PRISM (Second-Brain)

wiki/open-questions.md

PRISM — Open Questions

Refreshed 2026-06-28 to reflect the Chowmes-PRISM direction. Earlier detector-only list moved to the backlog section at the bottom.

[ ] Anthropic account credits — the executor's Claude key is loaded + valid but the account balance is too low; generation (W-A) can't run until billing is topped up. [2026-06-28]
[ ] MCP keys for the executor — APIFY_TOKEN, SimilarWeb, BuiltWith still unset (only chrome MCP wired). [2026-06-28]

[ ] BuiltWith vs SimilarWeb discrepancy — memory says BuiltWith was dropped (Scout replaced it) but the skills' README still lists SimilarWeb + BuiltWith as required. Wire them or confirm intentionally skippable? [2026-06-28]
[ ] Multi-rep isolation model — per-rep Hermes profiles (each its own bot) vs an API-server + web frontend. Decide before rollout beyond the operator. [2026-06-28]
[ ] Cost model at scale — Claude tokens per audit (generation) + Gemini per chat-turn (×2 with the grounding judge). Acceptable now; revisit at "every AE daily." [2026-06-28]
[ ] Browser/WAF on datacenter IP — unattended audit-browser gets blocked; need a residential-IP runner or a degrade-to-human path (the #1 generation risk). [2026-06-28]

[ ] Force-a-fabrication stress test of the transform_llm_output gate (inject an ungrounded claim, confirm it's blocked/rewritten). [2026-06-28]
[ ] QA-mode tool/delegation lockdown (L2) so phrasings can't trigger subagent delegation instead of answering from the report. [2026-06-28]
[ ] Persist report-binding to a file (currently in-memory per session). [2026-06-28]

[ ] Auth for the SPA chat — the SPA is public but the intel is private; rep login required before it answers. [2026-06-28]
[ ] Cross-channel identity mapping — the conversation key scheme (user_<id>:report_<slug>) that links a Telegram thread to the SPA thread. [2026-06-28]

[ ] Add finding metadata (confidence / risk-if-wrong / persona-fit / archetype-fit / evidence-tier) to the audit schema + generation. [2026-06-28]
[ ] Build the translation layer (finding → calibrated hypothesis + F1–F6 / M1–M10 + single-page call plan) + the deal-intelligence object (persists BDR→AE→SE→CS). Needs generation first. [2026-06-28]

[ ] Per-vendor deep extractors beyond Algolia (Constructor/Coveo use the generic key/index puller). [2026-06-27]
[ ] Deepen proxied-vendor header unmasking (dell→Coveo via pilot.search.dell.com reads as first-party). [2026-06-27]
[ ] Detection inside Scout (network-capture endpoint) vs the module launching its own Playwright. [2026-06-27]
[ ] Report standardization Wave 1+2 — finish the 6 with-data depth-fills (grounded synthesis) + render+import the 10, then run the 7 dataless full re-audits to the canonical schema. Resume: spike-unify-audit/L-standardization-status.md. [Added 2026-06-28]
[ ] render-audit.ts invocation bug — <slug> site from prism-hub wrote to ROOT index.html (clobbered hub), not <slug>/index.html. Find correct workdir/arg before batch-render. [Added 2026-06-28]
[ ] Rotate exposed keys — BuiltWith + SimilarWeb (public-repo history, scrubbed but assume compromised); also the free-tier grounding-gate Gemini key (intermittent 429s under traffic). [Added 2026-06-28]
[ ] Vercel project rename → prism-hub + domain, keep algolia-arian-v2.vercel.app as alias; verify git-integration after the GH repo rename. [Added 2026-06-28]
[ ] Stage 2 (next): new IA/layout for the reports SPA + cross-channel chat testing (Telegram↔web). [Added 2026-06-28]

[x] Wave-2 SimilarWeb traffic blocker RESOLVED. User captured logged-in SimilarWeb screenshots (10 tabs x 7 companies) at PIP/docs/temp/similarweb-wave2/; traffic now extracted from screenshots, not the dead API. Wave-2 is fully keyless. See 2026-06-30-wave2-similarweb-screenshots. (Wave-2 still needs the e2e run.)
[ ] Audit-page logo target [Added 2026-06-30]. Each /{slug}/ audit page logo links to /, which is now the About splash. Decide if it should instead go to /reports/ (back to the list). Left as / for now.
[ ] Telegram avatar upload [Added 2026-06-30]. Cassandra's Telegram avatar is a manual one-time @BotFather upload (no Bot API method); file prepared. Pending user action.