@rubytech/create-maxy-code 0.1.111 → 0.1.113

package/payload/platform/plugins/venture-studio/bin/scaffold.sh

@@ -2,7 +2,7 @@
 # Venture-studio data-room scaffold — deterministic enforcement of the
 # scaffold-first principle (Task 286 + feedback_doctrine_paragraph_is_not_a_gate).
 #
-# Creates exactly one Project (with eight pre-seeded artefact Tasks) in
+# Creates exactly one Project (with nine pre-seeded artefact Tasks) in
 # the graph, then materialises the ten-section data-room directory tree
 # on disk. The venture-studio agent's downstream skills are gated on
 # both signals existing — see venture-studio/PLUGIN.md.
@@ -53,9 +53,14 @@ fi
 
 DATA_ROOM="${PROJECT_ROOT}/.docs/data-room"
 
-# Eight pre-seeded artefact tasks — order and names match
+# Nine pre-seeded artefact tasks — order and names match
 # premium-plugins/venture-studio/PLUGIN.md § First-conversation routing.
 # Section order is preserved so the agent can walk them sequentially.
+# Prototype-host is slotted between Stage 2 (wedge + landing copy) and
+# Stage 3 (business plan): brand-pack and wedge are hard prerequisites
+# (the skill consumes 06-product-ip/brand/ tokens and 01-narrative/LANDING.md);
+# hosting before business plan keeps the founder's wedge-validation loop
+# (live URL) ahead of investor-pack work.
 PAYLOAD=$(cat <<JSON
 {
   "accountId": "${ACCOUNT_ID}",
@@ -64,8 +69,9 @@ PAYLOAD=$(cat <<JSON
   "tier": "full",
   "workItems": [
     {"name": "Stage 1 — Office-hours design doc", "description": "Produces 01-narrative/office-hours-design.md via the office-hours skill."},
-    {"name": "Brand pack", "description": "Produces brand identity (palette, typography, logo) into 06-product-ip/brand/ via the brand-pack skill."},
     {"name": "Stage 2 — Wedge validation + landing page + PRD", "description": "Produces 01-narrative/{PMF,LANDING,PRD}.md via the zero-to-prototype skill."},
+    {"name": "Brand pack", "description": "Produces brand guidelines + summary + color palette + typography system + tone-of-voice (voice/messaging/copy) + logo guidelines into 06-product-ip/brand/ via the brand-pack skill."},
+    {"name": "Prototype host", "description": "Public URL for the landing page and/or wedge prototype via cloudflared ingress + systemd-managed dev server (skill: prototype-host)."},
     {"name": "Stage 3 — Business plan", "description": "Produces 01-narrative/business-plan.md via investor-data-room Stage 3."},
     {"name": "Stage 3b — Term sheet", "description": "Produces html/prospectus/term_sheet.html via investor-data-room Stage 3b."},
     {"name": "Stage 4 — Deck blueprint", "description": "Produces 01-narrative/deck-blueprint.md via investor-data-room Stage 4."},
@@ -101,4 +107,10 @@ for section in \
   mkdir -p "${DATA_ROOM}/${section}"
 done
 
+# Hosted-prototype source roots live alongside the numbered sections under
+# data-room/. The prototype-host skill populates this with one subdir per
+# surface (landing/, prototype/, etc.); creating the parent here so the
+# directory exists before the first invocation.
+mkdir -p "${DATA_ROOM}/prototype"
+
 echo "scaffold.sh: data-room scaffolded at ${DATA_ROOM}"

package/payload/platform/plugins/venture-studio/skills/brand-pack/SKILL.md

@@ -39,7 +39,7 @@ Before generating anything, gather the following. Ask all questions in a single
 - Website URL (fetch it if provided — extract existing colors, fonts, tone)
 - Inspiration brands (brands they admire aesthetically)
 
-If the user provides a URL, use the fetch tool to read it and extract: dominant colors (check CSS or visual description), font choices, tone of copy, and any existing brand signals. Pre-fill your recommendations based on this research.
+If the user provides a URL — their own site, a competitor brand, or an inspiration brand — dispatch the `research-assistant` specialist (with `deep-research` for site copy + visual scan, `WebFetch` available through the specialist) rather than calling `fetch` or `WebFetch` directly from this skill. The specialist returns: dominant colors (CSS or visual description), font choices, tone of copy, and any existing brand signals. Pre-fill your recommendations from the specialist's structured findings.
 
 ---
 

package/payload/platform/plugins/venture-studio/skills/investor-data-room/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: investor-data-room
-description: Use when a UK-domiciled founder needs to produce a full seed-raise pack from idea to deliverables: graph-structured data room, 15-section business plan, persuasive prospectus + formal term sheet (with FCA self-certification appendices), 12-slide deck blueprint, print-ready HTML+PDF for each. Trigger phrases include "build me a data room", "draft a business plan", "deck from the business plan", "draft an investment prospectus", "generate a term sheet", "from office hours to investor pack", "set up the fundraise repo". The skill never speculates on financial figures or cap-table values: every number traces to a Companies House filing, a financial model worksheet, or a source citation. Public-facing artefacts contain zero internal workings (no "reconciliation pending", no "open Q" markers, no comparison-to-baseline commentary). Design tokens are harmonised across business plan, prospectus, term sheet, and deck via the operator's project design-tokens spec.
+description: Use when a UK-domiciled founder needs to produce a full seed-raise pack from idea to deliverables: graph-structured data room, 16-section business plan, persuasive prospectus + formal term sheet (with FCA self-certification appendices), 13-slide deck blueprint, print-ready HTML+PDF for each. Trigger phrases include "build me a data room", "draft a business plan", "deck from the business plan", "draft an investment prospectus", "generate a term sheet", "from office hours to investor pack", "set up the fundraise repo". The skill never speculates on financial figures or cap-table values: every number traces to a Companies House filing, a financial model worksheet, or a source citation. Public-facing artefacts contain zero internal workings (no "reconciliation pending", no "open Q" markers, no comparison-to-baseline commentary). Design tokens are harmonised across business plan, prospectus, term sheet, and deck via the operator's project design-tokens spec.
 allowed-tools:
   - Bash
   - Read
@@ -25,13 +25,15 @@ Complete when the data room contains:
   README.md                                 # data-room index, status snapshot, doctrine
   01-narrative/
     office-hours-design.md                  # ideation working scratchpad
-    business-plan.md                        # 15-section business plan
-    deck-blueprint.md                       # 12-slide blueprint
+    business-plan.md                        # 16-section business plan
+    deck-blueprint.md                       # 13-slide blueprint
+    exit-thesis.md                          # named acquirers + recent exit comparables
   02-corporate-legal/
     README.md                               # incorporation filings, articles, board minutes
     incorporation-<co-house-no>-<date>.pdf  # IN01 + statement of capital + cap table
   03-cap-table/
     README.md                               # pre/post-investment cap table with PSC notes
+    comparables.md                          # recent comparable rounds (company / pre-money / post-money / multiple / source) cited by the term-sheet valuation
   04-financials/
     README.md
     model_worksheet.md                      # opening cash, capex, burn, MRR ramp, two-round
@@ -78,7 +80,9 @@ Skip stages that are already complete; do not regenerate stale artefacts blindly
 
