Kelly Hall
Jan 12, 2026 - Nov 3, 2026
39
Decisions
0
Active Todos
16
Patterns
Categories
Decisions (39)
Accept Google previously-identified-CVEs contract wording - it is not what they really want, and their own language becomes scope leverage later
In the GDC contract thread with Kelly Hall and Bjorn, Peter accepted Google wording that limits CIQ obligations to a previously identified list of CVEs. He noted Google wants to control regression scope, but as worded they will not automatically get upstream changes, and because of embargoes many upstream changes are unlabeled CVE fixes. He chose to let Google learn that and ask for something different later, and said it will be leverage: future change requests can be answered as not in the previously identified list, per their own language.
GDC contract redline - air-gapped scope only, FIPS module is priced (75K plus lab fee) or dropped, 14-day critical/high SLA with the clock starting when a patch is identified upstream
On 10/27 Peter reviewed the GDC amendment line by line with Kelly and resolved Nathan comments: scope narrowed to deployed in GDC air-gapped environments (not connected GDC); the FIPS loadable module is new work and not at no additional cost - 75K plus lab fee, which forces the 250K expense cap up, or Google drops it or it moves to the next round; accepted a 14-day SLA for critical and high CVEs with the clock starting when a patch is identified upstream (per Peter conversation with Tissa), with a communication plan owed before a patch exists - a mitigation plan and a communication are the same thing; dropped dev-build language and did not care about support duration for the build Google is leaving.
GDC new ask after landing Anthropic - write down what we believe, parrot it back, give an ETA assuming funded, and use it to win the added 300K without slowing the base contract
On 10/29-10/30 Tissa came back with a larger ask after Google landed a big opportunity (Anthropic). Peter directed Nathan and Justin: before spending any time, write down what CIQ believes is true and send it to Tissa to validate - (1) what is delivered Monday, (2) the additional ask parroted back to confirm version and build, (3) when CIQ could have it assuming it is funded. Tissa is working to get CIQ about 300K more, taking GDC toward 1M plus royalties next year, and this must not slow signature of the existing contract. Peter relayed Tissa request that CIQ engineers stop saying that is not in the contract and say we will talk to Pete instead. On 10/30 he asked for the CIQ ETA column filled, including future releases, to talk through any gap between desire and capability.
GDC full kernel with IBT off is not just sign the kmod - say no unless it fits, do not reopen the contract, Peter and Kelly own the Tissa conversation
On 10/29, with the GDC contract about to be signed, Google asked for a 6.18 full kernel with IBT off for the following week. Peter framed it in #google-partnership-governance: the ask pushes CIQ from just sign our kmod into supporting kernel development, which CIQ told Google it must staff up for and is still hiring for; it falls back into the CIQ needs to do the live patching work bucket and cannot be delivered in a couple of days. If Justin path works, fine; otherwise the answer is no. He told Nathan he did not need to manage the contract, stopped the engineering thread (Let us spend no more time on this and Kelly and I will talk to Tissa), and refused to change the order of anything or reopen any question while the contract was being signed. He emailed and then called Tissa; Tissa dropped the full-kernel requirement, and Peter confirmed in writing the plan is the minimal kernel with IBT disabled for next week, with Kelly, Nathan and Justin on the thread.
Customer-specific asks go through Work Ingestion and RAT build/validation - no side channels, even under deal pressure
On 10/23 two escalations from Justin hit the same rule. Toss (Viva Republica) AWS private offers, tied to a $2.4M TCV deal with a frustrated customer: Peter joined the channel to ensure the ask goes through regular Work Ingestion - in Jira, with Product visibility, balanced against other work - and aligned with Bjorn that it goes on the product priority list. OCI HPC base image being built outside the normal path: if CIQ will stand behind it, it must come through the main RAT org, which runs the consistent build and validation process; same message in #team-asia-pacific.
GDC term sheet - balance the background-IP clause so it never reads as claiming Google shared code, and approve the live-patch quote as written
At the GDC Terms Sync, Bjorn set the main position: accept Google other changes (easy out, setup fees ending at 1.8M) in the spirit of partnership, and make it non-negotiable that the minimal kernel and CLK/FIPS 6.18 work are CIQ background IP, for the avoidance of doubt. Peter added the guardrail that Google will share live-patching code and Tissa will never agree that is CIQ IP, so the line must not read that way; he accepted Bjorn narrower wording, and Kelly added a counterweight that code shared by Google is Google IP. On the live-patch quote, Peter dismissed Nathan scoping comment (the cost is standing up kernel-signing infrastructure, not which kernel), deleted the comment, and approved the quote to ship.
