docs(sales): fixed-price agent flight-recorder pilot kit

sales/flight-recorder-pilot/01-offer.md

@@ -0,0 +1,92 @@
+# Agent Flight-Recorder Pilot
+
+**A fixed-price pilot that gives your team a verifiable record of what its coding
+agents actually did. Once a session is sealed, your security reviewers and
+auditors can check its record themselves, without trusting us or the tool that
+produced it.**
+
+## The problem
+
+Your engineers already let Claude Code read files, run shell commands, and edit
+code in real repositories. When someone asks "what did the agent do on that
+change?", the answer today is a chat transcript or a log file on a laptop. Anyone
+with access could have edited it, and nobody downstream can check it.
+
+Security questionnaires, enterprise customers, and internal risk owners are
+starting to ask that question. "We trust the developer" is a weak answer.
+
+## What the pilot does
+
+In two to four weeks, on your machines and your repositories, we:
+
+1. **Record.** We install Korg's open-source capture hook for Claude Code in the
+   pilot repositories of a small group of developers. Every session becomes its
+   own ledger: prompts, model turns, tool calls, and tool results (long results are
+   truncated at 8,000 characters), causally linked and SHA-256 hash-chained.
+2. **Redact before anything is written.** Recognized secrets (API keys, bearer
+   tokens, private keys, JWTs, credentialed URLs) are replaced before an event is
+   hashed or saved, and we prove it with a planted canary secret.
+3. **Seal selected sessions.** For the changes that matter, we mint a signed
+   Certificate (`korgcert@v1`, Korg's file format, not a compliance certificate).
+   It embeds the session's events plus a summary of agents, tool counts, and file
+   paths used by file tools. The summary is re-derived from the events, so it
+   cannot disagree with the record.
+   Anyone can verify it offline with a command-line verifier (Rust, Python, or
+   Node.js) or a browser tab that uploads nothing.
+4. **Prove tampering is caught.** We edit records, delete them, and re-sign them with
+   the wrong key in front of your team and show each verifier name the exact break.
+5. **Gate CI** (Recorder + CI Gate and Evidence Pack). A GitHub Action verifies
+   Certificates against your pinned key on pull requests and fails the job on any
+   tampered or unverifiable file.
+6. **Report.** You get a written findings report with coverage numbers, drill
+   results, measured overhead, gaps, and a recommendation on whether to roll out.
+
+## What you can do afterwards
+
+- Answer "what did the agent do in the session behind PR #1234?" with a record a
+  third party can verify, not a screenshot.
+- Give security and GRC owners artifacts they can inspect themselves when they
+  assess change-management and logging controls for AI-assisted development.
+- Decide on a rollout using your own measurements of coverage and overhead,
+  not vendor claims.
+
+## Why this is credible
+
+- **Open source, no lock-in.** Korg is MIT / Apache-2.0. The format
+  (`korg-ledger@v1`) is a public spec with three independent verifiers (Rust,
+  Python, JavaScript) that pass the same conformance vectors. You keep everything
+  we install.
+- **It runs in your environment.** Capture, sealing, and verification all happen on
+  your machines. We run no hosted service, and nothing is sent to us unless you
+  choose to share it.
+- **We disclose the limits.** Live capture is Claude Code only. A signature proves
+  a key, not a person. Until a session is sealed, its record can be rewritten by
+  whoever controls the machine, including the agent itself. A sealed Certificate
+  fixes it from that point on, and the pilot sets out who seals and when. The full
+  list is in [CLAIMS.md](CLAIMS.md#limits-to-disclose).
+
+## What this is not
+
+This is not a compliance certification, an audit, or legal advice. The pilot
+produces evidence that you and your auditors may use. Whether that evidence meets
+any control or regulatory requirement is your auditors' call.
+
+## Options
+
+| | Recorder | Recorder + CI Gate | Evidence Pack |
+|---|---|---|---|
+| Price | $6,500 | $14,500 | $24,000 |
+| Duration | 2 weeks | 3 weeks | 4 weeks |
+| Repositories / pilot developers | 1 / up to 5 | up to 2 / up to 10 | up to 3 / up to 20 |
+
+Fixed price, 50% at signature and 50% on acceptance against
+[written criteria](09-acceptance-criteria.md). Full comparison:
+[08-pricing.md](08-pricing.md).
+
+## Next step
+
+A 30-minute scoping call, then our [technical discovery questionnaire](05-discovery-questionnaire.md).
+We confirm fit within two business days of receiving your answers. If Korg cannot
+capture your agents, we will tell you then, before you pay anything.