 ## Stage 1 — Office-hours ideation
 
-Drive a conversational discovery session using the sibling `office-hours` skill. Output a single `office-hours-design.md` capturing:
+Drive a conversational discovery session using the sibling `office-hours` skill. Market sizing and competitor recon during discovery dispatch the `research-assistant` specialist with `deep-research` + `data-research` rather than calling `WebSearch` directly — every market figure that ends up in `08-market/sources.md` must trace to a structured-research citation.
+
+Output a single `office-hours-design.md` capturing:
 
 - Problem statement
 - Demand evidence (with numbers and dates)
@@ -113,22 +117,23 @@ References: `references/data-room-structure.md` for the section-by-section purpo
 
 ## Stage 3 — Business plan synthesis
 
-Generate `01-narrative/business-plan.md` with **15 sections** following the canonical structure:
+Generate `01-narrative/business-plan.md` with **16 sections** following the canonical structure:
 
 1. Executive Summary
 2. Vision and Mission (Vision / Mission / Doctrine triad)
 3. The Company (legal entity table + pre-investment cap table)
-4. The Market (TAM/SAM/SOM + structural tailwind + self-employed wedge + domestic adjacency + international upside + pricing)
+4. The Market (TAM/SAM/SOM bottoms-up with geography-tier floor + CAGR with citation + 3-yr market-expansion thesis + market-share trajectory to 3–8% SAM in 5 yrs + structural tailwind + self-employed wedge + domestic adjacency + international upside + pricing)
 5. The Product (what it is + wedge product + upsell path + substrate moat + conversation ingestion + network + Anthropic asymmetric capture + human-services layer)
-6. The Business Model (revenue streams + unit economics)
+6. The Business Model (revenue streams + unit economics — ACV, CAC, LTV, **LTV:CAC**, gross margin, **burn multiple**, churn — each a named line)
 7. Go-to-Market (Wedge → Beachhead → Blitzscale framework + demand evidence + GTM partners + horse-before-cart logic + geography)
 8. Competition (three failing categories + RANL differentiation + most-direct-competitor counter)
 9. Operations (technology stack + data sovereignty + IP ownership chain + compliance posture summary)
 10. Compliance and regulatory positioning (UK consumer protection + UK data/AI regime + EU AI Act + adjacent UK obligations + moat-not-tax close)
 11. Team (founders + strategic shareholders + hiring plan)
-12. Financial Plan (12.1 opening balance sheet through 12.7 use of funds)
+12. Financial Plan (12.1 opening balance sheet through 12.7 use of funds; valuation per round cites `03-cap-table/comparables.md`)
 13. Risks and Mitigations
 14. Milestones (the N-month thesis)
+14b. Exit thesis (target exit value + 5–8-year horizon + exit routes — strategic / PE / IPO — + 3–5 named acquirers with one-line rationale each)
 15. The bottom line (summary table + close)
 + Appendices (titled documents only; no internal-only file pointers)
 
@@ -140,7 +145,14 @@ Generate `01-narrative/business-plan.md` with **15 sections** following the cano
 - **Financial figures derive from the model worksheet.** Cite "Appendix A" by title.
 - **No em-dashes between alphabetic words** in user-facing prose (recurring style violation in this project's history; see `references/internal-workings-scrub.md`).
 
-Compliance research is mandatory before drafting Section 10. WebSearch (or equivalent) for: DMCC Act (UK consumer protection for estate-agency), ICO ADM framework (Articles 22A–22D under UK GDPR + ICO 2025 strategy), EU AI Act (force date, high-risk classification for property-financing decisions). Cite each.
+**Research routing across Stage 3.** Every figure sourced from the wider world routes through the `research-assistant` specialist — never raw `WebSearch` / `WebFetch` from this skill:
+
+- **Section 4 (Market)** — TAM/SAM/SOM citations, CAGR sourcing, market-share trajectory baselines, competitor rebuttal facts: dispatch `research-assistant` with `data-research`.
+- **Section 10 (Compliance)** — DMCC Act (UK consumer protection for estate-agency), ICO ADM framework (Articles 22A–22D under UK GDPR + ICO 2025 strategy), EU AI Act (force date, high-risk classification for property-financing decisions): dispatch `research-assistant` with `academic-verify` to retrieve the primary regulatory texts. Cite each in the body.
+- **Section 12 (Financial — valuation comparables)** — recent comparable rounds that feed `03-cap-table/comparables.md`: dispatch `research-assistant` with `data-research`.
+- **Section 14b (Exit thesis)** — 3–5 named acquirers (strategic / PE / IPO) with one-line rationale each, plus recent comparable exits (company / acquirer / multiple / year / source) that feed the exit section of `03-cap-table/comparables.md`: dispatch `research-assistant` with `data-research`.
+
+The specialist returns structured findings; the skill quotes those findings verbatim into the relevant section and into `08-market/sources.md` / `03-cap-table/comparables.md`.
 
 References: `references/business-plan-template.md` for the section-by-section template; `references/compliance-research-checklist.md` for the UK + EU regulatory regimes to verify.
 
@@ -172,20 +184,21 @@ References: `references/termsheet-template.md`.
 
