Meta Museum Roadmap
This is the current, authoritative execution plan. It supersedes
development-roadmap.md(development-roadmap.md), which is retained as the legacy
pre-Next.js plan. Completed slice history lives in
progress/era-history.md(progress/era-history.md); the strict evidence checklist
lives in roadmap-to-10.md(roadmap-to-10.md); open engineering risks live in
risk-register.md(risk-register.md).
The architecture north star is
linked-art/LinkedArtSOTAWebApp.md(linked-art/LinkedArtSOTAWebApp.md). Provider,
schema, protocol, and validation work must map tests to fixture anchors in
linked-art/LinkedArtModel1.0-Reference.md(linked-art/LinkedArtModel1.0-Reference.md).
This document owns sequencing and stop/go decisions.
---
Status (as of August 6, 2026)
<!-- BEGIN:PROJECT_STATS -->
<!-- Generated by `pnpm docs:stats`; do not edit by hand. -->
| Generated project stats | Current value |
|---|---|
| Next.js | `16.2.12` |
| React | `19.2.4` |
| App page files | root homepage + `41` non-root page files (`42` total) |
| API route handlers | `149` `app/api` route handlers |
<!-- END:PROJECT_STATS -->
Executive Assessment
Meta Museum is a strong, unusually complete Linked Art product and a credible
controlled-beta system. It is not yet defensible as institution-grade or
repeatable SaaS. The gap is mostly evidence quality, operational history, and
commercial proof rather than missing core product breadth.
| Category | Score | Evidence-based assessment | Immediate implication |
|---|---:|---|---|
| Product experience | 6.5/10 for the public; 8.2/10 for museum and research users | The source-backed professional journeys are coherent, but public discovery still exposes workspace language, operational controls, and specialist navigation before establishing a reason to explore or return. | Separate the public museum from the professional workspace and build one curiosity-led discovery loop before adding more platform breadth. |
| Linked Art and data semantics | 9.0/10 | Canonical JSON-LD, event-centric modeling, rights, provenance, equivalent identities, HAL relations, IIIF, and provider boundaries are deeply implemented and test-backed. | Sustain conformance; do not add another provider until readiness work clears. |
| Evaluator and trust story | 8.4/10 | `/projects`, `/evidence`, `/datasets`, `/docs`, and machine-readable APIs make the work inspectable. The public evidence ledger currently mixes contradictory artifact baselines. | Repair proof consistency before adding more evaluator copy. |
| Accessibility | 9.3/10 | `pnpm a11y:check` passed 18 routes with 0 violations on July 12. Auth redirects for protected routes were handled as expected. | Keep zero severe violations and add accessibility checks to any hero or navigation polish. |
| Engineering architecture | 8.0/10 | Boundaries, contracts, strict TypeScript, storage abstractions, tests, and evidence automation are mature. The route and script surface is large and operationally expensive. | Prefer consolidation and owner clarity over new surface area. |
| Reproducible local quality gate | 6.5/10 | Direct ESLint passed and the local review-goals gate passed, but the audit began with a stale closeout guard, direct TypeScript failed in generated `.next/dev/types/validator.ts`, and a direct full test run did not finish within 10 minutes. | Re-establish one clean, repeatable canonical gate before feature work. |
| Documentation and governance | 8.5/10 | The docs surface is rich, agent-readable, and guarded for drift. The previous roadmap had become a completion ledger rather than a decision document. | Keep this file current and concise; send completed detail to history. |
| Operational readiness | 6.0/10 | Production preflight is 20/20 and launch review is 7/8, but long-window SLO, uptime, KPI, and artifact-coherence proof remain red. | Clear deploy-environment proof, then let time-based evidence accumulate without manufacturing results. |
| SaaS and business readiness | 5.5/10 | The managed pilot offer and tenant-aware technical foundation are credible. There is no invoice-backed pilot, repeatable onboarding, retention, or margin proof. | Sell and execute one bounded concierge pilot before building self-serve billing. |
Overall decision: **8.1/10 as a local product and portfolio case study; 5.8/10
for strict public-production readiness.** The project is safe to keep demoing and
iterating. Broad institution-grade or profitable-SaaS claims remain blocked.
The July 21 live review confirmed that the primary public journeys render without
browser console errors. The same review found that `pnpm typecheck:diagnostic`
failed in test contracts and fixtures. Those type errors are now repaired:
`pnpm typecheck:diagnostic`, 59 focused tests, `pnpm lint`, and `pnpm build` pass.
