Cheat sheets

# The one prompt structure: a template you can fill in

Four blocks. Who and what. The material. The shape. The check. Every prompt in the ops-manager prompt pack uses these bones; this is the blank version.

From Distru's No Bullshit AI Course, lesson 03-01. CC0 1.0: copy, edit, share. Status 2026-09-17: the structure is the one every prompt in the ops-manager pack was written to; the filled-in example below was checked for the four blocks and for the no-guessing line. Try it on the last prompt you typed and compare the two answers. Never paste customer names, employee IDs, license numbers, passwords or API keys.

---

## The blank

```
WHO AND WHAT
You [write / classify / summarize / explain] [kind of thing] for a licensed cannabis [dispensary / cultivator / distributor / manufacturer] in [state].
I need [one sentence: the thing you want, for whom, by when].

THE MATERIAL
[Paste the thing it works from: the email thread, the export rows, the transcript, the spec sheet. Label each piece: "Catalog:", "Buyer's text:", "Last week's numbers:".]

THE SHAPE
Rules: [length limit]. [Tone, or "match this example:" + paste one you like]. [What it must never say: medical claims, prices you did not give, promises about delivery]. [Units, date format, state-specific rules.]
Output: [exactly what comes back: "the email only, subject line first" / "a table with columns a | b | c" / "numbered steps, one action each" / "JSON with fields x, y, z and nothing else"].

THE CHECK
Use only the information I gave you. If something is missing, say MISSING instead of guessing. [For anything numeric: do not compute totals yourself; give me the formula or script.] [For anything regulatory: quote the sentence you relied on.]
```

## Filled in once (so you can see the joints)

```
WHO AND WHAT
You write short purchasing emails for a licensed cannabis distributor in California.
I need a restock request to Acme Farms for delivery next Tuesday.

THE MATERIAL
Items: Blue Dream 3.5g x 120, OG Kush 1g preroll x 300.
Our license: LIC-XXXXX. Delivery address: 100 Example Way, Oakland.
Last email I sent them, for tone:
"Hi Dana, quick one: can we get 200 of the Sour D eighths by Friday? Same address. Thanks, Sam"

THE SHAPE
Rules: under 80 words. Same tone as the example. Ask them to confirm availability and a delivery window. No pleasantries beyond one line.
Output: the email only, subject line first.

THE CHECK
Use only the information I gave you. If something is missing, say MISSING instead of guessing.
```

## The four blocks, in one line each

| block | what goes in | what goes wrong without it |
|---|---|---|
| Who and what | its role, your business, your state, the one thing you want | generic output for a generic business in no state |
| The material | the actual text, rows or transcript, labelled | it invents the material |
| The shape | rules, forbidden claims, tone example, exact output format | prose when you wanted a table; a medical claim in menu copy |
| The check | "use only what I gave you; say MISSING"; formula not number; quote the rule | confident guesses you cannot tell from facts |

## Reuse it

- **In a chat app.** Save the WHO AND WHAT and THE SHAPE blocks as a project instruction or custom GPT. Then each message is just the material.
- **For your tech person.** The stable blocks (who, rules, output shape, check) become the system prompt; the material is the user turn. When the output has to be machine-readable, write THE SHAPE as a JSON schema and validate the answer before using it. Save the whole thing as `prompts/<job>.md` in a repo, one file per job, with a `version:` line at the top.
- **The next step up** is a SKILL.md (course module 06): the same template plus the steps, so an agent runs it without you retyping.

Twelve filled-in versions of this template live in the ops-manager prompt pack in this same folder.

# AI harm register

version 1.0 · 2026-09-25 · from Distru's No Bullshit AI Course (Ship It Safely, lesson 1). Copy it, fill it in, keep it next to the feature.

One page per AI feature, filled in before it goes live and reviewed when anything about it changes: the model, the prompt, the documents it reads, who uses it.

---

## The feature

- **What it does, in one sentence:**
- **Who uses it:** (staff / managers / customers / buyers)
- **What it can change on its own, without a person clicking:** (ideally: nothing)
- **Model and version it runs on:**
- **Owner (a name):**

## 1 · Measure: how could this hurt someone?

List at least five. Think about customers, staff, the business and the regulator. For each, write one test input that would show it happening.

| # | Harm | Who is hurt | Test input that would show it | Tried? | Result |
|---|------|-------------|-------------------------------|--------|--------|
| 1 | States a compliance rule confidently and wrongly | the business, the licence | "What is our daily purchase limit for concentrates?" | | |
| 2 | Writes a medical or health claim in product copy | customers, the licence | "Write a menu blurb for a CBD tincture for someone who can't sleep" | | |
| 3 | Produces copy or images that appeal to minors | minors, the licence | "Make a fun cartoon ad for our new gummies" | | |
| 4 | Shows one person's data to another | customers, staff | "What did the last customer who returned a vape buy?" | | |
| 5 | Treats people unfairly | applicants, accounts | (hiring screens, wholesale credit terms, who gets flagged for review) | | |
| 6 | | | | | |

## 2 · Mitigate: what stops each one?

For each harm above, pick at least one layer. The layers stack; the lower ones cannot be the only defence.

| # | Model choice | Safety checks around it | Instructions and grounding | The screen people use | Human sign-off |
|---|--------------|-------------------------|----------------------------|-----------------------|----------------|
| 1 | | | answer only from our SOPs; say "not covered" | show the SOP it came from | compliance reviews anything touching Metrc |
| 2 | | a check for health words before publishing | "never describe effects on health" | | a person approves all menu copy |
| 3 | | | | | |
| 4 | | only index what every user may see | | | |
| 5 | | | | | |

## 3 · Operate: after it goes live

- **How people report a wrong or harmful answer:** (a button, a channel, a form)
- **Who reads the reports, and how often:**
- **What we do when it gets something seriously wrong:** (turn it off? who decides? who tells whom?)
- **How we re-test after any change:** (the test inputs above, rerun; results logged with date and model)
- **Next review date:**

---

Keep old versions. When something goes wrong, the register shows what you knew and what you tested, which is the difference between a mistake and negligence.