Google live patching - set the near-zero-cost kernel flags now, nothing else before commercials, and treat the Tissa call as listen-not-commit
Before the 9/30 live-patch call with Tissa, Peter told Nathan and Justin it was not a commit meeting but a listen-to-them meeting, with the contract worked through later. In the follow-up mpdm, Kelly asked if he was agreeing to do this part now before commercials; Peter said no, then corrected within seconds that he did not mind setting those flags now because it costs almost nothing. Nathan confirmed about 30 minutes to stage plus a few hours testing, riding on a normal kernel rather than a special one. Afterward Peter told Kelly and Bjorn that Alyssa and Tissa were clearly allies on getting this across the line.
Price Google live patching at one headcount matched to the existing contract ratio - with a mandatory cutover to the CIQ patch pipeline once it is built
Peter set the structure Kelly uses to price live patching for Google: budget one full headcount per year (steady state is about half a headcount, the rest is Google acting as accelerator for the CIQ build-out, not funding it all); match the existing contract headcount-to-cost ratio, ignoring the last discount; require that once Nathan live-patch infrastructure is built Google sits on top of it. Interim signing of Google-built patches includes breaking each patch down and ensuring its contents land in the next full kernel. Roughly the same price in both phases; CIQ runs slightly behind for the first months.
No live-patch signing for Google until they pay - CIQ does no more goodwill engineering work ahead of a contract
Google (Tissa) is budgeting now, may try to fold live-patch signing into the 6.18 kernel amendment term sheet, and is trying to avoid paying CIQ for 2026. Peter told Kelly Hall to make clear, kindly, that CIQ does no signing until Google pays.
Serve Google security due diligence from the Core42 audit corpus rather than rebuilding it in a silo
Justin surfaced that a security organisation inside Google has been iterating on due-diligence requests for months - answers sent, then more questions, then demands for the actual documents, now a spreadsheet with links. Peter told him not to recreate the wheel, because the Core42 audit has already produced most of that material at a far deeper level. He confirmed he had read and approved the seven internal policy documents Steve sent him that morning, with one routed to Greg, and set the escalation line: involve Peter only if Google asks for something more technical than policy paperwork Steve can pencil-push.
Attack the live-patching gap through Google co-development as a paid deliverable while keeping the req open - buy the timeline, do not just wait for the hire
In the 2026-08-25 Exec Product Prioritization session Peter named kernel live patching as his single biggest capability gap, and said he does not need more heads beyond the requisitions already open to deliver the top of the board - with live patching the exception. Rather than waiting on that hire, he took a 5:15pm sync with Tissa Senevirathne at Google the same day, scoped specifically to whether Google can accelerate the live-patching timeline and whether it can be added as another paid deliverable to the existing engagement. He described the approach to Chris Baek and Bjorn Hovland as throwing co-development options at the wall to see what sticks. The Rex requisition stays open, so this is an additional path rather than a substitute for the hire.
Override your own teams stated intent to delete the RL 8.6 source tree, and apologize to Google directly rather than defend the position
Tissa Senevirathne emailed Kelly Hall on Jul 30 saying CIQ had informed Google it wanted to delete the RL 8.6 OS and kernel source tree, and asked that it be preserved for contractual traceability and auditability. Peter replied to Tissa the next morning without consulting his team first: I do not know why my team informed you they wanted to delete that tree. I apologize. There is little cost associated with us keeping it live. I hope it was presented as a discussion, not as CIQ is doing this. I will dig in with them to understand what was motivating that, but your request is more than reasonable. In parallel he told Nathan in DM: we cannot shut this down right now, it does not cost us to leave it up except for a few dollars, and pressed for the reason - but why would we need to delete it? I do not want to do anything at all to rock the boat with them right now unless we need to. He named the underlying stake: I want to make sure we have the actual contracts completely signed in blood, and pushed back on the suspected motive - I do not want to do anything that they are nervous about right now, especially if the reason is that its existence makes our metrics look bad.
