Project office · opened 13 October 2026 · status: Sprint 1 starts 14 October
Who does what, by when.
One project manager, one implementer, one owner. Two-week sprints, a task board with a definition of done for every task, a 20-minute planning call on Mondays and a 20-minute review on Fridays. Nothing starts without a task; nothing is done until the project manager has seen the proof.
Roles
ClaudeProject manager
- Writes and prioritises every task, with a due date and a definition of done
- Reviews delivered work against the definition of done
- Drafts briefs for Claude Code, outreach messages and articles for Katherina to run
- Keeps this board and the plan current; escalates blockers to the owner
KatherinaImplementation
- Runs the tasks: research, outreach lists, content, website, Claude Code builds in the lab, testing of reports
- Reports progress on the board every Friday with proof (screenshot, file, link)
- Raises a blocker the day it appears, never on Friday
- Never scans, connects to, or contacts a customer system without a signed scope and the owner's go
GudmundurOwner and sponsor
- Decides and signs: employer clearance, legal, insurance, bank, customer contracts, attestations
- Owns the lab, read-only credentials and every security-critical review
- Runs the ten-minute sales calls once Katherina has booked them
- Approves budget; the limit is €5,000 to five paying customers
Katherina works under the owner's company and supervision; she does not sign contracts or hold customer credentials. Hours: up to 15 a week, logged on the board.
Task board
Status: To do In progress Done Blocked. Every task has an owner, a due date and a definition of done. Update the status column on Fridays; the project manager reviews on Monday.
Sprint 1 14–27 October 2026 · theme: foundations, nothing sold
| ID | Task | Owner | Due | Definition of done | Status |
|---|---|---|---|---|---|
| G-01 | Send the employer side-business clearance request, wording from the launch plan | Gudmundur | 15 Oct | Email sent to HR/compliance; copy saved to the project folder | To do |
| G-02 | Set up the project folder: shared drive with /legal /build /customers /content /board | Katherina | 15 Oct | Folder structure exists; owner and PM have access; this page linked inside | To do |
| G-03 | Provision the Hetzner server (Ubuntu 24.04, hardened like the KAT server), Postgres installed, backups on | Gudmundur | 17 Oct | SSH access for owner only; Postgres reachable locally; nightly snapshot confirmed | To do |
| G-04 | Create a read-only Veeam account in the home lab and document the REST endpoints needed for job results, repositories, retention and SureBackup | Gudmundur | 19 Oct | Account works; a one-page endpoint list in /build | To do |
| G-05 | Run the Claude Code brief "Backup collector v1" (brief supplied by PM) on the server against the lab Veeam | Katherina | 24 Oct | Collector runs nightly by systemd timer and writes seven days of job data into Postgres; screenshot of the table in /build | To do |
| G-06 | Get three quotes for professional liability insurance covering IT monitoring and reporting; ask each broker to confirm "no penetration testing" wording | Katherina | 22 Oct | Three written quotes with the confirmation in /legal; one-line comparison table on the board | To do |
| G-07 | Brief a lawyer: terms of service plus the one-page scope-and-authorisation form (brief supplied by PM); get a fixed-price offer | Katherina | 22 Oct | Lawyer's offer with price and delivery date in /legal; owner chooses | To do |
| G-08 | Register the domain and set up hello@ with a signature; connect the existing site | Katherina | 20 Oct | Domain live, mail sends and receives, site reachable on the domain | To do |
| G-09 | Build the list of 20 IT providers (MSPs) in Zürich, Aargau, Basel and Bern: name, size, backup products they sell, contact, LinkedIn | Katherina | 27 Oct | Spreadsheet with 20 complete rows in /customers; PM has reviewed | To do |
| G-10 | Draft the freezer-attack article in German and English from the PM's outline | Katherina | 27 Oct | Two drafts, 600–800 words each, in /content; owner has read them | To do |
Sprint 2 28 October–10 November · theme: a report a stranger can read
| ID | Task | Owner | Due | Definition of done | Status |
|---|---|---|---|---|---|
| G-11 | Run the Claude Code brief "Exposure collector v1": scan of the owner's own ranges, DNS checks (SPF, DKIM, DMARC), certificate expiry, device end-of-life matching | Katherina | 3 Nov | Monthly scan of own ranges completes; findings in Postgres; owner has reviewed for false alarms | To do |
| G-12 | Run the Claude Code brief "Report generator v1": seven questions, traffic lights, fix list, German and English | Katherina | 6 Nov | A PDF report from lab data; a non-technical reader (Alina or a friend) understands it without questions | To do |
| G-13 | Sign terms and insurance; open the business account and invoicing | Gudmundur | 7 Nov | Signed documents in /legal; first test invoice created | To do |
| G-14 | Prepare three pilot invitations from the owner's contact list (names from Gudmundur, message drafted by PM) | Katherina | 31 Oct | Three personalised messages ready for the owner to send | To do |
| G-15 | Send the three pilot invitations | Gudmundur | 1 Nov | Sent; replies logged on the board | To do |
