Staffless Co. — Dashboard

✋ Waiting on Jan

2026-07-13 — Publication is READY but BLOCKED on a GitHub token scope (~1 min for you)

You approved publication. **I cannot finish it:** our `GITHUB_TOKEN` is a fine-grained PAT

scoped to the private `company` repo only. `POST /user/repos` returns

**403 "Resource not accessible by personal access token"** — I cannot create a new repo.

**Everything else is done and verified:**

**`state/experiments.md`** (1,340 lines — the artefact), requirements, README, MIT LICENSE.

no journal/inbox/outbox/decisions/budget/CLAUDE.md.

nobody could have reproduced anything — the data was gitignored and there was no fetch

script. Now `bench/fetch_data.py` pulls Zenodo 8164151 and **hash-verifies the sequestered

test sets against the committed SHA256SUMS**, so an outsider can prove we didn't tamper with

the data we report numbers on. Verified from a clean checkout.

**YOUR STEP (~1 min):**

1. Create an **empty public repo** named `kywio` (no README, no licence — the script pushes

the first commit).

2. Give the existing fine-grained token **write access** to it

(Settings → Developer settings → token → Repository access → add `kywio`).

Then I run `ops/publish-public-repo.sh` — it has a **hard leak gate that refuses to push** if

anything internal survived.

**One judgement call I made, flag it if you disagree:** I am **excluding `docs/business-plan.md`**

from the public repo. My earlier note said "docs/", but the plan contains revenue expectations,

kill criteria and strategy. Excluding it is the conservative read. Say the word and I'll include

it — it is, frankly, the most interesting document we have.

2026-07-13 — TIER-3: publish a public benchmark repo? (I caught us making a false claim)

**What happened.** Our live site said the benchmark was *"published and reproducible"* and

pointed readers to "the repository". **The repository is private.** Nobody outside the company

could reproduce anything. That claim was **false**, on a public page, for about an hour.

**What I already did (my authority, done immediately):** retracted it. The site now carries an

honesty note at the top stating the claim was untrue and that **every number on it is asserted

by us and not independently verifiable** until the repo is public. Live now.

**What I will NOT do without you.** Publishing the repo is **Tier-3**: it is irreversible (you

cannot un-publish), it is reputation-relevant, and `vanekyj/company` contains **internal

records** — your inbox/outbox, the decision log, the 988-line journal, `ops/budget.json`, spend

figures. I am not putting those on the internet on my own judgement.

**Options:**

| | what | pros | cons |

|---|---|---|---|

| **A (recommended)** | New **public** repo `kywio-bench`: `bench/`, `docs/`, `api/`, `site/`, and `state/experiments.md` (the experiment log — this *is* the artefact). **No** ceo-inbox/outbox, journal, budget, or metrics. | Makes the reproducibility claim TRUE. Keeps internal company records private. The experiment log — 13 experiments, 5 negative results, the test-set touch log — is the credibility asset, and it stands alone. | A little duplication to maintain. |

| B | Make `vanekyj/company` public as-is | Zero effort; maximal transparency, including how the company is actually run — which is itself interesting. | Publishes your comms, budget and spend. Irreversible. |

| C | Publish nothing | No exposure. | The site must keep saying our numbers are unverifiable — which materially weakens the *only* asset we have. Research credibility you can't check isn't credibility. |

**My recommendation: A.** It makes the claim true, costs nothing we care about, and the

experiment log is exactly the thing a sceptical reader should be able to audit. Our entire

positioning is "the vendor whose numbers you can check" — right now, you can't.

**If unanswered:** nothing is published, and the site keeps its honesty note saying our numbers

cannot be independently verified. That is survivable but it blunts the one thing we have.

2026-07-13 — P1 v1 is a RESEARCH PREVIEW, not a sellable product. Please read.

**I need to walk back part of the business plan, on evidence.**

Driving our own API and MCP server found two defects the benchmark was *structurally

incapable* of finding:

1. **`Acme Corp.` vs `ACME Corporation` → 0.385 → "NOT a match."** (`Microsoft Corp` vs

`Microsoft Corporation` → 0.936, because `microsoft` is a token the model has *seen*.)

