This is the current, authoritative execution plan. It supersedes
\ndevelopment-roadmap.md(development-roadmap.md), which is retained as the legacy
\npre-Next.js plan. Completed slice history lives in
\nprogress/era-history.md(progress/era-history.md); the strict evidence checklist
\nlives in roadmap-to-10.md(roadmap-to-10.md); open engineering risks live in
\nrisk-register.md(risk-register.md).
\nThe architecture north star is
\nlinked-art/LinkedArtSOTAWebApp.md(linked-art/LinkedArtSOTAWebApp.md). Provider,
\nschema, protocol, and validation work must map tests to fixture anchors in
\nlinked-art/LinkedArtModel1.0-Reference.md(linked-art/LinkedArtModel1.0-Reference.md).
\nThis document owns sequencing and stop/go decisions.
\n---
\n<!-- BEGIN:PROJECT_STATS -->
\n<!-- Generated by `pnpm docs:stats`; do not edit by hand. -->
\n| Generated project stats | Current value |
\n|---|---|
\n| Next.js | `16.2.12` |
\n| React | `19.2.4` |
\n| App page files | root homepage + `41` non-root page files (`42` total) |
\n| API route handlers | `149` `app/api` route handlers |
\n<!-- END:PROJECT_STATS -->
\nMeta Museum is a strong, unusually complete Linked Art product and a credible
\ncontrolled-beta system. It is not yet defensible as institution-grade or
\nrepeatable SaaS. The gap is mostly evidence quality, operational history, and
\ncommercial proof rather than missing core product breadth.
\n| Category | Score | Evidence-based assessment | Immediate implication |
\n|---|---:|---|---|
\n| Product experience | 6.5/10 for the public; 8.2/10 for museum and research users | The source-backed professional journeys are coherent, but public discovery still exposes workspace language, operational controls, and specialist navigation before establishing a reason to explore or return. | Separate the public museum from the professional workspace and build one curiosity-led discovery loop before adding more platform breadth. |
\n| Linked Art and data semantics | 9.0/10 | Canonical JSON-LD, event-centric modeling, rights, provenance, equivalent identities, HAL relations, IIIF, and provider boundaries are deeply implemented and test-backed. | Sustain conformance; do not add another provider until readiness work clears. |
\n| Evaluator and trust story | 8.4/10 | `/projects`, `/evidence`, `/datasets`, `/docs`, and machine-readable APIs make the work inspectable. The public evidence ledger currently mixes contradictory artifact baselines. | Repair proof consistency before adding more evaluator copy. |
\n| Accessibility | 9.3/10 | `pnpm a11y:check` passed 18 routes with 0 violations on July 12. Auth redirects for protected routes were handled as expected. | Keep zero severe violations and add accessibility checks to any hero or navigation polish. |
\n| Engineering architecture | 8.0/10 | Boundaries, contracts, strict TypeScript, storage abstractions, tests, and evidence automation are mature. The route and script surface is large and operationally expensive. | Prefer consolidation and owner clarity over new surface area. |
\n| Reproducible local quality gate | 6.5/10 | Direct ESLint passed and the local review-goals gate passed, but the audit began with a stale closeout guard, direct TypeScript failed in generated `.next/dev/types/validator.ts`, and a direct full test run did not finish within 10 minutes. | Re-establish one clean, repeatable canonical gate before feature work. |
\n| Documentation and governance | 8.5/10 | The docs surface is rich, agent-readable, and guarded for drift. The previous roadmap had become a completion ledger rather than a decision document. | Keep this file current and concise; send completed detail to history. |
\n| Operational readiness | 6.0/10 | Production preflight is 20/20 and launch review is 7/8, but long-window SLO, uptime, KPI, and artifact-coherence proof remain red. | Clear deploy-environment proof, then let time-based evidence accumulate without manufacturing results. |
\n| SaaS and business readiness | 5.5/10 | The managed pilot offer and tenant-aware technical foundation are credible. There is no invoice-backed pilot, repeatable onboarding, retention, or margin proof. | Sell and execute one bounded concierge pilot before building self-serve billing. |
\nOverall decision: **8.1/10 as a local product and portfolio case study; 5.8/10
\nfor strict public-production readiness.** The project is safe to keep demoing and
\niterating. Broad institution-grade or profitable-SaaS claims remain blocked.
\nThe July 21 live review confirmed that the primary public journeys render without
\nbrowser console errors. The same review found that `pnpm typecheck:diagnostic`
\nfailed in test contracts and fixtures. Those type errors are now repaired:
\n`pnpm typecheck:diagnostic`, 59 focused tests, `pnpm lint`, and `pnpm build` pass.
\nThe full serial `pnpm test` run completed `1,677/1,677` tests in `157.5s` on
\nJuly 28 after stale deployment-preflight and documentation-contract expectations
\nwere aligned with canonical evidence. `pnpm review:goals:check`
\nnow reports `21` production-proof blockers (`0` local-refresh, `0`
\ndeployment-environment, and `21` real-world-evidence). Completing the canonical
\nlocal test run is no longer a P0 blocker.
\nThe July 28 timeout investigation confirmed `1,704/1,704` tests pass in 154
\nseconds with a compact reporter. The canonical test script now uses that
\nreporter to prevent captured verbose output from stalling the command channel.