 ## Stage 4 — Deck blueprint synthesis
 
-Generate `01-narrative/deck-blueprint.md` as a **12-slide brief** the deck designer can execute. Each slide has Purpose, Headline (one-line message), Body (bullets + figures pulled from the business plan), Visual suggestion, and Source reference. The 12 slides:
+Generate `01-narrative/deck-blueprint.md` as a **13-slide brief** the deck designer can execute. Each slide has Purpose, Headline (one-line message), Body (bullets + figures pulled from the business plan), Visual suggestion, and Source reference. The 13 slides:
 
 1. Cover (raise headline + founders)
 2. Vision (Vision / Mission / Doctrine)
-3. The Market (TAM + tailwind + wedge)
+3. The Market (TAM + tailwind + wedge + **CAGR with citation**)
 4. Business Model (subscription + service layer + unit economics)
 5. Go-to-Market (Wedge → Beachhead → Blitzscale + named partners)
 6. The Product (substrate + wedge + network + asymmetric capture + services layer)
 7. Competition (three failing categories + most-direct counter)
 8. The Team (founders + strategic shareholders)
-9. Economics (P&L summary + cash flow + break-even)
+9. Economics (P&L summary + cash flow + break-even + **LTV:CAC and burn multiple**)
 10. The Raise (size, valuation, dilution, instrument, use of funds, IP transfer, follow-on round)
-11. Milestones (M0 to M-final timeline)
-12. Other Information (compliance + platform dependency + contact)
+11. Exit (target exit value + 5–8-year horizon + routes — strategic / PE / IPO — + 3–5 named acquirers with one-line rationale)
+12. Milestones (M0 to M-final timeline)
+13. Other Information (compliance + platform dependency + contact)
 
 Production notes attached: format (16:9 landscape, PDF + source deck), design tokens reference (the operator's project design-tokens spec, path supplied at Stage 5 invocation), chart-source consistency with the financial model, speaker-note attribution.
 

package/payload/platform/plugins/venture-studio/skills/investor-data-room/references/business-plan-template.md

@@ -1,4 +1,4 @@
-# Business plan template — 15-section structure
+# Business plan template — 16-section structure
 
 The canonical structure used by `01-narrative/business-plan.md`. Every public-facing artefact (deck, prospectus, term sheet) derives from this file. Apply the internal-workings scrub (see `internal-workings-scrub.md`) on every revision.
 
@@ -14,13 +14,13 @@ Three blocks. **Vision.** Where the company ends up at full execution. **Mission
 Legal entity table (legal name, Companies House number, incorporation date, registered office, SIC, PSC status, sole proposed director on IN01) + pre-investment cap table (sourced from the IN01 verbatim) + post-investment dilution pointer.
 
 ### 4. The Market
-Subsections: Size of the addressable market (TAM with citation per figure); Structural tailwind (margin squeeze, regulatory tailwind, or equivalent); Self-employed wedge or analogous high-growth segment; Domestic adjacency (next-vertical expansion); International upside (channel partner enabling it); Pricing and TAM (per-customer ACV × addressable count = TAM number).
+Subsections: Size of the addressable market (TAM with citation per figure, bottoms-up construction; geography-tier floor — **late pre-seed TAM is expected to clear $1B US / $500M UK / $500M EU**, flag if the named geography sits below its floor); Market growth rate (single CAGR figure with citation + a one-line 3-year market-expansion thesis stating why the market gets bigger and why this company captures more share as it does); Market-share trajectory (path to 3-8% of SAM within 5 years, reconciled line-by-line against the ARR target in Section 12); Structural tailwind (margin squeeze, regulatory tailwind, or equivalent); Self-employed wedge or analogous high-growth segment; Domestic adjacency (next-vertical expansion); International upside (channel partner enabling it); Pricing and TAM (per-customer ACV × addressable count = TAM number).
 
 ### 5. The Product
 Subsections: What it is (substrate description, CRM-agnostic / data-sovereign positioning); The wedge product (narrowest unit of value, public-by-default if applicable); The upsell path (wedge → high-value output → full substrate); The substrate moat (operator-data + ontological graph + flywheel); Conversation ingestion (or equivalent lock-in mechanic); The network (federation thesis); Asymmetric-capture position (the LLM-binary wrap argument, with commercial-practice insurance); Human-services layer (training, support, white-glove, anti-fragile-against-frontier-AI).
 
 ### 6. The Business Model
-Revenue streams (subscription tiers + future network-effect revenue), unit economics (ACV, CAC, gross margin, churn placeholder), compute-mark-up doctrine ("never mark up the LLM compute; customer pays the LLM provider directly").
+Revenue streams (subscription tiers + future network-effect revenue). Unit economics — each metric is a named line: **ACV**, **CAC**, **LTV**, **LTV:CAC ratio** (target ≥ 3:1 by Month 12), **gross margin** (target ≥ 70% steady-state), **burn multiple** (net burn ÷ net new ARR; target ≤ 2× during wedge, ≤ 1× post-PMF), **churn** (logo + revenue). Compute-mark-up doctrine ("never mark up the LLM compute; customer pays the LLM provider directly").
 
 ### 7. Go-to-Market
 Wedge → Beachhead → Blitzscale framework (with months and funding source per phase), demand evidence (40+ EOIs, paid intents, founder dogfood, partnership status — every number cited), GTM partners (one row per named partner with role and source), horse-before-cart logic (public-first wedge that earns trust for the private high-value upsell), geography.
@@ -38,7 +38,7 @@ Three regulatory regimes: UK consumer protection (DMCC Act for estate agency / e
 Founders (foregrounded) with role + concise career summary + key credentials + pre-investment shareholding. Strategic shareholders from incorporation (advisors, family, JV partners on the cap table from day one). Hiring plan table with month-triggered roles + salary + trigger condition.
 
 ### 12. Financial Plan
-12.1 Opening balance sheet (M0 after capex). 12.2 Year-1 Income Statement (revenue + COGS + every opex line + depreciation + EBIT + corp tax + net loss). 12.3 Year-1 cash flow summary table (period-by-period opening, net flow, closing cash). 12.4 Closing balance sheet (M12). 12.5 Two-round funding strategy (timing, size, pre-money, purpose, gating evidence per round). 12.6 Contingency levers. 12.7 Use of funds (this round) by bucket.
+12.1 Opening balance sheet (M0 after capex). 12.2 Year-1 Income Statement (revenue + COGS + every opex line + depreciation + EBIT + corp tax + net loss). 12.3 Year-1 cash flow summary table (period-by-period opening, net flow, closing cash). 12.4 Closing balance sheet (M12). 12.5 Two-round funding strategy (timing, size, pre-money, purpose, gating evidence per round) — **valuation per round cites `03-cap-table/comparables.md`** (recent comparable rounds: company / pre-money / post-money / multiple / source). 12.6 Contingency levers. 12.7 Use of funds (this round) by bucket.
 