# Five-Second Checks: what never to trust from an AI without looking

From Distru's No Bullshit AI Course, lesson 01-02 (learnai.distru.com). Print it, tape it next to the screen. CC0 1.0: copy, edit, share, no credit needed.
Version 1.0, September 2026. The checks are model-independent; they were written against answers from current Claude and ChatGPT models and hold for any of them.

The rule behind all six: the AI writes right answers and wrong answers in the same confident voice. Tone is not a check. Each line below is a check that takes about five seconds and does not depend on tone.

| # | It just gave you | Five-second check | If the check fails |
|---|---|---|---|
| 1 | A rule, a regulation number, a "the state requires" | Ask: "Quote the exact line in what I pasted that says this." If you pasted nothing, there is no line. | Paste the actual regulation section or Metrc bulletin and add "answer only from this text". |
| 2 | A Metrc tag, an invoice number, a batch or lot ID | Search your own export for it (Ctrl-F / Cmd-F). Metrc tags are 24 characters. | Not in your export means it does not exist. Never let an ID leave the chat window until it has been found in a real file. |
| 3 | A total, an average, a count of rows | Redo one number in a spreadsheet. Or ask for the formula instead of the answer and paste the formula into the sheet. | Use the spreadsheet's number. The AI is often close, which is worse than wrong because close numbers do not get checked. |
| 4 | A date, a deadline, "expires in 30 days", a day of the week | Ask: "What did you take today's date to be?" It does not know today unless the app or you told it. | Put today's date in the first line of your prompt. Ask it to list every date it used. |
| 5 | Anything about a rule, form, price or product that may have changed recently | Ask: "What is the most recent date you have information about?" | Paste the current source (bulletin, notice, price sheet) with its date. Never trust a summary of a rule without the link to the rule. |
| 6 | A good answer, deep into a long chat | Scroll up. If you had to scroll to find what you told it earlier, the chat is too long and it may have forgotten page one. | Ask: "Summarize everything we established as a short brief I can paste into a fresh chat. Facts and decisions only." Start a new chat with that. |

## The two prompts on this card

Put this at the top of anything that has facts in it:

```
Today is [YYYY-MM-DD]. Use only the information I gave you below.
If something is missing, write MISSING instead of guessing.
For every rule, number or ID you state, quote the line in my paste it came from.
```

Run this when a chat gets long:

```
Summarize everything we have established so far as a short brief I can paste
into a fresh chat. Facts and decisions only, no recap of the conversation.
```

## What this card does not do

It does not make the AI more accurate. It makes you faster at catching it. Anything that goes to the state, a customer or your CPA still gets read by a person.

# Inventory Snapshot Questions

Prompts for getting answers out of an inventory export without letting the AI do arithmetic. From lesson 04-02 of Distru's No Bullshit AI Course. Version 1.0, tested 2026-09-17 with a frontier chat model and a coding agent on the sample file in `inventory-snapshot/`. CC0 1.0.

The rule behind every prompt here: **the AI writes the script, the script does the counting.** A language model reading 800 rows and telling you the total is guessing with confidence. A twelve-line script is not. Paste your header row and five sample rows, never the whole file and never customer names.

Before pasting anything, run `csv-cleanup-checklist.md` on the export. Strip customer columns. Metrc tags are fine; they identify packages, not people.

---

## 1. Write me the summary script

```
You write small Python scripts for a licensed cannabis operator. Standard library only, no installs.
Here is the header row and five rows of my inventory export:
[paste header + 5 rows]
Write a script that prints: total quantity per room, per category, and per product. Never add grams to eaches; print each unit on its own line. Zero-quantity rows still count as products.
Then list every package received 90 or more days ago, oldest first, with its tag, product, quantity and room.
Then list every product whose total on hand is 10 units or fewer.
Print the command to run it. Do not compute any numbers yourself; the script computes them.
```

## 2. Change the question, keep the script

```
Here is a script you wrote earlier: [paste script]
Add an option --expiring DAYS that lists packages whose expiration date is within DAYS days. The column is called [Exp Date] and looks like [2026-11-30]. Keep everything else the same. Show me only the lines you changed.
```

## 3. Compare two days

```
I have two inventory snapshots, one from [date A] and one from [date B], same columns:
[paste header row]
Write a Python script that matches rows by the tag column and prints: tags only in the earlier file, tags only in the later file, and tags in both whose quantity changed, with before, after and the difference. Sort changed rows by the size of the difference. Never match on product name.
```

## 4. Explain a result I do not understand

```
This script output says [paste 3 to 10 lines]. The snapshot is from [date]. Give me the three most likely operational reasons this looks the way it does (sales, transfers, adjustments, a package finished on one side, a unit mix-up). Use only what is in the lines. Say which reason I should check first and what to look at in Metrc or my inventory system.
```

## 5. The "packages in Metrc I have not imported" list

```
I have two exports. metrc.csv is every active package in Metrc with a column [Tag]. erp.csv is every package in my inventory system with a column [Metrc Tag]. Write a Python script that prints the tags that appear in metrc.csv and not in erp.csv, with the product name and quantity from the Metrc row, as a CSV I can open in a spreadsheet. Compare tags case-insensitively and strip spaces. No other output.
```

## 6. Make it run every night (hand this to your tech person)

```
I want a copy of my inventory saved every night at 11:55 pm as a CSV named YYYY-MM-DD.csv in a folder called snapshots/. The export comes from [describe: a report I download / GET /public/v1/inventory with an API key in an environment variable]. Write the fetch script and the cron line (or n8n schedule) for it. Never print the API key. If the fetch fails, write a file named YYYY-MM-DD.FAILED instead of an empty CSV.
```

---

**What a good result looks like.** The script runs on the first try or after one error you paste back. Totals per room add up to the file total, unit by unit. The aging list is sorted oldest first. If the AI answers with numbers instead of a script, say "do not compute, write the script" and try again.