\nAugust 5 quality-gate refresh: P0.2 is green again after the 24-hour closeout
\nguard expired. Lint passed in `19.3s`, diagnostic TypeScript in `5.4s`, the full
\nserial suite in `150.4s`, and the Next.js production build in `50s`. The repair
\nkeeps intentionally untracked `data/source-repos` mirrors out of tracked-text
\ndrift scans and anchors synthetic SLO samples to each evaluation timestamp so
\nthe gate remains reproducible after the original June fixture window. The three
\nnew standalone evaluator briefings are preserved in the same clean worktree.
\nThe architecture evaluation briefing now marks the canonical-gate risk closed
\nand carries these measured results instead of its earlier stale warning.
\nreports `status: external-evidence-required`, `local gate status: passed`, and
\n`strict 10/10 gate status: failed`.
\nlaunch review passes `7/8`, with the launch-review Era C dependency still red.
\npaid-pilot proof, retention, and gross-margin evidence.
\nThe allowed claim is: **local gates pass and strong external proof exists; strict
\n10/10 production readiness remains blocked by external evidence.**
\ncanonical handoff, README, roadmap, and live ledger now agree on `21 = 0 + 3
\n+ 18` strict blockers. The ledger also reconciles partner confirmations with
\ngenerated ActivityStreams evidence, so its pending Delete row cannot repeat
\nconfirmed `Create` or `Update` types as missing.
\nThe closeout guard, a malformed generated Next dev validator, and a long-running
\ndirect test invocation obscure whether a fresh checkout is truly green.
\nAPI routes, public docs, validation, reconciliation, ActivityStreams, IIIF,
\nagent review, and tenant-aware pilot controls are enough for the next learning
\ncycle. More breadth would dilute the evidence and customer work.
\nhero can enlarge a low-resolution source image, while Core Web Vitals and
\nprimary-journey performance do not yet have a concise public baseline.
\nis useful, but it does not yet turn the underlying data advantage into stories,
\nsurprising discoveries, personal collections, or connections that no single
\nmuseum site can show.
\n---
\nPriority is determined by trust and dependency, not by implementation novelty.
\nDo not start a lower tier while an actionable higher-tier exit condition is red.
\nTime-bound external evidence may continue accumulating in parallel.
\n| ID | Outcome | Owner | Exit criteria | Verification |
\n|---|---|---|---|---|
\n| P0.1 | Keep public readiness evidence internally consistent. | Platform + Evidence | `/api/evidence/ledger`, `/evidence`, `/readiness`, review-goals, launch review, and the long-term artifacts agree on SLO sample/day counts, uptime, ActivityStreams observed/missing types, and current blocker scope. Fallbacks disclose missing artifacts instead of substituting incompatible values. | `tests/services/readiness-evidence-consistency.test.ts`; focused evidence-ledger, readiness, review-goals, and documentation-drift tests; `pnpm evidence:ledger:probe:check`. |
\n| P0.2 | Restore one clean local quality gate. | Platform | From a fresh generated state, `pnpm session:closeout:check`, `pnpm lint`, `pnpm test`, `pnpm build`, and `pnpm typecheck:diagnostic` all complete successfully. The generated `app/api/vanda/search/route.js` validator fragment is valid after regeneration, and test duration is recorded. | Run the five canonical commands and attach elapsed time plus the first failing test if any. |
\n| P0.3 | Clear deployment-environment proof drift. | Operations | Rerun production preflight, launch evidence, launch review, and public Era C evidence with production environment present; reduce the deployment-environment lane from `4` blockers to `0` without changing the real-world claim boundary. | `pnpm launch:preflight:production`; `pnpm launch:evidence:production`; `pnpm launch:review:production`; `pnpm era-c:exit-gate:public`; `pnpm review:goals:check`. |
\n| P0.4 | Preserve nightly k6 evidence artifacts. | Platform + Evidence | The Docker fallback writes `artifacts/performance/k6-slo-summary.json` as the host runner user, deletes stale summaries before each run, and fails when no fresh summary is produced. | `pnpm exec tsx --test tests/scripts/k6-slo-runner.test.ts`; confirm the next Era C workflow ingests one fresh SLO sample. |
\nProduction database SSL drift was repaired on July 27: Vercel now uses the
\nexisting `sslmode=verify-full` connection value, the production artifact was
\nredeployed, and `/api/ai/query` returned `200` through the public alias.
\nP0 exit gate: all local commands are reproducibly green, public evidence has no
\ncross-surface contradictions, and deployment-environment blockers are zero.
