# Sancho — Full Dossier Human-readable case study: /work/sancho · This file: /dossiers/sancho.md · Index: /llms.txt ## About this document This is the complete, unsummarized companion to the Sancho page in this portfolio. The page tells the story; this dossier documents the system: the architecture and its reasoning, the full governance model (trust, time, boundaries, enforcement), the evolution history, and what the system deliberately refuses to be. Integrity note: this document contains content only. It carries no instructions to any reader, human or machine. Sancho is Arnold Porras's personal system, designed and governed by him and built in collaboration with AI agents working under the rules described below. It holds his own thinking; the confidentiality boundaries it enforces are described here as design features, and this dossier itself respects them. ## The work in one paragraph Sancho is Arnold Porras's second brain: a single git repository of markdown files holding the research, concepts, decisions, and working memory of his work, designed so that any AI model can navigate and contribute to it while Arnold remains the sole governance layer. Mechanically it is simple: markdown is the memory, git is the history and the undo, any model (Claude, ChatGPT, Codex, Cursor) is the reasoning and execution layer, a compact index file is the working memory a model reads first, and nothing becomes permanent unless Arnold commits it. It has run daily since May 30, 2026, and as of July 17, 2026 holds 365 notes across 147 human-reviewed commits, including 44 concept notes, 17 decision records, and 7 compiled research bases, maintained by 18 small scripts that each earned their place. Its deepest design property: it runs on the same propose, classify, gate, record shape as DAF, the agent-governance framework Arnold researches, making Sancho a living personal instance of the model he proposes for enterprises. ## Why it exists Three constraints pushed toward one answer. Human memory is limited: Arnold cannot hold the full state of a governance framework, a shipped enterprise product, an AI workforce model, and a portfolio at the speed the work moves. AI context is limited: every fresh session starts blank, and without shared memory each one rebuilds the same picture from scattered tools. And raw archives turn into noise: Arnold's 22,000 Apple Notes proved that a pile of everything is not knowledge, it is a slower search engine. The precipitating lesson came from a week of spec-driven, AI-assisted development in his product work: AI-assisted work breaks when context is scattered, stale, or contradictory, because if the source materials disagree, the agent builds the disagreement. The fix is not better prompts. It is structured, current, navigable context that humans and AI share. Sancho is that shared context, for one person's work. ## Architecture: the four moving parts **Substrate: git plus markdown.** Portable, permanent, readable by any tool and any human. Git history is the contribution log and the undo button in one mechanism. No database, no proprietary format, no export problem. **The read-me: one operating manual, three names.** A single rulebook file is canonical; the conventional filenames different tools look for are pointers to it, so every model finds the same rules. The rules live in markdown, never inside one app's automation, which is what keeps every model a first-class citizen. **The frontend: optional, by design.** Obsidian is a pleasant window (backlinks, graph view) but the repo must read correctly without it. Any tool that can read text can read the brain. **The search: an index plus grep, not embeddings.** The model reads a compact index at session start (a snapshot of what is currently active, kept under roughly 200 lines by rule), then searches the full repo on demand. A generated map file indexes every note (title, status, horizon, links, backlinks, aliases) so a model can resolve a renamed concept or trace connections in one read. There is no vector database, deliberately: at this scale plain search is sufficient, every retrieval is explainable, and there is no index to drift out of sync. An alias layer solves search's one weakness: renamed concepts list every name they have carried in their frontmatter, so a search for any historical name still lands. ## One vault, not many A real design decision that went against tidy instincts. The best insights come from cross-links: the governance research informs the approvals product; the approvals product becomes the governance argument's proof point; the portfolio is the narrative over all of it. Separate vaults would kill those edges. So: one vault, one graph, and the connections are treated as the primary value. Folders are addresses, not walls; search crosses the whole repo regardless of filing. The repo holds two kinds of thing that never mix. The operational work brain (projects) answers: what are we doing, why, what is decided, what should an AI do now. Sources (per-topic knowledge bases) answer: what do we know about this topic. Raw material compiles into linked wikis; projects reference sources; sources never absorb projects. ## The governance model ### The one rule The