PIP-001 — Process Improvement Proposal (PSP × OpenUP × Agent), WI-19 postmortem draft

# Process Improvement Proposal (PIP) — WI-19 Campaign Postmortem
Draft v0.1 · 2026-09-18 · Key Fob Station / I5 · Process baseline: PSP0.1 + OpenUP + Agent-assisted (Kilo)

## 1. Cycle summary
- Scope: WI-19 — run history store/outbox (REL-05..07), Card-UID from INIT UPDATE, product serial KF-<CardUID>-<ChipUID>, 9F7F fallback identity, Keyfob Info history panel.
- Commit: a329532 (65 files, +4771/−219). Gates: fmt/clippy -D warnings/tests all green (137 tests).
- Calendar: 16.09. evening → 18.09. midday (2 days). Net test effort ≈ 4–4.5 h; ≈ 3–4 h defect investigation charged to external DEF-28 (KLMS vault data).
- Defects: 30 recorded (28 removed, 2 open: #28 supplier, #29 low). Finding density peaked in Code phase; the three Test-phase findings of 18.09. were integration-level.

## 2. Process problems → improvement proposals
| # | Problem observed | Proposal | Category | Priority |
|---|---|---|---|---|
| P1 | No live Time Recording log — phase times had to be reconstructed post-hoc from DB timestamps, reports and chat evidence | Agent maintains the PSP Time/Defect logs as a by-product: write session timestamps + phase transitions into a per-cycle log file at each gate/phase switch | PSP + Agent | High |
| P2 | fmt gate blind spot for `examples/` (DEF-23, recurred with trace-9f7f.rs) | Single workspace-level gate entry (`cargo fmt --all --check`, clippy `--all-targets`) inside generate-test-report.py — never per-package | OpenUP gate | High |
| P3 | Audit JSON in history log_text enabled byte-level root-cause analysis without extra tooling (DEF-25 payoff) | Keep the 256 KiB audit store; add variant-aware secret redaction (WI-20 part 2) so evidence stays usable but secret-free in prod/test | OpenUP + Security | High |
| P4 | KLMS vault records copied by hand → near-duplicate SPIDs, non-Ford certs (DEF-28, 15 failed runs) | (a) Supplier process: records machine-generated, device certs via CSR → FMC-NFC-ICA; (b) Station preflight: verify payload cert issuer == FMC-NFC-ICA before delivery attempt — fail fast with clear message instead of 6A 80 | OpenUP supplier + Station | High |
| P5 | Session seed never deleted (CCS DELETE /seeds/{seedUUID} unimplemented) | WI-20 part 1: delete on application/window close; log-only failure | Security | Medium |
| P6 | Latent O(N) queries in history store (found by 43 GiB stress run) | WI-21: partial pending index, runs(container_uuid) index, targeted duplicate check, batched replay; add "persistence stress at 10× lifetime volume" to the Definition of Done for storage features | OpenUP DoD | Medium |
| P7 | `accept_invalid_certs = true` in dev configs (open item C1) | Track to closure: prod readiness requires valid CA chain from Clypeum; add gate/assert in prod variant | Security | Medium |
| P8 | Agent permission profile flapped mid-cycle — allow-listed commands (fmt check, stress steps) intermittently denied, blocking phase work | Pin a stable project permission profile (project config / AGENTS.md) covering the standard gate + bench commands before the cycle starts | Agent | Medium |
| P9 | Reusable analysis scripts landed in %TEMP% (gen_stress.py, bench_stress.py) | Keep bench/stress tooling in the repo (`tools/` or `scripts/`) so methodology survives the cycle | Agent + Reuse | Low |
| P10 | Identity-source decision (IU-div = Card-UID) drifted through 3 offset theories before a live capture pinned it | Record identity/format decisions with a verification step (bench capture) in the same cycle they are made — decision log entry with evidence link | PSP design discipline | Low |

## 3. Lessons learned
- Audit evidence in the product (DEF-25) turned a supplier dispute into a byte-level proof in a single morning — evidence-first logging is the single highest-leverage practice of this cycle.
- The identity chain decision (INIT UPDATE diversification = Card-UID) survived end-to-end validation (KLMS payload echo, serial stability, live 9F7F/IU equality check).
- SQLite at 10M/20M rows is fast on indexed paths; the risks are the unindexed O(N) side queries — stress testing found them in 15 minutes.
- External data quality defects (self-signed certs in vault records) mimic station defects; a control run (Files flow on the same fob) isolates them fastest.
- Agent-assisted phases compress documentation/tooling work dramatically (27 defect rows, model exports, 4 doc generators) but need stable permissions and a fixed gate entry point to avoid mid-phase stalls.

## 4. Process definition — PSP × OpenUP × Agent
| PSP phase | OpenUP discipline/artifact | Agent role | Gate |
|---|---|---|---|
| Planning | Inception: requirements, TC list (test-cases.json/doc) | Draft requirements/scripts, issue texts (Forgejo), estimates (PSP0.1) | Model exports + TC doc regenerated |
| Design | Elaboration: architecture model, UC realizations | Doc-script generation + consistency fixes; decision log w/ evidence | Arch notebook + exporter gates |
| Code | Construction: implementation + defect log upkeep | Implement, maintain Time/Defect logs, run gates | fmt --all --check; clippy --all-targets -D warnings; cargo test --workspace |
| Compile | Variant gates (full/test/prod) | Variant builds, cfg-gated redaction checks | Variant gate (DEF-22 lesson) |
| Test | Bench campaigns + stress (WI-21 methodology) | Run bench, capture traces, byte-compare evidence, stress DBs | Test report (generate-test-report.py) |
| Postmortem | PIP + Project Plan Summary | Compute size/time from git/DB evidence, draft PIP | This document |

## 5. Next-cycle entries
- WI-20: seed delete on app close + variant-aware secret redaction (PSP0.1 ≈ 4.75 h)
- WI-21: history/outbox performance hardening (open for further fixes)
- DEF-29 fix (9F7F CLA 00/offset 8 in applet context)
- DEF-28 closure criteria with Clypeum (ICA re-issuance + serial re-link) → closing validation run
- Risk C1: accept_invalid_certs → false once valid CA chain arrives


id: 3eedb42882b2487dac7e9128882e1867
parent_id: beb251c3b3f9490285e6cb68942a5145
created_time: 2026-09-18T11:59:45.221Z
updated_time: 2026-09-18T12:06:56.541Z
is_conflict: 0
latitude: 0.00000000
longitude: 0.00000000
altitude: 0.0000
author: 
source_url: 
is_todo: 0
todo_due: 0
todo_completed: 0
source: joplin-desktop
source_application: net.cozic.joplin-desktop
application_data: 
order: 1789732785221
user_created_time: 2026-09-18T11:59:45.221Z
user_updated_time: 2026-09-18T11:59:45.221Z
encryption_cipher_text: 
encryption_applied: 0
markup_language: 1
is_shared: 0
share_id: 
conflict_original_id: 
master_key_id: 
user_data: 
deleted_time: 1789733216541
is_locked: 0
extracted_resource_ids: 
type_: 1