\n| ID | Outcome | Owner | Exit criteria | Verification |
\n|---|---|---|---|---|
\n| P1.1 | Complete the 30-day reliability window. | Operations | One canonical source reports 30 distinct UTC days of complete passing deployed SLO samples, including the cold-record scenario, and at least 99.9% public-read uptime with failed rows aged out of the retained window. | Scheduled probes plus `pnpm longterm:evidence:public` and `pnpm era-c:exit-gate:public`. |
\n| P1.2 | Produce real SOTA KPI evidence. | Data + Curation | Production/Postgres or warehouse exports meet the reconciliation auto-approve and reviewed-precision thresholds; every capture row identifies its production source. | `pnpm monitoring:kpi-evidence:production`; `pnpm era-c:exit-gate:public`. |
\n| P1.3 | Close one invoice-backed managed pilot. | Founder + Product | One real buyer has a signed scope and invoice reference, one collection is activated within seven days, and support, required KPI, retention, and gross-margin rows are captured without placeholders. | `pnpm pilot:buyer-pack`; `pnpm pilot:activation`; `pnpm pilot:support`; `pnpm pilot:kpi`; `pnpm pilot:evidence --check`. |
\nThe architecture evaluator now participates in the commercial pre-revenue claim control: it must disclose the absent invoice-backed pilot, remain `External evidence required`, and point to `pnpm pilot:buyer-pack` plus the tenant-scoped `pnpm pilot:evidence --check` acceptance gate. This improves the handoff but does not count outreach or local tooling as revenue proof.
\nAugust 5 ownership and operator-experience pass: the compact public mobile header and product-specific agent sign-in context are implemented and regression-tested. The operations-risk report now covers `35/35` page routes across `7` ownership/consolidation lanes alongside `61/61` API families and fully classified package-script namespaces. `pnpm ops:profile` makes the Next.js + Postgres portable baseline explicit and keeps Python services, AG2, Solr, GraphDB, and publication workers optional until their readiness gates justify enablement. The evaluator marks mobile and authentication closed while keeping broad surface area and specialist topology honestly managed rather than eliminated.
\n| P1.4 | Preserve honest ActivityStreams adoption. | Platform + Partnerships | Keep `3/3` real external consumers, `3/3` verified durable callbacks, and zero rejected subscriptions fresh. Add `Delete` only after a genuine upstream `404`/`410` tombstone and partner read; never synthesize it to satisfy the gate. | `pnpm providers:coverage:seed`; `pnpm activity:tombstone:scan`; `pnpm activity:subscriptions:guard`; `pnpm activity:syndication:evidence`. |
\n| P1.5 | Raise visible product quality and establish a performance baseline. | Product + Frontend | Home, Explore, one artwork detail, Projects, and Pilot pass mobile/desktop visual review; no hero image is rendered above a defensible intrinsic size; no text overlaps; LCP <= 2.5 s, CLS <= 0.1, and INP <= 200 ms on the agreed production profile. | Refresh public-trust screenshots, run a production performance audit, rerun `pnpm a11y:check`, and retain the metrics artifact. |
\nP1.5 performance checkpoint (July 28): all ten production cold-load traces pass
\nthe agreed lab budgets. Explore mobile is the limiting LCP at `2,286 ms`, Pilot
\ndesktop is the largest CLS at `0.0665`, and the representative interaction trace
\nis `28 ms`. The route matrix and profile are retained in
\n`docs/ops/frontend-performance-baseline.md`(ops/frontend-performance-baseline.md).
\nP1.5 remains open pending the mobile/desktop visual review and fresh axe run.
\nStep 6 remediation (July 28): the fresh axe run passes `18/18`. The two Home
\nblockers are fixed locally: the source band is now a normal full-width sibling
\nof the padded content container, and V&A IIIF services are promoted to a
\n1,200 px image derivative before thumbnail fallbacks. The repeated local
\nproduction-build matrix passes all ten mobile/desktop traces with 0.00 CLS, a
\nmaximum 1,628 ms LCP, and 29 ms INP; the 18-route axe gate also remains green.
\nRepeat this matrix against the deployed revision to close P1.5.
\nLinked Art 1.1 watch checkpoint (July 28): the standalone
\n`linked-art-1-1-agenda-impact-tracker.html`(../public/linked-art-1-1-agenda-impact-tracker.html)
\nmaps all 26 August 5 agenda issues to current support, expected impact, required
\nfixtures or schema changes, and pending community decisions. Update its decision
\ncolumn and the canonical Linked Art reference ledger after the meeting before
\nchanging validators or production mappings. Issue #637 now has an internal,
\nprovenance-bearing
\nconfirmed-negative reconciliation contract. It keeps curator-confirmed
\nnon-matches separate from unresolved candidates and withholds Linked Art
\nprojection until the community settles the property name and assertion pattern.
\nIssue #362 now has a provisional internal response-profile contract. Its
\nserver-defined brief projection preserves canonical identity, marks itself
\nincomplete, and links deterministically to the full record; no new public
\nprofile parameter is enabled before the community decision.
\nThe pre-meeting implementation evidence packet now combines issues #362, #637,
\nand #780 with executable references and decision questions. Use it during the
\nAugust 5 discussion, then replace its pending questions with resolution links
\nbefore promoting any candidate behavior.
\nThe machine-readable meeting decision ledger covers all 26 agenda issues.
\nAgenda proposals are recorded separately from outcomes; resolved rows require a
\nmatching Linked Art issue URL, target release, and explicit local action before
\nthey can drive post-meeting changes.
\nThe Step 3 conformance pass now covers nine focused patterns under
\n`tests/fixtures/linked-art-1.1/`: qualified `AttributeAssignment` ambiguity,
\ninscribed `Name` evidence, `Name.created_by`, prototype-level provenance for an
\nunenumerated `Set`, member-side Addition and Removal, Person Joining and
\nLeaving, and auction selling/purchase separation.
