authority and capacity / all active work','100% critical path','Not measured; role design is insufficient','Daily','Manager/ED'],
['M07','Original-date delivery','Accepted deliverables completed by original committed deadline / all deliverables due','≥99% assigned target; report actual first','Not measured','Weekly; rolling 30 days','Manager'],
['M08','First-pass acceptance','Eligible first submissions accepted without avoidable rework / all eligible first submissions','≥99% assigned target','Not measured','Weekly; rolling 30 days','QC + owner'],
['M09','Customer effectiveness','Eligible outcomes meeting predeclared success criteria / all eligible outcome opportunities','≥99% assigned target; age/product segmented','Not measured','Per release and rolling 30 days','Product owner'],
['M10','Efficiency and unit cost','Accepted work within frozen time/cost allowance / eligible work; also total attributable cost / accepted units','≥99% assigned target; lower cost without quality reduction','Not measured','Weekly/monthly','Finance + owner'],
['M11','Cash and contribution','Reconciled net customer receipts; revenue minus applicable variable fulfillment/acquisition costs; show fixed costs separately','Approved plan and liquidity limits; no fabricated baseline','Current consolidated actuals unavailable','Weekly 13-week cash; monthly close','Finance'],
['M12','Learning reuse','Due material corrections successfully retested in subsequent applicable use / corrections due for reuse validation','100% mandatory retests; zero repeated critical escapes','Not measured','Each reuse; monthly recurrence','Records/LL + owner'],
['M13','Founder intervention burden','Avoidable detail-correction minutes and cases per accepted deliverable; reserved decisions excluded','Reduce from measured baseline; do not suppress necessary escalations','Not measured','Weekly','Manager'],
['M14','Audit/agent accountability','Material claims with accessible exact-version evidence / all material claims; actions closed with valid acceptance / actions marked closed','100% supported claims; zero invented approvals or false closure','This report creates initial evidence trail, not population performance','Every update','This audit workstream; independent challenge'],
['M15','Risk resolution','Critical overdue actions, time to acknowledged alert, time to contain, and independently retested closures / closures due','Zero overdue critical actions; accepted response times by risk','Current complete action population unavailable','Event-based; daily reconciliation','ED + Security; IA retests'],
['M16','Coverage and freshness','Sources successfully observed within declared freshness limit / all required sources; show missing and stale separately','100% for mandatory decision inputs','Audit coverage incomplete','Every scorecard','Records/Manager']]
section('Founder scorecard and my accountability',para('Every measurement must retain the numerator, denominator, period, unit, baseline, target, owner, source/version, timestamp, exclusions and verifier. No data means Not measured. Missing evidence never becomes a zero incident count or a passing score. Targets are not accomplishments. Show red for failed mandatory controls, amber for incomplete evidence, and green only for currently verified compliance.')+table(['ID','Measure','Formula/required evidence','Target or rule','Initial actual','Cadence','Owner'],metrics)+para('For this audit workstream, also record promised versus delivered artifacts, retrieval coverage, corrections to my claims, overdue actions and time/cost when available. A future reviewer must be able to reproduce each claimed closure. I cannot independently certify my own work by adopting an IA title.'))
section('Measuring the assigned 30% performance target',para('Fortune rank alone does not identify the best operator for every activity. Use a leading comparable benchmark per metric, with a frozen peer group, same unit, period, geography, customer segment, cost allocation and service level. Keep the assigned target, but do not claim superiority to every Fortune 500 company without evidence for that population.')+table(['Metric direction','Proposed comparison','Example'],[['Higher is better','Enterprise result ≥ 1.30 × comparable leading result','Accepted units per paid productive hour: leader 10 → target 13, with equivalent quality and cost scope.'],['Lower is better','Enterprise result ≤ 0.70 × comparable leading result','Comparable cycle time: leader 10 days → target 7 days. This means 30% lower elapsed time; it is not the same as 30% higher speed.'],['Bounded percentage','Use remaining defects/downtime or another meaningful unbounded measure','Do not target 128.7% success from 99% × 1.30. A 0.10% defect benchmark could imply ≤0.07%, supported by adequate observation.'],['Zero/negative baseline','Set an absolute approved criterion','No percentage uplift from zero defects or a negative contribution baseline.'],['Claim gate','Require comparable evidence and sustained performance on each selected measure','Missing comparator or insufficient sample → Not benchmarkable. Do not average away a failed security or quality gate.']])+para('Proposed benchmark dimensions: accepted throughput, end-to-end cycle time, preventable defects, customer task success, cost per accepted outcome, restoration time, and learning recurrence. Freeze weights only if a composite is later desired; always display the underlying results and coverage. Start with internal improvement while credible external comparators are assembled. No 130 index or 30% lead is claimed today.')+para('Remaining privately held is a governance constraint: preserve approved ownership and reserved decisions, control commitments and maintain capital discipline. Do not infer an existing holding company or execute entity/IP transfers from a plan. Obtain scoped professional review for actual structure, ownership, tax and regulated-business constraints.'))
