docs: add sanitized demo plan

docs/case-study.md

@@ -105,7 +105,7 @@ The dense-retrieval path forces you to either:
 
 - **Embed everything upfront at ingest.** Expensive one-time cost, but
   also an ongoing cost — every KB article change re-embeds. With
-  3,500+ articles and a nightly reindex budget of 46 seconds, this
+  thousands of articles and a bounded local reindex budget, this
   doesn't fit.
 - **Embed on-the-fly.** ~100ms per embedding, times 10 queries per
   draft session, times 40 drafts per operator per day = hours of
@@ -215,7 +215,7 @@ sum _is_ magic.
 
 ## Links
 
-- **Repo:** [github.com/saagpatel/AssistSupport](https://github.com/saagpatel/AssistSupport) (MIT, 229 commits)
+- **Repo:** [github.com/saagpatel/AssistSupport](https://github.com/saagpatel/AssistSupport) (MIT)
 - **One-pager:** [docs/one-pager/AssistSupport-one-pager.pdf](one-pager/AssistSupport-one-pager.pdf)
 - **Deck:** [docs/deck/AssistSupport-LinkedIn-Live.pptx](deck/AssistSupport-LinkedIn-Live.pptx)
 - **Screenshot set:** [docs/screenshots/](screenshots/)

docs/deck/DEMO-VIDEO.md

@@ -78,7 +78,7 @@ column. Camera slowly zooms in on the confidence gauge as it fills to
 > citations are generated directly into the prompt — the model
 > can't cite a document it didn't actually see."_
 
-**Caption:** `Hybrid retrieval · 22ms p50 · 46ms p95 · 3,500+ articles`
+**Caption:** `Hybrid retrieval · 22ms p50 · 46ms p95 · sanitized local KB`
 
 ---
 

docs/deck/README.md

@@ -22,7 +22,7 @@ deck plus a rendered PDF for preview / distribution.
 | 04  | The pipeline — five stages, all local.                                    | Architecture: intent → retrieve → rerank → draft → learn, with latency per stage. |
 | 05  | The workspace — composer, answer, triage.                                 | Demo pause — hero screenshot + 3 annotated callouts.                              |
 | 06  | Why logreg + TF-IDF beat embeddings here.                                 | ML intent classifier: F1, latency, inspectability.                                |
-| 07  | Sub-25 ms retrieval over 3,500+ articles.                                 | Hybrid search: TF-IDF + MiniLM-L-6 cross-encoder, latency budget diagram.         |
+| 07  | Sub-25 ms retrieval over the local KB.                                    | Hybrid search: TF-IDF + MiniLM-L-6 cross-encoder, latency budget diagram.         |
 | 08  | The model is allowed to say "I don't know."                               | Trust gating: answer / clarify / abstain modes.                                   |
 | 09  | Low-confidence queries become the KB backlog.                             | Self-improving feedback loop with KB gap dashboard.                               |
 | 10  | Yes, a desktop app needs a deploy story.                                  | Ops surface + eval harness side-by-side.                                          |

docs/deck/REHEARSAL.md

@@ -52,15 +52,15 @@ and keeps the operator in the loop."**
 Slowest slide. Walk left-to-right through the 5 stages. At DRAFT
 (highlighted), pause — that's where the LLM lives. Call out the
 runtime line verbatim so audience absorbs the dependency list. End on
-the stat row: **1.8s p95 · 22ms p50 · ~5GB · 0 B exfil**. The last stat
-(0 B) is the applause line — wait a beat.
+the stat row: **1.8s p95 · 22ms p50 · ~5GB local runtime · no cloud demo path**.
+The last stat is the privacy line — wait a beat.
 
 ### 05 · Demo (5 min, interactive)
 
 Switch to screenshare / running app. Suggested script:
 
 1. Click into the composer, paste the real prompt from the deck
-   ("Can I use a flash drive...").
+   ("Can I use a flash drive for the offsite?").
 2. Click a single intent chip so the ML trace lights up.
 3. Press **⌘↵**. Narrate the sub-25ms retrieval while it runs.
 4. When the draft streams in, hover a `[1]` citation — show the
@@ -141,7 +141,7 @@ seconds after the first hand.
 