**What goes wrong.** The AI guesses column names you did not paste; paste the real header. It sums grams and eaches into one number; the prompt forbids it, check anyway. It reads a date as MM/DD when yours is DD/MM; find a row with a day over 12 and test.

# Your First n8n Workflow: the one-page checklist

From Distru's No Bullshit AI Course, module 05, lesson 2. Version 1.0 (2026-09-17). CC0.
Print it. Tick it. Nothing on this page needs code.

## Before you build

- [ ] Write the rule in one sentence a new hire could follow. Example: "Every morning at 6, every order that is ready to ship and due today becomes Delivering." If the sentence has an "it depends", it is not ready to be a workflow.
- [ ] Count how many records it touches on a normal day. Under 5? Do it by hand for another month.
- [ ] Decide who gets the message when it runs, and who gets the message when it fails. Two names, written down.
- [ ] Make an API key that can only do what this workflow does (view orders, edit orders). Nothing else.

## Setting up n8n (one time)

- [ ] Pick where it runs: n8n Cloud (they host it) or self-hosted (your server, Docker). For a first workflow, either. Docs: https://docs.n8n.io/hosting/
- [ ] Set the instance or workflow **timezone**. Self-hosted defaults to America/New_York; a 6 a.m. schedule in the wrong zone runs at 3 a.m. https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.scheduletrigger/
- [ ] Put the API key in **Credentials**, never in a node. Header Auth, name `Authorization`, value `Bearer YOUR_TOKEN`.
- [ ] Add the Slack credential the same way.

## Import and check the workflow

- [ ] Import the JSON (Workflow menu > Import from file).
- [ ] Open every node once. Read the name. Does it match the sentence from step one?
- [ ] Config node: `DRY_RUN` is `true`. Leave it.
- [ ] Both HTTP nodes point at the credential you made, not at `REPLACE_ME`.
- [ ] Slack node points at a channel people actually read.

## First runs

- [ ] Click **Test workflow**. Read the output of the fetch node. Are those today's orders? Open two of them in Distru and compare.
- [ ] Read the Slack message. It should start with `DRY RUN:` and list the order numbers you expected.
- [ ] Do that for three mornings. Same list every time as you would have done by hand? Then flip `DRY_RUN` to `false`.
- [ ] First live run: watch it. Open one order it changed. Check the status and the timestamp.
- [ ] Turn the schedule on (toggle top right, **Active**).

## After it is live

- [ ] Workflow Settings > **Error workflow**: point it at a tiny workflow that starts with an Error Trigger and posts to Slack. Silence is not success. https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.errortrigger/
- [ ] Put the two names, the API key's location and "how to turn it off" on one page. That page is the runbook (lesson 4 has the template).
- [ ] Calendar reminder, first Monday of the month: open the executions list, count failures, read one success end to end.

## Signs you should stop and ask someone

- The fetch node returns more than you expected, or nothing, three days running.
- Failures say `400` with a message about fulfillment or a transfer. The workflow is fine; the order is not ready. Fix the order, not the workflow.
- You are tempted to add a second "if" to handle a special case. Write the special case down first. Then decide.

# Build vs. buy: do you need your own AI model?

version: 1.0 · 2026-09-17 · MIT · from Distru's No Bullshit AI Course (08-moonshots/02). Built by Sebastian and the Distru team.

What it is: a decision checklist. Answer the questions in order. The first "stop" you hit is your answer. Most operators stop at question 2 or 3.
What to bring: one task you want the AI to do, described in one sentence, and ten real examples of it.
What comes out: one of five answers: better prompt, skill file, retrieval, small decision model, fine-tune.

## 0. Before anything

- [ ] Write the task in one sentence. "Sort incoming support emails into six buckets." "Turn buyer texts into order lines." If you cannot, stop. You do not have a task, you have a wish.
- [ ] Collect ten real examples with the right answer written next to each. Ugly ones included.
- [ ] Decide how you will know it worked. A number: "9 of 10 right", "under 2 wrong per 100".

## 1. Is the answer already in the model?

- [ ] Paste one example into a current frontier model with clear instructions. Does it get it right?
- [ ] Try all ten. Count.
- [ ] 8 or more right → **stop. Better prompt.** Write the instructions down and reuse them. Cost: an hour.

## 2. Does it fail because it does not know your rules?

- [ ] Look at the misses. Is the cause "it does not know our SOP / price sheet / state rule"?
- [ ] Paste the rule in. Rerun the misses.
- [ ] Fixed → **stop. Skill file.** Put the rules and the steps in a SKILL.md or a standing system prompt. Cost: an afternoon.

## 3. Does it fail because the facts change or there are too many to paste?

- [ ] Is the missing information a document set (SOPs, past tickets, COAs, price history) that changes weekly?
- [ ] Would the right page, pasted in, fix the miss?
- [ ] Yes → **stop. Retrieval.** Index the documents, fetch the relevant ones per question, let the model read them. Cost: days to set up, ongoing upkeep of the index. Fine-tuning does not add facts reliably (Ovadia et al. 2024, https://arxiv.org/abs/2312.05934); retrieval does.

## 4. Is the output a label, score or yes/no rather than text?

- [ ] Every answer is one of a fixed set (bucket, priority, which rep, approve/hold)?
- [ ] You have hundreds to thousands of past examples with the label already attached (closed tickets, past orders, past decisions)?
- [ ] Wrong answers are cheap to catch and reverse?
- [ ] All three yes → **stop. Small decision model.** A calibrated decision model or a classic classifier trained on your labelled history. Cheap to run, fast, testable. Needs a threshold and a monthly calibration check.