+
+Contact: {{SELLER_NAME}} · {{SELLER_EMAIL}}

sales/flight-recorder-pilot/02-ideal-customer-profile.md

@@ -0,0 +1,78 @@
+# Ideal customer profile
+
+Use this to decide whether a prospect is worth a scoping call, and to disqualify
+early when Korg cannot do what they need.
+
+## Primary profile
+
+**An engineering organization of 20–500 engineers that already uses Claude Code
+on production repositories and has someone who must answer for what the agents
+did.**
+
+| Attribute | Strong fit | Why it matters |
+|---|---|---|
+| Agent in use | Claude Code, used interactively or headless (`claude -p`), on macOS or Linux | It is the only live capture path ([L1](CLAIMS.md#limits-to-disclose), [L11](CLAIMS.md#limits-to-disclose)) |
+| Code host / CI | GitHub and GitHub Actions | The CI gate is a GitHub composite action ([C13](CLAIMS.md#claims-you-may-make)) |
+| Audit exposure | SOC 2 or ISO/IEC 27001 in place or in progress; enterprise customers sending security questionnaires; regulated industry (fintech, health tech, insurance, public-sector suppliers) | Someone owns the question "what did the agent change?" |
+| Agent maturity | Past the experiment stage: agents edit code that ships, or a wider rollout is planned this quarter | The record matters only once the work is consequential |
+| Buyer | A platform/DevEx lead, security engineering lead, or head of GRC with a budget line for AI tooling governance | They can sign a five-figure pilot without a procurement cycle |
+| Engineering culture | Comfortable installing open-source CLI tools and reading a hash-chain spec | The pilot runs on their machines, not on our SaaS |
+
+## Buying triggers
+
+Look for one of these in the last 90 days:
+
+- A customer security questionnaire or RFP asked how AI coding assistants are
+  governed or logged.
+- An audit window (SOC 2 Type II period, ISO surveillance audit) opens within six months
+  and AI-assisted change management is a new topic for the auditors.
+- An incident or near miss involving an agent: an unexpected file edit, a
+  destructive command, a leaked secret in a transcript.
+- Claude Code is moving from a few enthusiasts to a team-wide or company-wide
+  rollout.
+- A public post, talk, or job listing that mentions AI governance, agent
+  observability, or "AI SDLC" controls.
+
+## Personas
+
+| Persona | What they care about | Lead with |
+|---|---|---|
+| **Platform / DevEx lead** | Rolling out agents without slowing developers or creating a security veto | A capture failure never fails a session; the hook's added time is measured in the pilot, not promised; nothing is hosted |
+| **Security engineering lead** | Secret leakage, blast radius, "show me what it ran" | Redaction before hashing, canary drill, tamper drills, local-only trust boundary |
+| **GRC / compliance owner** | Evidence for change-management and logging controls that an auditor will accept | Independently verifiable records; control-evidence mapping (Evidence Pack); no certification claims |
+| **CTO / VP Engineering** | Customer trust, enterprise deals, avoiding a bad headline | A clear yes or no on rollout within a month, at a fixed price |
+
+## Secondary profile (qualify carefully)
+
+- **Teams mainly on OpenAI Codex CLI.** We offer only a feasibility replay of a
+  recorded trace ([L1](CLAIMS.md#limits-to-disclose)). Sell Recorder + CI Gate only
+  if they also have Claude Code users, or if a feasibility answer alone is worth the
+  price to them.
+- **Agent-tool vendors and consultancies** that want to attach verifiable
+  Certificates to agent-produced deliverables for their own clients. Capture has
+  to run on Claude Code.
+
+## Disqualify (do not sell the pilot)
+
+- The team uses only GitHub Copilot, Cursor, Windsurf, Gemini CLI, or another
+  agent with no Korg adapter.
+- They want a certificate of compliance, an audit opinion, or legal assurance.
+- They need a hosted, multi-tenant dashboard, central log collection, SSO, or RBAC
+  now. These do not exist ([L8](CLAIMS.md#limits-to-disclose)).
+- They need agent actions blocked or approved in real time. This pilot records
+  actions; it does not prevent them.
+- The pilot developers are on Windows only ([L11](CLAIMS.md#limits-to-disclose)).
+- Policy forbids installing Python packages or adding Claude Code hooks on
+  workstations, and they will not grant a pilot exception.
+- They need a trusted timestamp, or proof that a named person (not a key) produced
+  a change ([L3, L4](CLAIMS.md#limits-to-disclose)).
