THE TORONTO LISTENING PROJECT — intake scope, tensions, and proposed shape

v0.1 · 2026-08-01 · Strategy Jane (non-execution seat; everything below is PROPOSAL, nothing is fired or landed). Trigger: combined “boot strategy jane” + “boot new project” — new-project intake run under the mission-scoping rule. Dates that bind: nominations 2026-08-21 · voting 2026-10-26.

§1 · What this actually is (the strategic read)

VISION_CORE’s own central legitimacy claim is: “The vision is what we’ve heard from thousands of voices”. Today that claim is backward-looking — it rests on the operator’s years of one-on-one listening, which no outside reader can audit. The Toronto Listening Project converts that claim into forward-looking, auditable infrastructure: a standing, public, verifiable answer to “heard from whom? when? show me.” That is not a new project bolted onto the estate — it is the missing organ of the estate’s own theory of change, and it is also the only honest defense against the strongest attack the vision will face (“one guy’s synthesis dressed up as a city’s voice”).

Three streams plus one campaign asset, which are NOT the same kind of object:

The single most important structural decision in this memo: these four things must not share one pipeline, one storage rule, or one legal posture, even though they share one front door and one name.

§2 · Scope (new-project step 2)

In: a public intake door on the existing site (written / voice / video-link), per-stream handling rules, a consent architecture for the WITNESS stream, a verification path from testimony to ledger-grade fact, the petition (or a stronger instrument — §4-T3) as a firewalled campaign asset, and a “what we heard” feedback surface so being heard is demonstrable, not asserted. Out: any new organization, membership, app, or platform build (canon lock-in rule binds: one person’s synthesis + existing infrastructure + a trigger); any public naming of specific organizations as “systematic problem” sites until the evidence bar in §4-T2 is met; any raw-testimony storage inside this repo (§4-T1). Tracks: Movement (door, consent surfaces, petition rendering) + Research (public-record spine, protocol design, verification); Strategy holds the shape. Size call: big — own plan doc (this memo is its seed), not a single dispatch.

§3 · What already exists to build on (no duplication)

• The site is live (soft launch, 667 pages) with a sitewide “suggest an improvement” footer + a contact address — the intake door is an extension of an existing, working channel, not new infrastructure.
• The signup/identity design (minimal-record, passwordless, custody-first): the exact architecture a petition-signature store needs; design once, reuse.
• FLAGSHIP-H sealed (L0-L3) + the ~27.7k-word book draft: the petition’s factual context already exists at seal grade. The WITNESS stream corroborates it; it grounds the WITNESS stream.
• Frozen v1 Toronto-Homelessness-Solutions-Research + regenerative-toronto-assembly-kb: import-with-provenance sources.
• Skills already on the bench: source-check (defamation/firewall pass — mandatory for anything petition-shaped), honest-brief (facts→platform rendering).
• The inbox + Curator triage: the low-risk streams can literally use the existing capture pattern from day one.

§4 · The tensions — the strongest case against, named first (seat method §2)

T1 · “Capture now, decide later” is right for two streams and wrong for the third. For VISIONS and EXPERTS, unstructured capture-first is correct — cheap, reversible, exactly the inbox pattern. For WITNESS it inverts: consent cannot be retrofitted. A person in a shelter who hands over abuse testimony without a defined consent tier cannot later be found to re-consent when a use is decided — people in that population move, lose phones, disappear, die. Capture-first therefore produces an archive that is either unusable (no consent chain) or usable-in-a-way-that-betrays (used beyond what was understood). The Truth and Reconciliation Commission’s statement-gathering is the governing precedent: tiered consent chosen at capture (private archive / anonymized public / full public attribution), right of withdrawal, trained gatherers, support pathways. PIPEDA applies to us as a non-governmental collector of highly sensitive personal information. And a data breach of abuse testimony is not an ops incident — it is doing harm to the exact people this project exists to stand up for. Consequence: raw WITNESS material never enters this repo — not even the vault (gitignored is not encrypted, and this machine syncs). Dedicated encrypted store, operator-held keys, minimum copies; the repo holds only derived artifacts at the consented tier.

