ADR-0023: Mods: add-on packs that can only lower

Context

Rafa's words, verbatim:

"So you could extend the business model with mod sales, like a language pack, specific industry skill listening, etc."

"Yeah, let's add this to the product roadmap and planning, no financials tho, just product and reasoning, and suggestions for customer outreach and so on"

As on-device models improve, phones and room systems will run speech recognition and summaries on their own chips. Goldfish's value then moves away from raw computing. What stays is a shared object nobody at the table owns, a light wired to the microphones, provably no radio, and the open protocol. Add-on packs let the device keep getting better for a particular room without a cloud service, and without a subscription that pays for data.

Three kinds of pack came out of the discussion:

Decision

  1. A mod can only lower. It may suggest that something be kept at a lower level, or not at all. It can never raise a level, override a person's own choice, keep anything longer, or add a way for data to leave the device. This is the protocol's "lowering beats raising" rule (RP §6), applied to code nobody at the table wrote.
  2. The note names the mods that were on. Its front matter lists every active pack and version, so everyone knows what the device was listening for.
  3. No emotion, sentiment or personality inference, in any pack. The EU AI Act has prohibited emotion recognition in workplaces since 2 February 2025 (Art. 5(1)(f)), and it is not what Goldfish is for. Facilitation skills measure structure only: who spoke and for how long, what was decided. Any per-person figure is shown to the whole table and dropped when the session ends. No voiceprints are kept beyond the session (BIPA, ADR-0008).
  4. Installed by USB-C, licensed offline. A pack is a signed file, downloaded on a computer and copied over a cable. The secure element checks the signature, and a licence file tied to the device's serial number. No pack, licence or update ever needs a radio.
  5. The firmware stays open. The mod interface and the "only lower" checks are Apache-2.0, like the rest. Anyone can build and share free packs. First-party packs are separate artifacts (models, curated vocabularies, note formats). They earn their place through testing and certification, not by closing the code.
  6. Packs fit the board they run on. A pack declares its memory and compute needs. The device refuses one that would push speech recognition behind real time. Heavier packs (good summarisers in more languages) wait for the v02 hardware.
  7. First three packs: German (the works-council segment), Research (UX and qualitative researchers), Facilitator (talk-time balance and decision capture). They match the segments where the need is sharpest, and the Facilitator pack is the clearest demonstration of "better sessions".

Consequences

# ADR-0023: Mods: add-on packs that can only lower

- **Status:** accepted (2026-10-16)
- **Date:** 2026-10-16
- **Requirements touched:** P-06 (each participant controls their own words), P-09 (no transmitter), the note format
- **Builds on:** ADR-0007 (NFC hand-off), ADR-0008 (per-person levels), ADR-0022 (landing page)

## Context

Rafa's words, verbatim:

> "So you could extend the business model with mod sales, like a language pack, specific industry skill listening, etc."

> "Yeah, let's add this to the product roadmap and planning, no financials tho, just product and reasoning, and suggestions for customer outreach and so on"

As on-device models improve, phones and room systems will run speech recognition and summaries on their own chips. Goldfish's value then moves away from raw computing. What stays is a shared object nobody at the table owns, a light wired to the microphones, provably no radio, and the open protocol. Add-on packs let the device keep getting better for a particular room without a cloud service, and without a subscription that pays for data.

Three kinds of pack came out of the discussion:
- **Language packs:** a speech model plus the spoken-request phrases in that language. The profile has English and Spanish today.
- **Domain packs:** vocabulary and note formats for one field, e.g. research (personal details removed, insight tags), clinical huddles, legal, boards, retrospectives, education.
- **Facilitation skills:** structure, not judgement. A light for who hasn't spoken yet, decision capture, a parking lot for side topics, timekeeping.

## Decision

1. **A mod can only lower.** It may suggest that something be kept at a lower level, or not at all. It can never raise a level, override a person's own choice, keep anything longer, or add a way for data to leave the device. This is the protocol's "lowering beats raising" rule (RP §6), applied to code nobody at the table wrote.
2. **The note names the mods that were on.** Its front matter lists every active pack and version, so everyone knows what the device was listening for.
3. **No emotion, sentiment or personality inference, in any pack.** The EU AI Act has prohibited emotion recognition in workplaces since 2 February 2025 (Art. 5(1)(f)), and it is not what Goldfish is for. Facilitation skills measure structure only: who spoke and for how long, what was decided. Any per-person figure is shown to the whole table and dropped when the session ends. No voiceprints are kept beyond the session (BIPA, ADR-0008).
4. **Installed by USB-C, licensed offline.** A pack is a signed file, downloaded on a computer and copied over a cable. The secure element checks the signature, and a licence file tied to the device's serial number. No pack, licence or update ever needs a radio.
5. **The firmware stays open.** The mod interface and the "only lower" checks are Apache-2.0, like the rest. Anyone can build and share free packs. First-party packs are separate artifacts (models, curated vocabularies, note formats). They earn their place through testing and certification, not by closing the code.
6. **Packs fit the board they run on.** A pack declares its memory and compute needs. The device refuses one that would push speech recognition behind real time. Heavier packs (good summarisers in more languages) wait for the v02 hardware.
7. **First three packs:** German (the works-council segment), Research (UX and qualitative researchers), Facilitator (talk-time balance and decision capture). They match the segments where the need is sharpest, and the Facilitator pack is the clearest demonstration of "better sessions".

## Consequences

- A new check in `validate.py`: a hostile test pack tries to raise a level, extend retention and add an output, and every attempt must be refused (B-82).
- `v01/note-format.md` gains a `mods:` front-matter field. Python and JS must agree on it (light-ring parity rules apply).
- Each pack needs its own evidence before release: recall on real phrases for a language pack, a review by one ethics board for the Research pack, a cold-read test for any new light.
- Selling packs adds work that has to be planned: signing keys, licence files, and support for installing over a cable.
- The roadmap gains a mods track. The backlog gains B-81–B-86 for the mods and B-87–B-90 for customer outreach.