Building Padawan: the learning map

Date: 2026-08-07 00:08 EDT

Scope: founder-grade product learning map for making Padawan a better product.

The read

The useful curriculum does not start with agent papers. It starts with HCI, sensemaking, trust, and editorial judgment, then uses agent systems to implement those ideas. Padawan fails if it becomes a more capable chatbot. It gets much more valuable if it becomes an inspectable operating layer: it notices, researches, remembers, prepares, and acts only inside clear authority.

The hardest product problem is not memory size or tool count. It is the contract between user and agent: when Padawan interrupts, what it remembers, what it can do without asking, how it proves claims, and how the user corrects it. The agent literature matters, but mostly after those product boundaries are set.

My call: learn the old human systems first. Mixed-initiative UI, information foraging, intelligence analysis, lab notebooks, editorial practice, and capability security explain most of the product. Modern agent papers provide the runtime patterns, evals, and failure modes.

Facts below come from primary/searchable sources where listed. X/Grok material is live radar only. Treat it as signal until a primary source confirms it.

The curriculum map

1. Mixed-initiative interaction: who leads when

What to learn

How humans and agents share control. Eric Horvitz’s work is the clean starting point: the system should infer intent, but it must also know when not to act.

Why it matters for Padawan

Padawan is valuable because it can start work before the user asks. That same feature becomes annoying or unsafe if it grabs initiative at the wrong time. Mixed-initiative work gives language for initiative shifts, uncertainty, attention cost, and graceful handoff.

Start here

• Eric Horvitz, Principles of Mixed-Initiative User Interfaces.
• Eric Horvitz, People, Agents, and Interaction.
• Horvitz and Paek, work on conversational architecture and LookOut-style calendar assistance.

Then read

• James Allen, mixed-initiative interaction taxonomies.
• Brad Myers and early direct-manipulation vs agent debates.
• Modern assistant UX docs from Apple, Google, OpenAI, and Anthropic.

Product question it should change

What events are allowed to make Padawan speak first?

Bad default it prevents

A needy assistant that reports activity instead of insight.

2. Sensemaking and information foraging: briefs are work products, not summaries

What to learn

People do not only “retrieve” information. They forage, sort, model, discard, compare, and form a schema. Pirolli and Card’s sensemaking loop is the main model.

Why it matters for Padawan

Padawan’s briefs should show the foraging loop: what sources were checked, which claims survived, what model explains them, and what action follows. This is the difference between a link pile and a useful read.

Start here

• Pirolli and Card, The Sensemaking Process and Leverage Points for Analyst Technology.
• Pirolli and Card, *Information Foraging Theory*.
• Daniel Russell, Mark Stefik, Peter Pirolli, Stuart Card, early HCI sensemaking work.

Then read

• Brenda Dervin on sense-making.
• Karl Weick, *Sensemaking in Organizations*.
• Andy Matuschak’s writing on tools for thought and evergreen notes.

Product question it should change

How does the brief artifact preserve the trail from evidence to judgment without making the user read the trail first?

Bad default it prevents

Treating “source found” as “knowledge formed.”

3. Personal information management: memory as a user-owned data structure

What to learn

Personal information management studies how people keep, find, refind, forget, and recontextualize their own information. The core product lesson: memory is not a pile. It is a set of uses with different retention rules.

Why it matters for Padawan

Padawan has standing memory, private context, skills, session search, files, repos, and scheduled outputs. Those are different memory classes. They need different write rules, deletion rules, provenance, freshness, and user controls.

Start here

• William Jones, *Personal Information Management*.
• Barreau and Nardi on finding and reminding in personal file spaces.
• Gordon Bell and Jim Gemmell, *Total Recall* / MyLifeBits, as a warning and reference.

Then read

• Lifelogging and SenseCam work.
• PKM practice: Zettelkasten, PARA, GTD, commonplace books.
• Modern memory products: Mem, Fabric, Limitless, Rewind/Recall coverage.

Product question it should change

What must Padawan remember, what should it summarize, what should decay, and what must remain private context only?

Bad default it prevents

“Just store more context.” More memory creates more stale authority unless the system can forget.

4. Agent tool use and harness design: the runtime is the product

What to learn

Agent performance is no longer only model quality. It is planner shape, tool descriptions, state management, execution sandbox, verifier, retry policy, and observation loop.