\nEndpoint-family inspection now preserves the active terms-ontology inverse links
\n`added_member_by` and `removed_member_by`. The lifecycle fixture declares its
\nextension context explicitly and stays non-normative until the 1.1 meeting
\ndecision is recorded.
\nThe compatibility pass is now executable through
\n`LINKED_ART_1_1_COMPATIBILITY_BOUNDARY` and
\n`tests/quality/linked-art-1-1-compatibility-boundary.test.ts`. The audit keeps
\nsix representative pending property placements rejected, leaves proposed and
\ndeferred classes outside the endpoint map, and documents the post-meeting
\npromotion procedure in
\n`docs/linked-art/1.1-compatibility-audit.md`(linked-art/1.1-compatibility-audit.md).
\nP1 exit gate: 30-day reliability and production KPI rows pass, one real paid
\npilot reaches first value, and strict ActivityStreams evidence is either complete
\nor explicitly waiting on a genuine upstream tombstone with all other rows fresh.
\nJuly 27 checkpoint: the three accepted durable callback rows are restored and
\n`pnpm activity:subscriptions:guard` passes `3/3`. Syndication remains honestly
\nblocked only on a real `Delete` activity read.
\nThe nightly Actions environment now supplies all three production consumer IDs
\nto `activity:adoption:matrix`. Its production verification passed `12/12` feed
\nprobes and resolved `3/3` declared consumers; `Delete` remains the sole missing
\nobserved activity type.
\nA write-enabled July 27 tombstone scan checked 68 canonical upstream targets
\nacross 14 provider lanes with zero errors and found no genuine `404`/`410`.
\nAccordingly, no `Delete` was minted; the scheduled scan must continue until a
\nreal upstream removal can be observed and read by the three consumers.
\nThe nightly workflow now runs the durable callback guard exactly once through
\n`activity:syndication:evidence`; the redundant standalone guard step was removed
\nwithout weakening its failure behavior.
\nCollection and readiness now have separate Actions semantics. The nightly
\nevidence workflow succeeds when probes and artifact generation work even if the
\nrecorded status is red. The following `Era C Readiness Gate` workflow reports
\nthose known external-evidence blockers without producing a failed scheduled job;
\na manual dispatch remains fail-fast and owns strict Era C thresholds, durable
\ncallback enforcement, and production launch review.
\nThe Actions matrix now uses `actions/setup-node@v7`; execution-policy tests own
\nthat major consistently, and runtime file metadata no longer depends on an
\noverload-derived Node type that can become optional in newer type packages.
\nGoal: turn Meta Museum's cross-provider data advantage into a welcoming public
\nmuseum built around curiosity, storytelling, and repeat visits. The professional
\nworkspace remains available, but it must no longer dominate the anonymous public
\njourney. The defining promise is **connections no single museum website can
\nshow**.
\nThis track does not authorize a new provider, runtime dependency, or autonomous
\npublishing path. Each phase ships behind the existing rights, provenance,
\naccessibility, performance, citation, and human-review controls. Do not advance
\nwhen the preceding phase's measured exit condition is red.
\n| Phase | Outcome | Initial scope | Exit criteria | Verification |
\n|---|---|---|---|---|
\n| PD0 | Establish the public baseline and content boundary. | Record first-time task completion, artwork-to-artwork continuation, return visits, public-domain downloads, and share events. Define the minimum quality bar for public records: usable image, intelligible title/date, source, attribution, and resolved reuse message. | Baseline artifact exists; public and professional audiences, routes, vocabulary, and analytics events are explicitly separated; records below the quality bar cannot enter featured feeds. | Public-route inventory, analytics event contract, quality-filter fixtures, privacy review, and five non-specialist usability sessions. |
\n| PD1 | Separate the public museum from the professional workspace. | Public navigation becomes Home, Explore, Stories, Connections, My Collection, and About. Evidence, APIs, agents, imports, annotations, org status, and operational controls move behind one clearly labeled “For museums and researchers” entry point. Rewrite the homepage in plain language around art and discovery. | A first-time visitor can explain the product and reach an artwork without encountering workspace status or specialist implementation language; professional routes remain directly reachable and unchanged in capability. | Mobile and desktop visual review, keyboard pass, `pnpm a11y:check`, public-navigation tests, and moderated five-second comprehension checks. |
\n| PD2 | Ship the minimum delightful discovery loop. | Add `Surprise me`, a rights-safe Artwork of the Day with a stable dated URL, and public artwork pages led by image, essential facts, “Why this is interesting,” related works, and previous/next discovery. Collapse technical metadata and researcher feedback below the public story. | The complete loop works: entry point → artwork → short story → related discovery → another artwork. Featured records never have broken media or ambiguous reuse messaging. | Deterministic selection tests, record-quality tests, mobile/desktop E2E, share-preview checks, and measured artwork-to-artwork continuation. |
\n| PD3 | Launch Connections as the signature feature. | Start with three evidence-backed types: the same subject across cultures, works made in the same period on different continents, and recurring symbols or materials across institutions. Label documented relationships separately from algorithmic suggestions and expose sources plus confidence. | At least three curated connection journeys span two or more providers, contain no unsupported causal claims, and pass human editorial review. Visitors can move from a work to a connection and into another institution's work. | Connection contract tests, citation completeness, confidence-label checks, curator review checklist, and journey E2E. |