The full serial `pnpm test` run completed `1,677/1,677` tests in `157.5s` on
July 28 after stale deployment-preflight and documentation-contract expectations
were aligned with canonical evidence. `pnpm review:goals:check`
now reports `21` production-proof blockers (`0` local-refresh, `0`
deployment-environment, and `21` real-world-evidence). Completing the canonical
local test run is no longer a P0 blocker.
The July 28 timeout investigation confirmed `1,704/1,704` tests pass in 154
seconds with a compact reporter. The canonical test script now uses that
reporter to prevent captured verbose output from stalling the command channel.
August 5 quality-gate refresh: P0.2 is green again after the 24-hour closeout
guard expired. Lint passed in `19.3s`, diagnostic TypeScript in `5.4s`, the full
serial suite in `150.4s`, and the Next.js production build in `50s`. The repair
keeps intentionally untracked `data/source-repos` mirrors out of tracked-text
drift scans and anchors synthetic SLO samples to each evaluation timestamp so
the gate remains reproducible after the original June fixture window. The three
new standalone evaluator briefings are preserved in the same clean worktree.
The architecture evaluation briefing now marks the canonical-gate risk closed
and carries these measured results instead of its earlier stale warning.
Readiness Boundary
reports `status: external-evidence-required`, `local gate status: passed`, and
`strict 10/10 gate status: failed`.
launch review passes `7/8`, with the launch-review Era C dependency still red.
paid-pilot proof, retention, and gross-margin evidence.
- [ ] Strict 10/10 readiness is not green yet: `pnpm review:goals:check`
- [x] The July 10 production deployment preflight passes `20/20`; the latest
- [x] The latest strict handoff reports `0` local-refresh, `0` deployment-environment, and `21` real-world-evidence blockers, or `21` production-proof blockers in total.
- [x] The evidence ledger, readiness dashboard, Era C, long-term, launch-review, and review-goals artifacts now share the same canonical blocker, SLO, uptime, and ActivityStreams values.
- [ ] Remaining strict proof includes 30-day SLO/uptime evidence, production KPI exports, durable ActivityStreams syndication including a genuine `Delete`,
- [x] Current launch status is governed by `pnpm review:goals:check`.
- [x] `pnpm review:goals:check` must be green before broad public SaaS claims.
The allowed claim is: **local gates pass and strong external proof exists; strict
10/10 production readiness remains blocked by external evidence.**
Evaluation Findings That Change Priority
- Public evidence consistency is repaired and regression-guarded. The
canonical handoff, README, roadmap, and live ledger now agree on `21 = 0 + 3
+ 18` strict blockers. The ledger also reconciles partner confirmations with
generated ActivityStreams evidence, so its pending Delete row cannot repeat
confirmed `Create` or `Update` types as missing.
- The local gate is not yet reproducible from one clean command sequence.
The closeout guard, a malformed generated Next dev validator, and a long-running
direct test invocation obscure whether a fresh checkout is truly green.
- The product breadth is sufficient. Fourteen provider lanes, 34 pages, 146
API routes, public docs, validation, reconciliation, ActivityStreams, IIIF,
agent review, and tenant-aware pilot controls are enough for the next learning
cycle. More breadth would dilute the evidence and customer work.
- The next product-polish gain is quality, not more sections. The current
hero can enlarge a low-resolution source image, while Core Web Vitals and
primary-journey performance do not yet have a concise public baseline.
- The public product needs a distinct reason to return. Cross-provider search
is useful, but it does not yet turn the underlying data advantage into stories,
surprising discoveries, personal collections, or connections that no single
museum site can show.
---
Priority Plan
Priority is determined by trust and dependency, not by implementation novelty.
Do not start a lower tier while an actionable higher-tier exit condition is red.
Time-bound external evidence may continue accumulating in parallel.
