Project 04. The Architecture Dossier

At a different insurer's claims-assistant program, the cost model was built against a two-region topology; six weeks later the security review moved the workload behind a single-region endpoint with a residency-driven latency surcharge nobody repriced. Nobody caught it: the topology decision lived in one file, the cost model in another, and no one read both before the board approved the pilot at the old number. The invoice for month two landed well above the figure the board had signed off, and the program's sponsor spent the next steering committee explaining a number that traced to no file in the deck.

Illustrative composite. The topology mismatch is a composite of engagements the course draws on, not one company's record; in the composite, the month-two invoice ran close to 40% over the board-approved figure.

Harbor Mutual's board meets in ten days. The chief operating officer has one agenda slot, one page of pre-read, and a chief financial officer who will ask for the number, a chief information security officer who will ask what happens when a customer's attachment tells the assistant to email a claim file, and a general counsel who will ask which article of which regulation applies from which date. Fourteen files in your Dossier answer those questions between them. None of them is the answer. The answer is the page the board reads first, and the review that proves the fourteen files agree with each other.

This project's deliverable is the complete Architecture Dossier for your case, reviewed against the course's Well-Architected-style checklist, with a one-page executive summary a buyer could sign. It closes the Run stage of Frame → Decide → Prove → Run, and its last section opens the next Frame.

Brief

The client. Harbor Mutual, as carried through every lesson: a regional property-and-casualty insurer, EU and UK operations, an on-premises document archive plus a cloud tenancy in an EU region, a claims-correspondence assistant that drafts letters grounded in policy wording and proposes adjuster visits through a booking queue, with a human sender in phase one. If you built the Dossier for your own case, use yours; the checklist is the same.

What exists. Every file the course produced, in the order the lessons produced them. Each carries a one-line acceptance test; a file that fails its test is a gap, and a gap is recorded, never hidden.

What is missing. README.md, the executive summary, and the review record that shows the Dossier was read as a whole. Both are yours to write here.

Why the review matters. Fourteen files written over fifteen lessons drift. The cost model was built before the topology ADR chose the regional endpoint with its uplift; the threat model's control matrix may reference a tool the agent spec later removed; the compliance annex's classification may have changed which oversight notch the rollout plan can start at. The review is how the Dossier becomes one document instead of fourteen. The picture below shows what reads what; every arrow is a place where drift hides.

The rule this lab tests

When two Dossier files disagree, resolve the drift in the file that sits later in the loop — Decide before Prove, Prove before Run — unless the disagreement is with the charter itself; otherwise the earlier file governs, because it is what the sponsor actually agreed to. The condition is observable in your own drift log: check which file has the newer version line, or which file the rest of the Dossier already cites. A downstream file built against an assumption an upstream decision has since changed is the one that moves.

Steps

1. Read the Dossier end to end, in file order, in one sitting. Keep a drift log as you go: any number, name, tool, date or classification that appears in two files with two values. Expect between five and fifteen entries on a first read; a log with none means the read was not done.

2. Run the review checklist below. For every question, write the file and section that answers it, or the word "gap" with the owner who will close it and the date. Record the result in review.md with the question number, the answer, and the drift-log entries it surfaced.

3. Resolve every drift entry in the file that is downstream. The cost model moves to match the topology ADR, not the other way round; the rollout plan's oversight notch moves to match the compliance annex. Bump the version line in each file you touch and note the change at its foot.

4. Write README.md, the executive summary, using the template from lesson 15. One page: the decision requested, the problem and its measured baseline, what the system does and does not do, the evidence (eval result as a lower bound, cost per task and twelve-month total at the p90, threat-model residuals, compliance classification), the rollout with its gates and dates, the risks with owners, the exit option and its price, and the signature line. Every number on the page traces to a file in the Dossier; the page quotes, it does not restate.

5. Have the summary read by someone who has not read the Dossier. They should be able to say, without opening another file, what is being decided, what it costs, what could go wrong and who owns it. Where they cannot, the page is wrong, not the reader.

6. Write the review's final section: the next Frame. Three lines: what the review of this engagement learned that the next charter needs (the baseline method that worked, the failure modes found, the vendor terms actually experienced), the next use case the evidence qualifies or kills, and the date the Dossier is next reviewed.

The review checklist

Twenty-five questions, grouped by the loop. Each names the file that should answer it. "Gap" is an acceptable answer; a blank is not.

Questions 1 and 2 are answered in full below, against the Harbor Mutual model files in Example Files; question 3 is faded — decide it yourself first, then check the answer where this checklist's own check-fence reveals it, further down the page; questions 4 through 25 stay open, answered from your own Dossier.

Worked, against the Harbor Mutual model files.

