Kairos — Opportunity Evidence Strategy and Priority Programme

Evidence work only. This programme may map, inspect, reconcile, falsify, rank, pre-register and prepare decision packets. It does not authorize product work, production mutation, a live experiment, a landing page, customer or buyer outreach, an application, spend, transfer, fundraising, or any other material pursuit. No signed Opportunity Schedule means no material pursuit of a qualifying opportunity.

Result

The current opportunity order can now be converted into a disciplined evidence programme, but it cannot honestly be called a completed full-room audit.

The durable vault contains the current opportunity ledger, source atlas, twelve-room access register, candidate-specific evidence, and the predecessor handoff for the exhaustive room comb. It does not contain the named handoff-2026-08-27-opportunity-evidence-strategy-and-priority-programme.md, and the predecessor still says the complete opportunity-by-room recompute is pending. The current top five are therefore the provisional decision order, not a newly audited final order:

1. Payment Recovery
2. Retention Economics
3. GoProxies Conversion System
4. Residential Vantage Network
5. Crypto-native Access Wedge

The work programme begins by closing that audit gap. It then spends evidence effort in the order most likely to change a decision, not by blindly following candidate rank or whichever source is easiest to read.

The governing strategy is:

1. freeze the complete decision-surface and source-room denominators;
2. build the few identity, time, money, funnel, operations and product/network contracts that unlock several candidates at once;
3. attack the decisive uncertainty in the top three before widening the portfolio;
4. run cheap supply, semantics and existence falsifiers before demand work;
5. let challengers and generative candidates ride the same evidence rather than create parallel programmes;
6. prepare, but do not execute, any test that crosses into material pursuit;
7. preserve every negative, blocked, parked and superseded result so the portfolio cannot regress into story-first ranking.

Consequential decisions

These are the calls that shape the system. The recommended call is already clear from the current record, so no further interrogation is required before drafting.

Portfolio denominator — corrected

The current record supports nineteen decision surfaces but eighteen unique opportunity constructs. The difference is deliberate: Key Maker appears twice because its MN-enabler proposition and its external product proposition have different evidence and decisions. Counting the two propositions as one would mix internal operating value with external willingness-to-pay; counting them as two unique products would double-count the same architecture.

This denominator governs the audit matrix. The twelve-room source denominator is the current release target in Kairos — Data Access Evidence Register (2026-08-26) after Pipedrive entered the register. The mechanical coverage grid is therefore 19 × 12 = 228 classification cells. It is not a requirement to perform 228 deep analyses. It is a requirement to account for all 228 cells and justify which deserve a decision contract.

The data-to-decision architecture

flowchart LR
    A[Decision-changing claim] --> B[Source connection certified]
    B --> C[Inventory and fitness contract]
    C --> D[Identity / time / money / funnel / operations / product spine]
    D --> E[Bounded evidence packet]
    E --> F{Does the evidence change the decision?}
    F -->|Yes| G[Promote / narrow / hold / drop]
    F -->|No| H[Park with reason]
    G --> I{Material pursuit required?}
    I -->|No| J[Continue evidence work]
    I -->|Yes| K[STOP — Opportunity Schedule and human authority gate]

1. Candidate decision contract

Every active claim starts with:

decision · candidate/surface · load-bearing claim · current grade · decisive uncertainty · flip condition · kill condition · decision owner · pursuit boundary

If no plausible result can change promotion, narrowing, hold or rejection, the work is not currently decision-bearing and should be parked.

2. Source connection contract

Use the full lifecycle in 90-system/skills/kairos-sync/references/data-source-lifecycle.md:

authority → custody → authentication → scope → sufficiency → durability → acceptance → inventory → fitness → lineage → drift

Authentication, one returned object, a stored credential, or an HTTP 200 never raises an opportunity grade. A source may retain historical accepted findings while its current read path is blocked. BigQuery is the current example: earlier bounded contracts remain evidence, while current reads require identity-consent reauthentication.

3. Analytical spines

Do not build every pairwise source join. Build only the six shared spines that can carry several decisions:

4. Evidence cell contract

Every candidate-source cell records:

surface · claim · source · question · decision affected · source state · object/grain · window · denominator · examined · untouched · evidence · counterevidence · joins · exclusions · semantic owner · freshness · confidence · provenance · disposition · next falsifier

Allowed dispositions:

• FINDING — the mapped source supports a bounded result;
• NEGATIVE_FINDING — a bounded falsifier returned a decision-changing negative;
• BLOCKED — the accepted read path or required authority is absent;
• PARKED — work is possible but cannot currently change the decision, with the reason named;
• NOT_RELEVANT — the source cannot plausibly affect the named claim, with the reason named.

