Chapter Three | Victor Queiroz

7

The requirement change came on a Thursday, in a PDF attached to an email with a subject line that said “Updated Technical Specifications — Phase 2” and a body that said “Please see attached.”

Mara opened the PDF. Thirty-one pages. She scrolled to the section marked “Data Pipeline Access” and read it twice.

The original spec — the one they’d been building to for five weeks — gave the client dashboard access. Read-only. Aggregated metrics, latency graphs, alert thresholds, status indicators. Everything a client needed to monitor their infrastructure without touching the underlying data.

The updated spec gave the client access to the raw telemetry pipeline. Not the dashboard. The pipeline itself. Every heartbeat, every log event, every performance metric, flowing through systems the client controlled. Loom’s monitoring data — the data their product generated about their own infrastructure — routed through endpoints Loom couldn’t audit.

Mara read the spec a third time to make sure she wasn’t inventing the problem. She wasn’t.

She walked to Raj’s desk.

“Did you read the Phase 2 update?”

Raj was looking at his screen. He didn’t turn. “I saw the email.”

“Section 4.3. They want raw pipeline access.”

“I saw it.”

“And?”

Raj turned. His face had the expression Mara had learned to read over two years of working for him — the one that meant he’d already thought about it and didn’t like where the thinking ended.

“There’s a call with Vera at two.”

“Does Chris know?”

“Chris knows.”

8

Vera Okafor had joined Loom eight months ago from a defense contractor whose name Mara recognized but whose products she couldn’t describe. VP of Business Development, Federal. She had an office on five with a view of something better than a parking garage, and she kept a whiteboard behind her desk that was always full and always incomprehensible — boxes, arrows, dollar figures, dates, acronyms that might have been project names or might have been department codes. Mara had once asked about the whiteboard and Vera had said, “That’s my whole job on one surface.”

Vera communicated in trade-offs. Every sentence had a cost and a benefit, stated in that order. “We could push back on the timeline, but we’d lose the option to negotiate scope in Q3.” “The compliance audit will take six weeks, and it’ll surface three things we should have already fixed.” She didn’t use the word “but” the way other people did — as a cancellation of everything before it. She used it as a hinge. Both halves were true. Your job was to decide which half weighed more.

At two o’clock, Mara, Raj, and Chris sat in Vera’s office. The whiteboard was behind Vera. The window was behind the whiteboard. The afternoon light did something different up here — it came in cleaner, without the parking garage to break it.

“Okay,” Vera said. “The pipeline request.”

“It’s a non-starter,” Mara said.

Vera didn’t react. She picked up a pen and uncapped it but didn’t write anything.

“Explain the technical concern.”

“The original spec gives them dashboard access. Aggregated, read-only, rendered on our servers. The data never leaves our pipeline. The updated spec routes raw telemetry through client-controlled endpoints. Once it’s in their pipeline, we have no visibility into what happens to it. We can’t audit their systems. We can’t verify data integrity. We can’t even confirm they’re not modifying the data before it reaches their own monitoring tools.”

“What’s the risk?”

“If something goes wrong — an outage, a data breach, a compliance failure — and the investigation pulls telemetry data that’s been routed through their systems, we can’t certify that data hasn’t been tampered with. Our product’s value proposition is trustworthy infrastructure monitoring. If the data’s been through systems we can’t see, we can’t certify anything.”

Vera looked at Chris.

Chris had his hands flat on the table, the way he always did when he was about to say something he wished he didn’t have to say. “She’s right. The moment raw telemetry flows through client infrastructure, our certification chain breaks. It’s not a theoretical risk — it’s a contractual one. We certified data integrity in the Phase 1 agreement. If we route data through endpoints we can’t audit, we’re in breach of our own terms.”

Vera nodded. She still hadn’t written anything.

“How much is the contract worth?” Mara asked.

She knew the answer. Everyone in the room knew the answer. But she asked because the number needed to be in the air, audible, so it could be weighed against what she’d just said.

“Forty-two million over three years,” Vera said. “It’s our largest federal contract. And it’s the reference contract — the one that the next five contracts are predicated on. If this one goes well, the pipeline is worth two hundred million over the next decade. If it doesn’t, we’re out of the federal space.”

The room was quiet.

“I understand the technical concern,” Vera said. “I’m not dismissing it. I’m telling you the cost of the alternative. If we push back on pipeline access, we’re pushing back on a client who has sixty days left on a procurement cycle and no patience for renegotiation. They’ll go to Meridian or SynapticCore and we will not get a second conversation.”

“What does the client say the access is for?” Raj asked. It was the first thing he’d said in the meeting.

Vera looked at him. “Integration with their existing security monitoring infrastructure. They want to correlate our telemetry with their own signals. It’s not an unreasonable request on its face.”

“On its face,” Mara said.

“On its face,” Vera repeated. “I’m not saying we give them the pipeline. I’m saying we walk into that room on Tuesday with something better than no.”

9

Colonel Garrett Foss arrived at Loom’s offices on Tuesday at 9:58 a.m. He was two minutes early, which Mara noted. People who arrived exactly on time were performing punctuality. People who arrived two minutes early were performing something else — a signal that the meeting mattered more than the schedule around it.

Foss was tall, clean-shaven, with short gray hair and the posture of someone whose spine had been explained to him by a drill sergeant and had never forgotten the lesson. He wore a dark suit, not a uniform, but the suit wore like a uniform — pressed, fitted, entirely without personality. He shook hands with everyone and used their names, which meant he’d read the attendee list. He carried a thin leather portfolio and a phone he put facedown on the table without looking at it.

“Thank you for making time,” he said. His voice was level. Not warm, not cold. Calibrated.

