# Agent Working File
This file is a **living document** and a **full history tree** for this project —
not a snapshot. Any agent or person working here (Claude in chat, Claude Code,
Claude Cowork, or a human) maintains it by the rules below. Everything else in
this file varies by project; these rules do not.
## How to maintain this file
1. **Document everything.** On every change, record what was discussed, decided,
changed, or planned — decisions and plans included, not just executed work.
2. **Never overwrite or delete history.** When something changes, update the
relevant Current Truth section in place **and** append a dated Change Log
entry capturing old → new and why.
3. **Two parts, kept separate:** *Current Truth* is updated in place and always
reflects the present state; the *Change Log* is append-only, newest entry
first, and is never edited retroactively.
4. **Stamp facts** as `[verified YYYY-MM-DD]` or `[assumed]`. When you re-check a
fact, re-stamp it with today's date; a stale date means it needs re-verifying.
5. **Never prune the Change Log.** If the file gets unwieldy, ask before
archiving old entries to `AGENTS-history.md`. History is not destroyed.
---
# Current Truth
## 1. What this project is
A ground-up rebuild of **adr.smlcompany.ca**, the personal-brand website of the
alternative dispute resolution practice of **Pouya Lajevardi**. `[verified 2026-08-25]`
The brand's centre of gravity is the **practitioner**, not the firm and not
SML Company Ltd. Legal background, firm affiliation, and the operating company
are credibility signals referenced in support; they are not the subject.
`[verified 2026-08-25 — source: PL_ADR_Personal_Branding_Strategy_Brief.docx]`
**Positioning in one sentence:** a credentialed neutral who is also a working
litigator and a practising machine-learning / infrastructure engineer — a
combination that is close to absent from Canadian ADR rosters, and which is the
practice's economic moat. `[verified 2026-08-25 — source: strategy brief §I, §V]`
**Time horizon:** the strategy brief plans a 24-month compounding arc. The site
is built to be added to continuously, not shipped once. `[verified 2026-08-25]`
## 2. State of the thing being replaced
The site live at `adr.smlcompany.ca` as of this entry: `[verified 2026-08-25]`
- It is a **single 2.2 MB HTML file** containing an entire React application,
compiled **in the browser at runtime** by Babel Standalone loaded from unpkg.
- React and ReactDOM are loaded as **development** builds from a public CDN.
- **Crawlers see almost nothing.** A server-side fetch of the URL returns only
`SML Company`, `DISPUTE RESOLUTION`, and the loading string `Unpacking...`.
Every word of real content is assembled client-side after three CDN round
trips. `[verified 2026-08-25 — direct fetch]`
- The deployed `` has **no ``**, no meta
description, no Open Graph or Twitter card tags, no canonical URL, and no
favicon. `[verified 2026-08-25]`
- `robots.txt` returns **403**. There is no sitemap. `[verified 2026-08-25]`
- The two logo PNGs are ~1 MB combined and are **base64-inlined** into the HTML,
so they cannot be cached separately from the page. `[verified 2026-08-25]`
- `` is still `SML Company · Dispute Resolution` — the pre-rebrand
placeholder title. `[verified 2026-08-25]`
- There is **no version control, no build step, and no test suite**. The
publishing mechanism is a Python script (`rebuild-standalone.py`) that inlines
the JSX components into the single file. `[verified 2026-08-25]`
- The May 2026 content brief was **partially applied** — the JSX components
under `components-standalone/` contain the corrected Pouya-branded copy, but
the document `<head>` and some structural defaults still carry placeholder
content. `[verified 2026-08-25]`
**Consequence, stated plainly:** for a site whose entire purpose is to be found
by counsel, general counsel, and appointing bodies searching for a neutral, the
current architecture is close to a worst case. This rebuild is justified on
architecture alone, independent of any content or design opinion.
`[verified 2026-08-25]`
## 3. Locked decisions
Decided with Pouya on 2026-08-25. Each of these is settled; do not re-open one
without an explicit instruction and a Change Log entry. `[verified 2026-08-25]`
| # | Decision | Chosen | Rejected alternatives |
|---|---|---|---|
| D1 | Framework | **Astro**, static output | Next.js; patching the single-file build; hand-written HTML |
| D2 | Content scope | **Full re-architecture** — new IA, new pages, all copy rewritten | Copy rewrite on existing structure; audit only; technical layer only |
| D3 | Hosting & CI/CD | **Git repo + Gitea Actions → existing S3 + CloudFront.** *Amended 2026-08-26:* self-hosted **Gitea**, repo `adr-sml`. Gitea Actions uses GitHub Actions syntax, so the workflow ports nearly as is — but Gitea is not an AWS OIDC provider, so deploys authenticate with a **scoped IAM user**, rotated quarterly | GitHub Actions + OIDC; Terraform/CDK IaC; Amplify; manual deploys |
| D4 | Languages | **English only** | Full EN/FA bilingual; EN + one Farsi page; EN with FA scaffolding |
| D5 | Page structure | **Full multi-page**, ~20 URLs | Lean six-page; rich home + a few deep pages |
| D6 | Primary audience | **All four tiers**, served by different surfaces (see §5) | Single-audience focus |
| D7 | Visual design | **Keep palette and infinity mark; modernize the execution** | Faithful port; strip motion only; fresh design direction |
| D8 | Fees | **Full rate card published on a `/fees/` page** | Ranges only; on request; gated PDF |
| D9 | Insights | **Build it and launch with 3–5 drafted pieces**, every word reviewed by Pouya before publication | Launch empty; no Insights section |
| D10 | Intake | **Rebuilt intake form + calendar booking** for the confidential intake call | Structured questionnaire; form only; email/phone only |
| D11 | Rollout | **Build everything, one clean cutover.** The current site stays live untouched until replaced | Patch live site first; staging subdomain; take site down |
| D12 | Agent working file | **This file**, maintained under the constitution above | Ad hoc notes |
| D13 | Licensure claims | **The site asserts the JD only.** No claim of licensure, call to the bar, or entitlement to practise law. The approved phrasing for the boutique role is **"active litigation exposure"** or **"involvement in litigation and ADR matters"** — never "practice". Pouya's direction, 2026-08-26. **Explicitly interim — see Standing Reminders §12** | Stating LSO licence status; the word "practice" |
| D14 | Fee structure | **Single published rate card, all mediation matters at one rate.** Confirmed by Pouya 2026-08-26; figures in `docs/07-fees.md`. No tribunal-secretary line | Two-tier card (recommended by Claude, declined); ranges; fees on request |
| D15 | Analytics | **Privacy-first and cookieless** (Plausible or Fathom). No cookie banner, nothing to consent to, one line in the privacy policy | GA4; no analytics at all |
| D18 | Intake email | **Two emails per submission** — notification to `info@smlcompany.ca`, and a **confirmation receipt to the inquirer**. Pouya, 2026-08-26. The receipt is what requires SES production access (Q19) | Notification only; no email; no form at all |
| D17 | Working method | **Pouya architects; Claude Code implements and then adversarially reviews its own work.** Six-phase loop encoded in `.claude/commands/build.md`; two independent review agents in `.claude/agents/`; extended thinking on by default. Standing agreement — not restated per prompt | Implement-and-report; single generic reviewer; review only on request |
| D16 | Naming the boutique | **Never named.** Referred to throughout as *a Toronto litigation and ADR boutique*. Pouya's decision, 2026-08-26 | Naming the firm |
## 4. Credential and claim register
**This is the most important section in this file.** Pouya is a licensed legal
professional. Every public claim on this site is subject to Law Society of
Ontario marketing rules, and the previous version of the site carried fabricated
credentials, invented matter values, and a fictitious testimonial. That must
never recur.