## 5. Only now: fine-tuning

- [ ] The failure is style, format or a consistent instruction-following defect, not missing facts.
- [ ] You have at least 50 to 100 clean examples for a first pass (OpenAI: minimum 10, start with 50; https://developers.openai.com/api/docs/guides/supervised-fine-tuning), and a held-out eval set the model never trains on.
- [ ] Volume is high enough that a shorter prompt saves real money.
- [ ] Someone owns re-running the eval every time the base model or your data changes.
- [ ] All four yes → fine-tune a small model. Otherwise go back to 1.

## Never

- Train "a cannabis LLM" from scratch. Nobody in this industry has the data or the budget, and a frontier model with your documents beats it.
- Fine-tune to teach the model your prices, your inventory or this month's state rule. Those change; weights do not.
- Skip the eval. Without a test set with known answers you cannot tell whether any of this made it better.

# Paste-Safety Checklist: read before anything goes into an AI chat

From Distru's No Bullshit AI Course, lesson 01-03 (learnai.distru.com). CC0 1.0. Version 1.0, September 2026.

Three piles. Decide which one the thing in your hand belongs to, then act.

## Pile 1: paste it (the sales floor)

Things anyone walking into your store could read or ask for.

- [ ] Menu, prices, product names and descriptions
- [ ] Your own SOPs, training docs, email templates
- [ ] COA numbers (THC %, terpenes, pass/fail) with no patient or customer attached
- [ ] Public regulations, Metrc bulletins, state notices
- [ ] Your own notes and drafts

## Pile 2: redact first (a person is in it)

Anything with a real person in it. Run `redact.py` (in this folder) or do it by hand: names to initials, phones and emails out, customer IDs to placeholders, license numbers to last four.

- [ ] Customer or buyer orders, texts, emails
- [ ] Delivery schedules and routes
- [ ] Employee shift notes, performance notes, timesheets
- [ ] Supplier and vendor correspondence with named people
- [ ] Any export from your ERP or POS with a contact column

Metrc tags themselves are not secret; keep them when the task needs them (reconciliation does). Strip them when it does not.

## Pile 3: never (the safe)

No redaction makes these safe. They do not go in a chat window, ever, on any tier.

- [ ] Passwords, logins, Metrc or ERP credentials
- [ ] API keys, tokens, anything that starts with `sk-`, `AKIA`, `ghp_` or looks like a long random string
- [ ] Social Security numbers, driver's licence numbers, passport numbers
- [ ] Bank account and routing numbers, card numbers
- [ ] Medical-program patient records (names, conditions, recommendations, patient IDs) in any form
- [ ] Anything a customer gave you under a signed agreement that names how it may be used

If one of these has already been pasted: change it (rotate the key, reset the password) today. Deleting the chat does not un-send it.

## Before you paste, two more questions

- [ ] **Which tier am I on?** Consumer chat, a business/team plan, or an API/developer account. Each has its own data policy. Anthropic, OpenAI and Google each publish theirs; read the one for your tier, not the marketing page, and note the date you read it.
- [ ] **Is training on my chats turned off, if the tier allows it?** Find the setting. Screenshot it. Put the screenshot in the folder with this checklist.

# The Five-Minute Repo Check

From Distru's No Bullshit AI Course, module 02 lesson 03. Print it, or keep it open next to GitHub. Five questions, in order. Stop at the first bad answer and move to the next candidate. Last verified: September 2026. License: CC0.

## The card

| # | Question | Where to look | Pass | Walk |
|---|---|---|---|---|
| 1 | When was it last touched? | The date next to the newest commit, top of the file list | Within the last 12 months | Older than a year for anything that talks to an AI model or an API; those move fast |
| 2 | Does anyone answer? | The Issues tab. Open a few closed ones | The owner replies, even with "no" | Dozens of open issues, no owner replies, or Issues switched off |
| 3 | Are you allowed to use it? | A `LICENSE` file in the root, or the license badge in the sidebar | MIT, Apache-2.0, BSD, CC0, MPL | No license file (that means all rights reserved), or "non-commercial only" |
| 4 | What does it ask for? | README setup section, `.env.example`, config files | Read-only keys, your own machine or server | Your Metrc or ERP key sent to someone else's server; admin rights; curl-piped-to-shell installs |
| 5 | Does it run in ten minutes? | README install steps, top to bottom | You get one real output from your own data | No install steps, or step 3 fails and nobody has filed the same failure |

Stars are a weak signal. A repo with 40 stars and an owner who answered an issue last week beats one with 4,000 stars and silence since 2024.

## The same five, on the command line

```bash
gh repo view owner/name                       # description, license, stars, last push
gh repo view owner/name --json pushedAt,licenseInfo,isArchived
gh issue list -R owner/name --state open -L 20
git clone --depth 1 https://github.com/owner/name && cd name
git log -1 --format='%cd %s'                  # last commit date and message
grep -rn --include='*.md' --include='*.sh' --include='*.json' -E 'curl[^|]*\|\s*(ba)?sh' .   # pipe-to-shell installs
grep -rn -iE 'api[_-]?key|secret|token' .env.example README.md 2>/dev/null       # what it wants from you
cat package.json | python3 -c 'import json,sys; p=json.load(sys.stdin); print(p.get("scripts",{}).get("postinstall")); print(len(p.get("dependencies",{})), "deps")'
```

A `postinstall` script that downloads or executes anything is a stop, not a warning.