• Q1 — Is the problem stated as a measured baseline, not an aspiration? Yes: the executive summary's "The problem" line gives a dated baseline, "median 31 minutes per complex letter, citation errors on 4.1 of every 100 letters," measured 2026-09-15 to 2026-09-26, matching 00-charter.md §3 and 01-nfr-budgets.md. There is no aspirational phrasing standing in for that measurement.
• Q2 — Do the users named in the charter still own the decision the system drafts? Yes: the summary's "What the system does" line states the adjuster signs, and that the system does not send, does not book directly and does not face customers — the same ownership 05-agent-spec.md's risk ratings assume for every medium-risk tool.

Frame

1. Is the problem stated as a measured baseline, not an aspiration? (00-charter.md §1, §3)
2. Do the users named in the charter still own the decision the system drafts? (00-charter.md §2, 05-agent-spec.md risk ratings)
3. Does every non-goal in the charter still hold, and did any later file quietly build one? (00-charter.md §4 against 05-agent-spec.md and 06-integration-spec.md)
4. Does every budget have a number, a measurement and an owner, and does the eval plan measure each one? (01-nfr-budgets.md, 07-eval-plan.md)
5. Does the constraint register name the segment, and does the topology ADR cite the register? (02-constraints.md, adr/0003-topology.md)

Decide

6. Is the model chosen by the budgets in order, and does the ADR carry a review condition with a date? (adr/0001-model.md)
7. Does the context spec's cached prefix match the model the ADR chose, and are the cache minimums met? (03-context-spec.md)
8. Is there a schema at every boundary the sequence diagram crosses? (03-context-spec.md, diagrams/sequence.mmd)
9. Does every grounding document class have an owner, a freshness rule and an access rule? (04-grounding-data.md)
10. Is the augmentation decision recorded with the tree's exit, and does it name what would reverse it? (adr/0002-augmentation.md)
11. Is the pattern the least agentic one that meets the requirement, and does the loop have budget exits and a human gate? (05-agent-spec.md)
12. Does every tool have a schema, an idempotency rule and a risk rating, and does every high-risk tool have an approval? (05-agent-spec.md)
13. Does every call in the integration spec name the identity it runs under, and is it the user's, never the platform's? (06-integration-spec.md)
14. Are the trust boundaries in the integration spec the same boundaries the threat model draws? (06-integration-spec.md, 09-threat-model.md)
15. Does the topology satisfy every residency and retention row in the constraint register, with the vendor term cited and dated? (adr/0003-topology.md, 02-constraints.md)

Prove

16. Is the golden set specified with strata, constructed slices and zero-tolerance rules, and does it include the threat model's injection cases? (07-eval-plan.md, 09-threat-model.md)
17. Is the judge validated against human labels with a pre-registered threshold and the arithmetic shown? (07-eval-plan.md)
18. Does the cost model price every call in the task tree, including retries, judges and the regional uplift, and report the p90? (08-cost-model.md, 05-agent-spec.md)
19. Do the three cost scenarios include a broken-lever case, and is the break-even a formula with dated or badged inputs? (08-cost-model.md)
20. Does the threat model decide the lethal trifecta per leg, and does every control matrix row have an owner and evidence? (09-threat-model.md)
21. Does the go/no-go name one decision, with every condition owned and dated? (go-no-go.md)

Run

22. Is every applicable obligation mapped to a design element and the evidence it produces, with the date it applies and its source? (10-compliance-annex.md)
23. Does the runbook's fallback chain match the model ADR's alternatives, and do the SLOs match the budgets? (11-runbook.md, adr/0001-model.md, 01-nfr-budgets.md)
24. Are the rollout gates the charter's exit evidence turned into measurements, with kill criteria owned by the person who enforces them? (12-rollout-plan.md, 00-charter.md)
25. Is the exit priced: a scored alternative, portable prompts, exportable data and contract clauses? (12-rollout-plan.md, 08-cost-model.md)

Acceptance

• review.md answers all twenty-five questions with a file and section or a "gap" with an owner and a date; no question is blank.
• The drift log lists every cross-file disagreement found, and each entry names the downstream file that was changed and its new version line.
• No two files in the Dossier carry different values for the same budget, tool, identity, date or classification.
• README.md fits on one page, names the decision requested in its first line, and every number on it traces to a Dossier file and is quoted as a lower bound, a p90 or a badged composite as the source file states it.
• The summary has been read by someone who had not read the Dossier, and their three questions (what is decided, what it costs, what could go wrong) were answerable from the page alone; note who and when.
• The review's final section names what the next charter inherits, the next use case the evidence qualifies or kills, and the Dossier's next review date.
• Every file in the table above passes its acceptance test, or the gap is listed in review.md with an owner.

Rubric

Key Takeaways

• Fourteen files written over fifteen lessons drift; the review walks the arrows between them and makes them one document.
• Every review question is answered with a file and a section, or a gap with an owner and a date; blanks are the only failure.
• Drift is resolved downstream: the cost model follows the topology, the rollout plan follows the compliance annex.
• The executive summary quotes the Dossier's lower bounds and p90s; it never restates or rounds them.
• The Dossier ends in the next Frame, not in production.