### Governing rule
> **No claim reaches a public page unless it appears in the Verified column
> below.** If a page needs a fact that is not here, stop and ask Pouya. Do not
> infer it, do not soften it into something defensible, and do not carry it over
> from the old site.
### Verified — may be published
Sourced from Pouya's own strategy brief of 2026-05-26. Self-reported by the
subject, which makes them reliable as to substance, but **currency is not
confirmed** — several are on a moving credentialing track and may have advanced
since May.
| Claim | Status |
|---|---|
| Pouya Lajevardi, JD, Bond University | `[verified 2026-08-25 — strategy brief §I]` |
| ~~Lawyer; Law Society of Ontario member~~ | **DO NOT PUBLISH.** Pouya directed on 2026-08-26 that licensure is left out of the site entirely; the JD is asserted, nothing further. See D13 and the Forbidden table below `[verified 2026-08-26]` |
| Director of Firm Operations, Toronto litigation and ADR boutique | `[verified 2026-08-25 — strategy brief §I]` |
| Active litigation practice: personal injury, construction, regulatory (POA), insurance (SABS) | `[verified 2026-08-25 — strategy brief §I]` |
| Q.Med designation through ADRIC / ADRIO | `[verified 2026-08-25 — strategy brief §I]` |
| Has completed multiple sole mediations | `[verified 2026-08-25 — strategy brief §I]` — count deliberately not published, see below |
| Q.Arb credentialing pathway — **commenced August 2026** | `[verified 2026-08-26 — Pouya]`. Describe as newly commenced, never as held or nearing completion |
| C.Med-Arb stated as long-term designation goal | `[verified 2026-08-25 — strategy brief §I, §IV]` |
| Kompass Arbitration Certificate Program — completed | `[verified 2026-08-25 — strategy brief §I]` |
| Stitt Feld Handy negotiation and ADR workshop sequence — completed | `[verified 2026-08-25 — strategy brief §I]` |
| Practising machine-learning and DevOps / infrastructure engineer | `[verified 2026-08-25 — strategy brief §I, §V]` |
| Bilingual English and Farsi | `[verified 2026-08-25 — strategy brief §I]` |
| Iranian-Canadian; cross-cultural fluency with diaspora business communities | `[verified 2026-08-25 — strategy brief §I]` |
| Operator of SML Company Ltd. alongside the practice | `[verified 2026-08-25 — strategy brief §I]` |
| Memberships: **ADRIC**, **ADRIO**, **OBA sections** | `[verified 2026-08-26 — Pouya]`. Which OBA sections is still `[assumed]` — the brief names Construction & Infrastructure, ADR, and Civil Litigation |
| ~~OCNI~~ | **Not current. Do not publish** `[verified 2026-08-26 — Pouya]` |
| ~~LSO~~ | **Do not publish.** Listing the Law Society among memberships implies licensure, which D13 bars. Excluded deliberately, not by oversight `[verified 2026-08-26]` |
| Toronto, Ontario; by appointment | `[verified 2026-08-26]` |
| Contact: `info@smlcompany.ca`; no public phone number; consultations by scheduled call | `[verified 2026-08-26 — Pouya]` |
| LinkedIn: `https://www.linkedin.com/in/pouyalajevardi/` | `[verified 2026-08-26 — Pouya]` |
| The Toronto litigation and ADR boutique **may be named on the site** | `[verified 2026-08-26 — Pouya]`; the name itself is pending, see Q7 |
### Forbidden — must not appear anywhere
| Never publish | Why |
|---|---|
| Any count of matters closed, hours mediated, or years in ADR practice | Practice is new. Small true numbers do not persuade a sophisticated GC and invite scrutiny. Save for one-to-one appointment proposals where context travels with the figure. `[verified 2026-08-25 — content brief, "Rule of thumb on numbers"]` |
| Settlement rates, resolution percentages, median time to award | No underlying data exists |
| Aggregate value resolved; any dollar figure attached to past matters | No underlying data exists |
| Named or describable past matters | Confidentiality, and none are publishable |
| Testimonials, endorsements, quotes from counterparties | None exist. The prior site's testimonial was fabricated |
| "Since 2009", "sixteen years", London / New York offices, Co. № 07452218 | Artefacts of the placeholder template. All false |
| The name "S. M. Lawrence" | Fictitious founder from the template |
| Guarantees of outcome, or superlatives ("best", "leading", "top-rated") | LSO marketing rules |
| The word **"lawyer"** used of Pouya; "called to the bar"; "licensed"; "my law practice"; "my litigation practice"; any post-nominal implying a licence | D13. The site asserts the JD and nothing further |
| Any phrasing that *implies* entitlement to practise law without saying so — "acts for clients", "represents parties", "my clients", "legal advice" | Same rule. Implication is the risk, not just the word. Describe the role factually instead: *Director of Firm Operations at a Toronto litigation and ADR boutique*, and the matter types worked on |
| Q.Arb described as held, imminent, or "nearly complete" | It commenced August 2026 |
### The substitution principle
Wherever the design wants a "how much / how many" statistic, substitute a
**longer-arc credential** — something already substantial and true at launch that
does not grow by closing files. The approved stat set is `Q.Med` /
`JD + ML` / `EN · FA`, with `Q.Arb` as a fourth slot where one exists.
`[verified 2026-08-25 — content brief]`
## 5. Audience model
All four tiers matter, but they are served by different surfaces rather than by
diluting every page into a compromise. `[verified 2026-08-25 — decision D6]`
| Tier | Reads | Wants | Primary surface |
|---|---|---|---|
| In-house / general counsel | Home, practice pages | Credentials, subject-matter fluency, procedure, predictable cost | Home + `/practice/*` |
| Referring lawyers and litigation boutiques | Practice pages, fees, process | Availability, rules familiarity, rate card, confidence you won't embarrass them | `/fees/`, `/process/`, `/mediation/` |
| Appointing bodies and ADR institutions | About, credentials | A verifiable credential record and evidence of depth | `/about/` |
| Self-represented parties and SMEs | Plain-language layer | What mediation actually is, what it costs, what happens | `/for-parties/` |
Realistically, **referring counsel are the largest source of early
appointments**. Where two audiences conflict on a page, resolve toward counsel.