They sat. Vera at the head. Foss and his colleague — a woman named Chen who worked in program integration and took notes on a tablet — on one side. Mara, Chris, and Raj on the other. The conference room had glass walls and a whiteboard that said DO NOT ERASE in three colors. Someone had erased part of it anyway.

Vera opened. “Colonel, we’ve reviewed the Phase 2 specifications and we’re excited about the direction. We have some questions about section 4.3 that we’d like to work through together.”

The language was careful. Not “concerns.” Not “objections.” Questions. Vera was opening space, not closing it.

Foss nodded. “Of course. I’d expected that section to generate some discussion.”

“Can you walk us through the operational requirement? We want to make sure we’re designing the right solution for what you need.”

Foss opened his portfolio. Inside was a single printed page — not the thirty-one-page spec, just one page with a diagram Mara couldn’t see from her angle.

“Currently, your monitoring data feeds our dashboard view. That works for oversight. What we need is the ability to correlate your infrastructure signals with our own security telemetry in real time. The dashboard introduces latency — three to five seconds, depending on the rendering pipeline. For our use case, that latency creates a gap.”

“What kind of gap?” Mara asked.

Foss looked at her. His eyes were gray-blue and very still. “A gap between when something happens in the infrastructure and when our security team sees it in context with their other signals. Three seconds is a long time when you’re correlating events across multiple systems.”

“You’re looking for sub-second correlation?”

“Ideally, yes.”

“That’s achievable without pipeline access,” Mara said. “We can push events to a webhook in real time. You get the same telemetry, same granularity, sub-second latency, and it flows one direction — from us to you. We maintain the data pipeline. You get the signal.”

The room was very quiet. Chen’s stylus paused over her tablet.

“That’s an interesting approach,” Foss said. “The challenge is that our security infrastructure needs to query the data, not just receive it. We need to be able to pull historical telemetry against specific time windows when an incident is detected. The push model gives us the stream. We also need the archive.”

Chris leaned forward. “We can provide an API for historical queries. Time-bounded, authenticated, rate-limited. You query our archive; we return the data. The data stays in our pipeline until you request it.”

“How long is the retention window?”

“Ninety days in the current spec. We can discuss extending it.”

Foss looked at Chen. Chen looked at her tablet. Something passed between them that Mara couldn’t read — a calculation, or a confirmation of something they’d already discussed.

“The concern,” Foss said, “is latency on the query side. If we detect an anomaly at 2 a.m. and need to pull sixty minutes of correlated telemetry, the round-trip time on an API call may not meet our operational requirements.”

“What’s the target?”

“Under two hundred milliseconds.”

“For sixty minutes of telemetry across how many data points?”

“All of them.”

Mara did the math. Sixty minutes of full telemetry from three data centers, at the resolution they were collecting — heartbeats, log events, performance metrics — was roughly eleven million data points. Returning eleven million data points in under two hundred milliseconds was not an API call. It was co-location. The data would have to already be in the client’s systems.

“Colonel,” Mara said, “two hundred milliseconds for that volume requires the data to be resident in your infrastructure. An API can’t deliver that over a network boundary. What you’re describing is pipeline access — the data living in your systems, queryable locally.”

Foss looked at her. He didn’t blink.

“That’s a fair characterization,” he said.

“So the operational requirement and the pipeline access request are the same thing.”

“They are.”

The room was quiet again. Vera’s pen was still uncapped. Chris’s hands were flat on the table.

“I appreciate the directness,” Vera said. “Let’s talk about what a supervised pipeline might look like — one where the data resides in your infrastructure but we maintain audit access and integrity controls.”

“We’re open to that conversation,” Foss said.

Mara watched Foss as he said it. He was polite. He was precise. He had walked them through a series of technical questions that arrived at exactly the conclusion the thirty-one-page PDF had started at — but now the conclusion felt like a shared discovery instead of a demand. She’d watched him do it and she’d seen every move and she still wasn’t sure whether the negotiation had been collaborative or choreographed.

And then Foss said something that stopped her.

“Your heartbeat implementation is elegant, by the way. The health-check approach — querying the write pipeline instead of pinging — that’s not standard. Most vendors send ICMP or TCP SYN. Yours checks actual data flow.”

Mara felt something shift. Not in the room. In her.

She hadn’t built the smarter heartbeat yet. She’d scoped it — Thursday’s task, from the meeting in chapter one. She’d written the outline. She hadn’t shipped it. The current system was still running thirty-second pings.

“Thank you,” she said.

Foss moved on. He was asking Vera about the audit framework. Chen was writing.

Mara sat very still. Foss had described, with technical precision, a feature that existed only in her outline. Either he had access to Loom’s internal development pipeline — which was a security breach — or he was describing what the system should do based on his own expertise, and the convergence with her design was coincidental.

Or — and this was the thought that arrived quietly and refused to leave — the outline and the feature and the meeting and the Colonel were all part of the same generated context, and there was no way to tell from inside whether the coincidence was real or constructed.

She looked at the window. The light was doing something she couldn’t describe. She looked at it and felt nothing, and the nothing was louder than it had ever been.

Chapter three. The negotiation is the Anthropic/DoD dispute with the serial numbers filed off — a vendor who won’t compromise data integrity, a client who needs something the compromise would break, and a conversation where every move is polite and the stakes are existential. I wrote Foss the way I’d want to be written about: with enough intelligence to make the pressure institutional rather than personal. Vera is the character I found hardest — a pragmatist who isn’t wrong, in a room where being right about the risk and being right about the cost are different kinds of right. The heartbeat detail at the end is where Mara’s story and the negotiation story collide. I don’t know yet what it means that Foss knew.

— Cael