 ## Closing line options
 
-1. _"Everything you just saw is MIT-licensed and 229 commits. Fork it, ship your own."_
+1. _"Everything you just saw is MIT-licensed in the current repo. Fork it, ship your own."_
 2. _"If there's one thing to take away: local-first is a UX decision, not just a security one. Your operators will trust the tool more."_
 3. _"Support will always be repetitive. The question is whether repetition is suffered by humans or compiled down into a pipeline. Thanks for watching."_
 

docs/deck/build.mjs

@@ -51,7 +51,7 @@ const MONO = "JetBrains Mono";
 const pptx = new PptxGenJS();
 pptx.layout = "LAYOUT_WIDE"; // 13.333 × 7.5 in
 pptx.title = "Running a local-first support agent on a Mac";
-pptx.author = "Saagar Patel";
+pptx.author = "Demo Operator";
 pptx.company = "AssistSupport";
 pptx.subject = "LinkedIn Live — portfolio-grade IT support assistant";
 
@@ -344,8 +344,8 @@ function notes(slide, text) {
   });
   s.addText(
     [
-      { text: "Saagar Patel", options: { color: C.text1, bold: true } },
-      { text: "  ·  IT Platform Eng · Box", options: { color: C.text3 } },
+      { text: "Demo Operator", options: { color: C.text1, bold: true } },
+      { text: "  ·  IT Platform Eng · Local-first demo", options: { color: C.text3 } },
     ],
     {
       x: 0.75,
@@ -407,11 +407,11 @@ function notes(slide, text) {
   const pillars = [
     {
       head: "LOCAL-FIRST",
-      body: "App, sidecar, classifier, retrieval, reranker, and LLM all run on-device. SQLCipher AES-256 at rest. Zero data leaves the machine.",
+      body: "App, sidecar, classifier, retrieval, reranker, and LLM all run on-device in the demo path. SQLCipher AES-256 protects core workspace data at rest.",
     },
     {
       head: "KB-GROUNDED",
-      body: "Every draft cites real KB articles. Hybrid retrieval over 3,500+ indexed docs; inline [n] markers you can click.",
+      body: "Every draft cites KB articles from the local index. Hybrid retrieval narrows candidates before rerank; inline [n] markers you can click.",
     },
     {
       head: "TRUST-GATED",
@@ -727,7 +727,7 @@ function notes(slide, text) {
     h: 2.63,
     sizing: { type: "contain", w: 4.2, h: 2.63 },
   });
-  s.addText("Live classifier trace for AS-4218", {
+  s.addText("Live classifier trace for NSD-4218", {
     x: 8.6,
     y: 4.98,
     w: 4.2,
@@ -761,7 +761,7 @@ function notes(slide, text) {
   const s = pptx.addSlide({ masterName: "BASE" });
   pageChip(s, 7);
   eyebrow(s, "CHAPTER 06 · HYBRID SEARCH");
-  title(s, "Sub-25 ms retrieval over 3,500+ articles.");
+  title(s, "Sub-25 ms retrieval over the local KB.");
 
   // Left column: explanation
   bullets(
@@ -855,7 +855,7 @@ function notes(slide, text) {
     [
       { label: "P50 HYBRID SEARCH", value: "22ms", note: "TF-IDF candidate retrieval" },
       { label: "P95 HYBRID SEARCH", value: "46ms", note: "measured on M3 MBP" },
-      { label: "KB ARTICLES", value: "3,500+", note: "local SQLite, 46s reindex" },
+      { label: "DEMO KB", value: "27", note: "sanitized markdown sources" },
     ],
     5.9,
     1.2,
@@ -1178,7 +1178,7 @@ function notes(slide, text) {
     {
       label: "REPO",
       value: "github.com/saagpatel/AssistSupport",
-      note: "229 commits · v1.2.0 · MIT",
+      note: "current repo · v1.2.0 · MIT",
     },
     {
       label: "DECK + ONE-PAGER",