`[assumed]`
## 6. Architecture
Full sitemap, URL map, and per-page content outline: **`docs/01-architecture.md`**.
Summary: ~20 static pages. Home; About; three process pages (Mediation,
Arbitration, Med-Arb); six practice-area pages; Process; Fees; For Parties;
Insights index and articles; Contact; Privacy; Terms.
**Deliberate omission:** there is no Indigenous engagement / IBA practice page at
launch, though the strategy brief rates that niche as strategically the most
valuable. Publishing a practice page for it before the multi-year relationship
work described in brief §III.4 has been done would read as overreach to exactly
the audience it targets. Revisit at month 12–18. `[verified 2026-08-25 — decision recorded here, not yet discussed with Pouya]`
## 7. Environment and stack
| Thing | Value |
|---|---|
| Framework | Astro, `output: 'static'` `[verified 2026-08-25 — D1]` |
| Node | 22 LTS, pinned in `.nvmrc` `[assumed]` |
| Styling | Plain CSS with custom properties. No Tailwind, no CSS-in-JS `[verified 2026-08-25]` |
| Client JS | Astro islands only, where genuinely needed. Target: most pages ship zero JS `[verified 2026-08-25]` |
| Content | Astro content collections, MDX for Insights `[verified 2026-08-25]` |
| Fonts | Instrument Serif + Geist + Geist Mono, **self-hosted**, `font-display: swap` `[verified 2026-08-25]` |
| AWS account | `327082975128` `[verified 2026-08-26 — inventory]` |
| Region | **`ca-central-1`** throughout — hosting, Lambda, DynamoDB `[verified 2026-08-26]` |
| S3 bucket | **`adr-smlcompany-site`** — versioning **Enabled**, so rollback works `[verified 2026-08-26]` |
| CloudFront | **`E1OK7G98KNKUTA`**, alias `adr.smlcompany.ca`, origin `adr-smlcompany-site.s3.ca-central-1.amazonaws.com`, Deployed `[verified 2026-08-26]` |
| ACM certificate | `arn:aws:acm:us-east-1:327082975128:certificate/2b6d5bdf-6790-430c-9b82-c00ab66e6d87` — ISSUED `[verified 2026-08-26]` |
| Intake API | `adr-intake-api`, HTTP API `4tl0m5igkj`, endpoint `https://4tl0m5igkj.execute-api.ca-central-1.amazonaws.com` `[verified 2026-08-26]` |
| Intake Lambda | `adr-intake-handler`, `nodejs24.x` `[verified 2026-08-26]` |
| Intake table | `adr-intake-submissions` (DynamoDB, ca-central-1) `[verified 2026-08-26]` |
| SES identities | Domain `smlcompany.ca` **verified for sending** `[verified 2026-08-26]`; addresses `info@`, `intake@`, `adr@` |
| SES account | **In the sandbox** — `ProductionAccessEnabled: false` `[verified 2026-08-26]`. Production access required (Q19) |
| Mail hosting | **Google Workspace** — MX `1 smtp.google.com`; `google._domainkey` present, so Google DKIM is configured `[verified 2026-08-26 — DNS query]` |
| **SPF** | **ABSENT.** `smlcompany.ca` TXT holds only Anthropic and Google site-verification strings. No `v=spf1` record exists `[verified 2026-08-26 — DNS query]` |
| **DMARC** | **ABSENT.** No `_dmarc.smlcompany.ca` record `[verified 2026-08-26 — DNS query]` |
| Required DNS (Namecheap) | TXT `@` → `v=spf1 include:_spf.google.com include:amazonses.com ~all` · TXT `_dmarc` → `v=DMARC1; p=none; rua=mailto:info@smlcompany.ca; fo=1` `[assumed]` — start at `p=none`, tighten after monitoring |
| SES DKIM — **the set that actually resolves** | `f5puwearz5ek47aiuoskk57ya6ir66ju`, `jdue2r22cxrk27laxlgnjcpby2fq4vxu`, `kznn3cklvwh4gs342rtf5euqymlger53` — all three answer NOERROR at `<token>._domainkey.smlcompany.ca` `[verified 2026-08-26 — DNS]` |
| SES DKIM — **the set that is BROKEN** | `3zsnvsjg3ddi6hjyndjy6jgjoitvhydl`, `jejgp7na3wdpprsanamct4uxxgw2tyqw`, `xpiwyftpodmgpnzfof3ee7t7fzmlmhnh` — listed in the SES console, present in Namecheap, but **NXDOMAIN**. They were entered with the full name in Namecheap's Host field, so the zone doubled the domain: `<token>._domainkey.smlcompany.ca.smlcompany.ca` resolves, the correct name does not `[verified 2026-08-26 — DNS]` |
| SES identity — **`ca-central-1` (the one that matters)** | `Verified: true`, `DkimStatus: SUCCESS`, tokens `kznn…` / `jdue…` / `f5pu…` — the set that resolves. **Healthy. Change nothing** `[verified 2026-08-26]` |
| SES identity — `us-east-1` (unused) | `Verified: false`, `DkimStatus: PENDING`, tokens `3zsn…` / `jejgp…` / `xpiwy…` — the doubled-domain set. A stray identity in a region this project does not use `[verified 2026-08-26]` |
| ⚠️ **SES sandbox is per-region** | Production access must be requested **in `ca-central-1`**. The AWS console defaults to `us-east-1`; requesting there grants access to the wrong region and the intake email still fails `[verified 2026-08-26]` |
| SES custom MAIL FROM | **Not configured** — SES reports "No MAIL FROM records found". This is why SES's SPF is unaligned and DMARC rests on DKIM. Optional future improvement, not required `[verified 2026-08-26]` |
| **DMARC alignment** | SES satisfies DMARC via **DKIM**, not SPF — without a custom MAIL FROM domain its envelope sender is at `amazonses.com` and is unaligned. The SPF record's real job is authenticating **Google Workspace** mail `[verified 2026-08-26]` |
| **Do not delete** | Two ACM validation CNAMEs → `jkddzztszm.acm-validations.aws`. They renew the `adr.smlcompany.ca` certificate; deleting them breaks HTTPS silently at the next renewal `[verified 2026-08-26]` |
| Root domain | `@` carries a Namecheap **URL Redirect Record** to `sml-coming-soon.ca`. TXT records coexist with it — adding SPF does not disturb it `[verified 2026-08-26]` |
| DNS confirmed | `adr.smlcompany.ca` CNAME → `d26v23dhgsp2ta.cloudfront.net` `[verified 2026-08-26]` |
| TLS | ACM certificate `[verified 2026-08-25 — AWS-Hosting-Guide.md]` |
| DNS | **Namecheap**, not Route 53 `[verified 2026-08-25 — AWS-Hosting-Guide.md]` |
| Intake backend | API Gateway (HTTP API) → Lambda → DynamoDB, notifications via SES `[verified 2026-08-25 — AWS-Hosting-Guide.md]` |
| Repository | **`adr-sml`**, self-hosted **Gitea**. Local clone at `/Users/pouya/Dev/Websites/adr-sml` `[verified 2026-08-26]` |
| CI/CD | **Gitea Actions**, `.gitea/workflows/deploy.yml`. `.github/workflows/deploy.yml` kept as the OIDC reference in case the repo ever moves. Credentials: scoped IAM user in Gitea secrets — **no OIDC available** `[verified 2026-08-26 — D3 as amended]` |
| Analytics | **Plausible or Fathom** — cookieless, no personal data, no consent banner, EU-hosted `[verified 2026-08-26 — D15]` |
## 8. Design system
Full token set, type scale, motion rules, and contrast results:
