Warren Decision Archive

An evidence-first public library of consequential business decisions. Each case is split into an outcome-blind decision packet and a separate outcome/teaching note so a reader—or an analysis agent—can commit to a view before hindsight enters the record.

What is published

• Case overviews, Part A packets, and Part B teaching notes generated from the canonical catalog
• source records including filings, annual reports, court and government records, company materials, and contemporaneous publications
• structured financial and operating tables and supported material claims
• candidate rule hypotheses with boundary conditions and reversal criteria
• cross-case learnings and an agent evaluation protocol

Current case, source, table, claim, warning, and rule counts are derived from the canonical corpus during each build and recorded in data/corpus.json.

The public export retains citation-facing source titles, public URLs, accession numbers, and case-scoped source handles. It excludes downloaded source documents, raw evidence excerpts, artifact content hashes, internal evidence identifiers and locators, local paths, reviewer identities, internal caches, and artifact-store contents.

Architecture

The site uses React Server Components through vinext and deploys as a Cloudflare Worker. The source snapshot is deterministic:

• data/corpus.json contains the sanitized public teaching corpus.
• data/part-a.json is a physically separate outcome-blind bundle used exclusively by Part A routes.
• data/release-manifest.json binds the exact bytes of both content bundles to the catalog, ordered cases, Part A and Part B bundles and reports, QC, rules index, shared research inputs, generator sources, rendered-site sources, runtime version, and sanitizer policy.
• data/publication.json is a separate draft/published envelope. Publication metadata never changes the content bundles or their hashes.
• scripts/build-public-corpus.mjs regenerates the four-file set from a local Warren corpus and fails on stale or inconsistent digests, unsafe paths, replayed private excerpts, disallowed private fields, or outcome leakage.
• scripts/verify-published-release.mjs is the deployment gate. It rejects drafts and requires the approved digest, raw release-manifest bytes, public output bytes and lengths, runtime, generator files, and rendered-site files to match exactly.
• scripts/verify-build-inputs.mjs blocks ICNS, JPEG XL, and HEIF-family build inputs, including disguised signatures, while Vinext bundles the affected upstream image-size parser. It runs automatically before development and production builds.

Set WARREN_CASE_STUDIES_DIR when the canonical corpus is not located at ../case_studies, then run npm run content:build. That command always creates a draft snapshot for local review and does not embed publication approval.

Publishing is a separate, fail-closed rebuild bound to the exact release manifest. First run npm run content:build, review all four generated files, and copy the releaseManifestSha256 shown in data/publication.json. Then supply that exact digest and an ISO 8601 approval date or timestamp:

WARREN_PUBLICATION_APPROVED_AT=2026-08-15 \
WARREN_PUBLICATION_MANIFEST_SHA256=replace-with-reviewed-release-manifest-sha256 \
npm run content:publish

Publication mode independently rebuilds and rechecks the inputs and exact output bytes; any catalog, Part B, report, QC, rule-index, generator, sanitizer, or output change makes the approval digest mismatch and aborts before the generated set is replaced. The digest is a detached exact-snapshot approval, not an identity signature: confirming the human approver's identity and authority remains an external governance control. Snapshot-level direction is separate from each case's research lifecycle stage.

After the publication rebuild, npm run release:verify must succeed immediately before any deploy command. It intentionally exits nonzero for a draft. Every external hosting workflow must use this verifier as a required deployment precondition and build from the same source tree and Node.js runtime; ordinary npm run build remains available for local draft review and is not evidence of publication approval.

Development

npm ci
npm run dev

Validation:

npm run content:build
npm run security:verify-build-inputs
npm run lint
npm test
npm audit --audit-level=low

Research status

Every case admitted to an export is research-complete. The site preserves packet warnings and does not promote candidate rules into validated rules. Cases with PDF excerpts that could not be replay-verified automatically disclose those warnings individually. Public case-scoped source handles resolve citations to the public source ledger; internal evidence identifiers, exact locators, excerpts, and stored evidence hashes remain in the private research system.

Terms

The website code is available under the MIT License. Editorial case-study content is governed by CONTENT_TERMS.md. Third-party filings, publications, trademarks, and linked materials remain the property of their respective owners.

This project is historical and educational. It is not investment, legal, accounting, medical, engineering, or safety advice, and it is not affiliated with the organizations discussed.