Custody first. Fixes next. Then one slice at a time.

Four jobs, in this order, each with a gate before the next.

This revision supersedes rev1, which stopped partway through custody. It adds the full phase plan, the rules for when to announce, the record-safety rules, the open-source stack and the order of the slices.

Seven rules every later decision answers to.

1. 01

   HHI owns everything. Allodial operates on HHI's behalf.Every repo, tenant, account and key sits in HHI's name, and Allodial gets delegated access. The takeover stays clean, and HHI cannot be locked in a second time, including by us.

2. 02

   Custody before announcement.SDSOL hears about the transition only after HHI holds the code, data, keys and accounts, unless one of the triggers in §3 forces it earlier.

3. 03

   No deception.HHI asks only for things it is entitled to, and gives reasons that are true. If SDSOL asks directly whether HHI is changing vendors, HHI does not lie; it can say it doesn't discuss vendor strategy. Quiet is fine. False is not.

4. 04

   Fix first, then replace.Stabilizing HNS buys the operational goodwill and the time a careful rebuild needs.

5. 05

   Strangler fig, not big bang.New services sit in front of or beside HNS and take over one slice at a time. Every slice has a rollback.

6. 06

   No record is ever destroyed.Legacy data is archived immutably, each entity has exactly one writer at any moment, and every migration is reconciled. Money ties out to the cent.

7. 07

   Open source first.Custom code goes only where HHI's workflow is unusual, which mainly means campus scheduling.

Clear the conflicts, read the contract and pay the bills before asking for anything.

HHI holds the code. Allodial works from HHI's copy.

Allodial never appears in any system SDSOL can see until announcement day. Asking for its own source, data and keys is ordinary governance for any client of a custom-software shop, and SDSOL's docs haven't been updated since January 2026, so a documentation and custody refresh is easy to justify. None of these requests implies a vendor change. They should still go out one at a time over 2–4 weeks: a single list reads like an exit.

2.1 · Take today, without asking SDSOL

Accounts HHI almost certainly already owns as merchant or licensee. Confirm each one, add the HHI admin identity and read the configuration. That alone tells us how HNS is wired.

• Microsoft 365 / Entra ID tenant. The Outlook/Graph sync app registration should be in HHI's tenant. Record its permissions and secret expiry.
• Authorize.Net merchant account (HHI is merchant of record): API login IDs, CIM profiles, settlement reports. These reports are the ground truth for money reconciliation later.
• Cin7 Core, Shopify, Dialpad. Check whether API keys and webhooks point at HNS endpoints.
• Domain registrar and DNS for hippocrateswellness.org and any app subdomains. DNS control is what lets us cut traffic over later.
• AWS account behind SES, if it is in HHI's name.
• Apple App Store / Google Play developer accounts. Find out today whose name these are in. If they are SDSOL's, moving them takes weeks and needs SDSOL's cooperation, so this is the item most likely to set the earliest announcement date.

2.2 · Ask SDSOL, one item at a time, framed as governance

Who sends them: an HHI officer other than MB, from the HHI identity. Allodial writes the drafts; Allodial's name does not appear in them. If SDSOL stalls or refuses B, that is information: use the contract (1.2) to escalate while the work below keeps moving.

2.3 · Work that needs no code at all · from Week 0

• Black-box reproduction. With HHI staff logins, reproduce the Critical and High bugs and record exact steps, screenshots and timing. Start with FD-01, FD-02, FD-04, SO-01, SO-03, SO-05, SALES-01, EO-03 and VIDA-01.
• Data analysis from backup A, restored into an Allodial-isolated, HHI-owned environment: confirm the timezone hypothesis behind FD-04 and SO-03, find the overlapping bookings behind SO-01, and trace house-credit history behind SALES-01 through ActivityLogs.
• Synthetic test data. hns_synth_oct26_apr27_900.sqlite can drive tests without exposing guest PII.
• Fallback if B is blocked, legal sign-off first. If the compiled .NET 9 assemblies are deployed in an HHI-owned tenant, they decompile to readable C# with ILSpy. Only if counsel confirms the contract permits it. A last resort, not a plan.

Announce on A-day, with the fixes in hand.

A-day is the first business day after Gate 1 and after the §4 fix pack is ready to ship. Ideally both land together.

How the announcement is worded, and whether SDSOL is kept on for a paid transition period, is HHI's call. Allodial drafts both options.

Built quietly on the mirror, shipped from A-day.

Fixes are prepared during the quiet period and deployed only after A-day (trigger 3). On day one HHI gets visible relief, which is the strongest case for the transition.

Configuration and training items (EM-02, FD-06, GEN-04, SALES-04 monitoring) are handled as admin setup and SOP work. The remaining enhancements (HK, SH, SALES-05, ADMIN-01, ADMIN-03) are not built into HNS; they become requirements for the replacement slices, so nothing is invested in code being retired.

An open-source platform that sits in front of HNS, from Gate 1.

Runs alongside Phase 1. Every layer is open source unless noted, and the SaaS that already works stays.

ADR-1 · Base application platform

Decided at Gate 2, after a two-week bake-off against real HHI workflows using the synthetic database. Leaning: B for back office, with an A-style custom service for campus scheduling. Scheduling (rooms, staff, equipment, itineraries) is what makes HHI different and where HNS fails most, so we own that code. Everything generic comes from open source.

Low risk and high pain first. Money and reservations last.

Each slice runs shadow → dual-run → cutover → 30-day hypercare.

Rough calendar · months from Gate 0

Only S6–S8 are on the critical path. Estimates firm up after Gate 2.

A small Allodial team, an HHI sponsor who isn't MB, and a super user per department.

What could go wrong, and what we do about it.

Seven answers we need, and who has them.