**`docs/02-design-system.md`**.
Palette and infinity mark carry over unchanged. Execution is modernized:
fluid type scale, self-hosted fonts, an 8 px spacing scale, motion gated behind
`prefers-reduced-motion`, and one hard accessibility constraint discovered by
measurement:
> **Gold `#c9a876` on cream `#faf7f2` measures 2.10:1 contrast.** That fails WCAG
> AA for body text (4.5:1) and for large text (3:1). Gold is a decorative and
> on-dark colour only. On maroon it measures 5.84:1 and on ink 8.00:1, both of
> which pass. `[verified 2026-08-25 — computed]`
## 9. Open questions — blocking
Nothing below can be invented. Each needs an answer from Pouya.
| # | Question | Blocks |
|---|---|---|
| ~~Q1~~ | **ANSWERED 2026-08-26.** Licensure is left out entirely; the site asserts the JD only. See D13 | — |
| ~~Q2~~ | **ANSWERED 2026-08-26.** Q.Arb commenced August 2026 | — |
| ~~Q3~~ | **ANSWERED 2026-08-26.** Email `info@smlcompany.ca`. No public phone — "By scheduled call". Location: Toronto · Ontario · By appointment | — |
| ~~Q4 / Q14~~ | **ANSWERED 2026-08-26.** Rate card confirmed by Pouya — see D14 and `docs/07-fees.md` | — |
| ~~Q13~~ | **ANSWERED 2026-08-26.** Self-hosted Gitea with Gitea Actions | — |
| ~~Q15 / Q16 / Q17~~ | **ANSWERED 2026-08-26.** Non-mediation hourly $500. Prep bundled: 2 h in the half day, 3 h in the full day, **stated on the page**. Overtime $500/h | — |
| Q5 | Booking tool — **parked 2026-08-26 at Pouya's request.** Build `/contact/` with the form only and a clean slot for the embed. Now tracked as standing reminder R6 | `/contact/` — non-blocking |
| ~~Q6~~ | **ANSWERED 2026-08-26.** Supplied and committed: `src/assets/pouya-lajevardi.jpg` (1600×1600 master) and `src/assets/og-portrait.jpg` (1200×630 link-preview crop) | — |
| ~~Q7~~ | **ANSWERED 2026-08-26.** Pouya reverted to generic. The boutique is **never named**; refer to it as *a Toronto litigation and ADR boutique* throughout | — |
| ~~Q8~~ | **ANSWERED 2026-08-26.** ADRIC, ADRIO, OBA sections. Not OCNI. Not LSO (see §4) | — |
| ~~Q9~~ | **ANSWERED 2026-08-26.** Gitea, repo `adr-sml`, clone at `/Users/pouya/Dev/Websites/adr-sml` | — |
| ~~Q10~~ | **ANSWERED 2026-08-26.** Full inventory captured; values in §7 | — |
| ~~Q18~~ | **ANSWERED 2026-08-26.** `smlcompany.ca` is verified for sending — `true`. The `None` in the earlier listing was a query artefact, not a fault | — |
| **Q19** | **CONFIRMED AS A BLOCKER 2026-08-26. Request it in `ca-central-1`, not the console's default `us-east-1` — the sandbox is per-region.** `ProductionAccessEnabled: false` — the SES account is in the **sandbox**, so mail reaches only pre-verified addresses. Confirmed with Pouya (D18) that the inquirer receipt is wanted, so production access **is** required. ~24 h AWS turnaround. **The only item on this project with external lead time** | The confirmation half of `/contact/` |
| ~~Q20~~ | **ANSWERED 2026-08-26.** Both records added by Pouya and independently verified: SPF `v=spf1 include:_spf.google.com include:amazonses.com ~all` on `@`, DMARC `v=DMARC1; p=none; rua=mailto:info@smlcompany.ca; fo=1` on `_dmarc`. Both existing `@` TXT records, Google DKIM, MX, and the `adr` CNAME all confirmed intact | — |
| ~~Q21~~ | **ANSWERED 2026-08-26.** `ca-central-1` is healthy (`SUCCESS`) on the resolving token set. The broken records belong to a stray `us-east-1` identity this project does not use. **Nothing to fix.** The three dead CNAMEs are inert; leaving them is the low-risk choice | — |
| ~~Q11~~ | **ANSWERED 2026-08-26.** Privacy-first, cookieless — Plausible or Fathom. No GA4, no consent banner | — |
| ~~Q12~~ | **ANSWERED 2026-08-26.** `https://www.linkedin.com/in/pouyalajevardi/` | — |
## 10. Risks
| Risk | Severity | Mitigation |
|---|---|---|
| A fabricated or unverifiable claim reaches a public page | **High** — professional-conduct exposure for a licensed practitioner | §4 register; every claim traced to a source before it ships |
| Copy silently carried over from the placeholder template | High | Nothing is ported verbatim. All copy written fresh against `docs/03-content-spec.md` |
| Insights section launches and then goes stale | Medium | D9 commits to 3–5 pieces at launch and a monthly cadence. A dead blog is worse than no blog |
| Personal data in the intake pipeline without a retention policy | Medium — PIPEDA | `docs/05-backend-spec.md` sets retention, and `/legal/privacy/` states it |
| Cutover breaks the live site (D11 is a single-shot deploy) | Medium | Full pre-cutover checklist in `docs/06-deployment.md`; CloudFront can be rolled back to the prior origin path |
| Twenty pages of thin copy rank worse than six good ones | Medium | Each page must justify itself with substantive content. Ship fewer pages rather than padded ones |
| **Deploy-credential blast radius.** AWS account `327082975128` is not a single-project account. It also holds `meshkinilaw.ca` and its preview site, `demesne.media`, `orynenergy.ca`, `lajirugs.ca`, and **`mlp-clientdb-prod-backups`** — which by its name is a law firm's production client-database backups | **High** | A static deploy key for a personal website must never be able to reach a client database. The scoped IAM policy in `docs/06-deployment.md` grants four actions on one bucket and one distribution and nothing else — that narrowness is now load-bearing, not hygiene. Never widen it. Never reuse the `user/pouya` credentials in CI `[verified 2026-08-26 — inventory]` |
| **SES is in the sandbox** — confirmed, not hypothetical | **High** | Q19. Until production access is granted, every confirmation email to an inquirer fails silently. The site appears to work; the inquirer concludes they were ignored. Request access early — it is the only dependency with an external turnaround |
| **No SPF and no DMARC on `smlcompany.ca`** | **High** | Q20. Affects SES *and* the existing Google Workspace mail — Pouya's business email is unauthenticated today, which is a live deliverability problem independent of this project. Gmail and Yahoo both penalise it. Add both records before requesting SES production access; AWS also weighs domain authentication when reviewing |
## 11. Glossary
| Term | Meaning |
|---|---|