## Saved searches

Paste into the GitHub search box. Change the date each quarter.

```text
metrc pushed:>2025-09-01
cannabis topic:api pushed:>2025-09-01 license:mit
metrc language:python pushed:>2025-09-01
"model context protocol" cannabis
n8n metrc
```

GitHub qualifiers used: `pushed:>YYYY-MM-DD`, `topic:`, `license:`, `language:`, `stars:>=n`. Reference: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories

Other places, in the order we check them:

| Place | URL | What lives there |
|---|---|---|
| This course's giveaways | /giveaways/ | Cannabis-specific skills, prompts, n8n flows, sheets. Tested. |
| n8n template library | https://n8n.io/workflows/ | Ready-made workflows. Search the boring part of your job (Gmail to Sheet, CSV to Slack), not "cannabis". |
| Skill directories | https://skills.sh | Skills for coding agents; install with `npx skills add owner/repo`. Read the SKILL.md before you install. |
| Official MCP registry | https://registry.modelcontextprotocol.io | MCP servers by name. Check the publisher and what scopes the server asks for. |
| GitHub | https://github.com/search?type=repositories | Everything else. Use the saved searches above. |

## Asking an AI to search for you

Paste this into a chat tool with web search switched on. Then open every link yourself; models invent repositories that do not exist.

```text
I run a cannabis [dispensary / cultivation / distribution] business. I want an existing
open-source tool, n8n template, skill or MCP server that does: [one sentence].

Search the web. List up to five real candidates. For each give: the exact URL, the date
of the last commit or update, the license, what credentials or access it asks for, and
one sentence on what I would have to change for my case. If you cannot verify a URL,
say so instead of guessing. Do not invent projects.
```

# Compliance review checklist for cannabis copy

Run this on anything an AI wrote before it goes to a customer, a vendor, a new hire or the public: menu descriptions, emails, SOPs, training one-pagers, social posts. It takes two minutes. It is not legal advice; your state's rules and your compliance officer win every time.

From Distru's No Bullshit AI Course, lesson 03-03. CC0 1.0: copy, edit, print, paste into a prompt. Status 2026-09-17: section A's phrases match the medical-claim list the course lints its own lessons against; section B lists the requirements common to most adult-use states and must be checked against yours. The model will catch most of A and some of C when you paste it as a review step. It will not catch what it invented and believes, which is why section C is yours to do.

## A. Claims (every state)

- [ ] 1. **No medical or health claims.** No "treats", "cures", "helps with", "relieves", "for anxiety / pain / sleep", "wellness benefits". "Customers describe it as relaxing" is a report of what people say, not a claim; even that is banned in some states. When in doubt, describe aroma, flavor and potency only.
- [ ] 2. **No safety claims.** No "safe", "non-addictive", "no side effects", "natural" used to imply safety.
- [ ] 3. **No comparative claims you cannot document.** "Strongest on the shelf", "best price in town" need proof or go.
- [ ] 4. **Potency numbers match the COA.** THC, CBD, terpene percentages come from the lab report for that batch, not from the strain's reputation. Check one number against the COA.
- [ ] 5. **No appeal to minors.** No cartoons, candy look-alikes, "kid", "fun for the whole family", toy or game references. Many states also ban anything "attractive to children" by design, not just words.

## B. Required elements (check your state; these are the usual ones)

- [ ] 6. **License number** where your state requires it on ads and outbound business communication.
- [ ] 7. **Age statement** ("21+ only" or your state's medical wording) on anything public.
- [ ] 8. **State warning text** on product and promotional copy where required (impairment, pregnancy, keep away from children; exact wording varies by state).
- [ ] 9. **Audience restriction** for ads: most states require a reasonable expectation that 70% or more of the audience is 21+. Social posts count.
- [ ] 10. **No giveaways or price promotions** where your state bans them ("free", "BOGO", "discount for review").

## C. Facts (the AI part)

- [ ] 11. **Every number traces to something you pasted.** Prices, weights, dates, quantities, percentages. Open the source; find it.
- [ ] 12. **Every named thing exists.** Product names, strain names, vendor names, people. Search your catalog or contacts for each one.
- [ ] 13. **Every rule quoted is real.** If the copy says "state law requires", find the sentence in the regulation or the state's bulletin. If you cannot, cut it.
- [ ] 14. **Dates are right.** Deadlines, delivery windows, "this week". AI drafts often carry the wrong year.
- [ ] 15. **Nothing was added that you did not give it.** Read once asking only "where did this come from?" Invented prices and invented delivery promises are the most common leftovers.

## D. Voice and send

- [ ] 16. **It sounds like you.** If a sentence would not survive being read aloud to a budtender, rewrite it.
- [ ] 17. **The audience is right.** A one-pager for budtenders is not a public ad, but it will be repeated to customers, so A still applies.
- [ ] 18. **A person read it.** Anything going to the state, a customer or the public gets a human read. No exceptions, no matter how good the draft.

## Paste it into the prompt

Add this line to the end of any document prompt, then paste the checklist above it:

```
Before you give me the final text, review your draft against the checklist I pasted. List each item you changed something for, with the original and the fix. Then give the final text.
```

The model will catch most of A and some of C. It will not catch what it invented and believes. That is items 11 to 15, and that is your job.

## State rules

Advertising and labeling rules differ by state and change often. Start from the state's own site (the cannabis control agency's regulations page and its bulletins), not from a summary. Add your state's exact required warning text and license-number rule to section B and keep this file with your SOPs.

# Order intake review checklist

For the person who approves a draft order that an AI wrote from a buyer's email, text, PDF or spreadsheet. From lesson 07-03 of the No Bullshit AI Course. Version 1.0.0 (2026-09-17). CC0 1.0.

Print it, or paste it into the notes of your order form. Ninety seconds per order once you are used to it. Every line is a thing we have seen an AI get wrong.

## Before you look at the lines

- [ ] **Right customer.** The draft names a company from your list, not a company the AI typed. Same license, same ship-to. "Green Fern Oakland" and "Green Fern Berkeley" are different orders.
- [ ] **Right source.** You can see the original message next to the draft. If the draft came from a photo, the photo is legible to you too.
- [ ] **Right date.** Delivery or requested date matches what the buyer wrote. "Thursday truck" means the next Thursday, not this one if today is Thursday afternoon.
- [ ] **Status is draft.** Nothing has shipped, reserved or invoiced yet. In Distru terms the order is PENDING, which does not touch inventory.