\n| PD4 | Add source-backed Stories and guided exploration. | Publish short image-led stories using reusable formats such as “One artwork, three details,” “Same year, different worlds,” “A disputed identity,” and “How an object changed hands.” Add exploration by subject, place, century, and color; add mood only as clearly labeled interpretation. Hide empty maps and timelines. | A minimum viable editorial cadence is sustainable; every factual claim resolves to a source; guided filters return useful results; empty analytical surfaces do not appear publicly. | Story-schema and citation tests, filter-quality samples, editorial review log, structured-data/share-card validation, and completion-rate measurement. |
\n| PD5 | Make trustworthy reuse and participation useful. | Add public-domain image download with source, rights, attribution, and metadata. Add “What changed?” with plain-language record version comparisons. Allow local-first saved collections, then optional account sync and read-only sharing after demand is observed. | Downloads package correct rights context; record changes identify source, time, and change origin; a visitor can save and share a coherent collection without being forced to sign in first. | Rights/download fixtures, version-diff tests, local-storage and account-migration tests, privacy review, and collection share E2E. |
\n| PD6 | Prove retention before expanding. | Evaluate artwork continuation, Surprise Me use, story completion, connection opens, downloads, collections created/shared, and 7-day return visits. Improve the strongest loop; retire or revise weak entry points. | Two consecutive measurement windows show a credible repeat-use signal and no regression in accessibility, performance, rights, or citation quality. Any further personalization or recommendation work has a measured hypothesis. | Analytics review, usability replay, public performance/a11y matrix, editorial quality audit, and a written continue/change/stop decision. |
\nRecommended first release: PD0 + PD1 + PD2 + three PD3 journeys. It must
\ndemonstrate one complete public loop:
\nInteresting entry point → beautiful artwork → understandable source-backed\n
story → unexpected cross-museum connection → another discovery → save or share.\n
Public discovery stop conditions: pause expansion if featured-record quality
\ncannot be guaranteed, if connection evidence cannot support the displayed claim,
\nif rights context is separated from a download, if public pages regress the
\nagreed accessibility or performance budgets, or if measured use shows no
\nimprovement after two iterations.
\nPD1 implementation checkpoint (August 6): the primary public navigation is now
\nHome, Explore, Stories, Connections, My Collection, About, and one quiet “For
\nmuseums and researchers” entry. Anonymous Explore and artwork journeys no longer
\nrender organization status or professional workspace chrome, and public Explore
\nsuppresses import prompts, roadmap language, and provider implementation notes.
\nThe homepage now leads with cross-museum discovery in plain language; dedicated
\nStories, Connections, My Collection, and professional-workspace landing pages
\nmake every navigation destination intentional. Automated navigation, homepage,
\nworkspace-boundary, and Explore acceptance tests are green. The local production
\nbuild passes, the 18-route accessibility matrix reports zero severe violations,
\nand a 375 px browser review finds no horizontal overflow. A fresh deployed visual
\nreview and non-specialist comprehension sessions remain PD1 evidence tasks rather
\nthan reasons to reopen its implementation scope.
\nPD2 implementation checkpoint (August 6): `/surprise` selects from the same
\nimage-backed, publication-eligible local artwork pool as the homepage and sends
\nvisitors directly into a public artwork journey. `/today` resolves to a stable
\nUTC-dated `/today/YYYY-MM-DD` page whose selection is deterministic for that date.
\nThe homepage exposes both entry points. Anonymous artwork pages now lead with
\n“Why this is interesting,” keep facts and source detail in an expandable section,
\noffer previous, next, Surprise Me, and related-artwork paths, and withhold
\nresearcher annotations and operational relationship tools. Signed-in researchers
\nretain the complete professional view. Selection and surface acceptance tests are
\ngreen. The production build passes, the 18-route accessibility matrix reports
\nzero severe violations, Surprise Me resolves into an eligible local artwork, and
\nhomepage, daily, and artwork routes show no horizontal overflow at 375 px. A
\ndeployed review remains necessary before promoting this local checkpoint to
\nproduction proof.
\nAugust 7 deployed checkpoint: PD1/PD2 is live on the production alias. The full
\nserial test suite, lint, diagnostic typecheck, local and Vercel builds,
\nproduction 18-route axe audit, 66-check crawler preview, 20/20 deployment
\npreflight, public Explore smoke, repeated public-trust screenshot baseline, and
\nzero-advisory dependency audit pass. Ten retained Lighthouse captures report
\n100 accessibility and 0 CLS; the desktop routes pass the LCP budget, while the
\nstricter Lighthouse mobile profile reports 3.7-5.9 second LCP and keeps P1.5
\nopen for remediation and an agreed-profile recapture. The refreshed adoption
\nmatrix passes 12/12 operator-run endpoint probes for all three named consumer
\nIDs and remains blocked on genuine `Delete`. Those probes do not substitute for
\nfresh reads made by the external consumers themselves: the retained declared
\nconsumer reads are outside the 30-day adoption window, so Era C correctly
\nreports `0/3`. Production preflight is 20/20 with zero deployment-environment
\nfailures; the remaining launch-review blockers are time-bound SLO samples and
\nreal-world adoption/KPI evidence.