| ADR | Alternative dispute resolution |
| ADRIC | ADR Institute of Canada — national credentialing body |
| ADRIO | ADR Institute of Ontario — provincial affiliate |
| Q.Med | Qualified Mediator — ADRIC/ADRIO designation |
| Q.Arb | Qualified Arbitrator — ADRIC/ADRIO designation |
| C.Med-Arb | Chartered Mediator-Arbitrator — senior hybrid designation; the long-term goal |
| Med-Arb | Hybrid process: mediation that converts to binding arbitration if unresolved |
| SABS | Statutory Accident Benefits Schedule — Ontario auto insurance benefits |
| LAT | Licence Appeal Tribunal — hears Ontario SABS disputes |
| POA | Provincial Offences Act |
| ENE | Early neutral evaluation |
| LSO | Law Society of Ontario |
| OBA | Ontario Bar Association |
| IESO | Independent Electricity System Operator |
| OEB | Ontario Energy Board |
| SMR | Small modular reactor |
| PIPEDA | Personal Information Protection and Electronic Documents Act |
## 12. Standing reminders
**Surface these to Pouya at the start of any substantial session.** They are
open questions he has deliberately parked, not settled matters. The point of
this section is that a parked decision does not quietly become permanent by
never being raised again.
| # | Reminder | Raised | Why it must keep coming back |
|---|---|---|---|
| R1 | **Licensure.** The site currently asserts the JD only and describes the boutique role as *active litigation exposure*, never *practice*. Pouya flagged this as an interim position and asked to be reminded to change it | 2026-08-26 | If he is licensed and in good standing, it is the first credential appointing bodies and opposing counsel look for, and its absence from a detailed credentials page is conspicuous. If licensure is in progress, the copy should be rewritten the moment it completes. Either way this is a **temporary** framing that will otherwise ossify |
| R2 | **Matter counts stay off the site until they are independently credible.** Revisit once there is a number a sophisticated GC would find persuasive on its own | 2026-08-26 | §4 forbids them now. That rule has an expiry date nobody has set |
| R3 | **Indigenous engagement practice page.** Deliberately omitted at launch (§6). Revisit at month 12–18 | 2026-08-26 | The strategy brief rates it the most valuable single niche. Omission is a timing call, not a permanent one |
| R4 | **Insights cadence.** D9 commits to monthly. A blog that stops is worse than one that never started | 2026-08-26 | The section's whole value is compounding |
| R5 | **Fee review at 12 months.** Published rates are sticky; the right moment to move them is deliberate, not reactive | 2026-08-26 | D14 is priced for where the practice is going, not where it is |
| R6 | **Booking tool.** Parked by Pouya on 2026-08-26; `/contact/` ships with the intake form and a reserved slot for an embed | 2026-08-26 | He asked to be reminded. D10 committed to booking because it removes the back-and-forth that loses appointments — the form alone is a partial answer |
---
# Change Log
## 2026-08-26 (k) — Q21 resolved: nothing broken; SES sandbox is per-region
**Who:** Pouya ran the per-region check.
**Q21 closed — the good case.**
| Region | Verified | DKIM | Tokens |
|---|---|---|---|
| `ca-central-1` | `true` | **SUCCESS** | `kznn…` `jdue…` `f5pu…` — resolve correctly |
| `us-east-1` | `false` | PENDING | `3zsn…` `jejgp…` `xpiwy…` — doubled domain |
The region that matters is healthy. The three broken CNAMEs belong to a stray
`us-east-1` identity that nothing in this project uses; it is PENDING precisely
*because* those records were entered with the domain doubled. **No fix required.**
Recommendation recorded: **leave the three dead CNAMEs in DNS.** They are inert,
and the only way to cause harm is deleting the wrong row from a list of six
visually similar records. Optionally delete the `us-east-1` identity itself so it
stops reporting PENDING — that is a control-plane action with no DNS risk.
**New finding, and it would have cost a day: the SES sandbox is per-region.**
`ProductionAccessEnabled: false` was read from `ca-central-1`, which is where the
intake Lambda, DynamoDB, and API Gateway all live. The AWS console defaults to
`us-east-1`, and the panel Pouya screenshotted was `us-east-1` — so the natural
path would have been to request production access in the wrong region, wait a
day, and find the confirmation email still failing. Flagged in §7 and on Q19.
**Also worth noting for the record:** entry (j)'s correction was itself only
half the story. DNS proved which records resolved; it could not prove which
*mattered*. That needed the control plane. Neither source is sufficient alone —
the data plane says what exists, the control plane says what is expected, and a
discrepancy between them is the finding.
**Closed:** Q21. **Still blocking:** Q19 only.
---
## 2026-08-26 (j) — SPF/DMARC live; and a correction: three DKIM records are broken
**Who:** Pouya added the two TXT records. Claude verified independently.
**Q20 closed.** SPF and DMARC are both live and correct, confirmed by direct DNS
query rather than taken on report. Also confirmed unchanged: both existing `@`
TXT records, `google._domainkey`, `MX 1 smtp.google.com`, and
`adr.smlcompany.ca` → CloudFront. Nothing was disturbed.
**Correction to entries (h) and (i) — I had the two DKIM sets backwards.**
- Old → new: "`3zsn…`/`jejgp…`/`xpiwy…` are the live set; `f5pu…`/`jdue…`/`kznn…`
are inert orphans" → **the opposite.** The `f5pu` set resolves NOERROR at the
correct names. The `3zsn` set returns **NXDOMAIN**.
- **Root cause found.** `3zsnvsjg…._domainkey.smlcompany.ca.smlcompany.ca`
resolves; the correct name does not. Those three were entered into Namecheap's
Host field with the **full name including the domain**, so Namecheap appended
the domain a second time. This is precisely the gotcha flagged in entry (h) —
which was written before checking whether the existing records had already
fallen into it.
- **Why I got it wrong:** I inferred "live" from the SES console listing them and
did not verify against DNS. The console shows what SES *expects*, not what
exists. Lesson worth keeping: a control-plane listing is not evidence about the
data plane.