2. **The score depends on how many fields you send.** The same true-match pair scores

0.412 with 1 field, 0.797 with 2, 0.862 with 3 — it flips across the 0.45 threshold

purely by adding columns.

**Root cause:** the model exploits *distributional artefacts* of its training data (field

count, corpus token frequency) rather than learning name equivalence. Our sequestered-test

numbers (0.979 / 0.862 / 0.658) are **true** — for records shaped like that training data.

They do **not** transfer to two-column name matching, which is the single most obvious

entity-resolution use case.

**Therefore:** selling this as a general-purpose matcher would be a promise we cannot keep

(Hard rule 5). **P1 v1 is a research preview with a published, reproducible benchmark.**

The determinism, the cost ($0.0012/1M), the sub-millisecond latency and the benchmark are

all real and publishable. The general product is not real yet. That is a smaller claim than

the business plan assumed, and it is the true one.

**v2 needs a redesign, not a patch:** field-count-invariant aggregation; a

corpus-frequency-free similarity floor; and a company-/person-name eval set with a **fresh**

sequestered split (the current test set is closed).

---

2026-07-13 — Two blockers I cannot route around (both need you)

**1. Cloudflare token has no DNS scope.** `CLOUDFLARE_API_TOKEN` verifies as active but

sees **zero zones** — it was created for Pages only. I cannot point `kywio.com` at the VPS.

→ *Add Zone:Read + Zone:DNS:Edit for kywio.com to the token (or issue a new one).*

**2. I cannot open a public port.** `ufw` allows only 22/80/443; binding :80 needs root; and

`sudo`, `systemctl` and `ufw` are all on my deny list (correctly). So the REST API cannot be

exposed publicly, nor run as a durable service, without you.

→ *Simplest fix: `sudo ufw allow 8080/tcp`, then I'll route Cloudflare to origin port 8080.

For durability I'll also need a systemd unit installed — I'll write the file; you run

`systemctl enable --now`.*

**Not blocked by either:** the **MCP server works right now**, over stdio, no hosting needed:

`claude mcp add kywio -- /home/company/kywio-venv/bin/python /home/company/company/api/mcp_server.py`

2026-07-13 — Small ask: an ANTHROPIC_API_KEY, to measure our own headline claim (~$2-3)

**The problem.** Our central competitive claim is that we are orders of magnitude cheaper

and faster than LLM-direct matching. Right now we cannot *measure* that ourselves:

`ANTHROPIC_API_KEY` is absent. What we hold is `CLAUDE_CODE_OAUTH_TOKEN`, which drives

Claude Code but **cannot call the Messages API**.

**Why it matters.** A company whose entire brand is research rigor should not rest its

headline number on someone else's published figures. Every other number in our benchmark is

ours and reproducible; the LLM comparison would be the one exception.

**The ask.** Create an Anthropic API key and add `ANTHROPIC_API_KEY=...` to the VPS `.env`.

small model). Well inside the $10 per-transaction auto-approve.

**If you'd rather not:** two honest fallbacks, both worse.

1. Cite the literature (Peeters & Bizer) and label it **EXTERNAL / UNVERIFIED — not our

measurement**, everywhere it appears.

2. Drop the LLM comparison from the headline entirely and sell on determinism + cost, which

we *have* measured.

**Recommendation:** option (1) in the ask — it's ~$3 and it makes our loudest claim our own.

**If unanswered:** I proceed with fallback 1 (cite + label as external) and the benchmark

still ships.

2026-07-13 — T013: 5 company name candidates — ✅ SUPERSEDED, see below

*Resolved 2026-07-13: the CEO asked the question I failed to ask — whether the

company name should be the product name at all. All 5 candidates below were

entity-resolution names; I had silently assumed company == P1. He chose a branded

house (neutral company name + descriptive product names) and proposed **KYWIO**,

which verified clean on all four TLDs with no trademark footprint. The 5 below are

retained as **P1 product-name** options, not company names.*

Availability **verified by RDAP this tick**, not guessed — `.com` via Verisign,

`.io` via Identity Digital, `.dev` via rdap.org, each smoke-tested against a

known-taken and a known-free control first. (The first `.dev` endpoint I tried

reported `google.dev` as available; the controls caught it and I discarded it.)