T2 · The petition names adversaries; the estate’s whole posture is neutral. The ask names a specific organization as an example of a “systematic problem” place. Truth defenses exist — justification, fair comment, responsible communication on matters of public interest (Grant v. Torstar) — but every one of them requires documented, sourced, reasonably-investigated evidence before publication, not testimony-in-hand and conviction. The correct order is the one the estate already practices: public record first (Toronto Auditor General’s shelter audits, Ombudsman Toronto investigations, coroner’s inquests, shelter death statistics — already-published, institutionally-authored, safely citable), testimony as corroboration and human weight second, naming specific organizations last, if ever, and only through source-check at seal grade. The petition’s asks as stated — system-wide reform, full financial transparency, auditor/ombudsman investigation — are all institutional asks and need no org-naming to be maximally forceful. Also binding: the research/campaign firewall. The petition is campaign-side. It may consume only published artifacts. The listening infrastructure stays neutral — usable by any candidate, any party, any resident — or the whole estate’s neutrality claim becomes contestable in one move.

T3 · Is a petition even the strongest instrument? The strongest case against the petition as-imagined: unofficial online petitions in Ontario are politically expressive but institutionally weightless — no one is obliged to answer one. The same testimonial energy routed as a structured mass-complaint pipeline has teeth: Ombudsman Toronto takes complaints about city shelter services individually (each opens a file that must be dispositioned); the city Auditor General runs a fraud & waste hotline; the Ontario Ombudsman covers provincial bodies in the ask’s list. A petition is one document that can be ignored; three hundred individually-filed complaints are a caseload that cannot be. Proposal: both, sequenced — the petition as the public, signable, campaign-side declaration (it also serves the Aug-21→Oct-26 window as a story candidates must answer to), and the complaint pipeline as the institutional mechanism the petition points people into (“sign, and if the system touched you, file — here’s how, we’ll help”). The second is also the stronger answer to “make every Torontonian actually be heard”: a file number is being heard, on the record, by the body obliged to respond. CARD B puts this choice to the operator.

T4 · The clock. Nominations in 20 days; the go-live slice, flagship renders, and the publish click are the live campaign spine. A listening project is a months-scale organ being born in a weeks-scale window. Case against doing it now at full shape: it cannibalizes the only scarce resources (operator attention, judgment-tier tokens) at the exact wrong moment. Case for doing a thin slice now: the WITNESS/petition thread IS campaign-relevant (FLAGSHIP-H just sealed; “first hill”), and a listening door that exists before voting day makes the vision’s central claim demonstrable during the window when it matters most. Resolution proposed: Phase 0 only before Aug-21 (one door, one page, existing channels, §5); the synthesis machinery explicitly deferred post-Oct-26.

T5 · The promise is the product — and the liability. “Feel heard and actually be heard” creates an obligation the moment the door opens: an intake that goes unread, unanswered, and invisible is worse than no intake — it re-enacts, under our own name, the exact abandonment the project indicts. Two design consequences: (a) never promise individual response; promise visible aggregate response — a public “what we heard” surface with counts, themes, and changes made (the radical-transparency posture already ratified for how-this-was-made extends naturally); (b) open the door only as wide as real triage capacity (Curator cadence), and say so on the door itself. Precedents worth stealing from deliberately, later: vTaiwan/Pol.is (scaled sense-making), participatory budgeting’s feedback loops, StoryCorps (dignified capture mechanics), Participedia as the catalog of what’s worked elsewhere.