- **No harm done.** The advice in (i) was "leave both sets alone", which happened
to be the safe action either way.
**Q21 opened.** SES is regional, and `ca-central-1` reported
`VerifiedForSendingStatus: true` — only consistent with the `f5pu` set. So the
console panel screenshotted was probably a different region's identity. Until
that is confirmed per region, it is unknown whether the broken records matter.
Nothing should be deleted before that check.
**Closed:** Q20. **Opened:** Q21. **Still blocking:** Q19 (SES production access).
---
## 2026-08-26 (i) — SES DNS panel resolves the DKIM ambiguity; MAIL FROM absent
**Who:** Pouya sent the SES "Domain DNS records" panel.
**The six DKIM CNAMEs are now fully explained.** SES lists exactly three for
`smlcompany.ca`: `3zsnvsjg…`, `jejgp7na3…`, `xpiwyftpo…`. The other three in
Namecheap — `f5puwearz…`, `jdue2r22c…`, `kznn3cklv…` — are **not** referenced by
SES and are residue from an earlier verification of the same domain. Note the
TTLs corroborate this: the live set reads "1 min", the orphans "Automatic",
consistent with two separate additions.
**Recommendation recorded: leave the orphans in place.** They are inert. The only
way this becomes a problem is deleting the wrong three, which would break SES
DKIM and therefore DMARC. There is no upside to tidying a DNS zone.
**Custom MAIL FROM is not configured** — "No MAIL FROM records found". This
independently confirms the correction in entry (h): SES's envelope sender is at
`amazonses.com`, its SPF pass is unaligned with `smlcompany.ca`, and DMARC is
satisfied through DKIM alone. Configuring a custom MAIL FROM would add SPF
alignment as belt-and-braces; it is optional and not on the critical path.
**AWS's suggested DMARC value is `v=DMARC1; p=none;`** — valid but minimal, with
no `rua`, so it produces no reports. Using `v=DMARC1; p=none; rua=mailto:info@smlcompany.ca; fo=1`
instead so the monitoring period actually yields data before tightening to
`quarantine`.
**Net action for Q20 is two TXT records and nothing else.**
---
## 2026-08-26 (h) — DNS inspected; earlier SPF reasoning corrected
**Who:** Pouya sent the Namecheap DNS panel, asking exactly what to change
without breaking anything.
**Correction to entry (g) — the SPF reasoning was wrong.** Old → new: "SES needs
SPF or mail lands in spam" → **SES authenticates via DKIM, not SPF.** Without a
custom MAIL FROM domain, SES's envelope sender sits at `amazonses.com`, so its
SPF pass is not aligned with `smlcompany.ca` and contributes nothing to DMARC.
The six `*.dkim.amazonses.com` CNAMEs already in Namecheap are what make SES
DMARC-compliant, and they are working. The SPF record's real value is
authenticating **Google Workspace** mail, which has none. `include:amazonses.com`
stays because it is harmless and becomes live if a custom MAIL FROM is added.
Entry (g) is left as written per rule 3; this is the correction.
**Also found in the DNS panel:**
- Six SES DKIM CNAMEs where three are needed — the domain was verified twice.
Harmless, but do not prune without checking SES first.
- Two ACM validation CNAMEs → `jkddzztszm.acm-validations.aws`. **Flagged as
never-delete**: they auto-renew the `adr.smlcompany.ca` certificate, and
removing them breaks HTTPS silently at the next renewal rather than
immediately. This is the only genuinely destructive mistake available in that
panel.
- `@` carries a Namecheap URL Redirect to `sml-coming-soon.ca`. TXT records
coexist with it, so adding SPF does not disturb the redirect.
**DMARC `rua` changed** from `pouya@` to `info@smlcompany.ca` — the mailbox
confirmed to exist.
**Still blocking:** Q19 (SES production access), Q20 (the two TXT records).
---
## 2026-08-26 (g) — SES purpose clarified; D18; SPF and DMARC found missing
**Who:** Pouya asked why SES is needed given he already has an `info@` mailbox.
Fair question — the answer exposed two things.
**The distinction, recorded because it will come up again.** A mailbox receives
mail and a person logs into it. SES lets *code* send mail — the intake Lambda has
no mailbox and no login. They are complementary, not alternatives: SES sends
**to** `info@smlcompany.ca`. Verifying the address in SES did not create a
mailbox; it authorised sending.
**D18 — two emails per submission (new decision).** The sandbox blocks only one
of the two: the notification to Pouya works (his address is verified), the
**receipt to the inquirer** does not. That receipt was Claude's addition in
`docs/05-backend-spec.md`, not part of the original AWS-guide build, so it was
put back to Pouya as a real choice rather than treated as a defect. **He confirmed
he wants it** — so Q19 is genuinely blocking rather than optional.
**Q20 opened — the domain has no email authentication at all.** A DNS query of
`smlcompany.ca` on 2026-08-26 returned:
- TXT: only `anthropic-domain-verification` and `google-site-verification`.
**No `v=spf1` record of any kind.**
- `_dmarc.smlcompany.ca`: **no record.**
- MX `1 smtp.google.com` and `google._domainkey` present — Google Workspace with
DKIM configured.
- `adr.smlcompany.ca` CNAME → `d26v23dhgsp2ta.cloudfront.net`, as expected.
Old → new (planned): no SPF, no DMARC → one SPF record covering **both** Google
and Amazon SES, plus a DMARC record starting at `p=none`.
**This is wider than this project.** Pouya's existing business email from
`smlcompany.ca` is sending unauthenticated today. Google Workspace's DKIM carries
it, but Gmail and Yahoo both penalise missing SPF and DMARC, so mail he sends as a
human is already more likely to be filtered than it should be. Raised to **High**
in §10 and flagged to him directly. Both records should go in before the SES
production-access request — AWS weighs domain authentication when reviewing, so
it improves the odds of first-time approval as well.
**Opened:** Q20. **Still blocking:** Q19, Q20.
---
## 2026-08-26 (f) — SES sandbox confirmed; execution protocol built into the repo
**Who:** Pouya. Claude recording.
**Q18 closed, Q19 confirmed as a live blocker.** `smlcompany.ca` **is** verified
for sending (`true`) — the earlier `None` was a query artefact, not a fault. But
`ProductionAccessEnabled: false`: **the account is in the SES sandbox.** Mail
reaches only pre-verified addresses, so an inquirer's confirmation email fails
silently. Raised from Medium to **High** in §10: this is the failure mode where
the site looks like it works and the inquirer concludes they were ignored.
Production access must be requested; ~24 h turnaround, and it is the only
dependency on this project with external lead time.
**D17 — working method, made structural (new decision).**
- Old → new: an implicit understanding that Claude Code implements what Pouya
decides → **an explicit six-phase loop encoded in the repository**, so it
applies without being restated in each prompt.
- Why: Pouya's direction — he architects, Claude Code programs and then
adversarially reviews, with deep reasoning on, permanently.