Why it matters for Padawan

Padawan already has tools, skills, delegation, cron, browser control, and file access. Better product work means making those capabilities legible and testable. The user should not need to infer whether a task was really run.

Start here

• Yao et al., ReAct: reasoning plus acting.
• Schick et al., Toolformer: models learn tool-use patterns.
• Wang et al., Voyager: skill libraries and open-ended exploration.
• Jimenez et al., SWE-bench: real GitHub issue resolution as an eval.

Then read

• WebArena for web-agent tasks.
• OSWorld for real computer-use agents.
• AgentBench, ToolBench, GAIA, WorkArena, Terminal-Bench.
• MCP specification and current agent-tool protocol docs.

Product question it should change

What is Padawan’s eval harness for a “real task completed,” and how does it prove tool effects instead of reporting intent?

Bad default it prevents

A smart narrator attached to unreliable side effects.

5. Capability security and trust boundaries: authority must live outside the model

What to learn

Agents that read untrusted text and hold tools are confused deputies. The model cannot be the only policy engine. Real safety comes from capability limits, provenance, isolation, approval gates, logs, and effect-time checks.

Why it matters for Padawan

Padawan reads web pages, X, repos, local files, screenshots, and memory. It also has tools that can change state. The product must separate research text from instructions and keep authority at the action boundary.

Start here

• OWASP, Top 10 for LLM Applications.
• AgentDojo and InjecAgent work on indirect prompt injection.
• Papers on memory poisoning and tool-enabled agent security.
• Capability-security background: Mark Miller / object-capability systems.

Then read

• NIST AI Risk Management Framework.
• Google / OpenAI / Anthropic / Microsoft guidance on prompt injection and agent safety.
• Research on least privilege, sandboxing, non-human identity, and audit trails for AI agents.

Product question it should change

Which Padawan actions are free, which require confirmation, which require a prepared draft only, and which are never allowed?

Bad default it prevents

Approval theater. A human cannot safely review every tiny tool call. The system must reduce what reaches the human.

6. Intelligence analysis and forecasting: how Padawan should form views

What to learn

Structured analytic techniques help analysts reason under uncertainty. The key practices are competing hypotheses, source grading, red teams, indicators, and “what would change my mind?”

Why it matters for Padawan

The user wants a view, not a digest. Padawan should make calls while keeping uncertainty visible. Intelligence tradecraft gives a reusable method for briefs, market reads, codebase radar, and product decisions.

Start here

• Richards Heuer, *Psychology of Intelligence Analysis*.
• Heuer and Pherson, *Structured Analytic Techniques for Intelligence Analysis*.
• Philip Tetlock and Dan Gardner, *Superforecasting*.
• CIA / Sherman Kent school material on estimative language.

Then read

• National Academies, *Intelligence Analysis: Behavioral and Social Scientific Foundations*.
• Red-team methods and premortems.
• Forecasting platforms and Brier-score practice.

Product question it should change

How does each brief show its confidence, counter-case, indicators, and decision relevance?

Bad default it prevents

Fake balance. Some evidence should move the answer more than other evidence.

7. Editorial systems and mobile artifacts: the interface is the memo

What to learn

Good editorial systems turn messy research into a readable path. The user should get the conclusion first, then the mechanism, then enough trail to trust it.

Why it matters for Padawan

Padawan’s brief viewer is already a product surface. The better it gets, the less the user needs to read chat walls. Artifact quality is part of trust.

Start here

• Barbara Minto, *The Pyramid Principle*, for answer-first writing.
• Joseph Williams, *Style: Lessons in Clarity and Grace*.
• Edward Tufte, *Visual Explanations*.
• Bloomberg / Stratechery / Ben Thompson as examples of strong operator-friendly analysis.

Then read

• ASD-STE100 simplified technical English.
• Policy memo and intelligence briefing formats.
• Scientific explainer craft: Quanta, Distill, Andy Matuschak notes.

Product question it should change

What is the default artifact format for a question, and when is chat enough?

Bad default it prevents

Markdown sludge: many bullets, no shape, no usable sentence.