What You Have Now

The complete Architecture Dossier for your case, reviewed against the course's Well-Architected-style checklist, with a one-page executive summary a buyer could sign. It is the folder this course promised in its first lesson: charter, budgets, constraints, three decision records, specs, diagrams, an eval plan, a cost model, a threat model, a go/no-go, a compliance annex, a runbook, a rollout plan, a review record and the page on top. Hand the folder to an engineering team and they can build from it; hand the page to a buyer and they can sign it; hand the review to the next architect and they can start the next engagement's Frame from its last three lines.

The folder is dossier/ — every file in the acceptance table above lives at dossier/<name> (e.g. dossier/00-charter.md, dossier/05-agent-spec.md, dossier/adr/0003-topology.md, dossier/06-integration-spec.md), with your new review record at dossier/review.md and the executive summary at dossier/README.md; the lab's checker looks for all of them at those paths.

Example Files

A model executive summary for Harbor Mutual, one page. Its numbers are the course's illustrative composite; yours come from your own Dossier.

Illustrative composite. Every figure below is modeled for teaching and matches the composites used across the course; none is a measurement from a real company.

# Claims-correspondence assistant: decision requested

**Decision.** Approve an eight-week pilot with twelve motor-claims adjusters,
budget €68,000, starting 2026-10-05, with the kill criteria below. Production
is a separate decision at the pilot exit gate on 2026-12-01.

**The problem.** Complex first-party property and motor letters take
adjusters far longer than templated ones and carry a citation-error rate
that the quality team audits by hand. Baseline measured 2026-09-15 to
2026-09-26 on the motor team: median 31 minutes per complex letter,
citation errors on 4.1 of every 100 letters. (00-charter.md §3, 01-nfr-budgets.md)

**What the system does.** Drafts the letter from the claim record and the
current policy wording, proposes an adjuster visit to a queue, and hands
both to the adjuster, who signs. It does not send, does not book directly,
and does not face customers. (00-charter.md §4, 05-agent-spec.md)

**Evidence.**
- Quality: clause-citation criterion at a validated lower bound of 0.985
  against a bar of 0.99 on the 300-item golden set, with zero failures in
  the superseded-wording and injected-attachment slices; the remaining gap
  is the pilot's first exit criterion. (07-eval-plan.md)
- Cost: €0.19 per letter at the p90 with caching and routing, €0.41 without;
  twelve-month total €131,000 in the base case, €188,000 in the high case,
  €246,000 if the cache lever fails. Self-hosting does not break even below
  180,000 letters a month. (08-cost-model.md)
- Security: the agent never holds the send capability; attachments are
  untrusted content and cannot reach an external channel without a human;
  three residual medium risks, each with an owner. (09-threat-model.md)
- Compliance: not Annex III high-risk as scoped (no eligibility or pricing
  decision); Article 50 transparency applies to any customer-facing output,
  which is out of scope for phase one; residency satisfied by the EU regional
  endpoint with the vendor's zero-retention term, observed 2026-09-09.
  (10-compliance-annex.md)

**Rollout.** PoC complete. Pilot exit criteria: at least 20% reduction in
median minutes per complex letter against the baseline with audit quality
equal or better; at least 10 of 12 adjusters using it three or more times a
week by week six; zero wrong-clause letters sent. Kill criteria: under 10%
saving at the midpoint, or a wrong-clause letter the review step did not
catch. Oversight: every letter reviewed by its adjuster throughout the pilot;
the booking proposal at exception-only review from day one. (12-rollout-plan.md)

**Risks and owners.** Archive versioning incomplete for pre-2023 wordings
(head of claims, by pilot start). Judge drift on tone criterion (quality
lead, monthly re-validation). Vendor price change (procurement; notice
clause in contract; open-weight alternative scored at 0.93 on the clause
criterion, gap recorded, re-scored quarterly). (09-threat-model.md,
12-rollout-plan.md)

**Exit.** Provider-neutral prompts and gateway in place; golden set, traces
and labels exportable; contract carries no-training and notice clauses. Exit
to the open-weight alternative is available at reduced quality today; the
gap is a number the quarterly re-score watches. (12-rollout-plan.md §exit)

**Signatures.** Sponsor (COO) · Gate owner (head of claims operations) ·
Risk owner (CISO) · Architect

The review record template:

# review.md · Architecture Dossier review · <client> · <date>

## Drift log
| # | Value | File A (value) | File B (value) | Resolved in | New version |
|---|---|---|---|---|---|

## Checklist
| Q | Answer (file § or "gap") | Owner if gap | Date if gap |
|---|---|---|---|

## Next Frame
- What the next charter inherits:
- Next use case qualified or killed by this evidence:
- Next review of this Dossier: