WINNER: Slip

Date: 18 September 2026
Role: Project manager, CryptoBook pivot
Inputs read: BRIEF.md; research/agentic-ai-market.md, quantum-market.md, competition.md; ideas/agentic-ideas.md, quantum-ideas.md; challenges/legal.md, security.md, adoption.md, finance.md, competition.md; design/virtus-theme.md.
Rule: an idea SURVIVES only if it has no KILL from legal or security, and at most one FIX from finance / competition / adoption. KILL on any of those three also fails survival.

Winner

Slip — permission slips for coding agents.

One sentence: a public blast-radius card and a signed decision receipt for your coding agent, compiled from English rules, without becoming your MCP gateway, your LLM vendor, your IdP, or your auditor.

This is not Hallpass-as-specified, not a Permit.io clone, not a Langfuse, not a quantum classroom. It is the single merge of the five independent “patched survivor” sketches (legal PermitGate, security canonical PEP, adoption Blast Card, finance Permit Inbox, competition Slip) after every original idea failed the survival rule.

Ship it on https://cryptobook.space. Product name on the page is Slip. Do not put “CryptoBook,” “MCP gateway,” “observability,” “quantum,” or “AI Act compliant” in the H1.

Implementation spec: SPEC.md. Bind 127.0.0.1:3100. Do not touch nginx or the live site in this decision pass.

Scoreboard

Legend: L = legal, S = security, F = finance, C = competition, A = adoption.

† Workslip survives security only as hashed receipts with no hosted transcripts. The idea as written (session export → client-readable file list) is a transcript product unless fenced.
‡ BurnNotice’s job is receiving logs. Security kill-test 4: prompt bodies / tool args by default. Hash-on-ingest still receives secrets on this VPS.
§ Rehearse survives security only as a scripted demo. User-key planner is a key drop.
¶ Q3/Q5/Q8 die on key custody or hardware theater. Q2 is not a credential product but is a demand kill.

Q10 is off-mission (classical crypto), fake-compliance theater, and a Qualys/Cloudflare me-too.

Quantum loses. Research (quantum-market.md), idea agent (0 ideas proposed), and all five challengers agree. IBM Open Plan is free real hardware + unlimited simulators. This VPS is a ≤32-qubit numpy box. Do not put the word on the homepage.

Why every original idea died

Hallpass — killed by security, competition, and adoption (legal/finance were only FIX)

As specified it is a hosted MCP drop-in URL. That is the naive product security forbids (LLM/tool credentials terminate on 173.249.19.205; compromise = “CryptoBook stole the keys”) and the category competition already occupies:

• Permit.io MCP Gateway — *.agent.security/mcp?upstream_mcp=…, sub-5-minute drop-in, allow/deny/consent, Cursor/Claude snippets, Community free / Pro from $25.
• Preloop — OSS MCP firewall, allow/deny/ask/justify, CEL, hard budgets, Slack/mobile approve.
• Portkey MCP Gateway — now Palo Alto Prisma AIRS; virtual-key budgets; $49 Production.
• LiteLLM — hard $ caps that reject; MCP tool permissions; 53k+ stars.

Adoption: a policy textarea is homework; stdio MCP never hits a URL; “I put a proxy in front of my MCP” is not a tweet. Finance: $29 is Langfuse’s number, the worst possible price; generic “gateway” conversion will not reach $5k MRR.

English rules + receipts are not a 90-day moat on top of a gateway. English is a compiler. Receipts are a protocol (Obsigna, ProofAgent $19, IETF draft-sahu). Gluing three occupied features is an aggregator.

Permitfile — killed by finance, competition, adoption, security

Dependabot’s distribution is GitHub. We do not have that pipe. GitHub Copilot already ships org allowedMcpServers (6 Aug 2026). Microsoft APM apm-policy.yml is live. A YAML without a runtime is a linter; a runtime the IDE can bypass with stdio is theater. Finance: 400–2,000 Marketplace installs in year 1, not 102 paying orgs. Security: hosted enforcement that runs agents or holds GITHUB_TOKEN / OPENAI_API_KEY is a honeypot. Keep the file format. Do not build a GitHub App company in v1.

Workslip — killed by finance, competition, adoption

Two-sided cold start (freelancer wants it iff the client asked). Ceiling ~$900 MRR in the happy model. ProofAgent already has a public verify URL at $19. Signature proves we ingested a file at time T, not that the work is good. Escrow/scores/tokens would also be a legal KILL; we are not adding them. Keep the /r/ page. Do not build invoice software.

BurnNotice — killed by security; too many FIX elsewhere

The wound is real ($3.7k–$47k loops). File-drop aha is real. As a company it is a one-shot screenshot; the inventor’s retention fix (live tail proxy) is Helicone 2, which BRIEF and competition both kill. Receiving prompt bodies on this VPS is a security KILL. Keep a sample autopsy + optional hashed CSV drop as a homepage module. Not the SKU.

Rehearse — killed by competition

Claude Code / Cursor / Codex already plan. Permit.io auto-classifies destructive tools. A scripted “would delete 12 repos” is a landing animation, not a $29 sub. If the playground uses our LLM wallet, legal/finance kill (token reseller). Steal the jump-scare as HTML. No golden-plan eval product (Braintrust/Phoenix).

SchemaPin — killed by finance, competition, adoption

Invariant/Snyk mcp-scan pins tools for free. mcp-doorman hash-pins in the enforcement path. Hosted badges are SSL Labs: no conversion. SSRF if we fetch customer MCP URLs. Hash the catalog on the blast card. No badge SKU.

Quantum Q1–Q10 — killed everywhere that matters

Vendor revenue is hardware (~$1.8B 2025). QCaaS is IBM/Google/AWS/IonQ. Starling is 2029. Zapata (software-only application layer) did $0 revenue after ~$118M. IBM Composer + Learning + Classroom Accounts (real QPUs, no card) own education. Legal kills the “classroom” framing (Annex III pt 3 + children). Security would allow a WASM toy and still lose on demand. PQC is a different product and a Qualys/Cloudflare fight. Do not ship quantum. Do not costume the agentic product as quantum.

Why Slip lives

Slip is Hallpass with the poison cut out, Blast Card as the homepage, Permit Inbox as the SKU, and the security split as law.

Survival math vs the PM rule:

• Legal: SURVIVE (conditional PermitGate shape; required copy is in SPEC).
• Security: SURVIVE (canonical compiler + local PEP + hash ledger; playground uses toy tools we own).
• Finance: FIX (only one). Base 12-month PLG is ~$4.0k MRR; stretch $7–9k if the six named levers ship. That is the single allowed FIX.
• Competition: SURVIVE (different category from Permit.io/Preloop/Portkey if and only if the first screenshot is a card/receipt, not a gateway dashboard).
• Adoption: SURVIVE (60s card, one-sided, no sales call, tweetable /c/ + /r/).

Zero legal/security KILLs. Exactly one FIX (finance). Slip survives.

If engineering ships a customer-MCP reverse proxy or a paste-your-OpenAI-key field, this verdict flips back to KILL. Re-read challenges/security.md and challenges/competition.md before writing the first route.

Killed list (do not build, not even as v1.1)

1. Hosted MCP/LLM reverse proxy for customer upstreams (Hallpass-as-spec, Helicone-shaped BYOK gateway).
2. Anything whose homepage is traces, spans, session replay, prompt playgrounds, or LLM-as-judge (Langfuse $29 / Phoenix $0 / LangSmith / Braintrust).
3. Agent SSO / shadow-AI directory / “control plane” (Okta Agent SSO is free; IBM Orchestrate from $530; Broadcom AgentMinder).
4. GitHub App as the product (Permitfile). YAML export only.
5. Freelance marketplace, escrow, client logins, hire-worthiness scores (Workslip + legal KILL variants).
6. Live LLM proxy “to meter dollars” (LiteLLM/Portkey clone + bandwidth + key custody).
7. Quantum anything (classroom, Aer, QPU broker, VQE, QRNG, PQC badge).
8. Prepaid model credits / token wallet / receipt coins.
9. Browser agents that log into third-party sites (Ninth Circuit Amazon v. Perplexity, 26-1444, is fact-specific; vendor-to-site TCP is the open CFAA path).
10. “AI Act / SOC 2 / HIPAA / PQC / NIST compliant” as a claim or a badge.
11. Children’s classroom, school SKU, or ungated playground that stores chats from minors.
12. Social CryptoBook. Mission: take social out.