No cell may remain blank. UNKNOWN may describe the claim result, but not the work disposition.

5. Evidence ladder and decision rule

Use the existing ladder without averaging away a weak load-bearing claim:

• L0 — synthetic, desk or architectural evidence;
• L1 — company-reported or direct but unreconciled evidence;
• L2 — reproduced working-tier measurement at known grain;
• L3 — independently reconciled to a second source or control;
• L4 — semantic owner validation and decision ownership.

Promotion normally requires:

1. at least L2 on the load-bearing quantity;
2. L3 reconciliation where the number can drift across systems;
3. L4 semantics before an intervention is treated as interpretable;
4. a reachable population, reversible intervention and measurable outcome;
5. an explicit net-value and harm boundary;
6. enough observation time to distinguish signal from noise;
7. the applicable Opportunity Schedule before material pursuit.

A negative can kill earlier if it destroys the premise. A positive cannot promote merely because it is large, current or easy to explain.

6. Decision packet

The end product of each contract is one page, not a dashboard:

1. decision and prior state;
2. evidence and counterevidence;
3. denominator, examined count and untouched remainder;
4. source fitness and join boundary;
5. what changed and what did not;
6. promote / narrow / hold / drop / blocked;
7. cheapest next falsifier;
8. authority boundary;
9. correction and supersession links.

Programme sequencing rule

Candidate rank determines whose uncertainty matters most. Work priority is then lexicographic:

1. can the evidence kill or materially narrow a top-three candidate?
2. does it unlock two or more decision surfaces?
3. does it move a load-bearing claim from reported or measured to reconciled or owner-validated?
4. can it be obtained read-only, safely and reversibly?
5. is there a real information-decay deadline?
6. among ties, choose the cheaper and faster falsifier.

This avoids false precision from a weighted score while still producing a deterministic work order.

Sequenced evidence work programme

Gate 0 — close the audit denominator

Purpose: establish the actual starting portfolio before allocating deep work.

Inputs: the nineteen decision surfaces, twelve registered source rooms, current candidate notes, current source receipts, and source-neutral public or internal evidence already preserved.

Work:

1. freeze the nineteen-surface manifest and the Key Maker dual-surface rule;
2. freeze the twelve-room source manifest from the newest receipt state;
3. classify all 228 cells;
4. require denominator, examined count and untouched remainder for every cell marked FINDING or NEGATIVE_FINDING;
5. reconcile the current top-five ledger against every material delta;
6. publish a candidate-by-candidate delta: strengthen, weaken, hold, merge, split or retire;
7. preserve Payment Recovery's accepted findings separately from the draft, red-team-pending v0.2 architecture;
8. label the result self-reviewed unless a separate opposing strategic review occurs.

Exit: no blank or unclassified cells; every candidate has one current state, one decisive uncertainty and one cheapest next falsifier.

Until this gate closes, the current rank order remains provisional.

Wave 1 — top-three decision discriminators

Run at most three contracts in parallel.

Track A — Payment Recovery: net recoverable value, semantics and programme truth

Decision: is there a lawful, controllable recovery or prevention class with material net retained value after natural recovery, intent, fees, fraud, disputes and existing dunning are accounted for?

Use: accepted payment-funnel evidence; current processor and billing semantics; existing recovery-programme history; advice-code and retry conformance; processor export or independent control when available.

Must resolve:

• one invoice / renewal grain and one current denominator;
• voluntary, involuntary, unresolved and already-recovered classes;
• net retained value, not failed face value;
• existing retry, communication and orchestration treatment by class;
• fee, dispute, refund, fraud and scheme-rule boundaries;
• whether the observed programme changed an outcome;
• the payments, revenue-model and compliance semantic owners.

Output: a class-level decision table and a reconciled programme-effect finding. Do not design a live routing change until the evidence establishes a lawful, material class.

Stop / park: source discrepancy, absent owner semantics, no independent processor control, or conservative net value below the published flip threshold.

Track B — Retention Economics: comparable customer-value loss matrix

Decision: which controllable loss cell dominates retained contribution after product mix, acquisition mix, price, platform, payment, usage, service failure and support burden are separated?

