CipherShift365 -- Strategic Decisions

DR-0 -- Strategic Posture: Specialist Practice

Decision: Commit CipherShift365 v1 to Posture 1 -- Specialist Practice (services-led, .NET-deep, on-prem, engagement + license pricing).

Why: It is the only posture a solo founder can realistically execute; it monetises expertise immediately; it competes in the open gap rather than against funded incumbents.

Honest downsides:

• Revenue is capped by founder time.
• Key-person risk.
• Scaling wall beyond a certain point.

Mitigations: Annual platform license for Guardian creates recurring revenue; Vault and Guardian are productised; durable moat is kept off-client.

DR-1 -- Product Name & House Naming Convention

Decision: Product name is CipherShift365; modules are Compass (Discover), Vault (Migrate), Guardian (Guard).

House convention: 365 Architect products carry the 365 suffix as deliberate family branding (NestVault365, CodeNest365, etc.) -- not accidental collision with Microsoft 365.

DR-2 -- Go-to-Market Motion

Decision: Lead with the CBOM + migration plan as the credibility artifact that opens a consulting engagement; Vault and Guardian are delivery vehicles within it.

DR-3 -- Scope Breadth

Decision: Stay deep on .NET rather than broaden cross-platform; depth is the defensible differentiator for a small team.

DR-5 -- Hosting Roadmap

Decision: Ship on-prem / deploy-anywhere only; the offline guarantee is a genuine moat. Make no architectural choice that permanently forecloses a future hosted tier, but build no hosted capability in v1.

DR-6 -- IP-Protection Depth

Decision: Moderate posture:

• Sign all distributed artifacts
• Encrypt KB at rest (decrypt in memory)
• Native AOT + light obfuscation for runtime
• Do not pursue heavy commercial obfuscation
• Keep durable moat off-client (corpus, cadence, research, services)

DR-7 -- Posture 2: Horizontal Platform (Parked)

Status: Parked. A possible next product / next level if capacity changes, funding arrives, or proven demand emerges.

What it would be: SaaS-first, broadened scope, subscription/per-seat pricing, optional hosted aggregation.

Re-open triggers:

1. Founder hires/cofounders
2. External funding becomes available
3. KB and CBOM engine validated across multiple paid engagements
4. Repeated unsolicited demand for self-serve / hosted offering