Steal as modules, not companies: Rehearse jump-scare, BurnNotice sample loop, Workslip skin on /r/, agent-permit.yaml as the compiled file, schema hashes on the blast card.

Residual risks (owned, not ignored)

1. Finance stretch is required to clear $5k MRR. Base case ~128 paying × $31 ARPU ≈ $4.0k. Levers that must actually ship: Slip H1 (not CryptoBook), receipt paywall, weekly “denied N / saved you from X” email, one comparison page vs Cloudflare spend limits (“they cap tokens; we cap delete_file and git_push”), Claude Code / Cursor copy-paste snippet. Kill-switch: if M6 paying < 15 after a real launch, stop feature work and fix activation.
2. Cursor/Claude native per-tool policy can eat the PEP. Mitigation: be the shareable card and receipt, not the IDE. If they email a share link, we still host the public object.
3. Permit.io or Preloop add a 60s playground. Possible. We stay on public evidence objects and refuse the gateway category. If we panic-add a proxy, we die on their terms.
4. Fake dollar caps. We cannot see Anthropic invoices without sitting on the LLM path. UI must cap tool-call counts and named denies. Optional sidecar-reported usd_estimate is labeled an estimate. Never print “$2.00 of your OpenAI key remaining” as if we were the billing system.
5. Stdio MCP never hits our servers. Homepage must say so. Paste tools/list JSON is the honest path. Local npx PEP is documented, not vapor, but v1 enforcement on this box is the decide API + toy MCP.
6. CFAA residual. After we say allow, the user’s agent may still abuse a third party. We never originate those connections. ToS: user is the actor (Perplexity). Keep vendor servers off the third-party path.
7. EU person uses the site anyway. Geo-restrict EU/EEA/UK at the edge when ops wires nginx. Art. 50 disclosure on the playground regardless. Annex III still avoided by purpose.
8. User forwards a receipt as HR/credit evidence. No scores. Every /r/ page: “This is a log of a policy decision, not a legal, audit, or employment opinion.”
9. VPS breach. Acceptable blast radius: emails, policy text, receipt hashes, Stripe IDs, hashed project tokens. Unacceptable: model keys, PATs, prompts. Architecture must make the second set structurally impossible.
10. Founder-hour COGS. MCP client matrix (Cursor / Claude Code / Claude Desktop) will try to become a consultancy. Docs-only for free. Known-clients matrix on /docs. If >40% of tickets are “my client won’t connect,” we mis-built the pipe — we should not have been a pipe.
11. Brand leftover. cryptobook.com / .space still says “crypto social.” Product name Slip + Virtus chrome. Do not lean into the old graph.
12. This is not a legal opinion that Slip is “compliant.” Counsel reviews ToS before public launch.

Domain / DNS note

Public ports stay 80/443 only. No extra UFW holes. LiveKit/TURN remain for the old stack; Slip does not use WebRTC.

When ops later wires nginx, intended vhost: server_name cryptobook.space www.cryptobook.space cryptobook.com www.cryptobook.com; → proxy_pass http://127.0.0.1:3100. Until DNS for .com moves, that server_name is harmless.

Instruction to the builder

Read SPEC.md. Build the playground + signup + dashboard + POST /v1/decide as a real permit engine, not a brochure. Theme: design/virtus-theme.md (black / #e91e8a / glass / 14–34px radii). First screenshot must be a blast card and a receipt, never a gateway dashboard.

If a sprint choice is “customer MCP proxy vs. skip,” skip. That choice is how this decision dies.