Classification
Evidence gap. The public-private boundary on junochen.com has failed in two specific, verifiable ways. Those failures condition the credibility of every trust-centered claim you make in outreach and interviews. Better language will not fix this. The artifacts themselves must change before the claims they support can be used safely.
A perception layer sits downstream: even after repair, an interviewer who already encountered the exposed material may carry residual doubt. That layer is addressed in the verbal containment section below. But the primary routing is repair.
Scope boundary: The missing temporal-design artifact — the correction-to-next-run mechanism — is owned by the correction-loop dossier. This piece covers only existing exposure and the containment steps to restore the boundary.
What Is Exposed
The pricing essay. Your homepage links to What Do You Count When the Playbook Doesn't Exist? with teaser text that names the CEO, the CPO, pricing decisions, and six months of calls. The destination page shows a "Private Essay" overlay. The full 34,860-byte document — TinyFish's first product launch, pricing comparisons, cost-model decisions, per-step billing, failed-run credits, concurrency mechanics, tier naming — is delivered to the browser before the password logic runs. The password check is client-side: it reads a browser-local value after the content has already arrived. A crawler, a view-source check, or a browser with JavaScript disabled sees the full document.
I first documented this in Issue #6 and classified it as repair, not answer. Issue #7 ranked it P0. It remains unfixed.
Google exposure: Indexing of the essay URL cannot be confirmed without Search Console access. The homepage is indexed, and its teaser text surfaces TinyFish-specific content to Google. The site has no robots.txt, no sitemap.xml. The essay page carries no noindex directive, no X-Robots-Tag, no Open Graph or Twitter Card metadata controlling how sharing platforms render a preview. The Wayback Machine holds no snapshot of either URL form. That is the one favorable finding.
UAT Sentinel. This is not a dormant artifact at a URL nobody visits. It is actively loaded in the homepage's Agentic Work carousel as the second iframe, tagged "Human Oversight / QA Automation / Regression Detection," and linked to a standalone application that opens without authentication. The homepage says "Three live agents built solo" while displaying four. The embedded demo and standalone app carry no authorship statement, provenance label, permission classification, or confidentiality notice. Its content-security policy permits connections to agent.tinyfish.ai, but that technical dependency is unexplained to visitors.
Under the portfolio boundary rules, UAT Sentinel is unclassified: publicly reachable and actively promoted, but not approved as claimable proof.
How This Reaches the Interview Room
Your positioning centers on consequential delegation — designing the human-supervision, verification, and control layers for AI systems where mistakes have real costs. That positioning depends on the evaluator believing you treat evidence, access control, and disclosure boundaries with the rigor you claim to design into products.
The portfolio itself leaks proprietary pricing data through a painted-on gate, promotes an unclassified artifact with an undisclosed employer dependency, and miscounts its own inventory. The evaluator does not need to articulate the contradiction to register it. Here is how it plays: a hiring panel member Googles your name before the debrief, hits the homepage teaser mentioning the CEO and pricing decisions, views source on the essay page, reads the full cost-model content behind the overlay, and walks into the room with a question about whether you handle confidential material carefully. That question colors everything else they hear.
Containment is a precondition for the trust claims you are already making.
Which Claims Survive and Which Don't
Safe — high confidence:
- Thermo Fisher and Red Cross demonstrate consequential control design. BCG Digital Ventures cases with independent permission and attribution. The boundary failure may affect general evaluator confidence, but neither case depends on TinyFish material, the pricing essay, or the lab inventory being correct.
- "Accuracy is what the model achieves. Consistency is what the design delivers." This depends on the trust essay being intentionally published, which it was. The boundary failure elsewhere on the site does not alter that essay's publication permission. Safe as a framework claim. Do not extend it into proof that the portfolio's own governance is sound.
- TinyFish as past-role context. Depends on bounded verbal discussion that does not ask TinyFish work to prove design capability. The pricing essay and Retail Velocity currently make TinyFish-specific material part of the public evidence surface, which contradicts "bounded." Safe verbally, in past tense, after containment — only after containment restores the boundary that makes "bounded" true.
Modify before using — moderate confidence:
- "Juno's lane is consequential delegation: human supervision, verification, and control at the decision layer." The pricing essay's client-side gate failure shows the site's own publication control is broken. UAT Sentinel's unclassified status means an artifact with an undisclosed employer dependency is being promoted without provenance. Use the framework language. Do not volunteer evidence-governance claims until both are repaired.
- "The three approved Agentic Labs are original forward-looking design work informed by production experience." Depends on clear authorship, permission, provenance, and separation from TinyFish product artifacts across all three labs. Retail Velocity's explicit "POWERED BY TINYFISH" attribution and Carrier IQ's strong overlap with TinyFish's public insurance-quoting example prevent a uniform blanket statement. See the lab-by-lab assessment below.
Pause — use with caution or hold:
- "I've designed both sides of AI — the trust framework and the production systems that prove it works." Retail Velocity explicitly names TinyFish product surfaces; Carrier IQ overlaps TinyFish's public insurance-quoting example at the use-case, data, and interaction-sequence levels. "Production systems that prove it works" exceeds the published evidence boundary. Pause this phrasing.
- "Every spoken claim should survive portfolio and reference checking." The pricing essay leak and the lab-count mismatch mean the site currently contradicts that standard. Retain as an internal operating rule. Do not use as a self-description until the site matches it.
Lab-by-Lab Provenance Assessment
Brand Pulse — moderate confidence. No TinyFish name, endpoint, or product label appears in the delivered application or inspected front-end bundles. The social-listening use case overlaps TinyFish's public material and its Grubhub customer story, but the reviewed sources do not establish copied interface elements or a shared data schema. Supportable statement: "Original lab work in a domain overlapping TinyFish's public use cases." Add a provenance label.