section('Around-the-clock operating design',para('Continuous service requires an actual host, telemetry, permissions, a scheduler or event handler, an operator and a tested fallback. A named chat or a scheduled summary does not provide continuous security coverage.')+table(['Layer','Required operation','Acceptance test'],[['Event controls','Authentication, restricted data handling, transaction authorization and fail-closed rules run in the system handling the event.','Valid actions succeed; unauthorized, stale, duplicate and malformed actions fail safely.'],['Monitoring','Collect real logs and detect missed heartbeats independently of the worker being checked.','Deliberately stop a worker and disconnect a source; received alerts identify the blind interval.'],['Response','Named owner and backup acknowledge, investigate and take authorized narrow action.','Exercise escalation when primary is unavailable; preserve decision and evidence.'],['Execution','Each active work item has a next action, accepted operator, dependency and scheduled checkpoint.','A complete real work item reaches accepted output and post-release verification.'],['Resilience','Backups, restoration, host failure, credential expiry, vendor outage and operator absence are tested.','Recover the agreed business service within accepted objectives.']])+para('Use the existing hourly IP test and ED watch rather than cloning them. An audit follow-through schedule has been configured for this task every four hours. Its first scheduled run is not yet verified. It advances coverage and findings and notifies only on meaningful changes; it does not replace a security operations service. Local scheduled work depends on the computer and app remaining available, as described in '+link('official scheduled-task documentation','https://learn.chatgpt.com/docs/automations?surface=app')+'. No continuous enterprise deployment is certified here.'))
section('Accomplishments and wins ledger',table(['Item','What can be claimed','What cannot yet be claimed'],[['Current source census','29 identified chats, 22 enterprise Pages and 24 Sites mapped; selected charters and Learning Library records retrieved.','All enterprise chats or all Library assets audited.'],['Monitoring discrepancy identified','Current live Site census distinguishes 22 custom sites from 2 public sites.','The sites are unauthorized or IP theft occurred.'],['Existing governance recovered','Manager route, owner retention, IA independence, later target policy and P4 custody direction identified.','Those roles are staffed or their controls work continuously.'],['Audit package and scorecard','Evidence register, prioritized actions, metrics and benchmark definitions prepared.','Implementation, revenue, loss prevention or a 30% comparative lead.'],['Historical ETV engineering','Records report local delivery/replay/refund/restart checks and portable course work.','Independent current production delivery or customer success without fresh exact-version evidence.'],['Historical creative production','Records describe private storefronts, source artifacts and an animatic review cut.','Final production rights, physical sample approval, sales or universally accepted creative work.']])+para('A business win requires an accepted result, baseline, measured change, period, source and verifier, plus residual risks and recurrence check. A risk-reduction win needs control tests or an observed reduction; never invent dollars of loss avoided. Count intermediate engineering progress separately from customer and financial wins.'))
section('Required decisions and concrete access gaps',para('Only a small number of inputs require the Founder: identify the existing P4 vault by system/location; confirm the actual people or deployed workers who can accept the control roles; approve any reserved spending, access, entity or ownership decisions once a concrete packet is ready. Never supply passwords, keys, protected inventions or private authorization implementation in chat.')+para('The audit can continue independently on source reconciliation and preparation. Full assurance needs the complete Library inventory and readable current enterprise register, remaining chat history, backup/restore logs, security/access telemetry, rights and ownership records, and real reviewer receipts. These are explicit gaps, not reasons to presume controls failed or to claim completion.')+para('No private material was publicly published, no site audience was changed, no IP was moved or deleted, no funds were spent, and no messages were sent to other roles in this audit.'))
section('Source links',para(page('page_8917c0679ab48191b4f2909b04c543f9','Manager ledger')+' · '+page('page_cafcbbc4eff08191ac3037a670901e38','Manager policy')+' · '+page('page_f2cd40002ff88191bbf2438340802871','Existing approval tray')+' · '+page('page_08f2b882abe481919b298ed4d8bdb273','Learning Library release lessons')+' · '+page('page_46f16bc38d548191a68f76531b43c71e','Financial baseline policy')+' · '+page('page_f58966c9c10c8191965e19ce9fe6d5a9','Audit templates')+' · '+page('page_4b49290af6ec8191aa52191c86989d29','Prior legal gap review'))+para('The accompanying source register contains the full enumerated Page and chat list. Source assertions are not independently verified merely because they are cited. Live Site access results are preserved separately from historical chat reports.'))
