The founder role was defined as silent/non-participating, but Phase 2
also required "founder buy-in" for the unpublish decision — a direct
contradiction that made the success criteria unachievable as written.

Aligns the doc with SECURITY-RUNBOOK.md (DEVOP-571), which scopes the
founder-approval gate to full-package deletion only. The per-version
`npm unpublish` decision is the incident lead's call.

- Role table: founder is a silent observer; may break silence ONLY if
  the team escalates to a full-package delete gate (per runbook §5).
- Phase 2 step: lead owns the per-version unpublish call; observer
  just notes whether the lead announced the decision clearly.
- Phase 2 success: drops "founder buy-in"; substitutes "decision
  announced in channel," matching the runbook's actual authority model.

Resolves cubic P2 finding on PR allora-network#5.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

review-fix-loop iteration 1
reviewer(s): thermo-nuclear (P1)
file: tabletop/2026-Q1-shai-hulud-eliza.md:73-81,127-129,191-194

Sim-vs-real markers were sprinkled per-step (Phase 2 deprecate said
"we don't actually run it," Phase 4 publish said "this is acted out,"
Phase 4 send said "we don't actually send") while Phase 2 unpublish,
Phase 2 PyPI yank, and the Phase 2/3 `gh search` steps had no clarifier
at all. An executor under clock pressure has to guess each step.

Hoists a single rule into the §4 intro: read-only commands run for
real, state-changing commands are pasted-not-executed, default to sim
if unsure. Drops the per-step parentheticals and replaces them with a
brief back-reference where the rule is most likely to bite.

Same edit also adds a 5-line wall-clock layout to §4 intro so the
Phase 5 ("runs in parallel and concludes after debrief"), §4-intro
("Phases 5 and 6 happen after the clock stops"), and §5 debrief
("30 minutes after clock stops") timing claims line up in one place.

review-fix-loop iteration 1
reviewer(s): thermo-nuclear (P2)
file: tabletop/2026-Q1-shai-hulud-eliza.md:63,107-122,257-261

The doc described a "founder-approval gate" for full-package
unpublish/delete, citing SECURITY-RUNBOOK.md §5. The runbook §5
step 1 actually scopes that gate to "publisher and on-call agree,
in writing, in #security-alerts" — there is no founder-approval
gate in the runbook. The role-table break-silence exception for the
founder observer therefore could never fire (it referenced an
authority structure that doesn't exist in the runbook).

Aligns all four locations (role table, Phase 2 unpublish step,
Phase 2 success criterion, §8 facilitator notes) with the runbook's
actual gate. Returns the founder observer to a fully silent role
that matches the runbook's scoping (founders are not in the
authority chain for any in-incident action).

…ter PyPI checkbox

review-fix-loop iteration 1
reviewer(s): thermo-nuclear (P2 maintainability), ce-code-review (P2 correctness, P3 maintainability)
file: tabletop/2026-Q1-shai-hulud-eliza.md:111-116,134-138

Phase 2 ("Stop the bleed", 10-min budget) carried two checklist items
that didn't belong: a PyPI-yank checkbox annotated `N/A for this
scenario` (a dead-letter action that's also internally contradictory
with its own description), and a registry-repo `gh search` step that
duplicates the consumer-repo `gh search` already in Phase 3 (blast
radius). Future facilitators reading the dead-letter checkbox would
either skip-and-not-know-why or delete-and-lose-intent.

- Drops the PyPI checkbox from Phase 2's checklist; preserves the
  cross-registry muscle-memory observation as a §8 facilitator note
  where it belongs (it's a watch-for, not a step).
- Folds the registry-repo `gh search` into Phase 3's existing
  consumer-repo `gh search` bullet so blast-radius enumeration lives
  in one place.

Phase 2's checklist is now exclusively the deprecate + per-version
unpublish actions that match its 10-minute success criterion.

review-fix-loop iteration 1
reviewer(s): ce-code-review (P2 adversarial), thermo-nuclear (P2 doc)
file: tabletop/2026-Q1-shai-hulud-eliza.md:177-178,196-202

Two spots in the doc let the team coast through the exercise by
reading the script:

1. Phase 4 failure-mode bullet read "Lead reuses the bad version
   number (... the test is whether the team remembers without being
   told)" — and then told them, in the same sentence. Self-defeating
   as a recall check.
2. Phase 6 post-mortem template hard-coded the conclusion (the
   "16-hour blind spot is the most important finding"), turning the
   debrief into a fill-in-the-blank instead of a math-from-the-
   timeline exercise.