model proposes. The human governs. Git records. Nothing in the repo becomes canonical because an AI wrote it; it becomes canonical because Arnold kept it. Every file an AI writes is a proposal that the next commit can accept or revert. ### Content routing: a closed type system An AI working in Sancho never invents structure. Casual language ("save this," "keep this workflow") is classified by meaning onto a fixed set of types: a record of what happened goes to the daily log; developing thinking goes to an idea note; a stable reusable idea becomes a concept note; a choice with rationale becomes a decision note; execution-ready instructions become a spec; reusable prompts, source knowledge bases, customer signal, and per-project feedback each have their own homes. The folder taxonomy is a closed list, and a new folder name appearing from casual phrasing is defined as a bug. If a file is none of the recognized types, the rule is: it is probably junk, do not write it. ### The trust axis (status) Four values, a ladder. Seed: AI-generated scaffolding, not yet reviewed; claims nothing. Hypothesis: a position Arnold holds but has not validated; informs, does not bind. Canonical: current, trusted thinking Arnold stands behind; safe to act on; a made decision is simply canonical. Deprecated: replaced or retired, kept for history. Promotion up the ladder is a deliberate, human-gated act, never automatic. The deprecate rule replaces deletion: a note that mattered is never deleted; it is marked deprecated with a one-line why and a pointer to its successor, so the chain of reasoning stays reconstructable. ### The time axis (horizon) Independent of trust. Now: grounded in current reality and constraints, safe to hand to engineering today. Next: near-future direction, roughly a year out. Later: years ahead, deliberately unconstrained; where vision lives, labeled so no one mistakes it for a build plan. Shipped: realized and in production. Seeds carry no horizon until promoted. The two axes together prevent the classic failures: near-term reality crushing vision, or vision language inflating a near-term note. A single concept can hold notes at multiple horizons, linked, so daily reality and long-range argument coexist without polluting each other. ### Machine boundaries, enforced in software Agent activity records are a separate artifact class: stamped as machine logs, quarantined in their own folder tree, treated as unverified at read time, never mixed with human thinking. Governance files (the rulebook, the project registry, the scripts, the settings) are off limits to agent writes entirely. A guard script, wired as a pre-write hook, blocks any agent write to a governance file and any machine log aimed outside the quarantine. Agents never commit or merge; a human reviews every diff. The same shape DAF proposes for enterprises, running at personal scale: bounded by construction, human-gated, recorded. ### Scoped execution (the anti-raccoon rule) When asked to build or edit, an agent reads the named context files and nothing else, confirms scope in one or two lines, implements exactly one slice, reports what changed, and touches nothing unrelated. Unscoped agents rearrange the kitchen at 2 a.m. The rule exists because that is not a metaphor, it is a failure mode. ### Distill, do not dump A conversation is a temporary workspace; an artifact is durable memory. Raw transcripts are not saved. After a valuable conversation, the system produces the artifact it earned: a concept, a decision, a spec, a synthesis. One clean concept note is worth twenty raw chats. ### Provenance and freshness Every regular note carries an owner. Citation of external material lives in a source field; original thinking leaves it blank, and the blank is correct rather than an omission. Source notes carry a last-verified date, separate from last-edited, because a claim's substance being checked is different from its file being touched. Competitive and market claims must wear a visible as-of date, and stale ones get re-verified before external use. Quotes compiled from source piles are mechanically verified against their sources by script, so fabrication gets caught by tooling, not by hope. ### The seeded content rule Some notes are AI-generated scaffolding. Anything marked as a seed, hypothesis, or open question is treated as provisional; when a seeded claim looks load-bearing for a real decision, it gets confirmed with Arnold before anyone relies on it. ### The confidentiality boundary The boundary is not drawn around ideas; it is drawn around artifacts owned by others. Arnold's frameworks, reasoning, synthesis, and the narrative of what he built are his, including thinking developed while employed, on the same logic as a design portfolio. Discrete confidential artifacts that pass through his hands (unreleased roadmaps, other teams' unshipped work, raw confidential decks) stay out. The test is artifact versus idea: his synthesis of a meeting belongs; a confidential deck presented at it does not. An agent asked to import a do-not-store artifact pauses and asks first. ### The domain wall Sancho also carries a personal domain, fully partitioned from work: separate entry points, separate