P0 - Restore A Trustworthy Baseline (Now, 0-7 Days)
| ID | Outcome | Owner | Exit criteria | Verification |
|---|---|---|---|---|
| P0.1 | Keep public readiness evidence internally consistent. | Platform + Evidence | `/api/evidence/ledger`, `/evidence`, `/readiness`, review-goals, launch review, and the long-term artifacts agree on SLO sample/day counts, uptime, ActivityStreams observed/missing types, and current blocker scope. Fallbacks disclose missing artifacts instead of substituting incompatible values. | `tests/services/readiness-evidence-consistency.test.ts`; focused evidence-ledger, readiness, review-goals, and documentation-drift tests; `pnpm evidence:ledger:probe:check`. |
| P0.2 | Restore one clean local quality gate. | Platform | From a fresh generated state, `pnpm session:closeout:check`, `pnpm lint`, `pnpm test`, `pnpm build`, and `pnpm typecheck:diagnostic` all complete successfully. The generated `app/api/vanda/search/route.js` validator fragment is valid after regeneration, and test duration is recorded. | Run the five canonical commands and attach elapsed time plus the first failing test if any. |
| P0.3 | Clear deployment-environment proof drift. | Operations | Rerun production preflight, launch evidence, launch review, and public Era C evidence with production environment present; reduce the deployment-environment lane from `4` blockers to `0` without changing the real-world claim boundary. | `pnpm launch:preflight:production`; `pnpm launch:evidence:production`; `pnpm launch:review:production`; `pnpm era-c:exit-gate:public`; `pnpm review:goals:check`. |
| P0.4 | Preserve nightly k6 evidence artifacts. | Platform + Evidence | The Docker fallback writes `artifacts/performance/k6-slo-summary.json` as the host runner user, deletes stale summaries before each run, and fails when no fresh summary is produced. | `pnpm exec tsx --test tests/scripts/k6-slo-runner.test.ts`; confirm the next Era C workflow ingests one fresh SLO sample. |
Production database SSL drift was repaired on July 27: Vercel now uses the
existing `sslmode=verify-full` connection value, the production artifact was
redeployed, and `/api/ai/query` returned `200` through the public alias.
P0 exit gate: all local commands are reproducibly green, public evidence has no
cross-surface contradictions, and deployment-environment blockers are zero.
P1 - Convert Reliability And Demand Into Proof (Next, 1-6 Weeks)
| ID | Outcome | Owner | Exit criteria | Verification |
|---|---|---|---|---|
| P1.1 | Complete the 30-day reliability window. | Operations | One canonical source reports 30 distinct UTC days of complete passing deployed SLO samples, including the cold-record scenario, and at least 99.9% public-read uptime with failed rows aged out of the retained window. | Scheduled probes plus `pnpm longterm:evidence:public` and `pnpm era-c:exit-gate:public`. |
| P1.2 | Produce real SOTA KPI evidence. | Data + Curation | Production/Postgres or warehouse exports meet the reconciliation auto-approve and reviewed-precision thresholds; every capture row identifies its production source. | `pnpm monitoring:kpi-evidence:production`; `pnpm era-c:exit-gate:public`. |
| P1.3 | Close one invoice-backed managed pilot. | Founder + Product | One real buyer has a signed scope and invoice reference, one collection is activated within seven days, and support, required KPI, retention, and gross-margin rows are captured without placeholders. | `pnpm pilot:buyer-pack`; `pnpm pilot:activation`; `pnpm pilot:support`; `pnpm pilot:kpi`; `pnpm pilot:evidence --check`. |
The architecture evaluator now participates in the commercial pre-revenue claim control: it must disclose the absent invoice-backed pilot, remain `External evidence required`, and point to `pnpm pilot:buyer-pack` plus the tenant-scoped `pnpm pilot:evidence --check` acceptance gate. This improves the handoff but does not count outreach or local tooling as revenue proof.
August 5 ownership and operator-experience pass: the compact public mobile header and product-specific agent sign-in context are implemented and regression-tested. The operations-risk report now covers `35/35` page routes across `7` ownership/consolidation lanes alongside `61/61` API families and fully classified package-script namespaces. `pnpm ops:profile` makes the Next.js + Postgres portable baseline explicit and keeps Python services, AG2, Solr, GraphDB, and publication workers optional until their readiness gates justify enablement. The evaluator marks mobile and authentication closed while keeping broad surface area and specialist topology honestly managed rather than eliminated.
