From 269d67d26abcd54b98a3c19c934b928fd9064a4f Mon Sep 17 00:00:00 2001 From: abrichr Date: Mon, 31 Aug 2026 18:56:50 -0400 Subject: [PATCH] docs(commercial): address the partner, not the sales team Several passages in the commercial section were written to an internal sales reader and published unchanged. "Do not mix these in one pitch", "this is the motion you can sell now", "Charge 2 and 3", "Halt UX is the commercial product ... that is renewal", "IDN RFPs are not the growth engine", and "Do not publish a public healthcare procedure npm" all tell an OpenAdapt seller what to do. The reader of these pages is a partner evaluating the product. Keep every fact the partner needs and drop the instruction wrapped around it. Attended and unattended become operation modes with a scope statement instead of sales motions. The tier rule states which oracle mints a Seal instead of what to charge for. The go-to-market positioning is cut. Also expand two abbreviations that were never introduced: SoR in the receipt-field tables becomes "system of record", and PAM becomes "privileged access management". Co-Authored-By: Claude Opus 5 --- docs/commercial/oem-brief.md | 42 +++++++++------------- docs/commercial/procurement-faq.md | 19 +++++----- docs/commercial/qualification-sprint.md | 5 +-- docs/commercial/seal.md | 48 ++++++++++--------------- 4 files changed, 47 insertions(+), 67 deletions(-) diff --git a/docs/commercial/oem-brief.md b/docs/commercial/oem-brief.md index 80ddf04..b0f479f 100644 --- a/docs/commercial/oem-brief.md +++ b/docs/commercial/oem-brief.md @@ -27,12 +27,6 @@ A sealed verified run prints `VERIFIED`, a seal id, and `--seal` on replay is the intended Seal command. `openadapt flow seal` encrypts a bundle for deployment. -The buyer is the technical owner at a vertical software vendor, an RCM -provider, a BPO, or an agent platform. That company already has structured -inputs, business logic, and an exception team. OpenAdapt supplies the last -action in the customer GUI, then a Seal. Health-system IT is a downstream -environment. Do not staff this motion as an IDN RFP. - !!! note "Private pilot. Not a public API." This page describes the private-pilot product contract. It is not an self-service integration recipe and it does not publish partner access, @@ -145,25 +139,27 @@ does not infer a class or an identity from a screenshot, OCR, an application name, parameters, or a model. If the class is unavailable, it uses `record` or `item`. The runner rechecks the real identity before any resumed action. -## Two sales motions - -Do not mix these in one pitch. +## Attended and unattended operation -**Attended.** A person is in session. The runner uses that session. Consequential -writes pause for a signed phone or console answer, then recheck live identity -and state. This is the motion you can sell now. The human remains the legal -actor. A Seal is not a physician signature. +The private pilot runs attended. A person is signed in to the target +application, and the runner acts inside that session. A consequential write +pauses at `decision_required` until an authorized person answers, and the +runner rechecks live identity and workflow state before it continues. The +[attended decisions](#attended-decisions-and-mobile-delivery) section below +describes that round trip. -**Unattended.** Needs a dedicated agent identity, PAM, and session recording. It -does not type a physician password or stuff a physician login. +That person stays the legal actor. A Seal records that the configured +authorization, identity, postcondition, and effect contracts passed for one +run. A Seal is not a physician signature. -Halt UX is the commercial product: who gets the push, what they see, how they -teach one step without invalidating the bundle, and how "click continue" is -refused. +Unattended operation is qualified separately and is not part of the private +pilot. It requires a dedicated agent identity, privileged access management, +and session recording. In either mode, OpenAdapt does not type a person's +password, reuse a person's login, or share a service account. ## Oracle tiers -Charge 2 and 3. Tiers 0 and 1 never mint a production Seal. +Only a tier 2 or tier 3 oracle mints a production