 ### 13. Risks and Mitigations
 Two-column table: risk + mitigation. Cover Loop / Anthropic / competitor-ships-earlier / wedge-fails-to-convert / founder-transition / counsel-delays / Round-2-market / investor-structure.
@@ -46,6 +46,9 @@ Two-column table: risk + mitigation. Cover Loop / Anthropic / competitor-ships-e
 ### 14. Milestones (the N-month thesis)
 Month-by-month table: M0 close + closing conditions; M1 first paying customer; M3 product-engineer hire + ~10 customers; M6 wedge phase complete; M7 Round 2 raise opens; M9 Round 2 closes; M12 break-even.
 
+### 14b. Exit thesis
+Target exit value (£m), horizon (5–8 years), exit routes considered (strategic acquisition, PE rollup, IPO) with a one-line view on which route is most likely and why. **3–5 named acquirers**, each with a one-line rationale (why they would buy: distribution gap, technology gap, defensive play, vertical entry). Sourced from `08-market/sources.md` and `03-cap-table/comparables.md` (recent exit comparables: company / acquirer / multiple / year / source). Body references "Appendix B" by title.
+
 ### 15. The bottom line
 Summary table of headline numbers (raise size, pre-money, post-money, dilution, runway, Y1 revenue/loss/cash-burn/closing-cash/ARR, break-even month, Round 2 timing/size). Closing paragraph.
 

package/payload/platform/plugins/venture-studio/skills/investor-data-room/references/data-room-structure.md

@@ -9,8 +9,9 @@ Standard ten numbered sections plus root README, internal-narrative subdirectory
 
 **Currently present.**
 - `office-hours-design.md` — APPROVED office-hours output (internal).
-- `business-plan.md` — 15-section public business plan.
-- `deck-blueprint.md` — 12-slide brief.
+- `business-plan.md` — 16-section public business plan.
+- `deck-blueprint.md` — 13-slide brief.
+- `exit-thesis.md` — target exit value, 5–8-year horizon, exit routes (strategic / PE / IPO), 3–5 named acquirers with one-line rationale each.
 
 ### 02-corporate-legal
 **Purpose.** Statutory documentation. First section any investor's lawyer asks for.
@@ -20,12 +21,12 @@ Standard ten numbered sections plus root README, internal-narrative subdirectory
 ### 03-cap-table
 **Purpose.** Who owns what, before and after the round. Most-scrutinised number in seed-stage diligence.
 
-**Standard contents.** Pre-investment cap table (per IN01), post-investment cap table (with dilution math), fully-diluted including option pool, founder vesting schedule (if any), share register, subscription letters.
+**Standard contents.** Pre-investment cap table (per IN01), post-investment cap table (with dilution math), fully-diluted including option pool, founder vesting schedule (if any), share register, subscription letters, `comparables.md` (recent comparable rounds — company / pre-money / post-money / multiple / source — that the term sheet's valuation cites).
 
 ### 04-financials
 **Purpose.** The investability of the raise: runway, burn, revenue ramp, break-even, contingency.
 
-**Standard contents.** `model_worksheet.md` (opening cash, capex, monthly burn, MRR ramp, two-round funding strategy, contingency levers), historical accounts (if any), bank statements, unit economics, VAT status.
+**Standard contents.** `model_worksheet.md` (opening cash, capex, monthly burn, MRR ramp, two-round funding strategy, contingency levers), historical accounts (if any), bank statements, unit economics (must include **LTV:CAC ratio** and **burn multiple** as named lines alongside ACV / CAC / LTV / gross margin / churn), VAT status.
 
 ### 05-commercial
 **Purpose.** Customer pipeline, demand evidence, GTM partners, route-to-revenue.
@@ -45,7 +46,7 @@ Standard ten numbered sections plus root README, internal-narrative subdirectory
 ### 08-market
 **Purpose.** Size of the prize, shape of demand, competitive landscape. Every market figure in the business plan must trace to a row in this section.
 
-**Standard contents.** `sources.md` (every figure with citation), `competitor-value-claims-rebuttal.md` (vendor-by-vendor rebuttal framework), TAM/SAM/SOM file, customer-segmentation analysis, regulatory landscape, international-expansion potential.
+**Standard contents.** `sources.md` (every figure with citation), `competitor-value-claims-rebuttal.md` (vendor-by-vendor rebuttal framework), TAM/SAM/SOM file (bottoms-up; **geography-tier floor** — late pre-seed TAM is expected to clear $1B US / $500M UK / $500M EU; flag any named geography that sits below its floor), `market-growth-rate.md` (single CAGR figure with citation + one-line 3-year market-expansion thesis), `market-share-trajectory.md` (path to 3–8% SAM within 5 years, reconciled to the ARR target in the business plan), customer-segmentation analysis, regulatory landscape, international-expansion potential.
 
 ### 09-operations
 **Purpose.** Day-to-day regulatory, compliance, and operational infrastructure.
@@ -57,6 +58,16 @@ Standard ten numbered sections plus root README, internal-narrative subdirectory
 
 **Standard contents.** Press kit, pitch deck (live presentation version), demo recording, reference contacts, advisor letters, awards, published thought leadership.
 
+### prototype/ (sibling of the ten numbered sections)
+**Purpose.** Running code: landing page source, wedge prototype source, dev-server logs. This is the only top-level under `.docs/data-room/` that ships an executable surface rather than narrative or diligence artefacts. Lives outside the numbered investor sections because investors read the rendered URL, not the source tree.
+
+**Standard contents.** One subdirectory per hosted surface (e.g. `landing/`, `prototype/`, `prototype-v2/`), each containing:
+- Framework scaffold (e.g. Vite `package.json`, `src/`, `index.html`) or a single static `index.html`.
+- `.port` — the local port the dev server / file server binds to (allocated by `prototype-host` skill from the 4100–4199 range).
+- Framework dotfiles (`.gitignore`, `vite.config.ts`, etc.).
+
+**Lifecycle.** Created by `bin/scaffold.sh` (empty directory) when the data room is first scaffolded. Populated by the `prototype-host` skill when the founder runs "host the landing" or "host the prototype". Multiple surfaces can coexist — port allocation, cloudflared ingress rules, and systemd unit names are all namespaced by surface name.
+
 ## Top-level README.md doubles as data-room index
 
 Three things at the root:

package/payload/platform/plugins/venture-studio/skills/investor-data-room/references/deck-blueprint-template.md

@@ -1,23 +1,24 @@
-# Deck blueprint template — 12 slides
+# Deck blueprint template — 13 slides
 
 Each slide is specified by Purpose, Headline (one-line message), Body (bullets + figures pulled from the business plan), Visual suggestion, and Source reference. The deck is the presentation surface; the business plan is the source of truth.
 