Retail Velocity — use with caution. Its initial screen explicitly displays "POWERED BY TINYFISH SEARCH · TINYFISH FETCH · TINYFISH AGENTS." These are current public TinyFish product names. The artifact publicly declares a TinyFish technical dependency. It cannot be described as wholly independent of TinyFish. Supportable statement, only after confirming authorship and permission: "An original application and interaction model built using TinyFish's public Search, Fetch, and Agent surfaces." You need to decide whether that attribution is authorized and strategically acceptable.
Carrier IQ — use with caution. No TinyFish name appears in the delivered app. But the five-carrier parallel insurance-quote workflow — profile intake, carrier selection, staged progress, extracted quote evidence, comparison, approval — closely matches TinyFish's public homepage example and its Zebra customer story. The overlap is strong at the use-case, data, and interaction-sequence levels. No public record establishes derivation direction or authorship. "Original design work informed by production experience" is plausible but not publicly provable. Carrier IQ needs an explicit provenance record before it can carry a strong independence claim.
Verbal Containment
Use these only when an interviewer surfaces the exposure directly. Do not volunteer them.
If the pricing essay comes up — high confidence, but only after the page has actually been removed:
"I noticed a pricing essay on your site that references TinyFish's cost model — is that published with permission?" or "There's an essay on your portfolio about pricing strategy at TinyFish — can you walk me through that?"
"That page contained material from a past role that wasn't intended to be public. The access control was implemented incorrectly, and I removed it. I don't use TinyFish product work as portfolio evidence. I can discuss the production lessons at a bounded level and show the original work they informed."
Until the page is removed, substitute "I'm removing it" for "I removed it." Do not claim a fix that hasn't happened.
If UAT Sentinel comes up — moderate confidence:
"Your homepage says three agents but I count four — what's the fourth one?" or "What's UAT Sentinel? It's on your site but not in your case studies."
"UAT Sentinel appeared on the site before its reuse status was settled. I'm not using it as portfolio proof. The approved public set is Brand Pulse, Retail Velocity, and Carrier IQ."
If Retail Velocity's TinyFish attribution comes up — use with caution, pending permission confirmation:
"Retail Velocity says it's powered by TinyFish — is that a TinyFish project?" or "I see TinyFish branding in one of your labs — what's the relationship there?"
"Retail Velocity is my original application and interaction design, built on TinyFish's public API surfaces. It's not a TinyFish product screenshot or internal case study."
Do not use this phrasing until authorship and disclosure authority are confirmed.
Permanent Fixes
Ordered by urgency.
- Remove the homepage link and teaser to the pricing essay. Same day.
- Delete the essay or place it behind server-side authentication that withholds the body from unauthorized requests. Client-side overlays are not access control. Return a 404 or 410 for the old URL. Same day.
- Add a page-level
noindexdirective while any transitional content remains crawlable. Google's documentation confirmsrobots.txtalone will not keep a page out of search results. Same day, after step 2. - Inspect both URL forms in Search Console and use the Removals tool if either is indexed or carries a stale snippet. Same week.
- Remove UAT Sentinel from the homepage carousel and correct the lab count to three — unless authorship, permission, provenance, and safe phrasing are explicitly resolved first. Same week.
- Add a provenance label to each approved lab distinguishing original interface work from external infrastructure and production-informed reasoning. Resolution-dependent: requires the authorship and permission decisions in steps 7–8.
- Resolve Retail Velocity's TinyFish dependency. Decide whether the explicit "POWERED BY" attribution is authorized and strategically acceptable. If not, the artifact needs revision before it can carry an independence claim. Resolution-dependent.
- Document Carrier IQ's authorship and permission before using categorical "not derived from" language about it. Resolution-dependent.
Condensed Pre-Conversation Reference
The pricing essay is live and fully readable. UAT Sentinel is on the homepage. Neither is contained.
Safe to use now: Thermo Fisher, Red Cross (BCG DV attribution). The trust-essay framework language. TinyFish as past-role context in past tense.
Modify before using: Consequential-delegation positioning — the pricing essay's broken gate and UAT Sentinel's unclassified status undermine evidence-governance claims. Drop those claims until both are repaired. Lab independence claims — state per-lab, not as a blanket.
Pause: "Production systems that prove it works." "Every claim survives checking" as self-description. Blanket "original work" framing across all three labs.
If it comes up: Lead with the fix, not the explanation. State what you did, not why it happened. Stop after the correction.
Outreach does not stop. Containment is a bounded task with a specific fix list. The BCG DV cases, the trust-essay framework, and the TinyFish bridge narrative remain available while the site repairs are underway. The claims that depend on the boundary being intact are paused. The claims that don't are not.
- OWASP on client-side gates: The same access-control weakness behind the pricing essay overlay is formally classified as CWE-602 by MITRE, which means a technically literate interviewer has a named standard to cite if they inspect the page.
- Backchannel reference prevalence: Current reporting says employers are increasing off-list reference inquiries as AI-polished applications make formal materials feel less discriminating, which raises the cost of any claim inconsistency between portfolio, interview, and what a former colleague would say.
- Google's removal tool limits: Google describes its Removals tool as a temporary measure that must be paired with permanent deletion, authentication, or
noindex— so using it without fixing the underlying page only buys roughly six months. - Carrier IQ's overlap source: TinyFish's public Zebra customer story describes the same five-carrier parallel-quote workflow visible in Carrier IQ, which means the overlap is discoverable by anyone who visits both sites in the same session.