Seal. | Tier | What it reads | Production Seal | |---|---|---| @@ -236,7 +232,7 @@ the Seal. Map the receipt fields 1:1. | `execution_id` | The `POST /v1/executions` that produced this Seal | | `workflow_digest`, `workflow_version` | Admitted program | | `qualification_id`, `environment_id`, `runner_id`, `nonce` | Admission, environment, runner, uniqueness | -| `oracle_tier` | 0 visual, 1 second-session, 2 SoR, 3 counterparty | +| `oracle_tier` | 0 visual, 1 second-session, 2 system of record, 3 counterparty | | `outcome` | `verified` / halt / `reconciliation_required` / the other terminal values | | `contracts` | Authorization, identity, postcondition, effect | | `evidence_digest` | Pointer to retained evidence. Bytes stay in the boundary. | @@ -287,12 +283,6 @@ commercial compatibility pack. | OpenAdapt Execute | Private pilot | `POST /v1/executions` issues Seals. Not a new repository. | | Compatibility packs and verifier recipes | Commercial | Per-application and per-environment qualification assets. Bundles are not liquid. | -Embed through Execute and MCP into RCM vendors and agent platforms. Hospital -IT RFPs are not the growth engine. If Copilot or Power Automate already -clicked, OpenAdapt can still emit the Seal when asked. - -The compiler stays inspectable. Settlement is the Seal. - ## Next step [Qualify one workflow](qualification-sprint.md){ .md-button .md-button--primary } diff --git a/docs/commercial/procurement-faq.md b/docs/commercial/procurement-faq.md index 4e00681..9ed3620 100644 --- a/docs/commercial/procurement-faq.md +++ b/docs/commercial/procurement-faq.md @@ -86,15 +86,16 @@ No. The human remains the legal actor. A Seal records that the configured identity, policy, and effect checks passed for that run. **Do you sell attended and unattended as one product?** -No. Attended is the motion you can buy now: human session, phone or console -approve consequential writes. Unattended needs a dedicated agent identity, -PAM, and session recording. Do not mix them in one statement of work. Do not -type a physician password. - -**Are we buying a hospital RFP engagement?** -No. Embed through Execute and MCP into an RCM vendor, BPO, vertical SaaS, or -agent platform. Health-system IT is a downstream environment. IDN procurement -is not the growth path. +No. Attended is the mode you can buy now: a person is in session, and a phone +or console answer releases each consequential write. Unattended needs a +dedicated agent identity, privileged access management, and session recording, +and it is qualified separately. One statement of work covers one mode. +OpenAdapt does not type a person's password. + +**Does this need a health-system IT procurement?** +No. OpenAdapt embeds into your product through Execute and MCP, and your +company holds that integration. The health system is the environment where the +transaction runs. **Can Copilot or Power Automate still do the click?** Yes. OpenAdapt can emit a Seal from another actuator when asked. The diff --git a/docs/commercial/qualification-sprint.md b/docs/commercial/qualification-sprint.md index 1d7c4ac..291e7b6 100644 --- a/docs/commercial/qualification-sprint.md +++ b/docs/commercial/qualification-sprint.md @@ -49,8 +49,9 @@ Days on which access is broken or revoked pause the clock. See the confirmation is oracle tier 0 and never a production Seal. See [effect verification](../concepts/effect-verification.md) and [The Seal](seal.md). -- The sales motion: attended (human session, phone approve writes) or - unattended (dedicated agent identity, PAM). Do not mix them in one sprint. +- The operation mode for the workflow: attended (a person is in session and + answers a pause from a phone or console) or unattended (a dedicated agent + identity and privileged access management). One sprint qualifies one mode. - A security contact for boundary and data-handling questions. ## Exclusions diff --git a/docs/commercial/seal.md b/docs/commercial/seal.md index b442545..86cff56 100644 --- a/docs/commercial/seal.md +++ b/docs/commercial/seal.md @@ -19,16 +19,15 @@ failure: if a consequential tool returns done without a Seal, treat the call as failed. The compiler stays MIT. Record, compile, replay, halt, teach, `openadapt-types`, -local