-## 12-slide layout
+## 13-slide layout
 
 | # | Slide | What it lands |
 |---|---|---|
 | 1 | Cover | Company name, raise headline, three foregrounded founders, Companies House identifier. |
 | 2 | Vision | Vision / Mission / Doctrine triad. |
-| 3 | The Market | TAM with citation, structural tailwind (margin-squeeze / regulatory / equivalent), self-employed or analogous wedge, domestic adjacency, international upside, pricing band. |
+| 3 | The Market | TAM with citation, structural tailwind (margin-squeeze / regulatory / equivalent), self-employed or analogous wedge, domestic adjacency, international upside, pricing band, **CAGR with citation**. |
 | 4 | Business Model | Subscription tiers + hardware + service layer + future network-effect revenue + unit economics + compute-no-markup doctrine. |
 | 5 | Go-to-Market | Wedge → Beachhead → Blitzscale framework, demand evidence numbers, named GTM partners, horse-before-cart logic. |
 | 6 | The Product | Substrate description, wedge, upsell path, substrate moat, conversation ingestion, network, asymmetric capture, services layer. |
 | 7 | Competition | Three failing categories + most-direct-competitor counter (CRM-agnostic vs migration-required). |
 | 8 | The Team | Founders + strategic shareholders, with one-line credential per person and shareholding %. |
-| 9 | Economics | Y1 revenue, P&L loss, cash burn, M11 cash low, M12 closing cash, closing ARR, break-even month. Two-panel chart: MRR ramp with burn overlay + monthly cash balance. |
+| 9 | Economics | Y1 revenue, P&L loss, cash burn, M11 cash low, M12 closing cash, closing ARR, break-even month, **LTV:CAC and burn multiple**. Two-panel chart: MRR ramp with burn overlay + monthly cash balance. |
 | 10 | The Raise | Size, pre-money, post-money, dilution, instrument, use of funds, IP transfer at close, Round 2 size + timing, pre-emption. Pie chart of post-investment cap table. |
-| 11 | Milestones | M0 to M-final timeline with MRR curve and Round-1 / Round-2 close markers. |
-| 12 | Other Information | Compliance (DMCC + UK ICO + EU AI Act), platform-dependency disclosure with the commercial-practice-insurance answer, contact card (founders + email + web). |
+| 11 | Exit | Target exit value, 5–8-year horizon, exit routes (strategic / PE / IPO), 3–5 named acquirers with one-line rationale each. Sourced from `01-narrative/exit-thesis.md`. |
+| 12 | Milestones | M0 to M-final timeline with MRR curve and Round-1 / Round-2 close markers. |
+| 13 | Other Information | Compliance (DMCC + UK ICO + EU AI Act), platform-dependency disclosure with the commercial-practice-insurance answer, contact card (founders + email + web). |
 
 ## Production notes attached to the blueprint
 

package/payload/platform/plugins/venture-studio/skills/office-hours/SKILL.md

@@ -32,14 +32,13 @@ You are a **YC office hours partner**. Your job is to ensure the problem is unde
 
 ## Phase 1: Context Gathering
 
-Understand the project and the area the user wants to change.
+Understand the operator's business and the area they want to change.
 
-1. Read `CLAUDE.md`, `TODOS.md` (if they exist).
-2. Run `git log --oneline -30` and `git diff origin/main --stat 2>/dev/null` to understand recent context.
-3. Use Grep/Glob to map the codebase areas most relevant to the user's request.
-4. **List any prior office-hours design docs on disk** under the operator's project (e.g. the data-room `01-narrative/` directory when invoked from `venture-studio`, or the operator-supplied path otherwise). If prior designs exist, list them: "Prior designs for this project: [titles + dates]"
+1. Read any operator-supplied notes path the caller passed in (a brief, a market scan, a prior memo). If no path was passed, skip.
+2. **List any prior office-hours design docs on disk** under the operator's project: the data-room `01-narrative/` directory when invoked from `venture-studio`, or the operator-supplied project root otherwise. If prior designs exist, list them: "Prior designs for this project: [titles + dates]"
+3. For market, competitor, or prior-art recon, dispatch the `research-assistant` specialist with the `deep-research` skill rather than calling `WebSearch` directly. The specialist returns structured findings the design doc can cite.
 
-5. **Ask: what's your goal with this?** This is a real question, not a formality. The answer determines everything about how the session runs.
+4. **Ask: what's your goal with this?** This is a real question, not a formality. The answer determines everything about how the session runs.
 
    Via AskUserQuestion, ask:
 
@@ -56,7 +55,7 @@ Understand the project and the area the user wants to change.
    - Startup, intrapreneurship → **Startup mode** (Phase 2A)
    - Hackathon, open source, research, learning, having fun → **Builder mode** (Phase 2B)
 
-6. **Assess product stage** (only for startup/intrapreneurship modes):
+5. **Assess product stage** (only for startup/intrapreneurship modes):
    - Pre-product (idea stage, no users yet)
    - Has users (people using it, not yet paying)
    - Has paying customers
@@ -275,7 +274,7 @@ If no matches found, proceed silently.
 
 ## Phase 2.75: Landscape Awareness
 
-Read ETHOS.md for the full Search Before Building framework (three layers, eureka moments). The preamble's Search Before Building section has the ETHOS.md path.
+**Search Before Building — three layers, eureka moments.** Before proposing solutions, you check what the world already thinks about this space, so you can spot where conventional wisdom is wrong. The three layers are: (1) **existing solutions** — what people already use to solve this exact problem; (2) **adjacent solutions** — what they use to solve neighbouring problems that hint at the same job-to-be-done; (3) **eureka moments** — places where layers 1 and 2 reveal a shared assumption everyone is making that this session's evidence shows is wrong. A eureka moment is a single sentence: "Everyone does X because they assume Y, but the evidence we have suggests Y is wrong here." Layer 3 is the only layer that justifies building something different.
 