| P1.4 | Preserve honest ActivityStreams adoption. | Platform + Partnerships | Keep `3/3` real external consumers, `3/3` verified durable callbacks, and zero rejected subscriptions fresh. Add `Delete` only after a genuine upstream `404`/`410` tombstone and partner read; never synthesize it to satisfy the gate. | `pnpm providers:coverage:seed`; `pnpm activity:tombstone:scan`; `pnpm activity:subscriptions:guard`; `pnpm activity:syndication:evidence`. |
| P1.5 | Raise visible product quality and establish a performance baseline. | Product + Frontend | Home, Explore, one artwork detail, Projects, and Pilot pass mobile/desktop visual review; no hero image is rendered above a defensible intrinsic size; no text overlaps; LCP <= 2.5 s, CLS <= 0.1, and INP <= 200 ms on the agreed production profile. | Refresh public-trust screenshots, run a production performance audit, rerun `pnpm a11y:check`, and retain the metrics artifact. |
P1.5 performance checkpoint (July 28): all ten production cold-load traces pass
the agreed lab budgets. Explore mobile is the limiting LCP at `2,286 ms`, Pilot
desktop is the largest CLS at `0.0665`, and the representative interaction trace
is `28 ms`. The route matrix and profile are retained in
`docs/ops/frontend-performance-baseline.md`(ops/frontend-performance-baseline.md).
P1.5 remains open pending the mobile/desktop visual review and fresh axe run.
Step 6 remediation (July 28): the fresh axe run passes `18/18`. The two Home
blockers are fixed locally: the source band is now a normal full-width sibling
of the padded content container, and V&A IIIF services are promoted to a
1,200 px image derivative before thumbnail fallbacks. The repeated local
production-build matrix passes all ten mobile/desktop traces with 0.00 CLS, a
maximum 1,628 ms LCP, and 29 ms INP; the 18-route axe gate also remains green.
Repeat this matrix against the deployed revision to close P1.5.
Linked Art 1.1 watch checkpoint (July 28): the standalone
`linked-art-1-1-agenda-impact-tracker.html`(../public/linked-art-1-1-agenda-impact-tracker.html)
maps all 26 August 5 agenda issues to current support, expected impact, required
fixtures or schema changes, and pending community decisions. Update its decision
column and the canonical Linked Art reference ledger after the meeting before
changing validators or production mappings. Issue #637 now has an internal,
provenance-bearing
confirmed-negative reconciliation contract. It keeps curator-confirmed
non-matches separate from unresolved candidates and withholds Linked Art
projection until the community settles the property name and assertion pattern.
Issue #362 now has a provisional internal response-profile contract. Its
server-defined brief projection preserves canonical identity, marks itself
incomplete, and links deterministically to the full record; no new public
profile parameter is enabled before the community decision.
The pre-meeting implementation evidence packet now combines issues #362, #637,
and #780 with executable references and decision questions. Use it during the
August 5 discussion, then replace its pending questions with resolution links
before promoting any candidate behavior.
The machine-readable meeting decision ledger covers all 26 agenda issues.
Agenda proposals are recorded separately from outcomes; resolved rows require a
matching Linked Art issue URL, target release, and explicit local action before
they can drive post-meeting changes.
The Step 3 conformance pass now covers nine focused patterns under
`tests/fixtures/linked-art-1.1/`: qualified `AttributeAssignment` ambiguity,
inscribed `Name` evidence, `Name.created_by`, prototype-level provenance for an
unenumerated `Set`, member-side Addition and Removal, Person Joining and
Leaving, and auction selling/purchase separation.
Endpoint-family inspection now preserves the active terms-ontology inverse links
`added_member_by` and `removed_member_by`. The lifecycle fixture declares its
extension context explicitly and stays non-normative until the 1.1 meeting
decision is recorded.
The compatibility pass is now executable through
`LINKED_ART_1_1_COMPATIBILITY_BOUNDARY` and
`tests/quality/linked-art-1-1-compatibility-boundary.test.ts`. The audit keeps
six representative pending property placements rejected, leaves proposed and
deferred classes outside the endpoint map, and documents the post-meeting
promotion procedure in
`docs/linked-art/1.1-compatibility-audit.md`(linked-art/1.1-compatibility-audit.md).
P1 exit gate: 30-day reliability and production KPI rows pass, one real paid
pilot reaches first value, and strict ActivityStreams evidence is either complete
or explicitly waiting on a genuine upstream tombstone with all other rows fresh.
July 27 checkpoint: the three accepted durable callback rows are restored and
`pnpm activity:subscriptions:guard` passes `3/3`. Syndication remains honestly
blocked only on a real `Delete` activity read.
The nightly Actions environment now supplies all three production consumer IDs
to `activity:adoption:matrix`. Its production verification passed `12/12` feed
probes and resolved `3/3` declared consumers; `Delete` remains the sole missing
observed activity type.
A write-enabled July 27 tombstone scan checked 68 canonical upstream targets
across 14 provider lanes with zero errors and found no genuine `404`/`410`.