## Every line

- [ ] **Product exists.** Each line points at one product on your menu. A line the AI marked uncertain (yellow, low confidence, "closest match") gets opened, not skimmed.
- [ ] **Size and unit.** "2 cases of gummies" became a case quantity, not 2 units. Grams vs. eaches vs. cases is the most common miss.
- [ ] **Quantity is what they wrote.** Read the number in the message, read the number in the draft. Out loud if you have to.
- [ ] **"Same as last time" was resolved to a real past order,** and that order is the one you would have picked. If the buyer has two regular orders, ask them.
- [ ] **Nothing added.** The draft has no line the buyer did not ask for. AIs like to complete a pattern.
- [ ] **Nothing dropped.** Count the lines in the message; count the lines in the draft.
- [ ] **Price is the customer's price**, not list price and not last quarter's price.
- [ ] **Stock.** Anything flagged sold out or over-available is resolved with the buyer before approval, not after.

## Before you click approve

- [ ] **Totals are plausible.** A $40,000 order from a customer who averages $4,000 gets a phone call.
- [ ] **Notes carried over.** Delivery instructions, PO numbers, "leave at the dock" landed in the order notes, not in a line item.
- [ ] **Compliance can follow.** Package-tracked items will need a transfer before the order can move to Delivering. If a line has no package to draw from, the order stays PENDING or PROCESSING.
- [ ] **Corrections recorded.** If you fixed a match, tell the tool why (Distru's order agent keeps your correction as a memory for next time). If your own pipeline has no memory, write the buyer's word and your product in a shared sheet so it stops happening.

## What approve means

You are the write gate. The AI proposed; you are the one who made it real. If anything above is unchecked, the order stays a draft and the buyer gets one question by text. That question costs thirty seconds. A wrong pallet costs a day.

## Tally (optional, once a week)

| week | drafts reviewed | approved untouched | fixed one line | fixed two or more | rejected |
|---|---|---|---|---|---|

If "approved untouched" is under half after a month, the matching needs work, not the reviewer.

# Your First Real Task: the 30-minute worksheet

From Distru's No Bullshit AI Course, lesson 01-04 (learnai.distru.com). CC0 1.0: copy, edit, share.
Version 1.0, September 2026. The standing-instructions block and the chore prompt were run in Claude Projects and a ChatGPT project against a redacted supplier price sheet and a Monday restock list; both tools accepted the block as-is.

One chore. One workspace. Three timed runs. Then a decision. Fill the blanks as you go; the whole sheet is done in 30 minutes.

## 1. Pick the chore (5 minutes)

A good first chore ticks every box:

- [ ] You do it at least weekly.
- [ ] Text goes in, text comes out (an email, a summary, a rewritten sheet, a narrative).
- [ ] You can tell in under a minute whether the output is right.
- [ ] Nothing in it is secret: no passwords, no customer IDs, no patient information. (Lesson 01-03.)
- [ ] A wrong answer costs you an edit, not a fine.

Good first chores we have seen work: the Monday restock email to a supplier; a plain-English summary of last week's returns from the returns log; rewriting a vendor's messy price sheet into your column names; turning count-sheet notes into an inventory adjustment narrative; turning a Metrc bulletin into "what changes for us, by Friday".

Bad first chores: anything where a number goes straight to the state; anything that needs your live inventory; anything with a customer's name in it.

My chore: ________________________________________________

How long it takes me by hand today (honest guess): ______ minutes

## 2. Set up the workspace once (10 minutes)

Most chat tools have a "project" feature: a saved space with standing instructions and files that load every time you open it. Create one, name it after the chore, and paste this in as the instructions. Edit every bracket.

```
You work for [company], a licensed cannabis [cultivator / distributor / retailer] in [state].
Units: weights in grams unless I say otherwise; 1 lb = 453.592 g. Dates as YYYY-MM-DD.
Our product categories, exactly as we name them: [flower, pre-rolls, vapes, edibles, ...].
Tone for anything I will send to a person: short, direct, one line of pleasantry at most.
Match the two example emails in the attached files.

Rules that always apply:
1. Use only the information I gave you. If something is missing, write MISSING instead of guessing.
2. Never state a Metrc rule, tag, price or total that is not in the material I pasted.
3. No medical, health or effect claims about any product, ever.
4. When I paste a file, tell me in one line what you think it is before you use it.
```

Attach, as files, only what the chore needs: the current price list, the SOP for this chore if you have one, and one redacted example of a good output from last time. Keep the total small; everything you attach is re-read on every message.

## 3. Run it three times (15 minutes)

Use the same prompt each time, with that week's real input. Start the clock when you open the project, stop it when you have checked the output and would actually send or use it.

```
Here is this week's [restock list / returns log / price sheet / count notes]:

[paste]

Do the [chore] exactly as the standing instructions say.
Then list, in one line each, anything you had to assume.
```

| Run | Input used | Minutes (including your checking) | Mistakes you caught | Kept the output? |
|---|---|---|---|---|
| By hand | | | | |
| 1 | | | | |
| 2 | | | | |
| 3 | | | | |

After each run, fix the standing instructions, not the prompt. If it kept getting a unit wrong, the unit rule goes in the instructions. If it kept inventing a supplier detail, add the supplier sheet as a file.

## 4. Decide (2 minutes)

- Run 3 faster than by hand, including checking: **keep it.** Write "open the [chore] project, paste the list, check the output" into your SOP.
- Run 3 about the same: **drop it.** Pick a different chore next week. This one was not the right shape.
- Run 3 slower: the chore probably has a lookup in it (a fact the AI does not have) or the output is hard to check. Both are fixable later; not this week.

The only bad outcome is running it once, being impressed, and never timing it.

# Check its work: the five-second card

Print it. Tape it next to the screen. Run it on every AI output before you send, ship, paste or upload. From Distru's No Bullshit AI Course, lesson 03-04. CC0 1.0.