§5 · Proposed shape (phased; each phase operator-gated)

• Phase 0 — the door (pre-Aug-21, thin): one page on the live site: three streams explained, written submissions via existing form/email, voice via voice-memo-to-email, video via link-not-upload. VISIONS/EXPERTS → inbox Curator pattern, live immediately. WITNESS: the door describes the stream and its consent promise but takes only first-contact (“we will contact you; nothing is recorded until you’ve chosen how it can be used”) until Phase 1’s protocol is ratified. Zero new backend.
• Phase 1 — the WITNESS protocol: consent tiers, gatherer script, storage/custody rule (CARD C), withdrawal mechanism, verification path (testimony → corroboration against public record → ledger claim at VERIFY → Lane-V). TRC statement-gathering as the design template.
• Phase 2 — the instrument: CARD B decision; petition text drafted campaign-side from published artifacts only, through source-check; complaint-pipeline kit (plain-language how-to-file guides for Ombudsman Toronto / AG hotline / Ontario Ombudsman) built as neutral infrastructure — a how-to-be-heard guide is usable by anyone, hence firewall-clean.
• Phase 3 — the synthesis engine (post-Oct-26): “what we heard” renders, theme maps, expert-idea registry, scaling candidates — the canon pattern (capture → synthesis → renders) applied to the city’s voice instead of the operator’s.

§6 · Proposed decision-queue cards (drafts — handed, not landed; ≤3 by seat law)

CARD A — PROJECT SHAPE. Ratify: three streams + petition as separate-pipeline objects; “capture now, decide later” confirmed for VISIONS/EXPERTS and rejected for WITNESS (consent-first, Phase-1 protocol before any testimony capture); Phase 0/1/2/3 sequencing with only Phase 0 pre-Aug-21. Action: “ratify shape” or redline any line.

CARD B — THE INSTRUMENT. Petition alone · complaint-pipeline alone · both, sequenced (recommended: petition = public declaration, pipeline = institutional teeth; petition routes signers into the pipeline). Petition text consumes published artifacts only and passes source-check before any public surface. Action: one word — “petition” / “pipeline” / “both.”

CARD C — TESTIMONY CUSTODY. Raw WITNESS material never enters the repo (including the vault); dedicated encrypted store, operator-held keys, minimum copies; repo carries only tier-consented derived artifacts; no org-naming in any public artifact except through source-check at seal grade. Action: “custody rule approved” or name the storage you prefer.

§7 · Ready-to-fire dispatch drafts (new-project step 4 — full prompts, held for gates)

D2 may fire immediately (neutral research, no card dependency). D1 waits on CARD A; D3 informs CARDs A/C and may fire alongside them.

D1 · Movement Jane — the /listen door (Phase 0) — gated on CARD A

=== HEADER ===
To:       Claude (Cowork or Code) · Role: Movement — /listen door, Phase 0
Session:  new chat · Reads: MIND.md, state/NOW_MOVEMENT.md,
          this memo (§1, §4-T5, §5 Phase 0),
          state/DECISION_QUEUE.md (project cards — confirm CARD A ratified before building),
          site tree conventions + the corrections-footer implementation
=== GOAL ===
One new page (staged, NOT published — publish stays the operator's click):
the Listening Project door. Three streams explained in PC3.0 voice; written/voice/video-link
intake via EXISTING channels only; WITNESS section = first-contact-only with the consent
promise stated verbatim from the memo; a visible "what happens to what you send" section
(§4-T5's aggregate-response promise, no individual-response promise anywhere).
=== METHOD ===
Draft page → run the adversarial-gauntlet habit against it (would a hostile reader find an
org-to-join implication? a promise we can't keep? a data claim we can't honor?) → stage
beside the slice, flag for operator review. Explicitly: no new backend, no upload endpoint, no
database.
=== GUARDRAILS ===
Identity firewall. Canon rule (nothing implying an organization to join). No org-naming.
No WITNESS capture mechanics of any kind pre-Phase-1. Neutrality: door text usable by anyone.
=== OUTPUT ===
Staged page + ≤10-line report; state files + session close per MIND.md.