MCP, and Agent Skills stay inspectable. Settlement is the Seal. +local MCP, and Agent Skills stay inspectable. Public verify pages list synthetic and non-PHI Seals. They do not list healthcare production. Bundles are bound to one app build, one farm, one -resolution, one custom screen. Do not publish a public healthcare procedure -npm. +resolution, one custom screen. ## Oracle tiers -Charge tiers 2 and 3. Tiers 0 and 1 never mint a production Seal. +Only a tier 2 or tier 3 oracle mints a production Seal. | Tier | What it reads | Production Seal | |---|---|---| @@ -49,24 +48,20 @@ banner must halt. The store must stay unchanged. A Seal that points at a screenshot hash is a liability. Do not mint production `verified` below tier 2. -## Two sales motions +## Attended and unattended operation -Attended and unattended are two motions. Do not mix them in one pitch. +Attended is the mode available now. A person is already signed in to the +target application and the runner acts inside that session. A consequential +write pauses at `decision_required`. The operator answers from the local +console or the authenticated phone surface. The runner then reacquires focus, +a fresh observation, identity, and the target before it continues. -**Attended.** A person is already in session. The runner uses that session. A -consequential write pauses at `decision_required`. The operator answers from -the local console or the authenticated phone surface. The runner then -reacquires focus, a fresh observation, identity, and the target before it -continues. This is the product you can sell now. The human remains the legal -actor. A Seal is not a physician signature. +That person stays the legal actor. A Seal is not a physician signature. -**Unattended.** Needs a dedicated agent identity, PAM, and session recording. -It does not type a physician password, stuff a physician login, or share a -service account. Treat that as a later motion with its own identity design. - -Halt UX is the commercial product. Who gets the 2 a.m. push, what they see, how -they teach one step without invalidating the bundle, and how "click continue" -is refused: that is renewal. +Unattended operation needs a dedicated agent identity, privileged access +management, and session recording, and it is qualified separately. In either +mode, OpenAdapt does not type a person's password, reuse a person's login, or +share a service account. ## CLI story @@ -107,7 +102,7 @@ on that page. | `environment_id` | environment | The qualified environment | | `runner_id` | runner | The customer-controlled runner | | `nonce` | nonce | Per-Seal uniqueness so a consumer does not need the original request | -| `oracle_tier` | oracle | 0 visual, 1 second-session, 2 SoR, 3 counterparty | +| `oracle_tier` | oracle | 0 visual, 1 second-session, 2 system of record, 3 counterparty | | `outcome` | outcome | `verified`, `halted_before_effect`, `reconciliation_required`, `rejected_policy`, `failed_platform`, or `rolled_back_verified` | | `contracts` | contracts | Authorization, identity, postcondition, effect, required and observed strength, `model_used`, `external_network_used` | | `delivery_uncertain` | delivery | True when a write may have landed | @@ -138,17 +133,10 @@ The partner still validates the Seal the same way: `receipt_id`, ## How it ships -The buyer is the technical owner at an RCM vendor, BPO, vertical SaaS, or -agent platform that already finishes last-mile work in someone else's GUI. -Health-system IT is a downstream environment. IDN RFPs are not the growth -engine. - -Embed through Execute and MCP. One partner is many environments. A hospital -procurement cycle is 12 to 18 months. +A partner embeds OpenAdapt through Execute and MCP. -If Copilot, Power Automate, or another actuator already clicked, OpenAdapt -can still emit the Seal when asked. We do not need to win the chat box. Until -a counterparty demands the Seal, the incumbent keeps distribution. Coexist. +If Copilot, Power Automate, or another actuator already clicked, OpenAdapt can +still emit the Seal for that action when asked. Compile-once is a cache when the job is stable. If a computer-use agent gets cheap, the run still has to prove identity and effect, or halt.