Vee

The client had an idea that a document could not carry: a character people would talk to, on their own phones, with a face that listens. A proposal would have described it. A demonstration would have shown a fragment. Neither answers the question a board or a funder actually asks, which is whether the thing can exist.

So it was built, on our own account and before any contract, as a proof of ability: the whole thing, to a governed specification, deployed and in the client’s hands. We named it Vee. It is not a prototype of the client’s product. It is working software that brings their idea to life, so that the decision in front of them is about the product rather than about whether we can build it.

The specification went through twelve versions before the package was generated from it, and the versions are a record of how a character gets specified at all: seven epics, thirty-five features, forty-six user activities, and a pinned list of two hundred and forty requirements, of which fifty-nine are non-functional and forty-five are constraints. Much of what the character does is delivered by its instructions and a fact sheet it may not go beyond, so the specification has to pin behaviour, not just function: how it wakes, when it asks whether you are still there, what it will not joke about.

Two things made it unusual to govern. There are no accounts: a visitor opens a private link and talks. And some of its requirements can only be judged on a real phone, against a live voice model, so the specification says which criteria a build can prove and which the owner must grade by hand.

The build ran in four phases against sixty-seven requirements and one hundred and ninety-eight criteria, with the operator’s console, the link and session machinery, the animated face with its seven states, the real-time voice connection, captions, mute, and the optional camera. The browser connects to the voice model directly with a short-lived token from the server, so the content of a conversation never reaches our server at all. Behind the build are 1,116 unit tests and 109 browser-level gates.

The package that produced it was the fourth generated from the specification, patched and re-gated until it reached GO WITH GAPS with no blockers; the first was not buildable, and the second and third were sent back. One hundred rulings were made along the way: twenty-two to settle the specification and the package, sixty-two during the build, six from using the live software on a phone, and ten in the first enhancement cycle after deployment.

The enhancement cycle came from use. Sessions were lengthened to thirty minutes, with a database migration shipped as a first-class artifact; the character now asks whether you are still there before it falls asleep; and the content it speaks from is chosen at deployment, so the same build can carry a pitch or an open conversation.

A second cycle made it public. The same build now runs as a separate deployment in a public mode: one open link with no code, ten-minute conversations, a shared daily cap and a per-visitor limit, a busy page that says when to come back, and content that names nobody. The public start strips the private content sets out of its running copy, and a build check refuses a page that still carries them. It took four requirements, thirty criteria and fourteen rulings, and the cycle ended with a gate that returned no unsatisfied criterion.

The gates said no first. Phases one and two came back to remediate with twenty-one criteria unverifiable without a live key; phase three’s first gate rejected because one criterion went unchecked, an instrument failure rather than a product defect, and the re-gate passed seven of eight; phase four, graded on the whole product, returned 132 satisfied, none unsatisfied, twenty-four unverifiable and forty-two excluded by ruling. The enhancement cycle’s gate rejected on a test that failed because of the time of day, was fixed, and closed as accepted after remediation.

It is deployed and in use. The specification’s owner used it on a phone and a laptop before the enhancement cycle, and the rulings from that use are in the record; the first live session after the enhancement deployed passed its checks with one slip noted. Sixty-six criteria that can only be graded on a real phone against the live model are the owner’s to grade, and the record says which they are. A full thirty-minute session has not yet been run end to end. Two paths through the mute control were identified as risks and not tested. The gate’s own summary notes that a package can reach GO WITH GAPS and still carry a defect introduced by its patch round, and names the one it found. The public demo’s gate graded seventy-eight criteria: sixty-seven satisfied and eleven that belong to a phone or the live model, which the owner checks by hand.