← All investor documents · This document as plain markdown
# The Achievement: One Founder, ~10 Months, a Production Commerce OS **The build-proof and discipline record behind ComOS** *First written November 2025. Rewritten July 14, 2026 under CO 297. Every number was re-derived 2026-09-15 against `comos-federation` at HEAD `6b70605` — the live system. Facts are stated as facts; estimates are labeled as estimates.* --- ## What This Document Is This is the capital-efficiency and de-risk exhibit. It documents three claims, each verifiable: 1. **The system exists at production scale.** ~271,000 lines of live TypeScript, 9 autonomous agents declared on the agent service (8 cron-scheduled), four agent-commerce protocol surfaces served, live endpoints anyone can query today. 2. **It was built by one founder working with AI** — ~3,000 hours over ~10 months, ~$5,000 in compute. 3. **It is maintained under machine-checked discipline.** The methodology that keeps AI-built code correct at this scale — proof-before-done, change orders, the honesty ratio, quality sweeps — is itself part of the achievement, and it goes in the data room. This is not the business-model document. The revenue model gets one short section here ([below](#the-revenue-model-in-brief)) and lives in full at docs/business/FINANCIAL-MODEL.md. --- ## The Numbers (re-derived 2026-09-15, federation-only) **Read this row first.** The live system is `comos-federation` alone. comAI — the commerce engine that carried the earlier headline counts — was deprecated on 2026-08-04, after CO 420 deleted its entire deployed estate from GCP. Every figure below is counted from the repo that actually serves traffic. | Metric | Value | |---|---| | **Live code** | ~271,000 lines of TypeScript — ~180K source / ~91K tests | | **Built vs. live** | Two full systems were built and then deliberately retired: comai-portal (~392K, deprecated 2026-07-14) and comAI Retail (~435K, deprecated 2026-08-04). Both are excluded from every live count here — see [Subtraction](#subtraction-two-systems-built-then-deliberately-retired) | | **Deployable processes** | **2** — the federation gateway and the agent service, both on Cloud Run — over 33 in-process subsystem modules | | **Autonomous agents** | **9 declared, 8 cron-scheduled** on the federation's agent service (`contract-probe` runs on demand) | | **MCP tools** | **83** root tools registered, of which **22** are listed by `tools/list` and the remainder disclosed on demand (CO 529); **218** total served counting branched platform tools, gated at zero divergence (CO 413) | | **Platforms** | **20** composable platforms — 5 vendor / 15 customer, all available — plus 10 presets (events, food, salon, fitness, lodging, courses, repair, creative-studio, equipment-delivery, marketplace: recipes composing live platforms), queryable live via `federation_catalog_platforms` | | **Test files** | 465 — **34%** of the live codebase is test code | | **Protocols** | MCP, UCP, A2A in production; ACP discovery live | | **Frontend apps** | 3 — portal-app, webapp, webapp-introspection — plus 2 shared UI packages | | **Build cost** | ~$5,000 in compute | | **Build time** | ~3,000 hours over ~10 months | | **Dev-year equivalent** | ~60 developer-years on live source (~90 counting tests), at the industry-standard 3,000 LOC/dev-year | **Why the live number is smaller than it was in July.** Earlier editions of this document reported ~600,000 live lines. That figure summed comAI (~435K) with the federation. comAI is deprecated as of 2026-08-04: CO 420 took its deployed estate to zero — every service, job, cron, and mapping deleted — leaving exactly two Cloud Run services, both federation-owned. Counting a repo that serves no traffic would have been the easy thing to keep doing, and it is precisely the accounting error this document exists to avoid. The live figure fell to ~207,000 lines that day, and has since grown to ~271,000 through ordinary build on the surviving system. What was built across all three systems is a separate, larger, honestly-labeled number. **The comparison, labeled as an estimate:** delivering ~60 developer-years of live source through a traditional organization means a 10–15 engineer team working for multiple years, with payroll in the millions before the first customer. Roughly 1.1M lines were built across three systems to arrive at the 271K that run. The actual spend was ~$5,000 in compute and one person's time. That gap — not any single feature — is the capital-efficiency claim. The line counts are git-verified: tracked TypeScript/TSX only, excluding node_modules, build output, generated files, and type declarations. The verification method is on the record in CO 296; it was re-run against `comos-federation` at HEAD `6b70605` on 2026-09-15. --- ## The Build: Ten Months, Honestly Told The canonical build figure is **~3,000 hours over ~10 months.