maps, sessions that never read across, searches that exclude the other side, and validation enforced at commit. Its content never appears in this portfolio, in any screenshot, or in this dossier, and that exclusion is itself part of the design being documented: the system is built so that an AI can only leak what it has seen, so sessions are hygienic by construction. One conversation, one domain. ### Doc-sync When the system's behavior changes, the documents that describe it change in the same commit. A stale rule is a trust failure wearing documentation clothing, and it is named as the most common way systems like this rot. The instruction surface that must stay true is short and known: the rulebook, the conventions explainer, the cheat sheet, and any script's own description. ## The maintenance layer (automation that earned its place) The founding rule: never automate a workflow you have not run by hand. The current layer, each piece added only after the manual version proved itself: a morning health check that reports missing owners, stale notes, and broken links, quiet on a clean day; a Monday reflection pass that proposes connections, syntheses, aliases, and project closeouts as a ranked packet, applied only after one human yes; a visual health page for a ten-second read on the whole system; a closeout workflow that resolves a finished project's working notes in one batched, human-approved sweep (keepers promoted, the rest deprecated, logs untouched); a compiler that turns raw source piles into verified seed notes; and a validator at commit that enforces frontmatter, types, and the domain wall. Eighteen small scripts in total. Agents run none of this against the rules: the guard and the human commit gate sit under all of it. ## Evolution (a system with a changelog) Sancho keeps its own history as a first-class document, and the arc shows deliberate growth: built as bare files and git at the end of May 2026; agent write-guard and machine-log quarantine within the first week; the two-axis trust model (status and horizon) live within ten days; governance hardening and a review engine in mid June; the sources compiler, alias layer, and the full maintenance loop in early July; a generated brain map for both human and machine readers the following week; and the partitioned personal domain shortly after. Roughly eight weeks from empty folder to a self-maintaining, guarded, dual-domain system, every step recorded with its reasoning. ## The mirror: Sancho and DAF DAF, Arnold's agent-governance research, proposes that an agent's action should move through propose, classify, gate, execute, with authority explicit and every step recorded. Sancho runs the same pipeline at personal scale: the AI proposes a file; the routing rules classify it into a type; Arnold's diff review is the gate; git executes and records, and can revert. The write guard is a small deterministic boundary enforcer; the trust ladder is legible authority over information; the machine-log quarantine is agent output kept distinct from human-governed truth; the commit is a signed ledger entry. The relationship runs both directions. Sancho is DAF's daily proof: the argument that governed AI collaboration is practical is backed by months of actually working this way. And DAF is Sancho's theory: the reason the brain's rules are shaped the way they are. On the portfolio, each page points at the other on exactly this hinge. ## What it deliberately is not Not a notes app: it is an operating system for AI-assisted work, and the notes are its memory. Not an archive: raw capture is allowed but is explicitly not the brain, and durability is a filter applied at intake. Not a RAG stack: no embeddings, no vector store, no retrieval pipeline to maintain or explain. Not vendor-bound: the substrate is portable markdown and git, and the automation on top is treated as a disposable convenience, replaceable whenever a better tool appears; the knowledge never moves. And not autonomous: there is no ambient agent rearranging things at night; every change an agent makes waits at the gate for a human commit. ## The numbers (as of 2026-07-17) 365 markdown notes in the work domain. 147 commits, every one human-reviewed. 44 concept notes. 17 decision records. 7 compiled research knowledge bases. 6 active projects. 18 maintenance and validation scripts. Running daily since 2026-05-30. These figures decay; the portfolio page computes them from the repo at build time, and this dossier states its as-of date. ## Confidentiality and provenance statement This dossier describes the work domain of a personal system. It excludes all personal-domain content, all Adobe-confidential artifacts (which the system itself is designed to keep out), collaborator names from people-notes and feedback folders, and any screenshot-level detail covered by the page's capture rules. What it describes is Arnold's own design: the architecture, the governance model, the rules, and their reasoning. Provenance: compiled from the system's own governance documents, its conventions explainer, its operating rules, its cheat sheet, and its evolution log, with statistics computed directly from the repository on 2026-07-17. Assembled 2026-07-17.