Accordingly, no `Delete` was minted; the scheduled scan must continue until a
real upstream removal can be observed and read by the three consumers.
The nightly workflow now runs the durable callback guard exactly once through
`activity:syndication:evidence`; the redundant standalone guard step was removed
without weakening its failure behavior.
Collection and readiness now have separate Actions semantics. The nightly
evidence workflow succeeds when probes and artifact generation work even if the
recorded status is red. The following `Era C Readiness Gate` workflow reports
those known external-evidence blockers without producing a failed scheduled job;
a manual dispatch remains fail-fast and owns strict Era C thresholds, durable
callback enforcement, and production launch review.
The Actions matrix now uses `actions/setup-node@v7`; execution-policy tests own
that major consistently, and runtime file metadata no longer depends on an
overload-derived Node type that can become optional in newer type packages.
Public Discovery Product Track (Next, staged behind the P0 gate)
Goal: turn Meta Museum's cross-provider data advantage into a welcoming public
museum built around curiosity, storytelling, and repeat visits. The professional
workspace remains available, but it must no longer dominate the anonymous public
journey. The defining promise is **connections no single museum website can
show**.
This track does not authorize a new provider, runtime dependency, or autonomous
publishing path. Each phase ships behind the existing rights, provenance,
accessibility, performance, citation, and human-review controls. Do not advance
when the preceding phase's measured exit condition is red.
| Phase | Outcome | Initial scope | Exit criteria | Verification |
|---|---|---|---|---|
| PD0 | Establish the public baseline and content boundary. | Record first-time task completion, artwork-to-artwork continuation, return visits, public-domain downloads, and share events. Define the minimum quality bar for public records: usable image, intelligible title/date, source, attribution, and resolved reuse message. | Baseline artifact exists; public and professional audiences, routes, vocabulary, and analytics events are explicitly separated; records below the quality bar cannot enter featured feeds. | Public-route inventory, analytics event contract, quality-filter fixtures, privacy review, and five non-specialist usability sessions. |
| PD1 | Separate the public museum from the professional workspace. | Public navigation becomes Home, Explore, Stories, Connections, My Collection, and About. Evidence, APIs, agents, imports, annotations, org status, and operational controls move behind one clearly labeled “For museums and researchers” entry point. Rewrite the homepage in plain language around art and discovery. | A first-time visitor can explain the product and reach an artwork without encountering workspace status or specialist implementation language; professional routes remain directly reachable and unchanged in capability. | Mobile and desktop visual review, keyboard pass, `pnpm a11y:check`, public-navigation tests, and moderated five-second comprehension checks. |
| PD2 | Ship the minimum delightful discovery loop. | Add `Surprise me`, a rights-safe Artwork of the Day with a stable dated URL, and public artwork pages led by image, essential facts, “Why this is interesting,” related works, and previous/next discovery. Collapse technical metadata and researcher feedback below the public story. | The complete loop works: entry point → artwork → short story → related discovery → another artwork. Featured records never have broken media or ambiguous reuse messaging. | Deterministic selection tests, record-quality tests, mobile/desktop E2E, share-preview checks, and measured artwork-to-artwork continuation. |
| PD3 | Launch Connections as the signature feature. | Start with three evidence-backed types: the same subject across cultures, works made in the same period on different continents, and recurring symbols or materials across institutions. Label documented relationships separately from algorithmic suggestions and expose sources plus confidence. | At least three curated connection journeys span two or more providers, contain no unsupported causal claims, and pass human editorial review. Visitors can move from a work to a connection and into another institution's work. | Connection contract tests, citation completeness, confidence-label checks, curator review checklist, and journey E2E. |
| PD4 | Add source-backed Stories and guided exploration. | Publish short image-led stories using reusable formats such as “One artwork, three details,” “Same year, different worlds,” “A disputed identity,” and “How an object changed hands.” Add exploration by subject, place, century, and color; add mood only as clearly labeled interpretation. Hide empty maps and timelines. | A minimum viable editorial cadence is sustainable; every factual claim resolves to a source; guided filters return useful results; empty analytical surfaces do not appear publicly. | Story-schema and citation tests, filter-quality samples, editorial review log, structured-data/share-card validation, and completion-rate measurement. |
| PD5 | Make trustworthy reuse and participation useful. | Add public-domain image download with source, rights, attribution, and metadata. Add “What changed?” with plain-language record version comparisons. Allow local-first saved collections, then optional account sync and read-only sharing after demand is observed. | Downloads package correct rights context; record changes identify source, time, and change origin; a visitor can save and share a coherent collection without being forced to sign in first. | Rights/download fixtures, version-diff tests, local-storage and account-migration tests, privacy review, and collection share E2E. |
| PD6 | Prove retention before expanding. | Evaluate artwork continuation, Surprise Me use, story completion, connection opens, downloads, collections created/shared, and 7-day return visits. Improve the strongest loop; retire or revise weak entry points. | Two consecutive measurement windows show a credible repeat-use signal and no regression in accessibility, performance, rights, or citation quality. Any further personalization or recommendation work has a measured hypothesis. | Analytics review, usability replay, public performance/a11y matrix, editorial quality audit, and a written continue/change/stop decision. |
Recommended first release: PD0 + PD1 + PD2 + three PD3 journeys. It must
demonstrate one complete public loop:
Interesting entry point → beautiful artwork → understandable source-backed
story → unexpected cross-museum connection → another discovery → save or share.