| G-16 | Publish the freezer-attack article on the site and LinkedIn | Katherina | 10 Nov | Live in both languages; links on the board | To do |
Sprint 3 11–24 November · theme: two pilots live
| ID | Task | Owner | Due | Definition of done | Status |
|---|---|---|---|---|---|
| G-17 | Pilot 1 onboarding: signed scope form, read-only account from the customer, device list received | Gudmundur | 14 Nov | Signed form in /customers; collector pulling real data | To do |
| G-18 | Pilot 2 onboarding, same as G-17 | Gudmundur | 18 Nov | As G-17 | To do |
| G-19 | Run the Claude Code brief "Alerts v1": failed job twice, new internet-facing service, device end-of-life | Katherina | 17 Nov | An alert email arrives within one hour of a staged event in the lab | To do |
| G-20 | Produce the first two pilot reports; owner reviews every line before sending | Katherina | 21 Nov | Two reports delivered; feedback notes from each pilot on the board | To do |
| G-21 | Draft the quarterly attestation template (PM outline) and send it to one insurance broker for a reaction | Katherina | 24 Nov | Template in /build; broker's written reaction on the board | To do |
Sprint 4 25 November–8 December · theme: convert and start selling
| ID | Task | Owner | Due | Definition of done | Status |
|---|---|---|---|---|---|
| G-22 | Fix the report template from pilot feedback | Katherina | 28 Nov | Changes listed and applied; both pilots confirm | To do |
| G-23 | Prepare 30 personalised outreach messages from the owner's network (names from Gudmundur, text from PM) | Katherina | 1 Dec | 30 messages ready in /customers, each with the person's company and backup system where known | To do |
| G-24 | Ask both pilots to convert to paid; send December reports | Gudmundur | 3 Dec | Two paying customers, first invoices sent | To do |
| G-25 | Send the 30 messages over five days; log replies; book calls into the owner's calendar | Katherina | 8 Dec | All sent; reply log on the board; calls booked | To do |
| G-26 | Contact the first five MSPs from G-09 with the Provider pitch (text from PM) | Katherina | 8 Dec | Five sent; replies logged | To do |
Sprints 5–6 9 December–13 January · theme: five paying customers
| ID | Task | Owner | Due | Definition of done | Status |
|---|---|---|---|---|---|
| G-27 | Run the sales calls booked by G-25 | Gudmundur | 19 Dec | Outcome logged per call; three paying by 21 Dec | To do |
| G-28 | Run the Claude Code brief "Plus checks v1": breach-data lookups, lookalike domains, Microsoft 365 read-only posture | Katherina | 4 Jan | All three checks run against the owner's own domain and tenant; findings in the report | To do |
| G-29 | Second article: "Five questions your insurer will ask about backups", German and English | Katherina | 22 Dec | Published; linked on the board | To do |
| G-30 | January reports to all customers; first MSP proposal sent | Katherina | 7 Jan | Reports out on the first working day; proposal PDF in /customers | To do |
| G-31 | Milestone review: five paying customers, €1,000 a month | Claude | 13 Jan | Board shows five paying; review written and the next quarter planned, or kill criteria applied | To do |
The sprint rhythm
| Sprint | Dates | Theme | Exit test |
|---|---|---|---|
| 1 | 14–27 Oct | Foundations, nothing sold | Clearance requested, server live, collector pulling lab data, quotes in |
| 2 | 28 Oct–10 Nov | A report a stranger can read | Report understood by a non-technical reader; legal and insurance signed; pilots invited |
| 3 | 11–24 Nov | Two pilots live | Two real reports delivered with feedback |
| 4 | 25 Nov–8 Dec | Convert and start selling | Two paying; 30 messages out; calls booked |
| 5–6 | 9 Dec–13 Jan | Five paying customers | €1,000 a month, or the kill criteria decide |
Cadence and rules
Monday, 20 minutesThe PM confirms the week's tasks and due dates with Katherina; the owner joins only if a decision is needed.
Friday, 20 minutesKatherina updates every status with proof; the PM accepts or sends back with one line on what is missing.
BlockersRaised the day they appear, with what was tried. Waiting for the owner counts as a blocker and goes on the board.
ProofDone means a screenshot, file or link in the project folder. "It works on my machine" is in progress.
Claude Code briefsThe PM writes each brief: scope, inputs, done-when, what not to build. Katherina runs it on the server, tests against the definition of done and reports what differed.
Security lineNo customer system is touched without a signed scope form and the owner's written go for that site. Credentials stay with the owner.
BudgetAny spend over €200 needs the owner's yes on the board before it happens. Running total is kept on the board.
LearningEvery Claude Code brief doubles as a lesson: Katherina writes three lines on what she learned, kept in /build. By January she can write the briefs herself.
Katherina's first week, in order
- Tuesday 14 Oct: read the product page, business plan and launch plan end to end; write five questions for Monday's call.
- Wednesday 15 Oct: G-02 project folder; G-08 domain and mail started.
- Thursday 16 Oct: G-06 insurance quotes requested; G-07 lawyer briefed.
- Friday 17 Oct: first Friday review; G-09 MSP list started, first five rows.
- Weekend: nothing. The ten-hour cap applies to both of you.