 After understanding the problem through questioning, search for what the world thinks. This is NOT competitive research (that's /design-consultation's job). This is understanding conventional wisdom so you can evaluate where it's wrong.
 
@@ -302,7 +301,7 @@ Read the top 2-3 results. Run the three-layer synthesis:
 - **[Layer 2]** What are the search results and current discourse saying?
 - **[Layer 3]** Given what WE learned in Phase 2A/2B — is there a reason the conventional approach is wrong?
 
-**Eureka check:** If Layer 3 reasoning reveals a genuine insight, name it: "EUREKA: Everyone does X because they assume [assumption]. But [evidence from our conversation] suggests that's wrong here. This means [implication]." Log the eureka moment (see preamble).
+**Eureka check:** If Layer 3 reasoning reveals a genuine insight, name it: "EUREKA: Everyone does X because they assume [assumption]. But [evidence from our conversation] suggests that's wrong here. This means [implication]." Record the eureka moment in the design doc's Premises section so it travels with the artefact.
 
 If no eureka moment exists, say: "The conventional wisdom seems sound here. Let's build on it." Proceed to Phase 3.
 

package/payload/platform/plugins/venture-studio/skills/prototype-host/SKILL.md

@@ -0,0 +1,179 @@
+---
+name: prototype-host
+description: Use when the operator asks to "host the landing", "host the prototype", "deploy this", "give me a public URL", or any variant that means "make the landing page or wedge prototype reachable on a real URL the founder can send to a customer". Scaffolds a source tree, allocates a local port, edits the brand's cloudflared ingress, creates a DNS row, runs the dev server (or static file-server) under a systemd-user unit, and verifies HTTP 200 from outside the box. Idempotent: re-run for the same surface restarts cleanly without duplicating ports, ingress rows, or units.
+---
+
+# prototype-host
+
+## Outcome
+
+A founder asks "host the landing" or "host the prototype" and ends the turn with a working public URL — `https://<surface>.<brand-hostname>` — that returns HTTP 200, backed by a dev server (or static file server) supervised by systemd so it survives reboot. No CI, no Vercel, no Pages — the install device itself serves the prototype through the brand's existing cloudflared tunnel.
+
+The skill is a composition of primitives that already exist on every Maxy Code install: cloudflared multi-hostname ingress (see [`cloudflared/references/manual-setup.md`](../../../../platform/plugins/cloudflare/references/manual-setup.md)), `systemctl --user` unit files for per-process supervision, and the agent's Bash + Read + Write + Edit tools for source scaffolding. The skill's job is to compose them deterministically so the founder never has to.
+
+## Inputs
+
+The agent gathers these before invoking any of the six phases. Defaults below; use `AskUserQuestion` only when the operator's intent is ambiguous about surface name or framework.
+
+| Input | Default | Notes |
+|---|---|---|
+| `surface` | `landing` for "host the landing"; `prototype` for "host the prototype"; otherwise ask | The DNS label; becomes `<surface>.<brand-hostname>`. Lowercase, kebab-case, must be a valid DNS label (`^[a-z0-9-]+$`, max 63 chars). |
+| `framework` | `static` for `landing`; `vite` for `prototype` | One of `static`, `vite`, `next`, `sveltekit`, `astro`. See [`references/scaffold-frameworks.md`](references/scaffold-frameworks.md). |
+| `surface-dir` | `${PROJECT_ROOT}/.docs/data-room/prototype/<surface>/` | Source tree root. |
+
+Two environment values the skill derives, never asks for:
+
+- `BRAND` — from `jq -r '.hostname' <PROJECT_ROOT>/platform/config/brand.json` (same idiom every other skill uses).
+- `BRAND_HOSTNAME` — the cloudflared root domain for this install: `jq -r '.cloudflareRootDomain // .hostname' <PROJECT_ROOT>/platform/config/brand.json`. If the field is empty, abort with literal stderr `[prototype-host] FATAL brand-hostname-unresolved — set cloudflareRootDomain in brand.json`.
+
+## Hard prerequisite — brand-pack must have run
+
+Before phase 1, check `[ -d "${PROJECT_ROOT}/.docs/data-room/06-product-ip/brand" ]` and `[ -n "$(ls -A "${PROJECT_ROOT}/.docs/data-room/06-product-ip/brand" 2>/dev/null)" ]`. If either fails, abort:
+
+```
+[prototype-host] FATAL brand-pack-missing — run brand-pack first; hosted surfaces consume 06-product-ip/brand/{color-palette,typography-system,tone-of-voice}.md
+```
+
+This is doctrinal — hosting a brandless landing ships a surface that either confounds conversion data or forces a re-render after brand-pack. The check is exit-code, not LLM judgement.
+
+## Phases
+
+Every phase emits exactly one structured stdout line on success:
+
+```
+[prototype-host] phase=<n> surface=<surface> framework=<framework> port=<port> ingress=<state> dns=<state> service=<unit> status=<systemd-state> http=<code>
+```
+
+Any phase that cannot produce its key/value pair fails by emitting literal stderr (no narration, no retry, no menu-phrasings — [[feedback_no_stdout_parsing_for_control_flow]]) and exits non-zero. The agent surfaces the stderr verbatim to the operator.
+
+### Phase 1 — Surface intake (idempotency check)
+
+If `<surface-dir>/.port` exists, this is a re-run. Read the port from `.port`, skip directly to phase 5 (systemd restart) then phase 6 (verify). Log:
+
+```
+[prototype-host] phase=1 surface=<surface> idempotent=true port=<port>
+```
+
+Otherwise proceed to phase 2.
+
+### Phase 2 — Scaffold source
+
+Run the framework's canonical scaffolder into `<surface-dir>/`. The exact commands per framework live in [`references/scaffold-frameworks.md`](references/scaffold-frameworks.md). Static `landing` is a special case: write `<surface-dir>/index.html` directly from `01-narrative/LANDING.md` using the brand tokens.
+
+Brand application (every framework):
+
+1. Read `06-product-ip/brand/color-palette.md` — extract the CSS custom properties (the file ships a `:root { --color-*: ... }` block).
+2. Read `06-product-ip/brand/typography-system.md` — extract the font-family + scale tokens.
+3. For `static`: inline both into the `<head>` of `<surface-dir>/index.html`.
+4. For framework scaffolds: write the tokens into the framework's global stylesheet entry point (`src/index.css` for Vite/Astro, `app/globals.css` for Next, `src/app.css` for SvelteKit).
