Brief

Brief output must use plain operator language. Specifically: - **CVE** → "security hole" or "security vulnerability". Always name what the affected library/component is and what the practical risk is ("code execution if attacker hits URL X", "data leak if file Y is requested"). dompdf/swiper/chart.js mean nothing to Jim — say "the PDF generator", "the UI carousel library", "the chart library". - **CPS/CPI/CPM/CPC** → "commission per sale / install / impression / click" on first reference per item, then OK to abbreviate. - **T+1 / T+2** → "yesterday partial / two-day-ago final" - **DoD / WoW / MoM** → "day-over-day / week-over-week / month-over-month" on first use - **AOV** → "average order value (revenue ÷ orders)" - **ROI / ROAS / GP** → first-use unpack - Internal product codenames (4223, 5126, INVVM-1721) — keep the code but always add a parenthetical noun ("invoice INVVM-1721", "Cashiu attribution card 4223") Rule of thumb: if Jim can't act on the item without first decoding a term, the term is a bug. Translate or unpack.

When the brief flags a numerical anomaly (X "halved", Y "collapsed", Z "outlier"), it must check the trailing distribution before claiming significance: - Pull the last 7-14 day series from the relevant BQ metric - Compute mean / range / std-deviation - State whether the flagged value is genuinely anomalous (>2σ, outside band) or within normal volatility - If anomalous, propose 2-3 specific hypotheses (settlement lag, mix shift, prior-day outlier, attribution residue) — NOT generic "undiagnosed" Example of what NOT to do (today's brief): - "Cashiu AOV halved May 10→11, undiagnosed" The actual data showed: trailing 7d AOV range 33-106, mean 53, std-dev ~25. May 11 at 46 is WITHIN normal range. May 10 at 106 was the outlier needing explanation, not May 11. The brief anchored on the largest delta instead of running the distribution. With BQ data in hand the brief can and should do this analysis itself.