What Walks Out the Door
Five days building yudonKnow — an agent that interviews retiring experts — and what thirteen rounds of adversarial QA did to it.
The problem arrived as a friend
Yudon is a close friend of mine, a few years from retirement. He wants to leave what he knows to the people coming up behind him — the will is already there. I watched him try. He opens a blank document and stops at "what do I even write." Ask him how he knows a defect is a speed problem and not a temperature problem, and he says: "you just see it."
I run a manufacturing company myself, and I was deep in automation projects on my own lines when it clicked: automation takes the procedures — the judgment walks out the door. A robot can repeat every documented step. It cannot tell you why a flow mark on the far side of the gate means speed, not temperature, while the thermometer reads normal.
He is not withholding anything. He does not know what he knows until someone asks him the right question. That is an interviewing problem, and interviewing has a literature — the Critical Decision Method, ACTA, three decades of cognitive task analysis. What kept that literature away from Yudon was never the method; it was that a trained knowledge engineer costs more than a mould shop can pay. An LLM removes the unit cost. So the agent takes the interviewer's seat, and the human stays the source.
The design rule that decided everything
One rule, set on day one: the model joins only at the output layer — text in,
text out. Gap detection, citability, verification badges, triage verdicts:
all decided by plain code and by people. There is a test literally named
test_gap_decision_never_calls_the_llm. When the alter doesn't know, the
refusal is not the model being polite — the model was never called.
That rule earned its keep twice. Once when I swapped the base model from Anthropic to Gemini and exactly one file changed. And once for every adversarial test below, because a judgment that lives in code is a judgment you can write a regression test against.
Thirteen rounds of getting punched
From day two, an external tester ran adversarial QA against the live deployment — playing a retiring expert, a junior, HR and legal, a security reviewer, an enterprise buyer, and a deliberately grumpy hackathon judge. Thirteen rounds in four days, from a 72-point "idea demo" through two No-Go verdicts to 90/100. Every finding below shipped as a fix plus a regression test, the same day it was reported. Three favourites:
The expert's corrections tried to become knowledge. A tester answered a sensory question with "There was no sound, smell, or visual clue. Do not record one." The card compiler stored Do not record one as an observable cue — and it surfaced as a checkbox in the compiled protocol. The fix is deterministic, not prompted: statements of absence and meta-corrections are classified and blocked at capture, at merge, and at approval-save, and a sensory denial now pivots the interview to relational and timing cues instead of re-asking the channel question.
Reward integrity broke the moment money was imaginable. The product pays retirees by verified use — citations and "it helped" field reports. A tester showed the card owner could ask their own alter and click "it helped," inflating their own settlement basis. Now self-use answers normally but never counts: excluded from citations and the ledger at write time and read time, self-reports rejected outright, duplicates merged. The ledger stayed append-only; the statement just refuses to count you applauding yourself.
The 20-second turns were not a quota problem. Judges felt 20–26s question latency and suggested buying a better tier. The logs showed zero rate-limit errors — schema-extraction calls were spending 16–19 seconds in model thinking. Turning thinking off for extraction (keeping it only where output feeds the decision engine) cut turns to 1–4 seconds. Money would not have fixed it; reading the logs did.
The part I care about most
The alter refuses well. Ask it something the expert never left behind and it says so, plainly, and files your question — word for word — into the expert's dig queue, so the next interview digs where real demand is. Prompt-injection attempts get refused and quarantined: they never reach the expert's screen disguised as a junior's question. And the coverage number is capped at 0.95, because an early version reached 1.0 and it read as a lie — the fingertip knowledge was still in his hands. What could not be captured is reported next to what could, always.
He leaves. His judgment stays on the line — and every time it works, so does his name.
If you want to poke it
The demo needs no sign-in. Ask Dale's alter about clarifier weir stringing and open the card it cites; then ask it for salary advice and watch it refuse. The repo's 113 tests run offline — no API key, no network — because every promise in this post is enforced by one of them.