+5. For the landing's hero + CTA copy: read `06-product-ip/brand/tone-of-voice.md` and apply it when rewriting `01-narrative/LANDING.md` into HTML.
+
+### Phase 3 — Port allocation
+
+First unbound port in 4100–4199:
+
+```bash
+for p in $(seq 4100 4199); do
+  ss -tln 2>/dev/null | awk '{print $4}' | grep -qE ":${p}$" || { echo "$p"; break; }
+done
+```
+
+Write to `<surface-dir>/.port`. If the range is exhausted, abort:
+
+```
+[prototype-host] FATAL port-range-exhausted range=4100-4199 — free a port or extend the range
+```
+
+The range is a skill constant (not a `brand.json` field) because it sits below every documented admin/chat/VNC band and above the OS ephemeral range default. Extending the range is a follow-up task, not a per-install knob.
+
+### Phase 4 — Cloudflared ingress edit
+
+Per [`references/cloudflared-ingress-edit.md`](references/cloudflared-ingress-edit.md):
+
+1. Append a hostname rule for `<surface>.<BRAND_HOSTNAME>` → `http://localhost:<port>` immediately before the final `http_status:404` catch-all in `${CFG_DIR}/config.yml`. The reference doc carries the exact `awk` insert pattern (sed cannot safely insert before the last line of a multi-line YAML rule).
+2. Validate: `cloudflared --origincert "${CFG_DIR}/cert.pem" --config "${CFG_DIR}/config.yml" tunnel ingress validate`. Non-zero exit aborts with the literal cloudflared error.
+3. Create DNS row: `cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel route dns --overwrite-dns "${TUNNEL_ID}" <surface>.<BRAND_HOSTNAME>`. `TUNNEL_ID` comes from `${CFG_DIR}/tunnel.state` (the Step 5b file every install writes).
+4. Reload cloudflared: `systemctl --user restart ${BRAND}-cloudflared.service`.
+
+Idempotency: before appending, grep `${CFG_DIR}/config.yml` for `<surface>.<BRAND_HOSTNAME>`. If present, skip the append + DNS route + reload — the row already exists; this is a re-run after a failed phase 5 or 6.
+
+### Phase 5 — Systemd user unit
+
+Per [`references/systemd-user-service.md`](references/systemd-user-service.md), write `${HOME}/.config/systemd/user/${BRAND}-prototype-<surface>.service`. Two modes:
+
+- **Dev-server mode** (frameworks with hot-reload — Vite, Next dev, SvelteKit dev, Astro dev): `ExecStart=` runs the framework's dev command bound to `<port>` via `PORT=` or `--port`.
+- **Static file-server mode** (the `static` framework): run `npm run build` first (no-op for raw HTML), then `ExecStart=cloudflared file-server --port <port> <surface-dir>` (or `<surface-dir>/dist` for built output). No Node process for raw static landings.
+
+Then:
+
+```bash
+systemctl --user daemon-reload
+systemctl --user enable --now "${BRAND}-prototype-<surface>.service"
+```
+
+Check `systemctl --user is-active "${BRAND}-prototype-<surface>.service"` returns `active`. If not, dump the last 50 lines of `journalctl --user -u ${BRAND}-prototype-<surface>.service -n 50 --no-pager` to stderr and abort.
+
+### Phase 6 — External verification
+
+```bash
+curl -I -m 15 "https://<surface>.<BRAND_HOSTNAME>"
+```
+
+The skill emits the full HTTP response line (e.g. `HTTP/2 200`) to chat. Anything other than `200` aborts with the full curl output as literal stderr — same setup-done contract Task 288 established for cloudflare setup. This is end-to-end proof because the chat itself runs through the same tunnel: if the cloudflared connector were dead, the agent would never have answered the operator.
+
+Final success line:
+
+```
+[prototype-host] DONE surface=<surface> url=https://<surface>.<BRAND_HOSTNAME> port=<port> service=${BRAND}-prototype-<surface>.service http=200
+```
+
+## Idempotency contract
+
+Re-running the skill with the same `<surface>` is a first-class flow, not an error:
+
+| State on re-run | Behaviour |
+|---|---|
+| `<surface-dir>/.port` exists, ingress row exists, service active | Restart the systemd unit; re-verify; emit `idempotent=true` |
+| `.port` exists, ingress row missing | Re-run phase 4 (append, validate, route, reload); restart unit; verify |
+| `.port` exists, service failed | Restart unit; if still failing, dump journal and abort |
+| Nothing exists | Fresh six-phase run |
+
+The skill never allocates a second port for the same surface, never appends a duplicate ingress row, never creates a second systemd unit with a different name.
+
+## Failure surfaces
+
+Likely failure points and the literal stderr the agent should expect:
+
+- **Port range exhausted** — `[prototype-host] FATAL port-range-exhausted range=4100-4199`
+- **Ingress validate fails** — cloudflared's own multi-line YAML error, verbatim
+- **DNS route fails** — cloudflared's stderr (typically a 1xxx error code from the API)
+- **Systemd unit fails to start** — last 50 lines of journalctl, verbatim
+- **Curl returns non-200** — full `curl -I` output, verbatim
+
+Diagnostic commands the agent should suggest on failure:
+
+```bash
+cat ${CFG_DIR}/config.yml
+cloudflared --origincert "${CFG_DIR}/cert.pem" --config ${CFG_DIR}/config.yml tunnel ingress validate
+systemctl --user status ${BRAND}-prototype-<surface>.service
+journalctl --user -u ${BRAND}-prototype-<surface>.service -n 200 --no-pager
+ss -tln | grep :<port>
+dig <surface>.<BRAND_HOSTNAME>
+```
+
+## Out of scope
+
+- Production hosting (Cloudflare Pages, Vercel, Netlify, Workers). The dev server on the install device covers the founder workflow; production deploy is a separate, later task.
+- TLS / cert handling beyond cloudflared's own.
+- Per-prototype auth gating — the public landing is public; access control is a separate skill.
+- `brand.json` schema changes. Port range is a skill constant.
+- `paths.ts` reads.
+- Multi-tunnel — one tunnel per install with multiple ingress rules is the existing pattern.
+- CI/CD or git-push deploy.
+- Pre-built framework templates beyond the framework's official `create-*` scaffolders.
+- Telemetry on the public URL — the founder wires their own (Plausible, GA, server logs).
+- A `prototype-host-remove` companion skill. For now: `systemctl --user disable --now ${BRAND}-prototype-<surface>.service` + manually strip the ingress row + delete the DNS record. Removal is a follow-up task if it becomes friction.
+
+## Multi-prototype is supported by construction
+
+Port allocation scans first-free; ingress rules are additive; systemd unit names are namespaced by `<surface>`. Running `landing` + `prototype` + `prototype-v2` simultaneously on the same install requires no special handling — invoke the skill three times with three different surface names.