Use: accepted warehouse cohorts; commissioned Intercom aggregates; cancellation and churn reasons; acquisition and lifecycle exposures; Grafana only after metric fitness; realised contribution components when available.

Required matrix:

loss cell · eligible population · observed loss · natural recovery · retained contribution · controllability · reversibility · time-to-signal · evidence grade · semantic owner

At minimum compare:

• involuntary payment loss;
• voluntary cancellation;
• non-activation / failed first value;
• product or reliability failure;
• price / plan / market mismatch;
• acquisition-quality and channel-mix effects;
• support-intensive but retained cohorts;
• win-back and reactivation.

Output: one ranked loss matrix and one leading intervention hypothesis. The matrix must keep observed association separate from causal effect.

Stop / park: incompatible windows, unfit identity joins, undefined contribution, or a loss ranking that changes under plausible cohort definitions.

Track C — GoProxies: commercial identity and unit-economics gate

Decision: does any paid-test, customer or use-case cohort convert to durable recurring margin at account grain?

Current boundary: ClickUp and historical warehouse surfaces expose accounts, plans, funnel loss and support, but not paid-test identity, revenue amounts, recurring outcome, delivery cost or contribution. Pipedrive and the GoProxies API are currently blocked.

Work:

1. preserve the diagnostic funnel as a bounded finding;
2. retrieve the existing ICP and buyer-persona artifacts before inventing replacements;
3. specify the company → buyer → evaluator → paid test → integration → usage → recurring margin contract;
4. prepare the exact read-only Pipedrive and GoProxies acceptance fixtures;
5. require a paid-test ledger with amount, date, account, end state and recurring outcome;
6. reconcile delivery and support burden before any conversion claim.

Output: either a positive cohort-economics table or an explicit ECONOMICS_UNOBSERVABLE / COHORT_LEDGER_ABSENT finding. Funnel visibility alone cannot promote the candidate.

Stop / park: no accepted account identity, no cohort ledger, or non-positive recurring contribution.

Wave 2 — shared challenger and supply falsifiers

Start only after Wave 1 contracts have stable denominators or have parked cleanly.

Delight — inside Retention Economics

Current read paths have exhausted their present security and semantic boundary. Residential traffic share and support prevalence establish materiality for further investigation; current fields do not establish true production failure incidence, verified recovery, causal retained value or a Mysterium-specific advantage.

Next evidence is owner-confirmed outcome telemetry:

eligible incident → detected state → traffic containment → recovery action → route/IP/DNS/data-path verification → exposure → customer outcome → retention/value

Prepare the R4 contract and acceptance criteria only. Do not instrument, alter the client, run a live intervention or promote Delight outside #2 under this programme.

Residential Vantage + Poland Incentive Economics — one supply packet

These candidates share the same first falsifier: what supply actually exists, persists, is consented, can be selected, and costs.

One read-only node and incentive packet should measure:

• stable nodes by country, ASN, protocol and observation window;
• persistence, availability, utilisation and reset/churn semantics;
• consent and permitted measurement boundary;
• incentive outlay, payout, direct cost and any observed persistence effect;
• which counts refer to registered, active, reachable, usable or consented nodes.

Decision consequence: a failed supply contract kills or sharply narrows Vantage before buyer work and can separately retire Poland as an opportunity. A successful supply contract earns the right to prepare demand research; it does not authorize outreach.

Key Maker — internal enabler

Use passive evidence from naturally occurring access work. Every access request, repair, rotation, revocation or onboarding event may record elapsed time, touches, retries, authority states, acceptance result and useful work unlocked.

Do not build a separate Key Maker system to prove Key Maker. Promote the MN-enabler proposition only if natural-work journeys establish material delay and show that a bounded governed mechanism can reduce it without introducing a master-key risk.

Wave 3 — external and generative evidence preparation

This wave may perform desk research, source mapping, passive analysis and test pre-registration. It must stop before live demand generation or product-touching execution.

Wave 4 — capability evidence, kept off the commercial scoreboard

Capabilities do not outrank or dilute MN commercial evidence. They run only as passive measurement or when they directly reduce the cost, risk or latency of this programme.

WIP, cadence and stopping controls

Active-work limit

• maximum three active evidence contracts;
• one named coordinator owns integration and the decision ledger;
• extractors or scripts may produce rows but cannot promote candidates;
• one candidate can have several claims, but only one current decision state;
• a blocked source does not block unrelated sources or cells.