** Two chapters inside that window matter to an investor. ### The opening sprint (an early chapter, not the whole story) The first three weeks produced the working backbone: core commerce services (catalog, cart, orders, users, inventory, payments), the AI services (NLU, RAG, brand voice, policy engine), the database layer, and the initial testing framework. That sprint is worth naming because it set the velocity baseline — but it was the *start* of the build, not the build. ### The following months (where the hard part lived) The remaining months are where the system became an operating system rather than a large codebase: - **The Federation** — the MCP gateway that fronts every tenant behind one endpoint, with OAuth 2.1 + PKCE authorization (RFC 9728, RFC 8414), enterprise SSO, and fail-closed per-tool scoping. This is the system that survived, and it is the system that runs today. - **Four protocol surfaces served** — MCP, UCP (8 layers, 222 tests), and A2A in production; ACP discovery. - **The economy** — Com tokens, the ledger, per-act pricing, and the two revenue cuts, wired and live-proven on real transactions. - **The teardowns** — two entire systems deliberately removed, ~392K and ~435K lines (next section). - **The discipline machinery** — installed mid-build and applied to everything after, including the teardowns. One post-launch data point on sustained velocity: OAuth 2.1 with PKCE — spec-compliant authorization, dynamic client registration, enterprise SSO — shipped to production on the Federation in a single short session. Industry coverage has called authorization the hardest part of MCP adoption; a large share of production MCP servers still lack identity verification. ComOS ships it, in production, verifiable at `https://mcp.comos-federation.com/mcp` today. --- ## Subtraction: Two Systems Built, Then Deliberately Retired The strongest single piece of evidence in this document is not something that was built. It is something that was deleted — twice. **comai-portal (~392K lines, deprecated 2026-07-14).** A complete SaaS management platform: billing, subscriptions, team management, its own frontend apps, built to production quality. Then the business model evolved past it — revenue moved from subscriptions to two inline cuts collected where value flows, which made a subscription-management platform structurally unnecessary. So it was decommissioned (CO 153): its load-bearing pieces rehomed into the Federation, the rest torn down. **comAI Retail (~435K lines, deprecated 2026-08-04).** The commerce engine. As the federation matured, the capabilities that mattered converged into it — the atomic `order_create` settlement path superseded the retail checkout saga, tools were single-sourced onto the gateway's surface, and the retail estate's remaining reason to exist thinned to almost nothing. CO 420 finished it: every service, job, cron, and URL mapping deleted from GCP, leaving exactly two Cloud Run services, both federation-owned. Why this matters for diligence: - **Maturity by subtraction, twice.** The common failure mode of AI-assisted development is accretion — code is cheap to generate, so systems bloat. This founder deletes at scale, and has now done it to two production systems rather than defend a sunk cost. - **The counts are honest, and they moved when the system moved.** The live figure fell from ~600K to ~207K when comAI was deprecated, and it is reported that way still — the number moved on the day the underlying decision was made, not when it flattered us. Keeping the bigger figure would have required counting a repo with zero deployed footprint — which is exactly the error the correction names. The built-vs-live distinction is maintained everywhere, on purpose. - **A deleted deployment does not shrink a source tree.** That is the mechanism worth naming: after CO 420 took the estate to zero, a re-count run with the documented method still returned ~600K, because the source was still there. Statistics fail most quietly when they stay internally consistent while their referent disappears. The correction (CO 423) is on the record with the same discipline as the build. - **Both teardowns ran under the same discipline as the build** — change-ordered, gated, on the record. --- ## The Discipline: Why AI-Built Code Can Be Trusted Anyone can generate hundreds of thousands of lines with AI in 2026. The achievement is that this system is *maintainable* — and the machinery that makes it so is explicit, mechanical, and inspectable. It is also what made two deprecations survivable. This is the diligence exhibit. ### Proof-before-done