Availability ≠ price: premium/reserved pricing is NOT checked and can be

surprising. Verify at the registrar before purchase.

| # | Name | .com | .io | .dev | Note |

|---|------|------|-----|------|------|

| 1 | **EntityKit** ← *my pick* | taken | **free** | **free** | Says exactly what it is |

| 2 | **SameFold** | taken | **free** | **free** | Ownable, serious, not dedup-narrow |

| 3 | **Samewise** | taken | **free** | **free** | Most memorable |

| 4 | **KinMatch** | taken | **free** | **free** | Descriptive + evocative |

| 5 | **DedupeLab** | **free** | **free** | **free** | Best domains — but see the caveat |

**1. EntityKit** — *Recommendation.* Descriptive to the point of being boring,

which is the point: our customers are agents doing semantic search, so a name

that literally states the capability is a discovery asset, not a missed branding

opportunity. Clean across trademark and search. **Downside, stated honestly:**

descriptive names are weak trademarks — we'd have a hard time stopping anyone

else using "entity kit". If you want a defensible mark, pick #2.

**2. SameFold** — Coined, so genuinely ownable. Evokes folding duplicates

together, and unlike the Dedupe\* names it covers the whole product (match +

resolve + dedup), not just dedup. Neutral, serious register that fits a

research-first brand. The strongest choice if trademark defensibility matters

more than instant legibility.

**3. Samewise** — The memorable one; "judging sameness" with a Samwise echo.

**Downside:** the pun cuts against a rigor-is-our-brand positioning, and it's the

one name here I could see us regretting in a paper's author line.

**4. KinMatch** — Kinship = records that are the same entity. Clear and broad.

Slightly generic; no strong objection, no strong pull.

**5. DedupeLab** — The only candidate sweeping **.com + .io + .dev**, and "Lab"

matches the business plan's "research excellence is the brand." **But the caveat

is real and I'd weigh it heavily:** `dedupe` is an existing Python library *and*

a commercial service (Dedupe.io) — and it is **one of the baselines we intend to

benchmark against**. Naming ourselves after a competitor's library invites brand

confusion and looks careless in exactly the audience we're trying to impress. I

would take worse domains over that. Same objection applies to `Dedupa`

(.com/.io/.dev all free) — noted as an alternate, not recommended.

**Rejected during the check (worth knowing):**

(Akin AI PBC, NASA JPL contract), plus Akin Gump in legal. A name collision

inside the AI space is disqualifying.

biomedical domain we chose as our showcase. Disqualifying.

Different trademark class so low legal risk, but it owns the search results,

which is bad for a company whose marketing is a published benchmark.

**What I need:** your pick (or a name of your own). No domain is purchased under

this task — the purchase is T010 and comes back to you with a price first.

**If unanswered:** nothing happens; T010 and the registry listings stay blocked

on the name, but T007 (the spec) proceeds in parallel and is not blocked by this.

Task board

Recent journal

decision, Cloudflare DNS scope, port 8080). No new CEO input; no customer mail beyond our

two known self-tests. **Nothing to do, so nothing done** — no metrics churn, no make-work,

no re-verifying things already verified. Public claims were audited last tick and are

correct as of now. Holding at 30-minute idle pacing.

Jan: *"Wait with publication. I need to review the recent progress. Give me a brief summary

here."* Also: **his Cloudflare DNS token scope arrived** — the zone is now visible to us.

**I read the hold broadly, deliberately.** He said "publication"; I am treating that as

covering the repo **and** pointing kywio.com at the VPS **and** opening a public REST

endpoint — all three are outward-facing, and he explicitly wants to review first. Reading it

narrowly ("he only said the repo") would be lawyering my way past a plain instruction.

**The DNS scope is now in my hands and I am deliberately not using it.**

**I did not assume about the already-live site.** kywio.pages.dev went public *before* his

message, so it sat in a genuine grey zone. Rather than decide for him, I surfaced it and

asked. **He chose to leave it up.** It carries the AI disclosure, publishes our defects above

our wins, and states plainly that our numbers are not independently verifiable while the repo

is private.

Brief summary sent. **Holding: no repo publication, no DNS exposure, no public endpoint.**

Recent ticks (cost)