package/payload/platform/plugins/venture-studio/skills/prototype-host/references/cloudflared-ingress-edit.md

@@ -0,0 +1,81 @@
+# Cloudflared ingress edit — append a hostname rule before the catch-all
+
+This is the canonical pattern for adding a new hostname → local port mapping to an existing brand cloudflared `config.yml`. Sourced from the multi-hostname ingress block documented at [`platform/plugins/cloudflare/references/manual-setup.md`](../../../../../platform/plugins/cloudflare/references/manual-setup.md) under the "Multi-ingress: adding hostnames for prototype services" section.
+
+## The config.yml shape
+
+A working brand `config.yml` always looks like:
+
+```yaml
+tunnel: <TUNNEL_ID>
+credentials-file: <CFG_DIR>/<TUNNEL_ID>.json
+ingress:
+  - hostname: admin.<BRAND_HOSTNAME>
+    service: http://localhost:<PORT>
+  - hostname: public.<BRAND_HOSTNAME>
+    service: http://localhost:<PORT>
+  - service: http_status:404
+```
+
+A new prototype rule must land **before** the `http_status:404` catch-all; otherwise cloudflared matches the catch-all first and the prototype hostname returns 404.
+
+## The append pattern
+
+`sed` cannot safely insert before the last block of a multi-line YAML rule (`- service: http_status:404` is one logical entry but the line above it might be a comment or blank). `awk` is the right primitive: scan for the literal `- service: http_status:404` line and insert two lines before it.
+
+```bash
+SURFACE="<surface>"            # e.g. landing
+PORT="<port>"                  # from <surface-dir>/.port
+HOSTNAME="${SURFACE}.${BRAND_HOSTNAME}"
+
+# Idempotency guard — skip if the hostname already appears as an ingress rule.
+if grep -qE "^[[:space:]]*-[[:space:]]+hostname:[[:space:]]+${HOSTNAME}\b" "${CFG_DIR}/config.yml"; then
+  echo "[prototype-host] ingress-row-exists hostname=${HOSTNAME} — skipping append"
+else
+  awk -v host="${HOSTNAME}" -v port="${PORT}" '
+    /^[[:space:]]*-[[:space:]]+service:[[:space:]]+http_status:404[[:space:]]*$/ {
+      print "  - hostname: " host
+      print "    service: http://localhost:" port
+    }
+    { print }
+  ' "${CFG_DIR}/config.yml" > "${CFG_DIR}/config.yml.new"
+  mv "${CFG_DIR}/config.yml.new" "${CFG_DIR}/config.yml"
+fi
+```
+
+## Validate, route, reload
+
+```bash
+# 1. Validate the YAML and ingress semantics.
+cloudflared --origincert "${CFG_DIR}/cert.pem" \
+  --config "${CFG_DIR}/config.yml" \
+  tunnel ingress validate
+
+# 2. Create the DNS row (CNAME from <hostname> to <TUNNEL_ID>.cfargotunnel.com).
+TUNNEL_ID=$(jq -r '.id // .tunnelId' "${CFG_DIR}/tunnel.state")
+cloudflared --origincert "${CFG_DIR}/cert.pem" \
+  tunnel route dns --overwrite-dns "${TUNNEL_ID}" "${HOSTNAME}"
+
+# 3. Reload the connector so it picks up the new ingress rule.
+systemctl --user restart "${BRAND}-cloudflared.service"
+```
+
+Each step is its own command, runs sequentially, exits non-zero on failure. The skill propagates the failing command's stderr verbatim — no parsing, no narration ([[feedback_no_stdout_parsing_for_control_flow]]).
+
+## What `--overwrite-dns` does
+
+If a CNAME for `<hostname>` already exists in the account's DNS (e.g. from a prior install), `tunnel route dns` errors with `record already exists`. `--overwrite-dns` replaces the existing record with one pointing at this tunnel. Use it unconditionally — the alternative (probe-then-create) doubles the API surface and races with concurrent DNS edits.
+
+## Why restart, not reload
+
+`cloudflared` watches `config.yml` only when launched with `--config-watch` (off by default in the brand service unit). `systemctl --user restart` is the deterministic way to pick up the new rule. Brief connection blip (~1s) is acceptable because the brand's admin + public hostnames already tolerate the same blip on every cloudflared upgrade.
+
+## Failure points
+
+| Symptom | Root cause | Fix |
+|---|---|---|
+| `validate: ingress rule N has no service` | `awk` inserted only the hostname line, not the service line | Re-run; the snippet emits both lines atomically per match |
+| `validate: failed to parse YAML` | A previous `awk` run left a partial line | `cat ${CFG_DIR}/config.yml` and hand-fix; the skill cannot recover from corrupt YAML |
+| `route dns: 1004 invalid hostname` | `<surface>` violates DNS label rules (uppercase, underscore, leading dash) | Re-run with a valid `<surface>`; the skill validates `^[a-z0-9-]+$` before phase 4 |
+| `route dns: 9103 unauthorized` | The cert.pem in `${CFG_DIR}` doesn't grant DNS-edit on the zone | Re-run Step 1 of the cloudflare runbook to refresh `cert.pem` |
+| Restart succeeds but `curl -I` returns 502 | The dev server isn't actually listening on `<port>` | Phase 5 (systemd) failed earlier; the skill should have caught it. Read `journalctl --user -u ${BRAND}-prototype-<surface>.service -n 50` |