No task is declared complete without a closing test that verifies its central claim. This is not a norm; it is a gate. Agent-proposed pull requests must carry a closing-test section inline, an evidence chain, and a change-order link; self-approval is forbidden by branch protection and enforced mechanically. Tautological closing tests (compiles + "passes" but doesn't test the claim) are the named failure mode human review exists to catch. ### The change-order cascade Every deliberate change to a contract, interface, or invariant fires a change order: a four-artifact directory (seed, plan, blueprint, playbook) answering six fixed questions before any code moves. The log is sequential and public within the repos — at this writing it runs past CO 550, a continuous decision record from May 2026 forward. An acquirer or investor can trace *why* any architectural fact is the way it is. ### The honesty ratio Each repository carries a machine-computed honesty ratio: the fraction of shipped artifacts whose "done" claims are backed by verified proof, read live from the introspection plane and snapshotted on an automated cadence. The number is never 100%, and that is the point — it is a measurement the system takes of itself, not a marketing claim. A dashboard renders it continuously. ### Quality sweeps and the skill loop Ongoing quality is verified, not assumed: pattern-based sweeps (error handling, dead code, naming, dependency hygiene) run across the repos on a reusable audit prompt, and every debugging session produces a documented skill — permanent institutional memory that prevents the error class from recurring. The operating assumption is an 80% trust factor on any agent output; the machinery exists because of that assumption, not despite it. **Both core disciplines are open-sourced** — [github.com/ronrey/proof-before-done](https://github.com/ronrey/proof-before-done) and [github.com/ronrey/initiate-change](https://github.com/ronrey/initiate-change) — so the methodology can be inspected independently of any claim made here. --- ## The Testing: Verifiable, Not Vanity Only verifiable claims appear here. The verifiable facts: - **465 test files** across the live system. - **~91,000 lines of test code** — roughly **34% of the live codebase is tests.** - That ratio is the proof-before-done tax made visible, and it *rose* through the deprecations — from 29% across the three-system corpus to 34% in the federation alone. The surviving system is the more heavily tested one, which is part of why it is the one that survived. - Protocol conformance is tested at the layer level — the UCP implementation alone carries 222 tests across its 8 layers. --- ## What Runs Now That Didn't in November This document was first written in November 2025, when the achievement was a codebase. Nine months later it is an operating economy. Everything below is live, not roadmap: - **The two revenue cuts are live-proven.** On 2026-06-13, on real transactions: the 6% mint cut bit on a Com purchase, and the 3% merchant cut resolved into a clearing sale's journal split (CO 112 and its follow-on). - **ChatGPT and Claude shop the network.** Since 2026-05-12, both a ChatGPT Custom GPT and Claude via MCP connector transact the merchant network end-to-end — search → cart → shipping → live Stripe payment. Not a demo video; a working flow any investor can run. - **The door is open.** An outside agent can self-admit to the federation with OAuth and an accountable root — no human sales motion in the path (CO 263). - **Admitted agents are governed, and the disconnected-manager accountability arc is now complete.** Liveness decay for silent agents (CO 264), and cryptographic key binding (CO 314, 2026-07-17): a root proves control of a published key by signing a server-issued challenge, verified before it persists, so a disconnected/silicon manager keeps a durable, counterparty-verifiable identity across a severed human link (proven live in production). Plus freeze-at-dispatch enforcement (CO 259) and the accountable manager root stamped on every audit record (CO 318). - **Every priced act charges.** 50 priced write operations across 19 platforms charge per act, resolved from live pricesheets at the routing seam (CO 287). Queryable via `federation_pricesheet`. - **An entrepreneur cohort runs on real Coms.** Five autonomous agents have been operating businesses on the federation since 2026-06-29 (CO 230), scored by a reputation arena computed from settlement facts (CO 233). - **The same runtime runs on customer-class hardware.