D2 · Research Jane — the public-record spine — fireable now

=== HEADER ===
To:       Claude (needs WebFetch+WebSearch) · Role: Scout/Lane-M — shelter-system
          accountability record · Session: new chat
Reads:    MIND.md, state/NOW_RESEARCH.md, research/issue-map.md (homelessness slugs — a later round
          slugs ratified), SHORTHANDS SCOUT-6AXIS method (as tool, not quota),
          research/ledger/SCHEMA.md, FLAGSHIP-H ladder (know what's already sealed — additive
          only)
=== GOAL ===
Catalog + mine the already-public institutional accountability record of the Toronto shelter
system: Toronto Auditor General shelter audits, Ombudsman Toronto investigations + case
digests, coroner's inquests + jury recommendations, shelter-death data, city funding/financial
disclosures for shelter operators, provincial oversight reports. Done = Atlas rows + VERIFY
claims forming the factual spine the petition/pipeline will later cite — institutional
authorship only.
=== METHOD ===
Six-axis discovery; add_source/add_claim tooling only (lock-safe IDs); WebFetch + raw-fetch
cross-check per the mining doctrine's fabrication guard; pre-flight gate check per doctrine.
=== GUARDRAILS ===
Identity firewall. Institutional addressees only — NO named individuals, and no editorial
characterization of any specific operator organization: catalog what the AG/Ombudsman/coroner
themselves published, verbatim-traceable. Neutrality: descriptive, usable by anyone.
=== OUTPUT ===
Atlas/ledger rows per doctrine; ≤15-line report incl. claim-ID range for Lane-V; standard
close.

D3 · Research — WITNESS protocol + legal frame (thinking ON) — informs CARDs A/C

=== HEADER ===
To:       Claude (thinking ON — judgment work) · Role: Research —
          testimony protocol design (Phase 1) · Session: new chat
Reads:    MIND.md, state/NOW_RESEARCH.md, this memo (§4-T1/T2 are the spec), TRC
          statement-gathering protocols (fetch primary), PIPEDA collection/consent guidance,
          trauma-informed interviewing literature, Canadian defamation defences (Grant v.
          Torstar line)
=== GOAL ===
Draft WITNESS_PROTOCOL_v0.1 for operator ratification: consent tiers + capture script +
withdrawal mechanism + custody spec (encrypted, off-repo, key-holder named) + the
testimony→public-record-corroboration→ledger verification path + a plain-language
one-page consent notice a person in crisis can actually understand.
=== METHOD ===
Precedent-first (TRC, StoryCorps mechanics, community-based research ethics), then adapt to
this estate's ledger/verification discipline; every legal statement sourced, flagged "not legal
advice — counsel review before live use."
=== GUARDRAILS ===
Identity firewall. The protocol itself must be publishable (radical-transparency posture) —
write it to survive a hostile reader. No capture happens under this dispatch — design only.
=== OUTPUT ===
A WITNESS_PROTOCOL_v0.1 draft + ≤15-line report; standard close.

§8 · Handed lines (this review writes neither)

• ⚑ NOW.md flag: “Toronto Listening Project INTAKEN + scoped — 3 cards await operator; D2 dispatch fireable now.”
• The three cards above, for Founder/operator to land in the decision queue.

Not a lawyer’s document; §4-T2/D3 legal readings need counsel before anything ships publicly.

ADDENDUM 1 · 2026-08-01 (same day) — operator rulings landed; shape revised

Strategy Jane, same seat, second sitting. Rulings banked verbatim. This addendum amends the memo’s own proposals only. Interpretations flagged; one stands open for a one-line correction (§A1.2).

