# Need to Know

> Keep one surprise - a party, a gift, a proposal, a trip - secret until the reveal. A playful threat model for a secret kept among friends and family.

Live at https://need-to-know.skillsafe.ai/ (unlisted). Built on the SkillSafe skill @bobmatnyc/threat-modeling (scope, data flows, threats, risk scoring, mitigations), moved from software to a real-life surprise.

## What it does

- Free, in the browser: three need-to-know rings (planning it, doing one job, just told) drawn from your lines; flags for a child in the know, someone who lives with the person being surprised, a name listed in two rings, a big circle (10 or more) and a long fuse (over 60 days); a tuning dial of 14 shared channels (calendar, joint card, shopping account, parcels, inbox, location sharing, group chat, photo library, shared device, smart speaker, lock screen, guests posting, children, vendors calling) with a playful loudness estimate per channel; a fuse from today to the reveal; exports as Markdown, CSV, JSON and a calendar file.
- Metered, one task (`plan`, on gpt-terra): a leak for every ticked channel (plus up to two from your worries) with a risk level (high, medium, low) and a plug; a verdict by fixed rule (lockdown for 3+ high leaks, patch for 1-2, airtight for none); briefs for the flagged people; six spy-style field rules; a check of your cover story; a 3-6 step countdown ending on the reveal day; and what to do if the person gets suspicious.
- The page re-checks every plan against the form: the verdict against the rule, a leak per ticked channel, briefs for flagged people, the countdown inside your days, word limits, no gendered pronouns, no internal field names.

## Input contract (every field a string)

task ("plan"), surprise, for_whom, days_left ("0"-"365"), planning, helping, told (one person per line, "Name" or "Name - note", or "(nobody)"), channels ("<id> | <label>" per line or "(none ticked)"), worries, cover ("(not given)" when empty), page_scan ("<n> | <kind> | <detail>" per line or "(none)"), optional clip_note and retry_note.

## Output contract

One JSON object: task, title, codename, leaks[{channel, risk, how, plug}], verdict, verdict_reason, circle[{name, ring, brief}], field_rules[6], cover_story, cover_holes[], countdown[{days_before, do}], if_rumbled.

## Pages

- https://need-to-know.skillsafe.ai/api.html - API tutorial in eight languages with worked examples
- https://need-to-know.skillsafe.ai/ - the app

## Idea

The idea comes from Cold War spy "field rules", the Moscow rules: short rules for working under watch, here applied to a surprise kept among friends.