docs/demo/sanitized-demo-plan.md

@@ -0,0 +1,79 @@
+# Sanitized Demo Plan
+
+## Demo Boundary
+
+This demo uses only fictional `Northstar Labs` support data. Do not connect a real
+workspace, import private KB folders, source `.env` files, read Redis dumps, or
+run production-like sidecars while preparing the demo.
+
+Safe sources:
+
+- Checked-in markdown under `knowledge_base/`
+- Mock Tauri IPC data under `src/test/e2eTauriMock.ts`
+- Portfolio collateral under `docs/screenshots/`, `docs/one-pager/`, and
+  `docs/deck/`
+
+Unsafe sources:
+
+- `.env*` files
+- SQLite, Redis, Postgres, or app workspace data
+- Private customer, company, or ticket exports
+- Real Jira, Slack, ServiceNow, or knowledge-base credentials
+
+## Fictional Tenant
+
+- Tenant: `Northstar Labs`
+- Support portal: `https://it.northstar.example/support`
+- VPN portal: `vpn.northstar.example`
+- Helpdesk: `helpdesk@northstar.example`
+- Ticket IDs: use `NSD-*`
+- Demo persona: `Jordan Lee`, Finance, Northstar-managed MacBook Pro 14, macOS 14.5
+
+## Fake-KB Script
+
+1. Launch in mock mode with the workspace hero enabled.
+2. Paste this ticket:
+
+   ```text
+   Jordan Lee from Finance is traveling Thursday and asks whether they can copy
+   board-review slides to a USB drive for the offsite. They are on a
+   Northstar-managed MacBook Pro 14, macOS 14.5.
+   ```
+
+3. Show the `Policy / removable_media` intent route.
+4. Generate a grounded response that denies USB/removable-media use for company
+   data and offers approved alternatives: SharePoint, OneDrive, ShareFile,
+   encrypted email for small files, or VPN-connected file shares.
+5. Hover a citation and show that it maps to the checked-in policy KB.
+6. Rate the draft, then open Analytics to show fictional gap clusters such as
+   `VPN fails only on HQ Wi-Fi` and `Outlook crash on macOS 14.5`.
+7. Call out the privacy posture: local mock IPC, no real tenant data, no cloud AI
+   call, encrypted core workspace in real use.
+
+## Cleanup List
+
+- Keep `dump.rdb` ignored and outside every demo path.
+- Remove generated dependency folders before capture.
+- Keep all demo domains under `.example`.
+- Keep USB/removable-media behavior consistent: the demo denies USB use and
+  points to approved alternatives.
+- Label mock or aspirational views as mock collateral when presenting.
+- Re-run screenshots, one-pager, and deck outputs after text changes.
+
+## Verification Checklist
+
+```bash
+rg -n "company\\.com|it\\.company|vpn\\.company|passwordreset\\.company|Priya Anand|Aisera" knowledge_base docs src search-api -g '!docs/demo/sanitized-demo-plan.md'
+rg -n "IronKey|Apricorn|approved encrypted drive|whitelist-usb|PagerDuty rule 12" docs src -g '!docs/demo/sanitized-demo-plan.md'
+rg -n "USB|flash drive|removable media" knowledge_base docs src search-api
+git status --short --ignored=matching node_modules dump.rdb
+node scripts/ci/check-workstation-preflight.mjs
+node scripts/ci/check-workflow-command-drift.mjs
+node scripts/ci/check-version-parity.mjs
+```
+
+Optional when the workstation has `gitleaks` installed:
+
+```bash
+pnpm git:guard:secrets
+```

docs/one-pager/README.md

@@ -32,8 +32,8 @@ print-ready portfolio leave-behind.
 │ [01 ML intent] [02 Hybrid] [03 Trust] [04 Feedback] [05 Local]    │
 │                                                                   │
 │ ──────────────────────────────────────────────────────────────── │
-│   25%              │   <25ms              │   3,500+              │
-│   ticket deflection│   hybrid search p50  │   KB articles indexed │
+│   25%              │   <25ms              │   demo KB             │
+│   ticket deflection│   hybrid search p50  │   sanitized index     │
 │ ──────────────────────────────────────────────────────────────── │
 │ Tauri · React · TS · Rust · SQLCipher · Ollama   github.com/…     │
 └──────────────────────────────────────────────────────────────────┘
@@ -66,9 +66,9 @@ from session 2 — if that screenshot changes, re-run
   a small mono stat tag (e.g. `0.914 macro-F1`, `22ms p50`,
   `0.93 grounded · 0.96 faithful`).
 - **Impact strip (3 columns):**
-  - **25%** ticket deflection — benchmark from prior Aisera deployment
-  - **<25ms** hybrid search p50 — measured on M3 MBP, eval run #4812
-  - **3,500+** KB articles indexed — nightly reindex, 46s
+  - **25%** ticket deflection — illustrative support-automation benchmark
+  - **<25ms** hybrid search p50 — demo latency target for the local path
+  - **Demo KB** articles indexed — sanitized local index for capture
 - **Footer:** tech stack chips (Tauri 2 · React 19 · TypeScript · Rust
   · SQLCipher · Ollama · TF-IDF + MiniLM) plus repo URL.
 

