---
id: T-200
name: "Discovery layer design — pattern detection, omission finding, insight surfacing
  (T-194 Phase 4)"
description: >
  Inception: Discovery layer design — pattern detection, omission finding, insight
  surfacing (T-194 Phase 4)

status: work-completed
workflow_type: inception
owner: human
horizon:
tags: [discovery, assurance, antifragility, temporal-analysis]
related_tasks: [T-194]
components: [docs/reports/T-200-discovery-layer-design.md]
created: 2026-02-19T19:29:30Z
last_update: '2026-06-11T22:24:05Z'
date_finished: 2026-02-22T09:43:12Z
target_blast_radius: 3   # T-2193 migration default (M=small-subsystem floor)
voi_score: 0.5            # T-2193 migration default (medium)
bvp_scores_proposed:
  - ts: '2026-06-11T22:24:05Z'
    estimator: bvp-estimator-v1-heuristic
    scores:
      D1: 2
      D2: 2
      D3: 2
      D4: 2
      F-RECALL: 2
      F-ORCH: 2
      F3: 2
      F1: 2
      F2: 2
    rationale: D1=2 (no-signal); D2=2 (no-signal); D3=2 (no-signal); D4=2 
      (no-signal); F-RECALL=2 (no-signal); F-ORCH=2 (no-signal); F3=2 
      (no-signal); F1=2 (no-signal); F2=2 (no-signal)
    rubric_sha: e4a00f38e801
---

# T-200: Discovery layer design — pattern detection, omission finding, insight surfacing (T-194 Phase 4)

## Problem Statement

The framework has three assurance layers designed in T-194. Layers 1-2 (hooks + OE tests) answer "are controls working?" Layer 3 (discovery) should answer "what are we missing?" — finding patterns, omissions, and insights that no single check can see by analyzing data across time. This is the antifragility layer: the system getting smarter from its own history.

**For whom:** Human operator — discoveries surface things that need attention but aren't violations.

**Why now:** T-194 GO decision deferred Phase 4 to this inception. OE test infrastructure exists. 234 cron audits, 235 episodics, 230 completed tasks, and 550+ commits provide a substantial data corpus for temporal analysis.

## Assumptions

- A-022: Temporal analysis across audit history reveals actionable patterns not visible in point-in-time checks
- A-023: Discovery jobs can run as cron (same infrastructure as OE tests) without excessive compute
- A-024: A small number of high-value discoveries (5-8) provides more value than many low-signal ones
- A-025: The human will act on surfaced discoveries if presented well (not alert fatigue)
- A-026: Existing data sources (audits, episodics, git, tasks) are sufficient — no new data collection needed

## Exploration Plan

### Phase 1: Discovery Capability Inventory (with human)
- **1a.** Catalog candidate discoveries from T-194 genesis + new ideas from data review
- **1b.** Classify each: omission detection vs insight generation vs trend analysis
- **1c.** Score each: value (1-5) x feasibility (1-5)
- **1d.** Human dialogue: prioritize, cut low-value, validate scoring

### Phase 2: Surfacing Model Design (with human)
- **2a.** Design how discoveries reach the human: cron output, session-start summary, Watchtower page, or combination
- **2b.** Define "actionable finding" format: what context does the human need to act?
- **2c.** Design false-positive mitigation: thresholds, suppression, acknowledgment
- **2d.** Human dialogue: validate surfacing model, discuss frequency

### Phase 3: Technical Spike
- **3a.** Prototype 2-3 highest-priority discoveries against real data
- **3b.** Measure: accuracy, false positive rate, runtime
- **3c.** Validate output format with human

### Phase 4: Decision
- **4a.** Synthesize findings into architecture proposal
- **4b.** Map build tasks
- **4c.** Go/No-Go with evidence