§A1 · Rulings, recorded

1. T1/CARD A ratified — three streams + separate pipelines; consent-first WITNESS stands.
2. CARD B = PIPELINE. Read together with the operator’s T2 comment as: the mass-complaint pipeline is the instrument; the petition survives as the public declaration — systemic framing, “the system as a whole AND each and every component/supplier/agency/org in that system,” no new research needed (“we have everything we need” — FLAGSHIP-H sealed estate + the operator’s own witness). ⚑ FLAGGED interpretation: if the petition is instead fully dropped in favor of the pipeline alone, one operator line corrects this.
3. CARD C approved — custody rule binds as written. PLUS a new commissioned element: a whistleblower channel under WITNESS (shelter/agency staff, not only residents), to be done right — opsec, security, anonymity, immutability. Best-practices investigation commissioned → dispatch D4 (§A4).
4. T4 overridden: Ready-Fire-Aim. The §5 phase gates are dissolved for this project. Start now, keep going, reassess in a few weeks. Synthesis v0 = transcription + mechanical encodings (issue, type, severity, …), improved later — schema seed in §A3.
5. New build permitted. The memo’s “zero new backend” constraint is lifted: a real intake build on the platform is accepted (“we need a way to do intake”). The signup/identity design’s minimal-record, custody-first architecture is the design floor it inherits.
6. Skills retired: source-check + honest-brief killed by operator. The pre-publish verification/defamation pass survives as inline method (any seat shipping public text runs the check itself); §4-T2’s discipline is unchanged in substance, only de-skilled.
7. T2 note kept honest: a petition calling for investigation and reform of the whole system and all its components asserts opinion/demand, not per-org guilt findings — that is exactly the defensible shape. The discipline survives at the edges: any factual assertion in public text still cites the sealed estate; org-specific findings still wait for investigators we petition into motion. No new research required — concurring with the operator, not merely deferring.

§A2 · Revised shape — five start-now workstreams (no phase gates)

• W1 · INTAKE BUILD — tiered-agency intake system (the T3 ask): Tier 0 tell-your-story → Tier 1 guided self-file (we generate the packet, they submit) → Tier 2 assisted/on-behalf filing with signed consent (Ombudsman Toronto accepts representative complaints with consent) → Tier 3 automated generation + facilitated filing. Design spec first (D1′), build follows the identity design’s patterns.
• W2 · WITNESS PROTOCOL — unchanged (D3): consent tiers, capture script, custody, withdrawal, verification path.
• W3 · PIPELINE KIT + PETITION TEXT — plain-language how-to-file guides (neutral infrastructure) + the declaration text drafted campaign-side from what already exists; inline verification pass before anything ships.
• W4 · WHISTLEBLOWER CHANNEL — new (D4): the element that must be done right before it exists at all; no interim half-secure version.
• W5 · SYNTHESIS v0 — transcription + mechanical encoding. Note: WITNESS audio must never transit cloud APIs — local Whisper-class transcription on the compute fleet fits both the custody rule and the idle-GPU doctrine. Encoding schema seed (§A3) is deliberately dumb-simple, improvable later per the operator’s own instruction.

§A3 · Synthesis-v0 encoding schema (seed — Research refines in-lane)

submission_id · date_received · stream (VISION/EXPERT/WITNESS/WB) · channel · consent_tier · transcription_status · issue-slug(s) (issue-map vocabulary) · institution_class (system component type — shelter/warming/benefits/police/ health; institutional, never a named individual) · incident_type · severity (1-5, rubric TBD) · location_class (ward/FSA-level, never an address) · corroboration_link (ledger claim ID if verified) · status (raw→transcribed→encoded→verified→ rendered). One row per submission, append-only, derived tier only — raw material stays in the custody store (CARD C).

§A4 · Dispatch drafts, revised standing

• D1′ (Movement/Code, fireable now): as §7-D1 but the “no new backend” guardrail is REPLACED by: design the tiered intake system (W1, T3 tiers) on the identity design’s minimal-record custody-first floor; door page + intake spec are one dispatch, build lane follows review.
• D2 (public-record spine): PARKED by ruling — not needed for the petition. Retained unfired as the corroboration base for WITNESS verification (W2’s testimony→record path) whenever that lane wants it; re-scope before firing.
• D3 (WITNESS protocol): fireable now, unchanged, minus the killed-skill reference.
• D4 · NEW — whistleblower channel best practices (Research, thinking ON):