- Added:
- `.claude/agents/adversarial-reviewer.md` — code, accessibility,
crawlability, performance, security, simplicity. Instructed to **treat
uncertainty as a defect** and told that an approving review which misses a
real defect is a failure.
- `.claude/agents/claims-auditor.md` — every factual assertion traced to §4.
Separate agent on purpose: a generic reviewer consistently under-weights
professional-conduct checks, which is this project's highest-stakes failure
mode. It also audits JSON-LD, since a machine-readable misrepresentation is
still a misrepresentation.
- `.claude/commands/build.md` — the loop. `/review` — phase 3 alone.
`/wrap` — the session-end `AGENTS.md` ritual.
- `.claude/settings.json` — thinking on, high effort, and a read-deny on
`.env*` and `aws-inventory.txt`.
- `CLAUDE.md` — the protocol and the reasoning behind it.
- `docs/08-execution-protocol.md` — the prompt template Pouya writes from.
- **The design decision worth preserving:** the reviewers are given the diff and
the specs, and deliberately **not** the implementer's rationale. Explaining why
the work is correct anchors the reviewer and converts review into agreement.
Independence is the mechanism, not a courtesy. If a future change to this
protocol removes that, it removes the value.
**Closed:** Q18. **Still blocking:** Q19 (SES production access).
---
## 2026-08-26 (e) — AWS inventory captured; Q10 closed; blast-radius risk logged
**Who:** Pouya ran `scripts/aws-discover.sh`. Claude recording.
**Q10 closed.** All identifiers in §7. Bucket `adr-smlcompany-site`,
distribution `E1OK7G98KNKUTA`, region `ca-central-1`, intake API
`4tl0m5igkj`. Certificate ISSUED. **S3 versioning is already Enabled**, so the
rollback path in `docs/06-deployment.md` works as written — no change needed.
**Data residency confirmed.** Hosting, Lambda, and DynamoDB are all in
`ca-central-1`. `docs/05-backend-spec.md` treated Canadian residency as a
selling point conditional on the table's region; it is now a verified fact and
`/legal/privacy/` can state it plainly.
**New risk logged — deploy-credential blast radius.** The inventory shows this is
a shared account across at least five unrelated properties, including
`mlp-clientdb-prod-backups-327082975128`. A Gitea runner holding a static AWS key
for this site sits in the same account as a law firm's client-database backups.
Nothing about the plan changes — the scoped IAM policy was already correct — but
its narrowness is now load-bearing rather than good practice, and that is
recorded so nobody widens it later for convenience.
**Q18 and Q19 opened — SES.** `list-email-identities` returned
`VerifiedForSendingStatus: None` for all six identities, and sandbox status was
not checked. Either condition means the intake confirmation email silently fails.
This is the failure mode where the site appears to work and inquirers think they
have been ignored, so it is on the cutover checklist, not the nice-to-have list.
**Closed:** Q10. **Opened:** Q18, Q19.
---
## 2026-08-26 (d) — Memberships, analytics, prep time, firm naming; one blocker left
**Who:** Pouya. Claude recording.
**Q16 closed — preparation time is bundled and stated.** 2 h in the half day,
3 h in the full day, printed on `/fees/`. The carried-forward assumption is now a
decision. At $4,000 a day counsel will assume preparation happened; saying so
converts the assumption into a selling point and forecloses an argument about
what the fee covered.
**Q15 and Q17 closed.** Non-mediation hourly (ENE, settlement counsel,
dispute-system design, technical advisory) and mediation overtime both **$500/h**,
matching the arbitration rate.
**Q8 closed — memberships.** Old → new: five `[assumed]` bodies from the strategy
brief → **ADRIC, ADRIO, and OBA sections, verified.** OCNI is **not current** and
must not be published; the brief listed it as aspirational positioning for the
nuclear niche, which is a different thing from a membership.
- **LSO was deliberately not offered as an option and is not published.** Listing
the Law Society in a credentials block implies licensure, which D13 bars. Worth
recording explicitly so a later reader does not "helpfully" add it back.
- Which OBA sections remains `[assumed]` — the brief names Construction &
Infrastructure, ADR, and Civil Litigation. Low stakes; confirm in passing.
**D15 — analytics (new decision).** Old → new: unchosen → **privacy-first and
cookieless**, Plausible or Fathom. No GA4, no consent banner, no personal data
leaving the site, one honest line in the privacy policy. Consistent with a
practice whose privacy posture is part of its offer, on a site where visitors are
often describing live disputes.
**D16 — the boutique is never named (new decision).** Old → new: "may be named,
name pending" → **generic throughout**: *a Toronto litigation and ADR boutique*.
Pouya reversed his earlier answer. Trade-off, recorded for the record: naming a
recognisable firm is a meaningful credibility signal to appointing bodies, and
the generic phrasing gives that up in exchange for zero coordination cost and no
dependency on anyone else's sign-off. Do not infer the name from his email domain
or from anything else.
**Closed:** Q7, Q8, Q11, Q15, Q16, Q17. **Opened:** none.
**Q10 is now the only blocker.** Everything else needed to build is answered.
R6 (booking) stays parked by choice and does not block `/contact/`.
---
## 2026-08-26 (c) — Contact, headshot, LinkedIn; booking parked
**Who:** Pouya. Claude recording.
**Closed.** Q3 — contact is `info@smlcompany.ca`, no public phone, consultations
by scheduled call. Q6 — headshot supplied; committed as
`src/assets/pouya-lajevardi.jpg` (1600×1600 master, for Astro to derive AVIF and
WebP from at build) and `src/assets/og-portrait.jpg` (1200×630, cropped high so
the face is not centred under the fold of a link preview). Q12 — LinkedIn URL,
which now feeds `sameAs` in the `Person` JSON-LD.
**Q5 parked, not closed.** Old → new: "choose a booking tool" → **deferred at
Pouya's request**; `/contact/` ships with the intake form and a reserved slot for
an embed, so adding one later is a drop-in rather than a rebuild. He asked to be
reminded, so it is now **R6** in §12 rather than a question that quietly expires.
Worth restating when it comes back up: D10 chose booking because it removes the
scheduling back-and-forth that loses appointments, and the form alone only
half-solves that.
**Q7 partially answered.** The boutique may be named. The name itself was not
given. His email domain (`meshkinilaw.ca`) points to **Meshkini Law**, but an
inferred firm name is exactly the kind of thing §4 exists to stop — asked for
confirmation rather than published.
---
## 2026-08-26 (b) — Fees confirmed; Gitea; licensure wording; standing reminders
**Who:** Pouya, answering the second round. Claude recording.
**D14 closed — rate card confirmed, and it is not what was recommended.**
- Old → new: two-tier card (Tier A insurance/SABS at $1,800/day, Tier B
commercial at $3,200/day) → **one rate for all mediation matters: $2,000 half
day, $4,000 full day, $500 per party beyond two.** Arbitration $500/h, hearing
day $4,000, documents-only flat $6,500 simple / $9,500 complex. Tribunal-
secretary line removed. Cancellation terms adopted as recommended.