docs/one-pager/one-pager.html

@@ -557,8 +557,8 @@ <h1 class="tagline__h1">
             <div class="pillar__num">05</div>
             <div class="pillar__title">Local-first &amp; encrypted</div>
             <div class="pillar__body">
-              SQLCipher AES-256 at rest, local Ollama inference. Zero data
-              leaves the machine. Ships with deploy / rollback / eval ops.
+              SQLCipher AES-256 at rest, local Ollama inference, and a
+              no-cloud demo path. Ships with deploy / rollback / eval ops.
             </div>
             <div class="pillar__tag">
               <b>SQLCipher</b> · Ollama · Tauri 2
@@ -579,7 +579,7 @@ <h1 class="tagline__h1">
             of tier-1 tickets never reach a human — drafts accepted and
             pasted into Jira as-is.
           </div>
-          <div class="stat__source">benchmark: prior Aisera deployment</div>
+          <div class="stat__source">illustrative support-automation benchmark</div>
         </div>
         <div class="stat">
           <div class="stat__label">Hybrid search latency</div>
@@ -592,20 +592,20 @@ <h1 class="tagline__h1">
             reranker — instant in the composer.
           </div>
           <div class="stat__source">
-            measured on M3 MacBook Pro · eval run #4812
+            demo latency target for the local retrieval path
           </div>
         </div>
         <div class="stat">
-          <div class="stat__label">KB articles indexed</div>
+          <div class="stat__label">Demo KB indexed</div>
           <div class="stat__value">
-            <span class="stat__num">3,500</span>
-            <span class="stat__unit">+</span>
+            <span class="stat__num">27</span>
+            <span class="stat__unit"></span>
           </div>
           <div class="stat__caption">
-            local SQLite index of policies, runbooks, how-tos, and incident
-            retrospectives — refreshed nightly.
+            sanitized markdown policies, procedures, and references used for
+            portfolio capture.
           </div>
-          <div class="stat__source">nightly reindex · 46&#8239;s · see Ops surface</div>
+          <div class="stat__source">checked-in fake KB · no private data</div>
         </div>
       </section>
 
@@ -623,7 +623,7 @@ <h1 class="tagline__h1">
         <div class="footer__right">
           <span>github.com/saagpatel/AssistSupport</span>
           <span>·</span>
-          <span>MIT · 229 commits · macOS</span>
+          <span>MIT · current repo · macOS</span>
         </div>
       </footer>
     </div>

docs/portfolio/README.md

@@ -83,12 +83,13 @@ Engineering-professional across all artifacts:
 
 - No emojis
 - No marketing superlatives
-- Specific numbers: `22 ms p50`, `0.914 macro-F1`, `3,500+ articles`,
-  `25% deflection`, `90-second rollback SLO`
+- Specific numbers are allowed only when they are current and traceable.
+  For sanitized demo collateral, prefer labels such as `demo KB`,
+  `sanitized local index`, and `illustrative benchmark`.
 - Pronouns first-person singular only in the deck + case study
   (sessions 1–3 are product-voice)
-- Citations are real — every number traces back to either the README,
-  the eval harness, or a prior production benchmark
+- Citations are real — every number must trace back to current repo
+  evidence, the eval harness, or be labeled as illustrative.
 
 ## Regeneration commands
 

docs/redesign/SPEC.md

@@ -35,7 +35,7 @@ scrolling answer.
 Children (top-to-bottom):
 
 1. **Ticket micro-header** (single row, 32px tall)
-   - Left: `AS-4218 · REQUEST` (monospace, 11px, uppercase, `--as-text-3`)
+   - Left: `NSD-4218 · REQUEST` (monospace, 11px, uppercase, `--as-text-3`)
    - Center: ticket summary (14px / 1.3 semibold, truncated)
    - Right: priority badge + auto-detected intent badge
    - The blue→violet avatar gradient from `ClaudeDesignWorkspace` is

docs/screenshots/live-capture.mjs

@@ -168,7 +168,7 @@ async function main() {
     await page.waitForSelector(".wsx__composer", { timeout: 10_000 });
 
     const ticketText =
-      "Priya is flying to the offsite Thursday and wants to bring a USB stick for slide backups. Asking if IT permits it and if so what the approved model is. She's on a company-issued MacBook Pro 14 (M3), macOS 14.5.";
+      "Jordan from Finance is traveling Thursday and asks whether they can copy board-review slides to a USB drive for the offsite. They are on a Northstar-managed MacBook Pro 14, macOS 14.5.";
 
     // Set the textarea value via the native setter so React picks up the
     // change, bypassing any visibility/editability gates Playwright may