section('Quality review',para('Pass 1: evidence-source and count reconciliation, target/actual separation, benchmark arithmetic and action/metric identifiers. Pass 2: reviewed authority, privacy boundaries, failure paths, duplicate-control risk and limits of operational claims. Full enterprise assurance, independent professional review and complete history coverage remain open.')+para('Quality Assurance Log: [Technical Accuracy: bounded source and arithmetic checks; enterprise performance not quantified | Layout Spec: document rendering unverified | Operational Flow: design reviewed; enterprise implementation unverified]'))
css='body{font:16px/1.6 system-ui,sans-serif;color:#172733;background:#f4f6f7;margin:0}main{max-width:1160px;margin:auto;padding:40px 24px}header{border-top:7px solid #146458;padding:24px 0}h1{font-size:38px;line-height:1.15;max-width:820px}h2{font-size:25px;margin-top:0}section{background:white;border:1px solid #d7e0e3;border-radius:8px;padding:26px;margin:22px 0}p{max-width:100ch}a{color:#075f74}table{border-collapse:collapse;width:100%;font-size:14px}th,td{border:1px solid #d7e0e3;text-align:left;vertical-align:top;padding:11px}th{background:#e7f1ee}.table{overflow-x:auto}.tag{font-weight:700;color:#8b3912}footer{padding:24px 0;color:#4e5c66}@media(max-width:600px){main{padding:20px 12px}section{padding:16px}h1{font-size:29px}}@media print{body{background:white}main{padding:0}section{border:0;padding:8px 0}tr{break-inside:avoid}h2{break-after:avoid}.table{overflow:visible}a{color:inherit}}'
doc='Foresixa Enterprise Audit and Action Plan
FORESIXA ENTERPRISE · FOUNDER REVIEW · 21 OCTOBER 2026
Protect the intellectual property. Prove the execution. Measure the results.
Initial audit • coverage incomplete • implementation plan proposed
Private working report. Contains control findings and source references, not crown-jewel content.
'+''.join(sections)+''
(P/'enterprise-audit-and-action-plan.html').write_text(doc)
data={'as_of':'2026-10-21','status':'PROPOSED; not an operational performance result','actions':[dict(zip(['id','proposed_window','accountable_function','action','done','status'],x)) for x in actions],'metrics':[dict(zip(['id','name','definition','target','actual','cadence','owner'],x)) for x in metrics],'findings':[dict(zip(['id','priority','finding','evidence','closure_test','owner'],x)) for x in findings]}
(P/'action-and-metric-register.json').write_text(json.dumps(data,indent=2))
assert len(m['sites'])==24
assert sum(x['access']=='custom' for x in m['sites'])==22
assert sum(x['access']=='public' for x in m['sites'])==2
assert len(m['chats'])==29 and len(m['pages'])==22
assert sum(x['retrieved_turns'] for x in m['chats'])==332
assert len({x[0] for x in actions})==len(actions)
assert len({x[0] for x in metrics})==len(metrics)
assert 10*1.3==13 and 10*0.7==7
qa={'artifact_sha256':hashlib.sha256(doc.encode()).hexdigest(),'critical_defects':0,'pass_1':[{'id':'source-counts','mandatory':True,'status':'pass','evidence':'build_audit.py assertions: 29 chats, 332 returned turns, 22 enterprise Pages, 24 Sites = 22 custom + 2 public.'},{'id':'metric-arithmetic','mandatory':True,'status':'pass','evidence':'Higher-better 10*1.30=13; lower-better 10*0.70=7; zero/negative and bounded metrics explicitly excluded from naive scaling.'},{'id':'complete-enterprise-assurance','mandatory':False,'status':'unverified','evidence':'12 chat pagination cursors, unknown full Library population and inaccessible binary register; report explicitly remains initial.'}],'pass_2':[{'id':'operational-boundaries','mandatory':True,'status':'pass','evidence':'Report distinguishes proposed routes from accepted owners; retains IA independence, P4 exclusion, historical/current distinction, mandatory gates and unknown actuals.'},{'id':'rendered-layout','mandatory':False,'status':'unverified','evidence':'HTML created with accessible headings and tables; full responsive rendering not tested.'},{'id':'independent-review','mandatory':False,'status':'unverified','evidence':'No independent professional signoff claimed.'}]}
(P/'quality-review.json').write_text(json.dumps(qa,indent=2))
print(json.dumps({'status':'created','findings':len(findings),'actions':len(actions),'metrics':len(metrics),'sha256':qa['artifact_sha256']}))