8. Personal operating systems: convert rituals into primitives

What to learn

Founders use review loops, decision logs, lab notebooks, calendars, task lists, research notebooks, and staff systems to reduce cognitive load. The point is not that the user should maintain more systems. The point is that Padawan can absorb some of the system burden.

Why it matters for Padawan

The product can hold periodic radar, open questions, decision packets, project movement, reading reactions, and personal constraints. Those should not remain ad hoc chats.

Start here

• David Allen, *Getting Things Done*.
• Tiago Forte, *Building a Second Brain* / PARA.
• Sönke Ahrens, *How to Take Smart Notes*.
• John Boyd / OODA loop material.

Then read

• Lab notebook practice and decision-log templates.
• CEO staff systems: weekly business review, operating cadence, memo culture.
• Linear and Superhuman product examples for fast, opinionated workflows.

Product question it should change

Which recurring user workflows become first-class Padawan objects?

Bad default it prevents

Asking the user to do clerical work so the assistant can appear smart later.

9. Product references: copy patterns, not features

What to learn

Adjacent products show useful failures. Google Now was good because it was timely and ambient. Superhuman was good because it took one workflow seriously. Rewind/Limitless/Recall show why capture-first memory triggers privacy and consent problems. Claude Projects and ChatGPT Projects show how scoped context helps, but also where a workspace stops short of an operator.

Why it matters for Padawan

The category is not settled. Padawan could look like a chat bot, chief of staff, research terminal, operating layer, browser, or brief publisher. Product references help choose what *not* to become.

Start here

• Claude Projects.
• ChatGPT Memory FAQ.
• Claude Code docs.
• OpenAI agent-building tools.

Then read

• Google Now / Siri proactive assistant retrospectives.
• Microsoft Recall privacy coverage and security analysis.
• Rewind, Limitless, Mem, Fabric, Perplexity, Notion AI, Linear, Superhuman, Cursor, Devin, OpenHands.

Product question it should change

Is Padawan primarily a chat surface, an artifact system, a local operator, or a set of living workflows?

Bad default it prevents

A feature collage that has no daily rhythm.

10. Memory evals and lifecycle: forgetting is a feature

What to learn

Agent memory is an active lifecycle: extract, store, source, retrieve, merge, decay, delete, and audit. It needs tests.

Why it matters for Padawan

A stale memory can override the right answer. This has already happened in miniature with tool-version notes. The system needs stronger provenance and decay rules, not only more room.

Start here

• Recent surveys on memory for autonomous LLM agents.
• LoCoMo and LongMem-style long-term conversation memory evals.
• AMA-Bench / agent-native memory work surfaced in live radar.

Then read

• Bitemporal graph memory, Mem0-style architectures, Filesystem Memory.
• Memory poisoning papers: MemSecBench, SkillGate, Memory Provenance Laundering.
• Database temporal modeling and event sourcing.

Product question it should change

What is the memory write gate, and how does Padawan know that old memory lost to newer correction?

Bad default it prevents

An assistant that compounds wrongness.

The highest-value first readings

1. Horvitz, Principles of Mixed-Initiative User Interfaces — read now. It gives the product contract for proactive assistance. It should change interruption and initiative policy.
2. Pirolli and Card, Sensemaking Process and Analyst Technology — read now. It maps directly to briefs, source trails, and research artifacts.
3. OWASP Top 10 for LLM Applications / Agentic guidance — read now. It sets the threat model for tools, memory, and untrusted content.
4. Heuer, Psychology of Intelligence Analysis — read now. It teaches how Padawan should reason under uncertainty and avoid digest mode.
5. ReAct — read now. It is the baseline mental model for thinking plus tool action.
6. SWE-bench + WebArena + OSWorld primary sites — read soon. They teach why evals must test real environments, not model answers.
7. William Jones, Personal Information Management — read soon. It gives memory classes and refinding behavior.
8. Claude Projects / ChatGPT Memory / Claude Code docs — read soon. These are live product references for scoped context, instructions, and skills.
9. Minto, Pyramid Principle — read later but use immediately. It keeps briefs answer-first.
10. Memory poisoning and agent-memory eval papers — read soon. They matter because Padawan has durable memory and tools.

Reference products and what to steal

Architecture implications

Memory model

Use scoped memory classes: private context, durable user preferences, product facts, reading reactions, project state, temporary task state, and raw session history. Each class needs source, timestamp, owner, freshness, and delete/replace behavior. Do not inject all memory equally.

Skill system

Treat skills like procedures with supply-chain risk. They need versioning, tests, examples, missing-command checks, and a repair loop when reality differs from the skill.

Brief/artifact layer

Make artifacts first-class. A brief should hold thesis, source-role map, evidence trail, what would change the call, follow-up artifacts, and a stable link or local file. Chat should be a control plane, not the document body.

Source graph

Track source role, claim, confidence, and provenance. X/Grok should enter as radar. Primary sources should carry facts. Critical sources should mark failure modes. This would let Padawan answer “why do you believe this?”

Approval/action model

Keep the action boundary outside the model. Free: read, inspect, draft, summarize. Confirm: writes, external messages, installs, credentials, spend, pushes. Never: Tavisi operational authority. The product should show the exact effect before asking.

Notification policy

Interrupt only when a finding changes a decision, closes a window, blocks a plan, or protects the user from a serious error. Scheduled activity alone is not worth a ping.

Subagent orchestration

Use subagents for independent source lanes, but make consolidation adversarial: what did each lane miss, which claims conflict, which evidence is primary, and what changed the final call?

Eval harness

Test real tasks: “find and brief a paper,” “inspect repo movement,” “create a mobile artifact,” “use browser without stealing focus,” “detect poisoned memory,” “ask before risky action.” Score success by verified state, not self-report.

Feedback loop

Capture reactions as typed memory: reading reaction, correction, taste preference, rejected framing, trusted source, and stale instruction. Corrections should beat old memory.

Privacy boundary

Private context should inform answers but not leak into artifacts, cron outputs, public pages, or messages to others. This rule needs test coverage.

Product surface

Telegram is the command surface. HTML briefs are the reading surface. Local files and repos are the work surface. The product should not force one surface to do all jobs.

Product principles

1. The assistant earns autonomy by proving small effects, not by sounding confident.
2. The user should see the conclusion before the source trail.
3. Memory without provenance is a liability.
4. Forgetting and replacement are product features.
5. X and live search find leads; primary sources decide facts.
6. Interruptions must change a likely decision.
7. Chat controls work; artifacts carry work.
8. Skills are code-like procedures, so they need tests and repair.
9. A human approval gate is not a security model by itself.
10. Every risky action should have a visible effect preview.
11. The agent should prepare more than it executes.
12. Proactive work should reduce the user’s cognitive load, not create review chores.
13. Good briefs preserve uncertainty without hiding the call.
14. The product should make corrections cheap and durable.
15. The system should degrade honestly: if it did not verify, it must say so.

What to prototype next

1. Memory provenance browser

Tests: whether the user can inspect and correct what Padawan believes.

Why it matters: stale memory is the most likely compounding failure.

Keep if: corrections reduce repeated mistakes and old notes stop resurfacing.

Failure: the browser becomes another admin surface the user avoids.

2. Brief source graph

Tests: whether briefs can expose claim → source → role → confidence.

Why it matters: Padawan’s research quality depends on evidence shape.

Keep if: it makes follow-up questions faster and catches weak claims.

Failure: source graph overhead slows every brief.

3. Interruption simulator

Tests: the notification policy against real past findings.

Why it matters: proactive assistance is either the product or the reason it gets muted.

Keep if: it filters routine news and preserves decision-changing alerts.

Failure: it misses time-sensitive risks.

4. Action-boundary preview

Tests: whether every risky tool action can show exact command, target, effect, and rollback path before approval.

Why it matters: authority must live outside the model.

Keep if: approvals become faster and safer.

Failure: previews are vague or too frequent.

5. Brief reaction memory

Tests: converting user replies to typed learning records.

Why it matters: taste and judgment compound only if reactions are captured.

Keep if: future briefs visibly improve without asking the user to restate preferences.

Failure: inferred reactions get written as fact.

6. Repo radar dashboard-as-brief

Tests: whether commit movement can drive proactive research.

Why it matters: Padawan should know where attention is going from evidence.

Keep if: it finds stalls and mismatches the user cares about.

Failure: it becomes a digest of commits.