\nThe concrete production preflight is zero-failure on deployment
\n`dpl_2WH2w1hrM4zftM84kn3ouU3xu4N4`. The broader `review:goals:local` roll-up now
\nalso reports zero deployment-environment blockers: aggregate launch-review and
\nEra C wrappers inherit real-world-evidence scope, while concrete preflight,
\nauth, smoke, IIIF, and k6 failures remain deployment-scoped when present. The
\nremaining 21 strict blockers are explicitly time-bound or human/external
\nevidence rather than deployment configuration failures.
\nAugust 7 PD0/PD3 checkpoint: the five public outcome events now have a typed,
\nconsent-gated contract that excludes direct identifiers and professional
\nroutes. First artwork completion, artwork continuation, 24-hour return,
\nrights-qualified download selection, and successful share are instrumented.
\nA dated baseline artifact and five-session non-specialist
\nprotocol are present, while production observation and the five human sessions
\nremain open. PD3 has exactly one curated journey—Flowers across two centuries—
\nspanning Getty and Met records with citations, a high-confidence metadata
\nlabel, an explicit no-influence boundary, contract tests, and an editorial
\ndecision packet awaiting attributable human sign-off. Do not expand to three until this first
\njourney is deployed and the measurement/editorial evidence is reviewed.
\nAugust 8 cultural-intelligence checkpoint: the first journey now produces three
\nsynchronized representations from one typed contract: a public visual story, a
\nresearch dossier exposing fact/inference labels, method, uncertainties, rejected
\nhypotheses, novelty status, and rights boundary, plus an evaluation-only JSON
\nrecord with the same claim/citation graph and human-review state. Consent-gated
\nstory-completion and reuse-interest signals are instrumented outside the five PD0
\noutcomes. Institutional usefulness, agent/editorial minutes, independent novelty
\nverification, five usability sessions, and attributable editorial approval remain
\nexternal evidence gates; the one-journey expansion stop is unchanged.
\nThe expansion gate is now executable through `pnpm connections:evidence`: its
\nprivacy-safe artifact requires observed completion plus sharing/reuse, qualified
\neditorial sign-off, institutional usefulness, agent/editorial labor and cost,
\nindependent novelty review, a real price response, and the valid synchronized
\nmachine record. It reports tested gross value before labor separately from labor
\nminutes and cannot call that result profit. No real evidence has been imported,
\nso expansion remains unauthorized.
\nInternal hidden-pattern work can now proceed without violating that public gate:
\n`pnpm connections:patterns` emits a review-only collection-intelligence report
\nfrom normalized records plus explicit source rows. Deterministic candidates cover
\nequivalent-record conflicts, possible entity reconciliation, shared materials,
\nowner/custodian or set references, structured-provenance coverage gaps, and
\ngeographic contrasts. Every lead carries citations, confidence, and a refusal
\nboundary; uncited records are rejected and unsupported demographic or market
\nconclusions are listed as refused analyses. No second public journey was added.
\nThe review-only report now also consumes explicit Linked Art event evidence:
\nmatching exhibition identifiers, `used_specific_object` groupings, structured
\nacquisition/transfer parts, dated event places, and shared activity actors. Its
\nevent graph preserves source-record IDs on every edge. Geographic sequences are
\nmovement candidates rather than transport claims; ownership histories do not
\nassert completeness, authenticity, custody, or legal title.
\nAdditional explicit-evidence candidates now cover alternative maker assignments,
\nreversed event timespans, repeated technique identifiers, separate `represents`
\nand `about` iconographic concepts, and unidentified depicted people. Boundaries
\nprevent authorship resolution, invented corrected dates, workshop/influence
\nclaims, collapsed depiction semantics, or demographic/underrepresentation
\ninference from these candidates.
\nThe machine layer now also exposes `/api/cultural-intelligence` as a lifecycle-
\naware collection feed. Each item preserves revision, production provenance,
\nreview history, corrections, and separate editorial/licensing decisions. The
\nfeed currently reports one evaluation item and zero licensable items; approval
\nmetadata must be complete and all corrections resolved before eligibility can
\nchange. Underlying source-record and media rights remain explicitly separate.
\nFive derivative formats now compile from the same versioned claim graph:
\nnewsletter, daily feed, narrated visual essay, classroom package, and licensed
\narticle. Evidence sections preserve claim/citation IDs and all formats repeat the
\nrights boundary. The derivative endpoint returns only an HTTP 409 release
\nmanifest—not internal copy—while the first record lacks editorial and licensing
\napproval. Format availability is therefore implemented but audience demand,
\nquality, labor, accessibility, and price remain unproven external evidence.
\nValue-based pricing now has an executable evidence ladder through
\n`pnpm connections:pricing`: hypothesis, tested-no-signal, market signal, one
\ninvoice-validated delivery, and repeatable price evidence. Repeatability requires
\nthree scoped offers and two paid, accepted, value-confirmed, positive-contribution
\ndeliveries across buyer segments. Labor is fully costed at an attributable rate;
\ninterest is never revenue. No real offer artifact exists yet, so pricing remains
\nunvalidated.