Google ELTS: pay or I stop the work - and CIQ eats the disputed 150k out of the existing discount to remove the excuse
In the 7/28 CIQ ELTS payment discussion with Google (Madhu, Alyssa, Arun, Katur and Kelly Hall), Peter went in deliberately hot and said so. Madhu was trying to hold Kelly to account for who made a technical decision back in February, with the implication that if CIQ made it Google would not pay for work since then. Peter refused the premise - these are technical decisions, they get made by the team, they get recorded by your people as the decisions of the consolidated team, and then we move forward - and then removed the money as an obstacle by offering to absorb it against an existing concession: I gave you a 250,000 dollar discount over here, so you are bitching about 150,000. I will shake your hand right now that that is on us. That 250,000 discount just turned into a 100,000 discount. With the excuse gone he put the actual question: are we getting paid or are we not getting paid, and if we are not getting paid I am taking my toys and going home. Madhus boss and others stopped the meeting and committed to closing it out by the next day. The call also ended abruptly, which Peter read as someone telling Madhu to stand down.
Reclassify the GDC MIP-listing disclosure question as a contract-timing call and route it to Kelly Hall with a decision criterion
On 7/23 Brady Dibble escalated to Peter, Bjorn, and Kelly that CIQ still had not told GDC the 8/8 MIP listing was at risk because the ESV certificate had not arrived from NIST - and that atsec had flagged NIST not asking for review or comment, typically meaning they had not reached the certificate. Justin Haynes pushed back directly with why would we not let them know. Peter did not answer the disclosure question. He assigned it: this is a Kelly Hall call, and supplied the criterion - whatever path is most likely to get a contract signed in the next couple of days. The thread resolved as non-disclosure, with Bjorn stating he would not flag it and Justin later confirming they did not bring it up and neither did we.
Release the Google 6.18 build; hold the line on future deliverables until Google resolves the LTS question
On 7/22 Peter lifted his own 7/21 hold on the Google/GDC 6.18 image. He connected with Bjorn first, then told Justin Haynes in #google-partnership-governance and in DM to Kelly Hall: give Google the build. He emailed Tissa Senevirathne at Google the same morning confirming the release, restating a firm stance that the LTS work has already been provided to Google, and stripping Mahdu and Alyssa off the thread. He paired the release with an explicit condition: future deliverables are held until Google sorts out the LTS commitment.
Pull the business side (Kelly) into the FIPS 6.18 CAVP-retrigger vs fork call
Justin flagged that upstream 6.18 LT landed hundreds of CVEs/fixes touching the crypto code being FIPS-certified, forcing a choice between re-triggering CAVP (risking the 8/8 Google delivery) or forking/reverting the kernel (a growing maintenance burden). Justin was inclined to retrigger CAVP and risk the timeline. Peter did not make the technical call himself - he decided the business side must be convened, with Kelly Hall involved, because the choice puts the Google 8/8 delivery at risk.
Hold the Google 6.18 image as contract leverage - nothing ships to Google without Peter say-so
Both 6.18 kernels (default and minimal) were built and validated by 7/17, but Peter instituted a delivery-control gate: no kernels go to Google without his explicit say-so, and delivery-timing questions route to Kelly Hall. The build is done; the only remaining gate is contractual, so CIQ holds the finished image as leverage until GDC signs and resolves the outstanding payment. The ultimate release decision Peter deferred to Bjorn and Kelly.
Support Nathan CVE-first prioritization over the Google minimal-kernel delivery; own the customer comms
Nathan flagged that in-flight critical local-privilege-escalation CVEs collided with the committed 6.18 minimal-kernel delivery to Google and called for CVE remediation to come first. Peter backed that call rather than making it: agreed to a bounded slip (no more than a week, not three), was comfortable asking the team to work a weekend to verify already-built patches, and took personal ownership of communicating the slip to Google - framed as value-add (surface only the CVEs Google benefits from), not an apology. Peter wrote and sent the explanatory email to Tissa and the Google team the same day.
Empower Nathan to defer Hassan secure-boot working session if engineering not ready
Apr 28 morning, Nathan flagged in #google-partnership-governance that he was not prepared for the Hassan working session that afternoon. Peter (at IAG, unable to attend) DMed Nathan: Youll be the senior guy in the room. If we arent ready for it tell Kelly we arent ready and to push it back. Brady and Kelly both signaled flexibility; the team coordinated and chose to proceed with a working-meeting framing. Peter closed the channel thread with Thank you all.
Reframe Azure relationship — CIQ supports RLC, not all of RESF
Directed Justin to align with Kelly on Azure messaging, clarifying that CIQ supports its own RLC offering (not the entire RESF ecosystem). Protects Nathans team from unbounded support burden while preserving the January 2027 contract renewal opportunity.
Committed CVE categorization + kpatch estimates to Google by Monday
After Tissa agreed no one can answer Madhus blanket questions, committed CIQ to deliver a CVE-type classification table with kpatch coverage estimates by Monday. Reshaping an unanswerable request into a structured, defensible answer by category.
Google NEXT - Value-First Attendance Framework for Nathan
When Kelly asked if Nathan should attend Google NEXT (April 21-24), set a value-first framework: Nathan goes only if there's a concrete business objective. Pushed Kelly to define the business case rather than defaulting to sending people.
Google Meeting Communication Coaching for Brady/Nathan
Directed Brady and Nathan on exactly how to communicate during the Google GDC follow-up call — present CIQ as calm, capable, and dedicated; don't volunteer unnecessary details; distinguish technical infeasibility from resource constraints. Personally bookended the engineering meeting with success criteria. Chose to keep GDC post-mortem attribution under Peter's name rather than crediting others.
FIPS Delivery Contingent on Google Commercial Commitment
Peter stated CIQ needs to make clear to Google soon that FIPS delivery depends on either getting a revenue ramp projection or a new contract. Google can't have the deliverable without the commercial commitment. This came after Bjorn reported Google's Madhu is delaying projection estimates and 'feels like they are trying to exert leverage.'
Taking Personal Lead on All GDC Communication for Next Month
Peter decided to personally lead ALL Google GDC communication for the next month, replacing the current multi-voice approach. New framing: 'we are technically capable; let's discuss the contract' instead of 'we can do it if you pay us.' All GDC work must be categorized into two buckets: work CIQ would do anyway (GDC accelerates it) vs work done only for GDC.
FIPS 6.18 Option 2 Engineering Kickoff
After Manu at Google did not respond to the relationship reset email sent Sunday, Peter escalated the FIPS proposal to Tissa via Kelly. Tissa authorized CIQ to proceed. Peter then directed Nathan to begin engineering work on Option 2 (faster timing path) while awaiting the Atsec contract. Engineering was held in reserve until external confirmations landed to avoid thrashing.
Google GDC Relationship Reset via CTO Email to Manu
Drafted and sent strategic email directly to Manu at Google Engineering, acknowledging communication disconnect, offering FIPS 6.18 acceleration at certification cost only (~$180k, CIQ absorbs NRE), directing shared git repo setup for co-development transparency, and requesting Google revenue ramp projections. Reviewed draft with Bjorn before sending; forwarded final to Max crediting his input.
Google FIPS 618 as Commercial Leverage
Peter decided to use FIPS 618 kernel as leverage to push Google toward a paid contract before committing CIQ to significant new engineering work like live patching.
Google Contract Engineering Justification
Directed Nathan Blackham to provide engineering cost breakdown for GDC work, and Kelly Hall to provide revenue numbers, building justification for higher pricing in Google contract renewal/expansion. Nathan confirmed ~$800K/yr cost for 1-2 engineers on GDC with zero profit, and CIQ actually spends more on GDC than GCE.
Google Deal — Engineering Owns Resource Projection
Directed that engineering (not finance/biz dev) should own projecting what the Google deal requires in terms of team size and capacity. Participated in Google Deal review meeting where consolidated $6M/yr development fee proposal was developed, including engineering guardrails (live patching scope limits, early renewal trigger). Deal structure: $6M dev fee for 5-7 senior engineers, uncapped variable usage fees (removing $1M cap), 15-25% margin on premium listings + MDF, early renewal trigger if scope exceeds funded team capacity.
Prioritize Google Exec Meeting — Adjust Reno Travel
Agreed to meet a confidential new Google executive (distinguished engineer from Google Cloud, came through Tissa) for Monday dinner or Thursday lunch. Thursday option requires returning from Reno Wednesday night. Directed Greg to cover Toyota in person on Wednesday if needed.
Unified Google Proposal — Present Combined GDC/GCE to Rohan
Aligned Kelly and Bjorn on presenting a unified GDC/GCE proposal to Rohan (Google senior director) instead of negotiating separately. Reframing from pro-serve/ticket model to value-driven partnership with a large fixed annual fee ($8-9M).
Set Google GDC meeting strategy: build direct relationship and manage attendee roles
Peter decided to attend the Google GDC executive meeting himself (without Greg), bringing Max, Brady, and Nathan. Will personally manage Nathan's participation to protect Brady's roadmap presentation. Kelly directed to tell Google 'Peter has this covered.'
Committed to creating CVE remediation value driver for GTM
Committed to creating a value driver for CVE remediation work after learning that remediation volume jumped from 1 to 86 per week. Timeline is ~2 months to develop the story after validating the new process is sustainable.
Google Partnership Strategy - Build Rapport with Tissa
Decided to shift the Google contract renegotiation strategy from confrontational to collaborative. Peter will personally meet with Tissa (Google) to build rapport and empathy, framing CIQ's financial pain as a shared problem to solve together. Greg will be excluded from this meeting to ensure a non-antagonistic conversation.
Google TDX Work - Funding Requirement
Rejected doing Google TDX work if it only means 2-3 months of paid engineering time. Set requirement that the work must add headcount to CIQ to be worth pursuing - otherwise CIQ is just spending scarce resources on Google priorities instead of its own.
Google Scope Change - Hold the Line on Commercial Terms
Decided to personally join the Monday lunch meeting with Tissa to lead negotiation on Google scope change. Google was trying to bundle Rocky 8 and 9 into one version (reducing from 8 to 5 versions) and push release next format without updated commercial terms.
H1 Planning Framework - 3-Lane Model
Pushed for the team to focus on ICPs, goals, and milestones rather than getting lost in metrics and mid-level tactics. Established a 3-lane framework (GTM, Value Drivers, Engineering) to align all work.
Google Scope Change - Hold the Line on Commercial Terms
Google is pushing scope changes that bundle 8 versions into a 5-version contract, omit EOL dates, and include undefined dev streams. This creates scope creep risk and jeopardizes the Extended LTS revenue stream (~$300k/year per product). Decision to personally attend the Monday meeting with Tissa (with Max) to hold the line. Greg will NOT attend to preserve escalation path.
Related Patterns (16)
Protect Engineering Capacity
When external demands threaten to overload engineering capacity, protect capacity by either requiring the demand to come with additional resources, or forcing hard prioritization choices upstream.
Executive Sponsorship for Strategic Partnerships
Strategic cross-company initiatives and major client partnerships require executive-level accountability to move at the right pace and ensure proper prioritization.
Lead by Example with New Tools
When championing new tools or processes, personally use them and share results rather than just advocating. Learning by doing and demonstrating value through example is more effective than mandates.
Small Circle for Sensitive Operations
When executing sensitive strategic operations, keep the circle of informed people as small as possible to prevent leaks that could accelerate hostile action or undermine the initiative.
Protect Engineering Focus Through Process
When faced with requests that would disrupt engineering focus (from sales, governance, product, or other stakeholders), establish processes that protect engineering ability to innovate while still satisfying legitimate concerns. Prefer systematic solutions over ad-hoc responses.
Reclassify to Route - Decide Who Owns It, Then Give a Criterion Not a Verdict
When a question arrives at Peter framed in one domain, he often does not answer it in that framing. He reclassifies it into the domain that actually governs the outcome, which relocates ownership to whoever owns that lane, and then hands down a decision criterion rather than a verdict. The reclassification IS the decision - it determines who decides. He does this rather than adjudicating on the merits himself, even when he was explicitly cc-ed and even when a direct report challenges him on the substance.
Purpose Is the Decision Procedure
When someone asks how a process, board, tool or artifact should handle their specific case, Peter refuses to answer on the askers terms. He re-derives the answer from what the artifact is for, states that purpose as the only decision procedure, and lets the answer fall out. Anything found to be serving a second purpose is deleted rather than debated. Tools and views are explicitly subordinate to definitions. He will accept that the askers real problem is simply not solved by this artifact rather than widen the artifact to cover it.
