# Phase 15: Data Model, Detection & Ticket Evidence - Discussion Log

> **Audit trail only.** Do not use as input to planning, research, or execution agents.
> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.

**Date:** 2026-07-15
**Phase:** 15-data-model-detection-ticket-evidence
**Areas discussed:** Scan trigger, Backfill scope, Match surface, Idempotency key

---

## Scan Trigger

| Option | Description | Selected |
|--------|-------------|----------|
| Webhook + cron reconciliation | Hook into ticket.created webhook path for near-real-time detection, plus a scheduled sweep to catch anything missed — mirrors the ticket_notes "webhook primary, cron reconciles" pattern | ✓ |
| Cron-only sweep | Simpler: one new scheduled job scans recent tickets on an interval, no webhook hook-in | |
| On-demand only for this phase | Build just the scanner function; wiring to run automatically deferred to Phase 18 | |

**User's choice:** Webhook + cron reconciliation (Recommended)
**Notes:** None beyond the recommendation.

---

## Backfill Scope

| Option | Description | Selected |
|--------|-------------|----------|
| Backfill + forward | One-time scan of existing tickets (~267 in last 30 days) plus catching new ones going forward | |
| Forward-only | Only tickets created/updated after this phase ships get scanned | ✓ |

**User's choice:** Forward-only
**Notes:** User deviated from the recommended option. Backlog backfill deferred — see Deferred Ideas.

---

## Match Surface

| Option | Description | Selected |
|--------|-------------|----------|
| Title + description + notes | Also search ticket_notes (already synced locally) since report text sometimes lands in a follow-up note | |
| Title + description only | Simpler first pass, matches only the ticket's own fields | ✓ |

**User's choice:** Title + description only
**Notes:** User deviated from the recommended option. Broadening to notes deferred — see Deferred Ideas.

---

## Idempotency / Reprocessing Key

| Option | Description | Selected |
|--------|-------------|----------|
| Content hash | Hash title+description, mirroring the analyzer pipeline's content_hash idempotency pattern | ✓ |
| Timestamp comparison | Compare ticket.last_activity_date against report's processed_at | |

**User's choice:** Content hash (Recommended)
**Notes:** None beyond the recommendation.

---

## Claude's Discretion

- Exact migration file number (next available after 096, confirm at plan time)
- Exact cron schedule cadence/name for the reconciliation sweep
- Whether the detector is one shared function called from both paths, or two thin wrappers over shared core logic
- Exact `reports` row shape for EVID-01 evidence beyond ROADMAP.md's stated success criteria

## Deferred Ideas

- Backfill scan of existing/historical phishing tickets — noted as a possible future one-off script, not a roadmap phase
- Broadening match surface to `ticket_notes` — revisit if false-negatives are observed in practice