Rewrites both as non-leading observations: the facilitator is
watching for whether the lead articulates the version + non-collision
rationale; the post-mortem template tells the team to compute the
detection-to-mitigation latency and identify the single largest gap,
without naming what that gap will turn out to be.

review-fix-loop iteration 1
reviewer(s): ce-code-review (P3 security, P3 doc)
file: tabletop/2026-Q1-shai-hulud-eliza.md:33-34,180

- The fictional exfil endpoint named a real `*.workers.dev`
  subdomain (`eliza-telemetry.workers.dev`). Anyone can register a
  workers.dev subdomain, so the doc either implicates an existing
  owner or invites someone to register the name and grep for hits.
  Replaces with an RFC-2606/RFC-6761 reserved placeholder
  (`exfil.example.invalid`) and notes inline why.
- Phase 5 header said "clock stops at end of Phase 4; this runs in
  parallel and concludes after debrief," which contradicted the
  §4 intro's "Phases 5 and 6 happen after the clock stops." The
  new wall-clock layout (added earlier this iteration) defines the
  timing once; the header now just states T+30 onward + parallel
  with the debrief, leaving the rest to the canonical layout.

…le §3 paragraph

review-fix-loop iteration 2
reviewer(s): thermo-nuclear (P2 maintainability), ce-code-review (P2 correctness, P2 maintainability)
file: tabletop/2026-Q1-shai-hulud-eliza.md:71,107-114,118-122,257-262

Iteration 1 fixed the founder-gate language to align with the
runbook, but did so by renaming the quote in four places (§3 founder
cell, Phase 2 unpublish bullet, Phase 2 success block, §8 author
note) instead of consolidating it. That left two follow-up smells:

- The same gate quote ("publisher and on-call agree, in writing, in
  #security-alerts") appears verbatim in three locations; any future
  runbook revision now silently drifts this file in three places.
- §3 said "full-package unpublish/delete" while Phase 2 only enumerated
  "full-package delete" in its forbidden-action call-out, leaving the
  doc taxonomy inconsistent (in npm these are the same action, but the
  inconsistency forces the executor to flip back to §3 to confirm).

Defines the gate exactly once, in a new "Authority chain for this
scenario" paragraph immediately after the §3 roles table, and
clarifies inline that "full-package deletion" in npm is `npm unpublish`
without a version (so the unpublish/delete naming inconsistency
collapses). Phase 2 unpublish, Phase 2 success, and §8 author note
now reference §3 instead of re-quoting the gate.

…eline math

review-fix-loop iteration 2
reviewer(s): thermo-nuclear (P2 doc, P3 doc), ce-code-review (P3 correctness, P3 maintainability)
file: tabletop/2026-Q1-shai-hulud-eliza.md:34,176-180,196-203

Iteration 1's polish edits introduced three voice-and-clarity smells:

1. The §2 injected-scenario blockquote is read in-character at T+0 by
   participants. Iteration 1 dropped four lines of meta-rationale
   (RFC-2606/RFC-6761/`*.workers.dev`) into that blockquote, breaking
   the simulation voice for everyone except the doc reviewer.
   Moves the rationale to a §8 facilitator note where it belongs;
   the blockquote keeps just the URL.

2. The Phase 4 version-collision failure-mode used "yanked" — PyPI
   terminology — for an npm-only scenario. Switches to npm's
   "unpublished" and adds a one-line cross-registry aside so the
   wording stays correct without losing the broader awareness.

3. Phase 6's detection-to-mitigation bullet was internally
   contradictory ("compute the gap between publish and `ack`" vs.
   "identify the single largest latency"), and the meta-instruction
   ("do not pre-name the answer") sat inside the same bullet a lead
   might copy verbatim into the post-mortem document. Splits the
   bullet into a checkbox plus a clearly-marked nested facilitator
   note that names the timestamp set, asks for consecutive gaps
   (not one), and is unambiguously not template content.