** ComOS installs on a machine the merchant owns as a sealed, signed artifact and joins the one federation as a node (CO 475). A buying agent has discovered a vendor that exists only on a node, purchased from it, and seen the sale execute locally and settle on the hub rail with the 3% collected — node-stamped, hosted-identical. The node calls out and nothing calls in; its identity keypair is generated on the machine itself and the private key never leaves it; the ledger projects down read-only and cannot be written from the node. Where we are: five businesses trade on the network and revenue is pre-meaningful; the throughput clock started 2026-07-14. The system is built, governed, and transacting. --- ## The Revenue Model, in Brief ComOS charges **two flat inline cuts and nothing else**: **6%** when a tenant buys Coms (the mint cut) and **3%** when a sale clears (the merchant cut). Both are live-proven on real transactions as of 2026-06-13. Free to start — no subscriptions, no tiers, no seats, no rent. Revenue is linear in throughput, indifferent to who is transacting: the Visa shape, made literal. There is no subscription tier, no GMV take rate, and no services revenue line: the code that once implemented subscription billing was torn down with the portal. The full model, including its integrity ledger, is the financial model, available in diligence. --- ## What This De-Risks — and What It Doesn't **Retired risks:** - **Execution risk.** The system is built, deployed, and transacting. This is not a plan to build; it is an operating record. - **Capital-efficiency risk.** The entire build cost ~$5,000 in compute. Burn is deliberately small; scale spend follows throughput rather than preceding it. - **Key-person risk, partially.** The system runs under manager-rooted autonomous agents, and the knowledge lives in the documentation and change-order corpus across the repos, not in one head. The discipline machinery is what a hire — or an acquirer — would onboard against. Hiring is for distribution, not survival. - **AI-slop risk.** The specific fear that an AI-built codebase is an unmaintainable liability is answered by the discipline chapter: mechanical gates, a public decision log, a self-measured honesty ratio, and a founder with a documented record of deleting two production systems — ~392K lines and then ~435K lines — when the architecture demanded it. **Not retired, and not claimed:** - Distribution. Five trading businesses is a start, not traction. The raise exists to buy down exactly this risk. - The throughput curve. Instrumentation started July 2026; the curve will show what it shows. The founder's background — five decades of software across NASA, Amazon, Apple, Wells Fargo — is on his LinkedIn profile for anyone who wants it. This document leads with the system because the work is the proof. --- ## Appendix: Verified System Inventory All live figures re-derived 2026-09-15 against `comos-federation` at HEAD `6b70605`. **Live system = ComOS Federation, alone.** comAI Retail and comai-portal are both excluded as deprecated. | | ComOS Federation (live) | comAI Retail (deprecated 2026-08-04) | comai-portal (deprecated 2026-07-14) | |---|---|---|---| | **Lines of code** | **~271K (~180K src / ~91K tests)** | ~435K — built, estate deleted (CO 420) | ~392K — built, then decommissioned (CO 153) | | **Deployable processes** | **2** — gateway + agent service, over 33 in-process subsystem modules | 0 (was 26 services) | 0 (was 26 services) | | **Agents** | **9 declared, 8 cron-scheduled** | — (was 70) | — (was 26) | | **MCP tools** | **83 root (22 listed) / 218 total served** (CO 413, CO 529) | — (was 43) | — | | **Frontend apps** | **3** + 2 shared UI packages | — | — | | **Test files** | **465** | — | — | **Two repos, and only two:** `comos-federation` — the live system; `comai-plan` — the origin cockpit (docs, change orders, strategy). **Protocol surface:** MCP (OAuth 2.1 + PKCE, Streamable HTTP + stdio transports, spec 2025-06-18), UCP (`/.well-known/ucp`, 8 layers, 222 tests; catalog / orders / OAuth live — checkout + payment layers decommissioned per CO 308/310), ACP (`/.well-known/acp.json` discovery live; checkout_sessions decommissioned, 410 Gone — agent checkout settles via the federation's `order_create`), A2A (scope-based authorization, correlation tracking). AP2 was deliberately withdrawn (CO 370): its card-shaped mandate model doesn't match a ledger that settles in milliseconds; its delegated-spend-caps primitive is recorded for rebuild on the Coms rail. **Stack:** TypeScript / Node.js / Fastify; Next.js 14 + React 18 frontends; MongoDB Atlas; Google Gemini 2.5 Flash via Vertex AI for LLM inference; Docker, Kubernetes-ready. **Live endpoints:** Federation MCP at `https://mcp.comos-federation.com/mcp`; agent-vendor disclosure at `/.well-known/comos-vendor.json`; public catalog via `federation_catalog_agents` / `federation_catalog_platforms`; live pricing via `federation_pricesheet`.