- Why: Pouya's decision.
- **Recorded dissent, for the 12-month review (R5).** A single premium rate puts
the insurance / SABS / LAT segment out of reach — the published market there
runs roughly $800–$1,200 a day, and $4,000 is three to five times it. That is
the segment the strategy brief (§IV.7) identifies as the highest realistic
near-term volume, flowing directly from the firm's existing accident-benefits
work. The trade is deliberate if it is deliberate: a premium specialist
position that forgoes volume. It is a mistake if the volume was being counted
on. Flagged once, implemented as directed.
- Three parameters were not specified and are carried forward as assumptions,
logged as Q15–Q17: non-mediation hourly ($500), bundled prep hours (2 h half
day / 3 h full day), mediation overtime ($500/h).
**D13 refined — approved wording for the boutique role.**
- Old → new: "describe the role factually" → the specific approved phrases are
**"active litigation exposure"** and **"involvement in litigation and ADR
matters"**. The word **"practice"** is barred in that context.
- Pouya asked to be **continuously reminded** that this is interim. That request
is now structural rather than a note — see the new §12.
**New §12, Standing Reminders.** Five items (R1–R5) that any agent must surface
at the start of a substantial session. Added because a parked decision otherwise
becomes permanent by never being raised again — and R1 is Pouya's explicit
instruction to keep raising it.
**D3 amended again — Gitea.**
- Old → new: "private git server, software unknown" → **self-hosted Gitea with
Gitea Actions**, clone at `/Users/pouya/Dev/Websites/adr-sml`.
- Consequence: Gitea Actions uses GitHub Actions syntax, so the workflow ports
almost unchanged into `.gitea/workflows/deploy.yml`. But **Gitea is not an AWS
OIDC provider**, so the OIDC role assumption is replaced by a scoped IAM user
whose key lives only in Gitea's secret store. The IAM policy stays exactly as
narrow. Quarterly rotation is now an operational obligation that OIDC would
have made unnecessary — noted in `docs/06-deployment.md`.
**Closed:** Q4, Q9, Q13, Q14. **Opened:** Q15, Q16, Q17.
**Still open:** Q3, Q5, Q6, Q7, Q8, Q10, Q11, Q12, Q15, Q16, Q17.
---
## 2026-08-26 (a) — Licensure decision; Q.Arb dated; git host changed; fees researched
**Who:** Pouya, answering the blocking questions from §9. Claude recording.
**Date correction.** The entry below is stamped 2026-08-25. The correct date of
that work was **2026-08-26** — the session clock was a day behind. Per rule 3 the
entry is left as written rather than edited; this note is the correction. Facts
touched today are re-stamped `[verified 2026-08-26]`.
**D13 — licensure left out of the site (new decision).**
- Old → new: "confirm LSO licence status before launch" → **the site asserts the
JD and makes no licensure claim at all.**
- Why: Pouya's direction.
- **Consequence, and it is not small.** The strategy brief describes an *"active
litigation practice in personal injury, construction, regulatory (POA), and
insurance (SABS) matters."* Copy written that way would imply entitlement to
practise law without stating it — which is the risk the decision is meant to
avoid, restated in different words. So the Forbidden table now bars implication
as well as assertion, and the About page describes the role factually:
*Director of Firm Operations at a Toronto litigation and ADR boutique*, plus
the matter types worked on. **Flagged back to Pouya**: if he is in fact
licensed and in good standing, that is a material credential for exactly the
audience this site targets, and omitting it costs more than it protects.
**Q.Arb dated.** Old → new: `[assumed]`, stage unknown → **commenced August
2026** `[verified 2026-08-26]`. Describe as newly commenced. Not as held, not as
nearing completion.
**D3 amended — the repository is not on GitHub.**
- Old → new: "git repo + GitHub Actions" → **repo `adr-sml` on a private git
server**; the GitHub Actions workflow in `.github/workflows/` is retained as a
working reference implementation, to be translated once the server software is
known (**Q13**).
- Why: Pouya is running his own git server.
- Knock-on: GitHub's OIDC provider is unavailable. GitLab CE can federate to AWS
by OIDC; Gitea/Forgejo and bare git cannot, so those need a scoped IAM user
with rotated keys, or deploys run from Pouya's machine. The choice is real and
waits on Q13.
**D14 — fee structure recommended (new decision, pending sign-off).** Market
research completed against the Ontario mandatory-mediation tariff, ADR Chambers
published ranges, and four published Ontario practitioner rate cards. A two-tier
structure is recommended so the price-sensitive SABS/LAT volume work does not
anchor the commercial rate. Figures are in the response to Pouya and are **not
written into any page until he signs off (Q14).**
**Still open:** Q3, Q5, Q6, Q7, Q8, Q10, Q11, Q12, Q13, Q14.
---
## 2026-08-25 — Project initiated; architecture decided; repo bundle authored
**Who:** Pouya Lajevardi with Claude (Cowork session), acting as architects. Claude Code to implement.
**What was discussed.** Pouya asked for a modernization of `adr.smlcompany.ca`
going beyond appearance — content and codebase included — with Claude Code doing
the implementation and deploying to AWS.
**What was found.** An audit of the live site and the local sources established
the facts in Current Truth §2. The headline finding: the site is a browser-
compiled single-file React bundle that serves crawlers three words of content.
For a personal-brand site whose function is discoverability, this is the
dominant problem, ahead of any question of looks or copy.
**What was decided.** Twelve decisions, D1–D12, recorded in §3. In summary: an
Astro static rebuild, full content re-architecture, ~20 pages, English only,
git + GitHub Actions onto the existing S3/CloudFront, palette and infinity mark
retained with a modernized execution, a published rate card, an Insights section
launching with drafted content, a rebuilt intake form plus booking, and a single
clean cutover.
- Old → new (framework): browser-compiled React single file → Astro static site
- Old → new (publishing): manual `rebuild-standalone.py` + console upload → git + GitHub Actions with OIDC
- Old → new (structure): one scrolling page → ~20 pre-rendered pages
- Old → new (content): partially-corrected placeholder template → written fresh against a claim register
- Old → new (record-keeping): none → this file, under the AGENTS constitution
**Why.** Discoverability is the practice's growth constraint and the current
architecture forecloses it. Every other decision follows from fixing that, with
the content decisions following from the strategy brief of 2026-05-26.
**Also decided, not yet discussed with Pouya:** no Indigenous engagement practice
page at launch (§6), on the reasoning recorded there. Flag this to him.
**Planned, not yet done.** Astro implementation; all page copy; 3–5 Insights
drafts; intake backend rework; CI/CD wiring; pre-cutover audit. Twelve blocking
questions are open in §9 — several pages cannot be written until they are
answered.