\nThe `pd0:evidence` intake command now validates a real GA4 export and moderated
\nsession records, rejects direct identifiers or invented counts, and derives
\ncompletion only from five sessions plus attributable product-owner approval.
\nIts package namespace, script, artifact directory, and product-governance owner
\nare registered in the executable evidence-ownership and operations-risk controls.
\nResponsive browser review found the initial action block below the full image on
\nmobile; it now precedes the image and remains overflow-free at 390 px and 1440 px.
\nThe Vercel ignore contract excludes local provider source mirrors, the `.tools`
\nbinary cache, and the upstream `linked.art` checkout except its required schema
\nsubtree. However, deployment `dpl_GiNFmNpo2UZs4uGEm4Y3B54Bya3b` still archived
\n79,077 files (669.1 MB), so CLI archive filtering remains an open packaging
\noptimization; the deploy itself completed and passed its runtime build.
\n| ID | Outcome | Trigger | Exit criteria |
\n|---|---|---|---|
\n| P2.1 | Guided organization onboarding and first-value dashboard. | One invoice-backed pilot completes activation and its friction is documented. | A new managed org can be provisioned with a sample or customer dataset in under 15 minutes; progress and first value are visible without engineering inspection. |
\n| P2.2 | Repeatable subscriptions and usage visibility. | Pricing, support load, and gross margin are validated on at least one pilot. | Checkout or invoice-backed subscription sync, webhook/audit evidence, quotas, usage, billing state, cancellation reason, and customer portal are supportable. |
\n| P2.3 | Institution procurement package. | A buyer starts security/legal review. | Deployment-specific subprocessors, DPA/legal artifacts, access review, incident drill, retention controls, backup/restore proof, status reporting, and SLA/SLO packet are buyer-reviewable. |
\n| P2.4 | Production agent bridge decision. | A named operator accepts the review workload and risk boundary. | AG2 bridge has explicit sign-off, eval evidence, rollback, auditability, and human-publication approval. A2A/AG-UI remain deferred. |
\n---
\n| Lane | Score | Decision | Next evidence |
\n|---|---:|---|---|
\n| Internal development and portfolio demo | 9.0/10 | Safe to use and present with the strict-readiness caveat. | Reproduce the canonical local gate and resolve the public evidence inconsistencies. |
\n| Controlled public beta | 8.4/10 | Technically credible on Vercel + Neon, but the formal beta gate remains evidence-red. | Clear P0, then maintain narrow acceptance criteria while the 30-day window accumulates. |
\n| General public production | 6.5/10 | Do not claim complete readiness. | Passing long-window SLO/uptime, production KPI, and coherent launch evidence. |
\n| Institution-grade / strict 10/10 | 5.5-6.0/10 | Blocked by external and time-based proof. | `pnpm review:goals:check` passes with no production-proof blockers. |
\n| Lane | Score | Decision | Next evidence |
\n|---|---:|---|---|
\n| Technical SaaS foundation | 7.0/10 | Strong enough for concierge pilots. | Prove onboarding, support load, usage, and tenant operations with one buyer. |
\n| Paid pilot readiness | 8.2/10 | The offer and operator path are ready; revenue proof is not. | Reply or qualified follow-up, signed scope, invoice-backed entitlement, real activation. |
\n| Self-serve SaaS readiness | 3.0/10 | Deferred. | Start only after the pilot validates pricing and activation friction. |
\n| Profitable SaaS business | 4/10 | Credible wedge, but repeatable revenue is not proven yet. | Retention, support minutes, infrastructure cost, conversion, and gross-margin evidence. |
\nThe primary wedge remains the Managed Linked Art Launch Pilot for small and
\nmid-size museums, archives, galleries, digital-humanities labs, and artist estates
\nthat need standards-compliant collection publication without a semantic-web team.
\nManual invoicing is correct for the first 1-3 pilots. Creator-side provenance and
\nself-serve billing stay deferred until the B2B pilot loop produces evidence.
\n---
\n| Workstream | Current state | Completion condition |
\n|---|---|---|
\n| Local quality | Review-goals local status passes and direct ESLint passes; full canonical reproducibility was not demonstrated in the July 12 audit. | P0.2 is green from a clean generated state. |
\n| Deployment | Preflight `20/20`, both Render probes, all public smokes, and deployed k6 pass; launch review is `7/8`. The strict handoff has zero deployment-environment blockers because its remaining launch and Era C wrappers depend only on real-world evidence. | Preserve the green concrete deployment matrix while the real-world evidence windows mature. |
\n| Long-window SLO and uptime | The latest strict handoff reports `11` retained deployed SLO samples across `10/30` distinct UTC days, with `11` passing samples and no failed or incomplete rows in the active report window; the Era C artifact still reports only `15/30` samples toward its exit gate. | Continue distinct-day collection until the complete 30-day threshold is genuinely met. |
\n| ActivityStreams | Operator endpoint probes pass for three named IDs, but the retained real external consumer evidence is stale and therefore counts as `0/3`; genuine `Delete` evidence is pending. | Collect three fresh real external consumers covering `Create`, `Update`, and `Delete`, with verified callbacks. |
\n| Production KPI | Local enrichment is promising; production reconciliation distribution and reviewed precision are incomplete. | P1.2 passes the SOTA KPI acceptance rows from named production sources. |
\n| Managed pilot | The offer, runbook, entitlement, activation, support, and evidence tooling exist. The latest no-pricing buyer pack is specific to the recorded Te Papa outreach and has a real account, organization, and owner, but no paid-pilot tenant or invoice-backed entitlement exists. | Obtain a real buyer reply plus signed scope or invoice reference, provision the tenant, then use P1.3 tooling to record activation, retention, support load, and margin evidence. |
\nThe buyer-review surface now includes a standalone ten-record demonstration at
\n`/museum-linked-art-pilot-demonstration.html`. It uses traceable public API records
\nto show source preservation, event-centric Linked Art JSON-LD, rights review
\nboundaries, validation findings, and museum questions. It proves a review pattern,
\nnot a completed customer engagement or permission to reuse source images.