+
+## Qualification checklist (first call)
+
+- [ ] Claude Code in use today on at least one production repository
+- [ ] Pilot workstations are macOS or Linux
+- [ ] GitHub and GitHub Actions (required for the CI Gate tiers only)
+- [ ] A named owner for the agent-governance question
+- [ ] A trigger from the list above, with a date
+- [ ] Budget authority for the selected tier
+- [ ] Agreement that the output is evidence, not certification

sales/flight-recorder-pilot/03-scope-and-exclusions.md

@@ -0,0 +1,140 @@
+# Scope and exclusions
+
+Attach this to the statement of work. Tier names, limits, and prices match
+[README.md](README.md#pilot-at-a-glance).
+
+## In scope — all tiers
+
+1. **Install capture** for the agreed pilot developers on Claude Code (macOS or
+   Linux workstations):
+   - Install the `korg-ledger-py`, `claude-code-adapter`, and `korg-seal` Python packages
+     from a local checkout of the public Korg repository, at a pinned commit at or
+     after `781bc41`. Install them with `--no-deps`, plus `cryptography` from the
+     customer's usual index, so that pip never looks up the unregistered
+     `korg-ledger-py` name on PyPI ([L10](CLAIMS.md#limits-to-disclose)).
+   - Register the `korg-hook` capture hook (`PostToolUse`, `Stop`, `SubagentStop`)
+     **per pilot repository**, in that repository's `.claude/settings.local.json`.
+     Because the file is created by hand, it is added to `.gitignore` and
+     `git check-ignore` confirms it stays out of commits. We also check that
+     `~/.claude/settings.json` has no `korg-hook` entry from an earlier
+     `korg-setup` run, so only Claude Code sessions in pilot repositories are
+     recorded. The hook entries are reviewed with the developer before they are
+     written. `korg-setup` is not used ([L16, L17](CLAIMS.md#limits-to-disclose)).
+   - Ledgers are written to `~/.korg/sessions/<session_id>.jsonl` on each
+     workstation. Custom locations are not used in the pilot, because not every
+     Korg command honors `KORG_HOME`.
+2. **Backfill (optional).** With the developer's consent, convert existing Claude
+   Code session files for the pilot repositories only, with `korg-backfill
+   --projects-dir` pointed at each pilot repository's Claude Code project folder.
+3. **Verification toolchain.** Set up verifiers from at least two independent
+   implementations ([which verifier checks what](CLAIMS.md#which-verifier-checks-what)):
+   - Python: `python -m korg_ledger lint` (ledgers) and `korg-seal verify`
+     (Certificates).
+   - JavaScript: `verify.mjs` from Node.js, or the browser pages for reviewers.
+   - Rust: `korg-verify`, built from source on at least one customer machine or CI
+     runner where a Rust toolchain is allowed. It lints a Certificate for secrets
+     directly (`--require-redacted`). Without Rust, the Python lint checks a
+     Certificate's extracted events instead
+     ([which verifier checks what](CLAIMS.md#which-verifier-checks-what)).
+   - Do not use the `@korgg/ledger-verify` npm package or the `korg-verify` crate
+     from crates.io. Both are stale 0.1.0 releases that predate Certificates and
+     redaction ([L10](CLAIMS.md#limits-to-disclose)).
+4. **Issuer key setup.** The customer generates an Ed25519 issuer key with
+   `korg-seal` and records its public key as the pinned key. The customer also
+   chooses a sealing model ([06 §5](06-security-and-data-handling.md#5-keys)).
+5. **Certificates.** Mint `korgcert@v1` Certificates for a sample of pilot
+   sessions chosen by the customer, only from ledgers that pass the redaction lint.
+6. **Drills.** Run the tamper, redaction-canary, and wrong-key drills defined in
+   [09-acceptance-criteria.md](09-acceptance-criteria.md).
+7. **Measurement.** Capture coverage (transcript tool calls compared with ledger
+   events), hook overhead, and the time between capture and sealing, on real pilot
+   sessions.
+8. **Findings report and readout** following
+   [10-sample-report-outline.md](10-sample-report-outline.md).
+
+## Additional scope — Recorder + CI Gate
+
+9. **CI verification gate.** Add a workflow to the pilot repositories that runs the
+   `verify-korgcert` GitHub composite action, referenced by commit SHA and pinned
+   to the customer's issuer key, so that tampered or unverifiable Certificates
+   fail the job. Because the action does not check redaction, the workflow also runs
+   a redaction-lint step: `korg-verify --require-redacted` built in the job, or the
+   Python lint over each Certificate's extracted events. Because Certificates
+   contain full session content, the customer chooses where the CI job reads them
+   from: committed to the pilot repository after review, or fetched from a private
+   customer store. PR comments (which show the claim, tool counts, and file paths)
+   are on by default in the action, so the workflow sets `comment: "false"` unless
+   the customer turns them on.