Route Non-Differentiating FTE Classes to Partners
When CIQ would otherwise need to staff a function whose work does not differentiate the company — compliance bureaucracy, audit/cert paperwork, ongoing regulatory attestation, etc. — Peter routes the load to a partner who already owns adjacent capability rather than adding the FTE class internally. Org-shape decision dressed as a partnership decision.
Demonstrate the Standard, Then Collect It
When a new leadership expectation has to land across multiple orgs, Peter does not write a spec. He runs a live exemplar in public with the strongest performer first, says openly that the ordering was deliberate, keeps the form of the deliverable open so the ask stays about the thinking rather than the artifact, lets the delta be self-evident to the people who will have to close it, and then collects the same from everyone else on a named rotation. He prefers showing imperfect work now over polished work later.
Decide on the Precedent, Not the Case
When a request arrives framed as a one-off, Peter does not evaluate the one-off. He evaluates the rule that granting it would write, and answers that instead. Peter generalized this himself on 2026-08-11: it is always about understanding precedent - whether it is a comp change or anything that structurally affects the company. It is therefore NOT a compensation pattern; the domain of the presenting request is incidental. The tell that this pattern is live is that the stated reason for the answer refers to future cases rather than to the merits of the present one.
Metrics Must Follow Strategy
When shifting team priorities or strategic direction, the communication alone will not drive behavior change. Engineers may acknowledge the new direction but continue existing behavior patterns without clear, explicit metrics holding them accountable.
Switch Instrument, Not Intensity
Applies when a message, rule or ask has already failed through the channel Peter is currently using - repeated advocacy that has not landed, coaching that produced defensiveness rather than improvement, exhortation that did not change behaviour, or a rule that keeps losing case by case. His response is never to restate the same thing more forcefully. He changes the instrument and usually names the switch out loud. Mined from 7 independent observations between 2026-01-06 and 2026-08-21.
Time Over Cost
Peter treats elapsed time as the scarce quantity and money as the abundant one, and will spend cash to buy schedule, clarity or optionality. Notable because he named it himself as a transferable principle on 2026-05-21 and coached the lens explicitly to a direct report, which is rare - most of his patterns are inferred rather than stated. It generalises past procurement: he will pay to convert an ambiguous dispute into a binary one, remove cost as a variable entirely when a priority has executive visibility, and reason about a commitment in terms of lead time rather than budget. Mined from 5 independent observations between 2026-02-01 and 2026-09-11.
Promise Only What Is Inside CIQ Control
Applies when someone asks CIQ to commit to an outcome whose delivery depends partly on something CIQ does not own - a lead time, a third-party publisher, a customer-provided environment, an unsigned contract. Peter does not accept or refuse the request as posed. He isolates the specific component that sits outside CIQ delivery chain, refuses that component by name, and substitutes an adjacent commitment CIQ can actually keep - then often adds a harder problem worth solving in its place, so the counterparty gets more engagement rather than less.
Install the Criterion Before the Argument
Applies to a contested question that has not been argued yet - a meeting about to start, a test about to run, an escalation just received, a proposal about to be written. Peter moves first to fix the criterion, the boundary or the posture, before anyone argues the substance. The consistent effect, named explicitly in the 2026-07-29 observation, is that the other party cannot win by being more persuasive on the merits, because the merits are no longer the axis. Distinct from Reclassify to Route in mechanism: that pattern reassigns who owns a question, this one controls WHEN the criterion lands relative to the debate. The two frequently co-occur. Mined from 7 independent observations between 2026-01-20 and 2026-08-31.
Measure, Commit Publicly, Then Execute
A three-beat escalation arc Peter runs when he needs a commitment from a peer or the CEO that private pressure has not produced. Beat one: measure the thing and get a number. Beat two: state the commitment in a venue where the people who matter are watching. Beat three: execute against it. The 2026-04-15 observation names the sequence explicitly and notes he does not skip steps, because each beat builds the legitimacy of the next. The venue choice is treated as a decision in its own right, separate from what the message says. Mined from 8 independent observations between 2025-12-29 and 2026-08-28. NOTE: scope this to the venue-and-sequence mechanism specifically - forcing function is a phrase that appears loosely across many unrelated decisions and should not be taken as a match on its own.