7. Skill regression harness

Tests: whether common skills still match tool reality.

Why it matters: stale skills are prompt-shaped bugs.

Keep if: it catches broken commands, missing paths, and unsafe assumptions before live runs.

Failure: it requires approvals or setup in unattended contexts.

Follow-up artifacts to produce next

• Padawan product thesis: category, promise, user, non-goals, wedge, and why now.
• Memory architecture spec: classes, schema, provenance, decay, correction, and injection policy.
• Trust and action-boundary model: free/prepare/confirm/never matrix with examples.
• Briefing system spec: source graph, HTML surface, citation policy, reaction capture.
• Evaluation harness: real tasks, success checks, regression suite, poisoned-memory tests.
• Notification policy: trigger list, quiet rules, score, examples, replay on past outputs.
• Skill supply-chain spec: skill provenance, validation, update path, quarantine rules.
• 90-day roadmap: one lovable workflow, one safety spine, one artifact layer, one eval loop.

What would change this map

• If Padawan becomes a team product rather than a single-founder agent, shared memory, ACLs, and org audit become first-order.
• If the main surface moves from Telegram to desktop, browser, or mobile, HCI priorities change toward ambient UI and notification design.
• If the product gains real operational authority, capability security moves from important to existential.
• If users mostly want public research briefs, editorial system and source graph move ahead of local tool use.
• If users mostly want engineering execution, eval harness and repo-tool reliability move ahead of HCI reading.

Live radar notes

The X/Grok radar lined up with the thesis rather than changing it. Recent builder discourse is practical: memory hygiene, action permissions, prompt injection, and eval harnesses matter more than bigger demos. The strongest recurring claim was that memory must be inspectable, scoped, and forgetful. The sharpest warning was approval fatigue: if humans must review too many small prompts, they will rubber-stamp or disable the system.

Product radar also raised the same warning from another angle. Capture-first products are powerful, but they produce consent, privacy, storage, and trust problems. The useful direction is not total recall. It is controllable memory plus clear human agency.

Treat these as leads, not settled facts. Product-acquisition rumors and benchmark numbers from X need primary verification before they affect a roadmap.

Sources

Primary papers / academic

• Eric Horvitz, Principles of Mixed-Initiative User Interfaces.
• Pirolli and Card, The Sensemaking Process and Leverage Points for Analyst Technology.
• Yao et al., ReAct.
• Schick et al., Toolformer.
• Wang et al., Voyager.
• SWE-bench.
• WebArena.
• OSWorld.

Product docs / company references

• Anthropic, Claude Projects.
• OpenAI, ChatGPT Memory FAQ.
• Anthropic, Claude Code docs.
• OpenAI, New tools for building agents.
• Mem.
• Fabric.
• Limitless.

Security / safety

• OWASP, Top 10 for LLM Applications.
• NIST, AI Risk Management Framework.
• AgentDojo, InjecAgent, prompt-injection and memory-poisoning papers.
• Capability security / object-capability literature.

HCI / design / operating systems

• William Jones, *Personal Information Management*.
• Barreau and Nardi on personal file spaces.
• Brenda Dervin, sense-making.
• Karl Weick, *Sensemaking in Organizations*.
• David Allen, *Getting Things Done*.
• Tiago Forte, PARA / *Building a Second Brain*.
• Sönke Ahrens, *How to Take Smart Notes*.
• Barbara Minto, *The Pyramid Principle*.
• Edward Tufte, *Visual Explanations*.

Intelligence analysis

• Richards Heuer, *Psychology of Intelligence Analysis*.
• Heuer and Pherson, *Structured Analytic Techniques for Intelligence Analysis*.
• Philip Tetlock and Dan Gardner, *Superforecasting*.
• National Academies, *Intelligence Analysis: Behavioral and Social Scientific Foundations*.

Live radar / X-Grok discoveries

• Builder discourse around memory hygiene, skill/workflow memory, progressive trust spines, prompt injection, and action-boundary policy.
• Product discourse around Rewind, Limitless, Mem, Fabric, Microsoft Recall, local-first memory, and the criticism that perfect capture can damage sensemaking.
• Eval discourse around OSWorld, WebArena, SWE-bench, memory evals, MCP security, and harness-first reliability.