+10. **Public anchoring (opt-in).** If the customer agrees, commit a file that
+    contains **only** a Certificate's tip hash to a public GitHub repository, bind
+    it with `korg-seal anchor`, and show `korg-seal resolve`. The Certificate itself
+    is never published ([L15](CLAIMS.md#limits-to-disclose)). If the customer does
+    not opt in, deliver a memo that explains the structural-only option and what
+    it does not prove.
+11. **Second-agent feasibility.** The customer records and sanitizes one
+    OpenAI Codex CLI WebSocket trace, following our sanitization checklist (the
+    capture includes authentication headers). We write a short replay script,
+    which the customer keeps, to run the trace through the `codex-ws` adapter into a
+    `korg-ledger@v1` journal. We verify that journal and report what production
+    capture of Codex would take. This is a feasibility finding, not a capture
+    deployment.
+
+## Additional scope — Evidence Pack
+
+12. **Control-evidence mapping workshop** (half day, remote). With the customer's
+    GRC owner, map pilot artifacts to the controls *the customer selects* from its
+    own framework, for example change-management and logging controls in SOC 2 or
+    ISO/IEC 27001. The output is a draft evidence matrix for the customer and its
+    auditor to review. It is not an audit opinion.
+13. **Operating runbook.** Written procedures for rollout beyond the pilot group,
+    key custody and rotation, ledger retention, redaction incidents (using
+    `rechain-redacted`), and verifier upgrades.
+14. **Executive readout** for a second audience, such as leadership or the audit
+    committee.
+
+## Exclusions — all tiers
+
+The following are out of scope. Any of them can be quoted separately through a
+change order ([08-pricing.md](08-pricing.md#change-orders)).
+
+- **Certification or attestation.** No compliance certification, audit opinion,
+  legal advice, or statement that the customer meets any standard or regulation.
+- **Agents with no live capture path.** Live capture of GitHub Copilot, Cursor,
+  Windsurf, Gemini CLI, Codex CLI, or any agent other than Claude Code. Codex
+  appears only as the feasibility replay in item 11.
+- **Hosted or networked components.** No hosted service, central log server, or
+  shared dashboard. `korg-server` and `mcp_server.py` are not deployed on any
+  network ([L8](CLAIMS.md#limits-to-disclose)).
+- **The `stream-json` adapter**, because its blob store is not redacted
+  ([L7](CLAIMS.md#limits-to-disclose)).
+- **Prevention.** No blocking, approving, or sandboxing of agent actions.
+- **Fleet rollout.** Endpoint-management packaging (MDM, Ansible, golden images)
+  and installs beyond the tier's developer limit.
+- **Windows workstations** ([L11](CLAIMS.md#limits-to-disclose)).
+- **DLP and data classification.** Redaction beyond `korg-redact@v1` rules; detection
+  of personal data or proprietary code inside ledgers.
+- **Trusted timestamping, identity binding, and key registries** beyond the
+  pinned-key and git-tip mechanisms in [CLAIMS.md](CLAIMS.md).
+- **Changes to Korg itself.** New adapters, features, or bug fixes. Bugs found
+  during the pilot are reported upstream through the public repository (security
+  issues through [SECURITY.md](../../SECURITY.md)). Fixing them is not a pilot
+  deliverable.
+- **Code quality review** of agent-produced changes. A Certificate shows what
+  happened, not whether the work was good ([L5](CLAIMS.md#limits-to-disclose)).
+- **Onsite work and travel**, unless agreed in writing and billed at cost.
+
+## Customer responsibilities
+
+- Name a pilot owner who can make decisions and attend the weekly check-in.
+- Provide pilot developers who use Claude Code on the pilot repositories during the
+  pilot window (at least three working sessions each).
+- Provide approvals before kickoff: workstation install exception, hook
+  registration, and (for CI tiers) permission to add a GitHub Action.
+- Hold the issuer private key. We never take custody of it.
+- Review and approve every artifact before it is shared with us
+  ([06-security-and-data-handling.md](06-security-and-data-handling.md)).
+- Return the [discovery questionnaire](05-discovery-questionnaire.md) before kickoff.
+
+Delays caused by missing access or approvals move the timeline without changing
+the price. Longer pauses are handled under
+[08-pricing.md](08-pricing.md#payment-terms).