Contract close states

Every contract closes as one of:

• DECISION_CHANGED;
• NEGATIVE_FINDING;
• BLOCKED_EXACT_REQUEST_READY;
• PARKED_NO_CURRENT_FLIP_POWER;
• SUPERSEDED_BY_BETTER_CONTRACT.

“More analysis needed” is not a close state unless the missing evidence, owner, source and decision consequence are exact.

Reopen rules

Reopen a candidate only when one of these changes:

• a load-bearing source, schema, denominator or metric definition;
• an owner validates or rejects semantics;
• a cross-source contradiction appears;
• a new measured outcome crosses a published flip or kill threshold;
• the authority boundary changes;
• a time-sensitive external condition materially changes information value.

Source priority — current boundaries

The source priority is governed by decision unlocks, not room prestige.

Mechanical acceptance checks

The programme is ready to drive work only when all of the following are true:

1. nineteen decision surfaces and twelve rooms are machine-enumerated;
2. all 228 classification cells have an allowed disposition;
3. every deep-work cell has a decision-changing question and stop rule;
4. every finding states denominator, examined count and untouched remainder;
5. every cross-source result has identity, grain, time, missingness and reconciliation contracts;
6. every candidate has one current state and one published flip condition;
7. rank changes cite the exact new evidence and preserve the prior state;
8. blocked cells contain an exact source-owner request and acceptance fixture;
9. no current source failure is rewritten as business absence;
10. no source readability is converted into candidate promotion;
11. no external test or product-touching step has been executed;
12. the Opportunity Schedule gate is explicit wherever material pursuit would begin.

Immediate execution queue

The first five work packets are:

1. Portfolio audit packet — nineteen surfaces × twelve rooms; close every cell and issue the candidate delta.
2. Payment–Retention common spine — customer/subscription/payment identity, two time windows, net-value semantics and processor control.
3. GoProxies economic unlock packet — existing ICP artifact, paid-test ledger, Pipedrive and product/API acceptance contracts.
4. Network supply packet — Vantage + Poland + Delight-relevant node/protocol semantics, persistence, consent and cost.
5. External pre-registration bench — Crypto, Key Maker external, Grant and G5; research and test design only.

Packet 1 must close before a new ranking is claimed. Packets 2–4 may then occupy the three active lanes. Packet 5 begins only when one lane frees or when a true information-decay deadline outranks a current lane under the sequencing rule.

Verification and review state

• Handoff resolution: the named handoff is absent from the current vault and has no Git history under that filename. The current predecessor is handoff-2026-08-27-opportunity-evidence-room-comb, which still records the exhaustive recompute as pending.
• Opportunity source: Kairos — Opportunity Hypotheses (2026-08-11) remains the vault decision ledger. The team-readable Opportunities board is v0.8.1 dated 2026-08-27; this Core-only evidence programme is a separate decision-control layer and does not promote or reorder that board.
• Live boundary: deployed on 2026-08-27 to https://kairos-war-room.leematulis.com/notes/kairos-opportunity-evidence-strategy-and-priority-programme-2026-08-27. A signed-in Lee/Core browser returned the canonical title, H1 and machine record with data-pursuit-status="prohibited" and no console errors. A Robertas/team service-token probe redirected the note request through the Core root to /team/ without returning the strategy body or Core machine record.
• Shared Kairos state: the shared checkout remains dirty and no shared-repository publication is claimed. The War Room deployment is a separate Core-only surface.
• Review: this strategy is Codex self-review only. It is not an independent opposing strategic verdict. Independent review is required before this programme promotes a candidate into a material decision or is used to justify pursuit.

Core sources

• Kairos — Opportunity Hypotheses (2026-08-11)
• handoff-2026-08-27-opportunity-evidence-room-comb
• Kairos — Source Atlas
• Kairos — Data Access Evidence Register (2026-08-26)
• Kairos — Customer Intelligence Spine
• Kairos — Payment Funnel Decision (2026-08-12)
• Kairos — Payment Recovery — Foundation Architecture v0.2 (2026-08-25)
• Kairos — VPN Self-Healing Data Signal (2026-08-27)
• Kairos — Key Maker Access Control Plane (2026-08-27)
• Kairos — Ahrefs SEO Opportunity Map (2026-08-27)
• Kairos — Omnisend Campaign Operating Review (2026-08-27)
• Kairos — Impact-to-BigQuery Reconciliation (2026-08-27)
• 90-system/skills/kairos-sync/references/data-source-lifecycle.md