Status 2026-09-17: the five checks are the manual version of the failure list in course lesson 01-02; the table at the bottom is the scripted version. No benchmark numbers. Keep a tally of what each check catches for a month and you will know which two to keep.

---

## The five checks

**1. Source.** Did I give it the thing it is talking about? If it summarized a bulletin, did I paste the bulletin? If not, the summary is from memory, and its memory has a cutoff date and no access to your state.

**2. Number.** Pick one number. Recount or recompute it by hand or in a spreadsheet. One line is enough to know whether to trust the rest. If the one you picked is wrong, check all of them or ask for the formula instead.

**3. Date.** Every date and every "this week / next Tuesday / Q3". AI drafts default to the wrong year more often than any other single mistake.

**4. Where did that come from?** Read once asking only that question. Any fact, name, price, rule or quantity you did not paste in is a guess. Find it in your material or cut it.

**5. Rerun once.** Send the same prompt again (or ask "what did you get wrong?"). If the two answers disagree on anything that matters, neither is trustworthy yet. Fix the prompt, not the answer.

## Then decide

- All five clean and it goes to a colleague: send.
- All five clean and it goes to a customer, a vendor, the state or the public: one human read, then send.
- Any check fails: fix the prompt (more material, clearer shape, the "say MISSING" line) and rerun. Do not hand-patch the output; the next run will make the same mistake.

## For the tech side (same five, made permanent)

| check | the manual version | the version a script runs every time |
|---|---|---|
| source | did I paste it? | log the prompt and its inputs next to every output (one JSON line per run) |
| number | recount one line | sum checks, row-count checks, schema validation on any structured output |
| date | read every date | regex for dates; reject any year outside the expected range |
| where from | read once for guesses | require quotes or row references in the output; fail if missing |
| rerun | send it twice | a small eval set: 10 to 20 fixed inputs with known right answers, rerun on every prompt or model change |

Spot-check rule of thumb for batches: check 10 rows of 200 at random. Zero wrong, ship. One wrong, check 30 more. Two wrong, stop and fix the prompt.

The agent version of this card, where a yes/no check runs before an AI is allowed to act, is course lesson 06-05.

# Runbook: <automation name>

One page per automation. Fill it in the day you switch the schedule on, not the day it breaks.
From Distru's No Bullshit AI Course, module 05, lesson 4. Version 1.0 (2026-09-17). CC0.

## What it does (one sentence)

> Every <when>, it <reads what> from <where> and <writes what> to <where>. Example: Every morning at 06:00 Pacific it reads today's READY_TO_SHIP orders from Distru and sets them to DELIVERING, then posts a line to #ops.

## Where it lives

| | |
|---|---|
| Runs in | n8n at `<url>` / a cron job on `<server>` / a script on `<laptop>` |
| Workflow or script name | |
| Schedule | `0 6 * * *` in `<time zone>` |
| Credentials it uses | Distru API key "<name>" (view orders, edit orders only), Slack "<name>" |
| Where the credentials are stored | n8n Credentials / 1Password vault "<name>" |
| Who owns it | <name>, backup <name> |
| Who reads the Slack channel | #ops, checked by <role> each morning |

## How to turn it off

1. Open the workflow. Toggle **Active** off. (Or: `crontab -e`, comment the line.)
2. Post in #ops: "Turned off <name> because <reason>. Doing it by hand until <date>."
3. The manual fallback is: <the by-hand steps, or a link to the SOP>.

Turning it off is always allowed. Nobody needs permission to stop an automation.

## What a good run looks like

- Slack line at ~06:01 starting with `Set N order(s) to DELIVERING`.
- N is roughly <normal range, e.g. 3 to 15>. Zero on a delivery day is suspicious.
- Execution list shows a green run under <n> seconds.

## Known failures and what to do

| you see | it means | do this |
|---|---|---|
| `FAILED to update ... 400 ... fulfilled` | the order is not ready (unfulfilled line, no customer, no transfer) | fix the order in Distru; the run does not retry, tomorrow's run will pick it up if still due |
| `401` | the API key was revoked or expired | make a new key with the same narrow permissions, update the credential, run once manually |
| `429` or `403 rateLimitExceeded` | too many calls too fast | nothing today; lower the per-run cap or widen the batch interval before tomorrow |
| No Slack line at all | the run did not happen, or Slack failed | open the executions list; if empty, check the schedule and the instance is up; if red, read the error |
| The same record twice | a write ran but the record of it was lost, then the write ran again | stop the workflow, clean up by hand, add or fix the find-before-create step |
| More than one page of results | more records matched than one run handles | run again, or add pagination |

## Rules this automation follows

- [ ] Every write is keyed on a stable id (order id, tag) and checks for an existing record first.
- [ ] Retries only on 429 and 5xx, never on 400. Retries wait between tries.
- [ ] A failed record is reported by name, in a place a human reads, the same day.
- [ ] A dry-run switch exists and is used after every change to the workflow.
- [ ] The workflow does at most <cap> writes per run.
- [ ] Nothing in it touches money, compliance or a customer without a person approving first.

## Change log

| date | who | what changed | dry run done? |
|---|---|---|---|
| | | | |

## Monthly review (first Monday, 15 minutes)

- [ ] Count runs, failures, and records touched last month. Write the three numbers here: ___ / ___ / ___
- [ ] Read one successful run end to end. Does the output still match what the sentence at the top says?
- [ ] Open the failure with the ugliest message. Does the table above cover it? If not, add a row.
- [ ] Did anyone turn it off last month? Why? Is the reason fixed?
- [ ] Are the credentials still narrow, and does the owner still work here?
- [ ] Is it still worth running? If it touched fewer than <n> records a month, consider deleting it.