## Technical Constraints

- File-based only (D4 Portability) — no databases, no external services
- Must run as cron jobs (bash + standard tools) — same infrastructure as OE tests
- Must work when no Claude session is active
- Runtime per discovery job: target <5s (cron runs every 15-30 min)
- Output must be machine-readable (YAML) for Watchtower consumption
- Must not create alert fatigue — quality over quantity

## Scope Fence

**IN scope:**
- Discovery capability design and prioritization
- Surfacing model (how findings reach the human)
- False-positive mitigation strategy
- Technical spikes on top 2-3 discoveries
- Build task mapping

**OUT of scope:**
- Full implementation of all discoveries (build tasks come after GO)
- AI/ML-based pattern detection (keep it bash/python, no models)
- Cross-project analysis (AEF only for now)
- Real-time streaming alerts (batch/cron only)

## Acceptance Criteria

- [x] Discovery capabilities cataloged and prioritized (>= 5 candidates scored)
- [x] Surfacing model designed (how findings reach human)
- [x] False-positive mitigation strategy defined
- [x] Technical spike on 2-3 top discoveries validates feasibility
- [x] All research persisted in docs/reports/T-200-*
- [x] Go/No-Go decision made with rationale

## Go/No-Go Criteria

**GO if:**
- At least 3 high-value discoveries are feasible with existing data and infrastructure
- Surfacing model avoids alert fatigue (findings are actionable, not noisy)
- Technical spikes demonstrate <5s runtime and <20% false positive rate
- Build effort estimated at 1-2 sessions for initial set

**NO-GO if:**
- Discoveries are mostly redundant with existing audit checks
- Data is insufficient for meaningful temporal analysis
- Runtime exceeds acceptable cron budgets
- False positive rate makes findings untrustworthy

## Verification

# Research artifact exists and covers all 4 phases
grep -q "Phase 2: Surfacing Model Design" docs/reports/T-200-discovery-layer-design.md
grep -q "Phase 3: Technical Spike Results" docs/reports/T-200-discovery-layer-design.md
grep -q "Phase 4: Decision Synthesis" docs/reports/T-200-discovery-layer-design.md
# Remaining discoveries are backlogged
test -f .tasks/active/T-248-implement-remaining-discovery-jobs-d6-d.md
# D5 FP refinement is backlogged
test -f .tasks/active/T-249-refine-d5-lifecycle-anomaly-detection-t.md

## Decisions

**Decision**: GO

**Rationale**: 12 discovery capabilities cataloged and scored against real data. Top 5 score 20-25. 58% episodic decay rate validates D1 immediately. 10 temporal infrastructure gaps identified — zero temporal intelligence exists despite 234 cron audits. Gap-to-discovery mapping complete. Build tasks for top discoveries.

**Date**: 2026-02-21T23:37:37Z
## Updates

<!-- Auto-populated by git mining at task completion.
     Manual entries optional during execution. -->

### 2026-02-19T19:29:38Z — status-update [task-update-agent]
- **Change:** status: started-work → captured
- **Change:** horizon: now → later

### 2026-02-20T08:42:13Z — status-update [task-update-agent]
- **Change:** horizon: later → now

### 2026-02-21T23:20:57Z — status-update [task-update-agent]
- **Change:** status: captured → started-work

### 2026-02-21T23:37:37Z — inception-decision [inception-workflow]
- **Action:** Recorded inception decision
- **Decision:** GO
- **Rationale:** 12 discovery capabilities cataloged and scored against real data. Top 5 score 20-25. 58% episodic decay rate validates D1 immediately. 10 temporal infrastructure gaps identified — zero temporal intelligence exists despite 234 cron audits. Gap-to-discovery mapping complete. Build tasks for top discoveries.

### 2026-02-22T09:43:12Z — status-update [task-update-agent]
- **Change:** status: started-work → work-completed

## Reviewer Verdict (v1.5)

- **Scan ID:** R-7b8fce10
- **Timestamp:** 2026-06-02T15:00:49Z
- **Catalogue:** v1.3-seed
- **Overall:** PASS
- **Needs Human:** no
- **Findings:** none
