Draft for the COO
A charter is not a description of what the PMO does. It is a statement of what the PMO decides. Everything below is negotiable except the mandate.
The PMO makes Guidewire delivery predictable, holds one prioritized queue against a known capacity, and reports what delivery changed for the business.
Decision rights
Where the PMO decides, it decides. Where it recommends, it publishes the recommendation and the reasoning, and the named owner decides.
| Decision | PMO | Business / PO | Engineering | COO |
|---|
What the PMO provides
- One intake path for all delivery demand, classified as defect, missing requirement, change request, enhancement or growth.
- A single prioritized queue held against a published capacity ceiling.
- The weekly Operational Execution call, Tuesday 11:00 PT, and the release calendar.
- The monthly scorecard: what shipped, whether it moved the number it was meant to move, and what it cost.
- Cross-track conflict detection and the risk register.
- The roadmap and capacity model, re-baselined quarterly.
- The delivery process definition and its gates, maintained in Workflow Studio.
What the PMO does not do
Naming this is what stops the PMO being read as overhead.
- Write requirements. BAs own elaboration; the PMO owns whether elaboration happened before the gate.
- Approve technical design or judge branch promotion readiness.
- File tickets for requesters who bypass intake. Requests arriving by direct message are returned to intake.
- Own defect root cause. The defect team owns classification against original requirements.
- Set priority inside a business unit. The BU owns its own order.
Operating cadence
| When | What | Output |
|---|
Escalation triggers
These reach the COO automatically. They are not judgement calls.
- A track exceeds its published epic ceiling for the release.
- A cross-business-unit priority conflict is unresolved after five business days.
- A published release date is at risk, at the point it becomes known rather than at freeze.
- A risk scoring 16 or above on exposure has no owner.
- Scope added after code freeze exceeds 10% of the committed item count.
Nine metrics, three questions
Every metric has an owner, a cadence, and a decision it drives. A metric nobody is required to respond to is decoration and should be cut.
Published, not implied
The ceiling is published so business units trade against each other instead of escalating. The WIP limit is what the Tuesday call actually enforces.
By track
Seeded from the current roster. A proposal, not a measurement — set them against real throughput once two releases of say-do data exist.
| Track | Bamboo | EY | Epic ceiling | WIP limit | Last snapshot |
|---|
Where the capacity goes
The number for Finance: how much of delivery is paying down work that should have been specified at MVP launch.
| Work class | Counts as | Delivered epics |
|---|
Why “missing requirement” is its own class. Most of what Bamboo logs is not a defect. Guidewire went live as an MVP and the system does not match business logic that was never written down. That distinction is the entire MBR thesis, and it only carries weight with the board if it is countable rather than anecdotal.
Owners and dates, or it is a note
TrackKeep found 833 cross-track intersections and teams recorded none of them. The detection works; the obligation to act on it does not exist yet. This is that obligation.
Add a risk
Open
| Ref | Risk | Owner | Due | Exposure | Status |
|---|
Three inputs, all manual for now
Everything on the scorecard reads from what gets entered here. The snapshot is the one with a clock on it; the other two can be backfilled any time.
Paste a Jira export or just a list of keys. Any format works — CSV, TSV, or one key per line. The parser finds issue keys and picks up priority, business unit and track columns if the export has them.
Snapshots on file
| Release | Freeze | Deploy | Say-do | Added after freeze |
|---|
Defect counts and unplanned work per release. Backfill R4.7 onward from what QA and prod support already know.
| Release | Deployed | UAT | Prod 30d | Escape rate | Unplanned |
|---|
Loads epics from the snapshots that have no class yet. One pass with the defect team produces the rework-share number and the missing-requirement trend.
Ordered by what delay costs you
Only the first item has a hard clock on it. Everything else can be backfilled.
R4.10 targets deploy on 1 October. Freeze lands ten working days ahead of that under the current cadence.
- Run scorekeep-migration.sql in Supabase.
- At freeze, export the R4.10 fixVersion from Jira and paste it into Feed the data with phase freeze.
- At deploy, paste the same export again with phase deploy.
- Say-do ratio and scope change rate then compute themselves. Nothing else is required.
- Backfill work classes for R4.8 and R4.9 in section 3 of Feed the data. This produces the rework-share number.
- Fill release quality for R4.7 through R4.9 from what QA and prod support already know.
- Link fixed clusters to their release in cluster_fix_link with the deploy date. Report volume 30 days either side then computes on its own.
- Publish the capacity ceiling and get the COO to say the number out loud in the Tuesday call. An unpublished ceiling is not a ceiling.
- A /snapshot route on gwmain-sync that pulls the fixVersion from Jira on a schedule and writes both phases. Do this after the paste flow has proven the shape of the data, not before.
- Defect origin field. Escape rate needs found-in-UAT separated from found-in-production. If Jira has no reliable field, add one before R4.11 rather than inferring from creation date.
- Effort attribution. Cost per delivered epic needs hours against epics. If timesheets are not viable, use Roadkeep t-shirt sizes and say plainly it is a proxy.
- EY commercial data. SOW value and burn for the blended-cost view. A Finance conversation with Ben King, not a tooling problem.
Cloudflare Access on the .pages.dev hostnames. The Supabase anon key sits in client-side code across every tool in the suite, with RLS as the only barrier, on public hostnames holding roster data, work emails and photos. The password gate hides UI, not data.
It is a short change and it is the difference between the tooling being an asset the company relies on and a finding in an audit. Better that you raise it than Internal Audit does.
The other thing worth deciding
Twenty-odd single-file apps, a six-thousand-line worker and one Supabase project currently have one maintainer. That reads as heroics, and heroics do not survive a promotion or a vacation. Two moves convert it into an institutional asset: name a second maintainer with real access, and get Syed's org to formally own the worker and the database even if you keep building the front ends.