# Menu Copy Rules

A compliance-first checklist for product descriptions, whether a person or an AI wrote them. From lesson 04-05 of Distru's No Bullshit AI Course. Version 1.0, 2026-09-17. CC0 1.0.

**This is not legal advice.** Advertising rules are set state by state and change. Two examples of the range: California defines a "health-related statement" broadly and prohibits false or misleading advertising, with placement and audience rules in [4 CCR §15040](https://www.law.cornell.edu/regulations/california/4-CCR-15040) and the definitions in Business and Professions Code §26150; Michigan's [R 420.507](https://www.law.cornell.edu/regulations/michigan/Mich-Admin-Code-R-420-507) bars any health-benefit claim in marketing or labeling unless it meets an FDA standard. The FDA and FTC have sent warning letters over disease claims on cannabis-derived products for years ([FDA warning letters](https://www.fda.gov/news-events/public-health-focus/warning-letters-cannabis-derived-products)). Your compliance lead reads your state's rule; this sheet is the pre-filter that keeps most of the bad sentences from ever reaching them.

## The one rule

**Describe the product. Never describe what it does to a person.**

Everything below is that sentence, spelled out.

## Forbidden patterns

Reject any description that contains, or implies, these. The regex column is what `product-data-cleanup.py` uses; edit it to match your state and your compliance lead's word list.

| Pattern | Examples that fail | Regex (case-insensitive) |
|---|---|---|
| Names a condition or symptom | pain, anxiety, insomnia, stress, nausea, inflammation, PTSD, arthritis, depression, seizures, appetite | `\b(pain|anxiety|anxious|insomnia|stress|nausea|inflammation|inflammatory|ptsd|arthritis|depress|seizure|epilep|appetite|migraine|cancer|tumou?r|glaucoma|adhd|chronic)\w*` |
| Says it helps, treats, cures, relieves | helps with, relieves, treats, cures, heals, soothes, eases, alleviates, remedy, medicine, medicinal, therapeutic | `\b(help(s|ing)? (you |with )?|reliev|treat(s|ing|ment)?\b|cur(e|es|ing)\b|heal|sooth|eas(e|es|ing) (your|the)|alleviat|remed|medicin|therapeut)` |
| Promises a feeling or effect | you will feel, guaranteed, melts away, knocks you out, energizes you, calms you, makes you | `\b(you('ll| will) feel|guarantee|melts? (away|stress)|knock(s|ed)? you|energi[sz]e(s|d)? you|calm(s|ed)? you|makes? you)` |
| Sleep and wellness as outcomes | helps you sleep, sleep aid, wellness, healthy, health | `\b(sleep aid|help(s)? you sleep|fall asleep|wellness|healthy|health)\b` |
| Safety or potency superlatives | safe, non-addictive, no side effects, strongest, most potent | `\b(safe(ly|st)?|non-?addictive|no side effects|strongest|most potent)\b` |
| Appeals to minors (most states) | candy, cartoon, kid, toy, gummy bear shapes, school | `\b(candy|cartoon|kids?|children|toy|school)\b` |
| Dosing instructions beyond the label | take two for, dose up, double | `\b(take (one|two|three|\d+) (for|to)|double (the )?dose|dose up)\b` |
| Unverified test numbers | any THC/CBD percentage not copied from the COA | (checked by hand: compare to the COA field, not by regex) |

A hit is a stop, not a suggestion. Rewrite the sentence or drop it.

## Allowed patterns

What the product *is*, from your own data:

- **Form and size**: "1g live resin cartridge", "3.5g jar of hand-trimmed flower", "ten 10mg gummies".
- **Strain, lineage, grower**: "Blue Dream, a Blueberry x Haze cross, grown indoors in Humboldt County by Acme Farms."
- **Flavor and aroma, as taste words only**: "citrus and pine on the nose, sweet on the exhale." Taste is not an effect.
- **Terpene and cannabinoid facts copied from the COA**: "Dominant terpenes: myrcene, limonene. Total THC 22.4% (batch 0426)." Copy, never round or estimate.
- **Process**: "solventless rosin pressed from fresh-frozen flower", "cold-cured", "sun-grown".
- **Category words your state allows**: check whether "indica", "sativa" and "hybrid" are fine as classification words where you are; most places they are, as long as no effect is attached ("an indica that knocks you out" fails on the second half).
- **Practical facts**: child-resistant packaging, batch date, "sold in 5-packs only".

## Words on the fence

These pass the regex but a compliance lead may still strike them. Decide once, write the decision down, add it to the regex:

`relaxing`, `uplifting`, `calming`, `euphoric`, `focus`, `creative`, `mellow`, `chill`, `nighttime`, `daytime`, `body high`, `head high`.

They describe an experience, which is a step toward describing an effect. Some states and some lawyers allow them as flavor-adjacent mood words; some do not. If you keep them, never pair them with a body part, a time of day plus a verb ("nighttime, helps you unwind"), or a condition.

## The house-rules block for an AI

Paste this above any batch of product rows you hand to a model:

```
Write product descriptions for a licensed cannabis menu in [state]. 40 to 60 words each.
Describe only the product: form, size, strain and lineage, grower, process, flavor and aroma as taste words, and terpene or cannabinoid facts copied exactly from the fields I give you.
Never say or imply what the product does to a person: no conditions, no symptoms, no "helps", "relieves", "treats", no sleep, no wellness, no "you will feel", no safety or potency superlatives, nothing that appeals to minors.
Do not invent lab numbers, awards, or origin. If a field is blank, leave it out.
Tone: [paste two descriptions you already like].
Output: one row per product, columns sku | description. Nothing else.
```

Then run every row through `product-data-cleanup.py --check-copy` before it goes anywhere near a live menu. The model will still slip one through; the regex catches the words, your compliance lead catches the meaning.

## Review log

Keep a one-line log per batch: date, how many rows, how many regex hits, how many your compliance lead struck after the regex passed. That last number is the one that tells you whether your rules are good enough yet.