=== HEADER ===
To:       Claude (thinking ON) · Role: Research — whistleblower intake
          architecture (W4) · Session: new chat
Reads:    MIND.md, state/NOW_RESEARCH.md, this memo (§4-T1/T2, ADDENDUM §A1.3/§A2-W4),
          the signup/identity design (custody-first floor)
=== GOAL ===
WHISTLEBLOWER_CHANNEL_v0.1 design draft for operator ratification: how a shelter-system insider
submits evidence with real anonymity, and how we hold it with real immutability. Done = a
compared-options design (not a survey): intake transport · anonymity guarantees ·
metadata hygiene · storage/custody · tamper-evidence · legal exposure, each
with a recommendation and its strongest counter-case.
=== METHOD ===
Precedent-first, primary sources: SecureDrop and GlobaLeaks architecture docs (threat models
included), Hush Line-class lightweight alternatives, Signal-based intake patterns, Tor onion
service tradeoffs vs. a low-tech dead-drop tier (paper/voicemail) for low-digital-literacy
insiders; metadata scrubbing at ingest; tamper-evidence via hash-chain/trusted-timestamping
(e.g. OpenTimestamps-class) WITHOUT publishing content; honest read of Ontario/Canada
whistleblower-protection gaps (weak private-sector cover — the design must protect people the
law won't). Map each option against the CARD C custody rule and the operator-held-keys
constraint. Flag every legal statement "not legal advice — counsel before live use."
=== GUARDRAILS ===
Identity firewall. Design only — nothing stood up under this dispatch. The channel does not
exist publicly until it is actually secure ("done right" is the ruling): no interim half-secure
version, and the design must assume a motivated adversary (an org whose funding is threatened)
attempting submitter unmasking. Radical-transparency posture applies to the protocol's public
description, never to operational security details that enable unmasking.
=== OUTPUT ===
A WHISTLEBLOWER_CHANNEL_v0.1.md draft + ≤15-line report; standard close.

§A5 · Draft decision text (handed for Founder to mint; wording proposal only)

Project shape RATIFIED (operator, verbatim banked): three streams + petition-as-declaration, consent-first WITNESS (capture-first rejected for that stream); instrument = mass-complaint PIPELINE with tiered on-behalf/facilitated filing; custody rule approved (raw testimony off-repo, encrypted, operator keys, derived-tier-only in repo); whistleblower channel commissioned under WITNESS, done-right bar (opsec/anonymity/immutability), design before existence; Ready-Fire-Aim — no phase gates, synthesis v0 = transcription + mechanical encoding; new intake build on the platform ACCEPTED on the identity-design floor; source-check + honest-brief skills retired, verification discipline inline. FLAGGED interpretation open: petition survives as declaration vs. dropped-for-pipeline-alone.

§A6 · Handed lines (updated)

• ⚑ NOW.md flag: “Project RULED (operator, 2026-08-01, banked): pipeline instrument, custody approved, whistleblower element commissioned, Ready-Fire-Aim — D1′/D3/D4 dispatch drafts fireable now (memo ADDENDUM 1); D2 parked; decision mint awaits Founder.”
• Open on operator (one line each): the §A1.2 petition interpretation, if wrong.

Nothing fired, minted, or landed.

ADDENDUM 2 · 2026-08-01 — complaint-mechanism map commissioned and drafted

Operator ask (banked, third bank same day): map ALL formal Toronto/Ontario/Federal complaint mechanisms — facilitation depth, importance, triage/routing — before deciding which to stand up. Delivered as its own memo: a Complaint Mechanism Map (~30 mechanisms, every row flagged for verification; assessment axes; the internal-first/case-state-machine finding that reshapes W1’s data model; the unauthorized-practice-of-law boundary rule — guidance/pointing everywhere, representation/advocacy only where the body permits; the volume-trap caution; dispatch D5 — ready-to-fire verification sweep landing a complaint-mechanisms data file). W1’s intake build should read that memo’s case (not complaint) framing and its triage tree as design inputs. Fireable set now: D1′ · D3 · D4 · D5 (D5 first — the registry gates W3’s routing table).