Reviewed: build plan v1 against review framework v1 · Date: 2026-08-12 Scored by: an independent reviewer who did not write either document
This is not "don't build it." Phases 0–4 are clean and can start immediately. The verdict means: do not build the money layer (Phases 5–6) until seven specific things change. All seven are cheap. None requires redesigning the product.
| Gates passed | G2 disclosure · G3 Google licence · G4 identity claims · G5 review integrity |
| Gates failed | G1 unlawful-assistance monetization · G7 legal-basis prerequisites · G8 directive compliance |
| Gate N/A | G6 compensation structure (Phase 6 already deferred) |
| Score | 71/100 — CONDITIONAL band, below the 75 GO bar |
| Dimension | Weight | Score | Why |
|---|---|---|---|
| D1 Legal & regulatory | 20 | 13 | Research is strong; the exposure is deferred to a human choice, not engineered out. No per-state rule engine. fee_practice is self-attested. |
| D2 Veteran outcome | 15 | 12 | Free-VSO module genuinely sits above the sponsored block. But the 20% / post-decision fee rules never appear at the point where the veteran clicks "contact." |
| D3 Monetization integrity | 15 | 11 | Flat-fee core is sound and Phase 6 is gated — yet the lead table ships in Phase 1 and the contested tier is specified in build-ready detail. |
| D4 Data & identity | 12 | 9 | No SSN, no DD-214, Google licence encoded in the schema. Deductions: VSHE dependency, no retention/deletion policy, re-identification risk from review + outcome + state on small firms. |
| D5 Trust & safety | 12 | 9 | Every 16 CFR 465 clause has a mechanism. Missing: reviewer appeal path, a definition of "clearly false," and publishing removals as insider-review accusations creates fresh exposure. |
| D6 Delivery feasibility | 10 | 7 | Sequencing is sound, but ID.me is treated as a cost line rather than a contracting dependency that gates every review, and the estimate omits a large hidden work item (below). |
| D7 Directive & ops | 6 | 3 | Verification evidence format is strong; the claim → usage → status → release loop is simply absent from the plan. |
| D8 Commercial viability | 10 | 7 | Cold start is genuinely solved by the free OGC roster. No price, no willingness-to-pay evidence, no churn model. |
| Total | 100 | 71 |
G1 — unlawful-assistance monetization. The plan leaves "can an unaccredited consultant buy a Sponsored slot?" as an open human choice in §9.1 while the BLUF says it implements the spec as written. There is no mechanism preventing it. The framework's own evidence rule — a mechanism counts, an intention does not — makes an unresolved gate a failure. Fix: make paid tiers structurally unavailable to unaccredited firms as a database constraint on subscription keyed to accreditation.is_current, not as a policy sentence.
G7 — legal-basis prerequisites. Phase 0 lists ToS, privacy policy, headers and the 301. The gate also requires a documented breach process, and the plan mentions it only as something VA will ask for. One paragraph of work, but a fail as written.
G8 — directive compliance. The plan documents the deploy lane and the verification evidence format but never states the claim loop, one-billable-per-claim, the usage line, or document delivery via /api/1099/document. Ironically the framework tests for a loop the plan never wrote down — evidence the instrument was not run against the plan before both were published.
These are the ones worth your attention — they are not restatements of the plan.
1. The plan contradicts itself on California. §1.4 excludes California from pay-per-lead because of B&P §6155 (referral-service registration). But §6 puts a lead inbox in the flat subscription tier — and §6155 turns on operating a referral service, not on how you price it. So the plan ships a lead-delivery product into California on the flat tier while carefully excluding California from the per-lead tier. This is the sharpest internal contradiction in the document and it sits in the revenue path.
2. Consumer health data is unmodeled, and may be the largest exposure of all. The dataset is "this named person is a disabled veteran filing a disability claim" — inferred health status. That is sensitive personal information under CPRA and regulated consumer health data under Washington's My Health My Data Act, which carries a private right of action. Neither the plan nor the framework covers it. This is plausibly bigger than anything gates G1–G6 model.
3. The seeding plan hides the biggest engineering item. The VA OGC roster is per-person. The data model is per-firm, with a google_place_id. Mapping accredited individuals → firms → Google Places is fuzzy entity resolution with dedupe and merge conflicts, and neither document mentions it. It is the single most under-scoped item, and it invalidates the "4–6 sessions" estimate for Phases 0–4.
4. Defamation and publisher liability are absent. Reviews name individual attorneys. Section 230 covers hosting third-party content; it does not cover FedM8's own badges, removal notices, or "reported" legal-threat logs. No notice-and-correction process, no anti-SLAPP posture, no E&O insurance anywhere in the plan.
5. The stale roster makes the site's most consequential claim the firm-side one. A Monday/Wednesday/Friday refresh means a suspended attorney wears a "VA-accredited" badge for up to 72 hours. G4 gates identity claims made about veterans; nothing gates the accuracy of claims made about firms, which is where the false statement does the damage.
6. Two of my own claims were overstated. "Federally penalty-less" is too strong — accreditation cancellation survives, and the North Carolina ruling I cited holds that charging violated federal law. And "$53,088 per violation" is the 2025 figure; FTC penalties re-adjust annually.
You asked to be able to fix either artifact. The framework needs fixing too.
The independent reviewer's first finding was that the framework was reverse-engineered from the plan. G3's failure condition restates the plan's "no google_rating column, ever." G4 names the exact four vendors the plan evaluated. D4's 8–10 band describes the VSHE dependency and nothing else. D8's top band is the plan's seeding section verbatim. Four of eight gates and two dimension bands were written so this plan passes by construction.
That is what happens when the same author writes both — which is why the scoring was handed to a reviewer who had not seen either document being written. The score above is theirs, not mine. If you want the framework to be reusable on the next plan, it needs:
design decision already made;
businesses;
felony reaching the paying lawyer. Counsel cannot sign off on that; the gate is weaker than the plan's own analysis.
Seven items. Items 1–4 flip G1 and G7; item 5 flips G8. Together they move D1 to ~17 and D4/D5 to the top of their bands, clearing 75.
ineligible for any paid tier — enforced as a DB constraint, not a policy.
fee_practice from self-attested to OGC-fee-agreement-verified before it powers any filter.
or register under §6155, or gate CA sponsorship with Phase 6.
consumer-health-data position (MHMD / CPRA sensitive PI — opt-in, limit-use) — all before ID.me, not after.
"grep the DB for a ratings column" test with an end-to-end check of rendered HTML, CDN cache and request logs.
source_roster_dateexceeds N days; a takedown/correction path for named individuals; a reviewer appeal path.
Start now, no further approval needed: Phase 0 (legal pages, headers, 301 — overdue regardless of this product) and Phases 1–4 (schema, roster import, browse, verified-veteran reviews, firm claim). These carry no failed gate. Phase 0 is worth doing this week whether or not the directory ever ships — ai.fedm8.com currently handles veteran PII with no terms, no privacy policy and no security headers.
Blocked on your decision: Phase 5 (paid sponsorship) behind items 1–3, and Phase 6 (pay-per-lead), which I recommend dropping rather than gating. Texas barratry is a felony that attaches to the paying lawyer, so firms' own counsel will refuse the contract — you would be building a product your customers cannot legally buy.
Three ways forward:
re-score before Phase 5. Cost: roughly one session of plan revision.
state laws will fall, say so and D1 rescores upward. That position is defensible; it just has to be stated and owned rather than assumed.
near 85, and roughly 80% of the revenue survives. This is the version I would build.