⚡ Valent Kickoff Prep Kit

Attendees: Tony (VTKL, intro), Charlie (VTKL, CTO), Joana (VTKL, lead & client touchpoint), Victor (VTKL, background) | Hector, Nick, RJ, Matt (Valent) | Charlie, Tony (TBD)

Facilitator notes: Keep Hector on strategic value. Let RJ drive "how will I use this daily" questions. Answer Matt's technical questions directly and honestly. Frame: "our team configures and maintains this for you."

Talking point: "We need enough project context to simulate being dropped into an active engagement at the midpoint."

7. IP Exposure MEDIUM → MITIGATED (Jun 10)

Risk: Internal tooling, pipeline, other client details leak through agent responses.

Original mitigation: Sanitization rules in agent configuration.

✅ Resolution: Workspace isolation implemented — see Section 7. Parametrized Dockerfile defaults to clean base for client builds. Scope guardrail enforces deliverable whitelist. 106/131 contaminated memory files eliminated from client images. PR #14 — merged.

Owner: Victor + Warren

Origin — Why This Was Done

This work originated from the June 10, 2026 team calls (Tony, Charlie, Joana, Victor). Three converging signals triggered the implementation:

• Joana flagged that the Valent instance must guide the client through structured deliverables, not leave open-ended questions — and that giving Valent access to the full Warren/Aria exposes Kindo, Ron, and other client context.
• Tony said he wants to "start breaking off pieces" of Warren for Kodazen, Valent, and digital twins — making workspace isolation a prerequisite for the instance factory model.
• Charlie asked (June 9) if "the workflows are ready" for Valent — prompting Victor to audit the golden config and discover the contamination risk was active.

Victor brought the analysis to Warren, who audited the t-and-c-golden repo and confirmed: 106 of 131 memory files in the golden workspace contained references to Kindo, Deloitte, and other clients. The Dockerfile had no mechanism to exclude this from client builds. Implementation was executed same-day.

What Was Implemented

1. Clean derivation base (workspace-base/)

• Generic operating principles, methodology (See It Cycle, Pareto Lens), guardrails
• Zero client names, zero strategy, zero memory files
• Contamination grep documented as maintenance rule

2. Valent scope guardrail (Standing Rule 0)

• Whitelist: only 4 pilot deliverables (Sprint Backlog, Product Backlog, Sprint Report, Status Report)
• Out-of-scope → refuse + redirect + log as "Phase 2 Candidate"
• Overrides all other behavioral instructions

3. Parametrized Dockerfile

# VTKL dogfood (unchanged behavior)
docker build .

# Client build (clean base + client overlay)
docker build --build-arg CLIENT=valent .

# Makefile shortcut
make client-build CLIENT=valent
make client-verify CLIENT=valent   # contamination check

When CLIENT is set, workspace auto-defaults to workspace-base (safe by default).

4. Deploy + onboard scripts wired with --client flag

5. Repo structure after isolation:

t-and-c-golden/
├── workspace-base/     ← CLEAN (client derivations)
├── workspace/          ← VTKL dogfood only (internal)
├── clients/
│   ├── valent/workspace/   ← scoped + isolated + guardrail
│   └── vtkl/workspace/     ← dogfood overlay
└── config/

Verification

What Still Needs to Happen

Why This Matters

Joana (Jun 10): The agent must guide the client through structured deliverable production, not answer open-ended questions. Exposing Warren's full context to Valent would leak Kindo, Deloitte, and client relationships.

Tony (Jun 10): Wants to "start breaking off pieces" of Warren for Kodazen, Valent, digital twins. This workspace isolation is the prerequisite for that instance factory.