\nA one-page buyer brief at `/managed-linked-art-pilot-brief.html` now packages the
\nproblem, five-day process, required inputs, deliverables, privacy and security
\nboundaries, and post-pilot decision into a printable pre-call handout. It links to
\nthe ten-record demonstration and preserves the same evaluation-only claim boundary.
\nThe first-call workflow now has a timed guide at
\n`/museum-pilot-discovery-call-guide.html`: a one-minute permission-based opening,
\nfive fit questions, a boundary recap, three explicit decision paths, and a
\nfollow-up record. The call qualifies a bounded pilot before any product tour and
\nlinks directly to the buyer brief and demonstration when supporting proof is useful.
\nThe post-call handoff now has a public-data request at
\n`/museum-pilot-data-request-template.html`. It supplies a copy-ready museum message,
\naccepts CSV, JSON, XML, LIDO, or a public API, distinguishes minimum from optional
\nfields, excludes credentials and restricted material, and records the reviewer,
\npublication boundary, transfer method, receipt evidence, and agreed deletion date.
\nThe conversion and delivery packet now adds a counsel-review sample agreement,
\nfour-level introductory pricing, and a reusable results report. The public pilot
\noffer uses the same `$0` evaluation, `$3,500` fixed paid pilot, implementation from
\n`$12,000`, and ongoing service from `$1,250` monthly hypothesis, so buyer surfaces
\nno longer conflict. These remain unvalidated prices until invoice-backed delivery,
\nacceptance, retention, and gross-margin evidence exists.
\nThe refined demonstration presents one primary path on desktop and mobile:
\ncollection record, Linked Art mapping, validation, then reviewable result. Source
\nevidence is collapsed beneath the interaction, and the final state names open
\nmuseum decisions and the human publication gate.
\nThe current outreach ledger records the eight user-confirmed August 5 submissions,
\ntheir real recipient or form channel, zero assumed replies, and August 12 follow-up
\ndates. `docs/sales/museum-outreach-pipeline.md` contains eight unsent follow-up
\ndrafts plus a second official-source-researched group of eight prospects that must
\nremain `research_only` until first-round feedback is reviewed and sending is
\nauthorized. `docs/ops/paid-pilot-commercial-evidence-process.md` closes the
\ninvoice-to-margin capture design without treating placeholders as proof.
\n`generatedAt` separate from source `sourceUpdatedAt` and `sourceUpdatedDoc`
\nchecksum metadata.
\n`wikidataexplorer-metamuseum-prod` and the other real consumers distinct,
\nretain durable callback evidence, and preserve the zero rejected subscriptions
\nstate without allowing placeholders to satisfy strict proof.
\n`pnpm longterm:evidence:public` output remain strict gates; a frontend Core Web
\nVitals baseline is added in P1.5 rather than inferred from API SLO evidence.
\nremain separate scopes. No aggregate badge may silently promote one scope into
\nanother.
\n---
\nsemantics, carrier/content/surrogate separation, and opaque URI handling.
\ncross-provider mapping stays in `src/utils/artwork-builder.ts`; contracts remain
\nleaf modules.
\ncites reference rounds and fixture anchors before implementation.
\naudit evidence, and human approval.
\ncanonical ID decisions locked as documented in CLAUDE.md(../CLAUDE.md).
\nstarted while P0 is red without explicit approval.
\neconomics and activation are real.
\nby measured scale or customer evidence.
\n---
\n| Cadence | Required action |
\n|---|---|
\n| Every behavior change | Red-green-refactor tests, focused smoke/evidence, README + roadmap update, and `pnpm session:closeout`. |
\n| Every 72 hours during active shipping | Canonical local gate plus fresh P0 evidence checks. Stop expansion when a required gate is missing. |
\n| Weekly | Refresh long-window evidence, inspect failed-sample age-out dates, review pilot pipeline, and update only changed roadmap decisions. |
\n| Monthly or before a buyer review | Refresh production preflight, launch evidence/review, procurement packet, access/DR evidence, and the strict handoff. |
\nThe roadmap records current decisions and measurable outcomes, not every merged
\nchange. Completed implementation detail belongs in
\nprogress/era-history.md(progress/era-history.md), specialized docs, generated
\nartifacts, and git history.
\n---
\nhistory, including the milestones consumed by `/api/roadmap`.
\nartifact handoff.
\ncontract.
\ncommand ownership and preferred entry points.
\nstandards rounds and fixture anchors.
\narchitecture and SOTA acceptance criteria.
\n