Public discovery stop conditions: pause expansion if featured-record quality
cannot be guaranteed, if connection evidence cannot support the displayed claim,
if rights context is separated from a download, if public pages regress the
agreed accessibility or performance budgets, or if measured use shows no
improvement after two iterations.
PD1 implementation checkpoint (August 6): the primary public navigation is now
Home, Explore, Stories, Connections, My Collection, About, and one quiet “For
museums and researchers” entry. Anonymous Explore and artwork journeys no longer
render organization status or professional workspace chrome, and public Explore
suppresses import prompts, roadmap language, and provider implementation notes.
The homepage now leads with cross-museum discovery in plain language; dedicated
Stories, Connections, My Collection, and professional-workspace landing pages
make every navigation destination intentional. Automated navigation, homepage,
workspace-boundary, and Explore acceptance tests are green. The local production
build passes, the 18-route accessibility matrix reports zero severe violations,
and a 375 px browser review finds no horizontal overflow. A fresh deployed visual
review and non-specialist comprehension sessions remain PD1 evidence tasks rather
than reasons to reopen its implementation scope.
PD2 implementation checkpoint (August 6): `/surprise` selects from the same
image-backed, publication-eligible local artwork pool as the homepage and sends
visitors directly into a public artwork journey. `/today` resolves to a stable
UTC-dated `/today/YYYY-MM-DD` page whose selection is deterministic for that date.
The homepage exposes both entry points. Anonymous artwork pages now lead with
“Why this is interesting,” keep facts and source detail in an expandable section,
offer previous, next, Surprise Me, and related-artwork paths, and withhold
researcher annotations and operational relationship tools. Signed-in researchers
retain the complete professional view. Selection and surface acceptance tests are
green. The production build passes, the 18-route accessibility matrix reports
zero severe violations, Surprise Me resolves into an eligible local artwork, and
homepage, daily, and artwork routes show no horizontal overflow at 375 px. A
deployed review remains necessary before promoting this local checkpoint to
production proof.
August 7 deployed checkpoint: PD1/PD2 is live on the production alias. The full
serial test suite, lint, diagnostic typecheck, local and Vercel builds,
production 18-route axe audit, 66-check crawler preview, 20/20 deployment
preflight, public Explore smoke, repeated public-trust screenshot baseline, and
zero-advisory dependency audit pass. Ten retained Lighthouse captures report
100 accessibility and 0 CLS; the desktop routes pass the LCP budget, while the
stricter Lighthouse mobile profile reports 3.7-5.9 second LCP and keeps P1.5
open for remediation and an agreed-profile recapture. The refreshed adoption
matrix passes 12/12 operator-run endpoint probes for all three named consumer
IDs and remains blocked on genuine `Delete`. Those probes do not substitute for
fresh reads made by the external consumers themselves: the retained declared
consumer reads are outside the 30-day adoption window, so Era C correctly
reports `0/3`. Production preflight is 20/20 with zero deployment-environment
failures; the remaining launch-review blockers are time-bound SLO samples and
real-world adoption/KPI evidence.
The concrete production preflight is zero-failure on deployment
`dpl_2WH2w1hrM4zftM84kn3ouU3xu4N4`. The broader `review:goals:local` roll-up now
also reports zero deployment-environment blockers: aggregate launch-review and
Era C wrappers inherit real-world-evidence scope, while concrete preflight,
auth, smoke, IIIF, and k6 failures remain deployment-scoped when present. The
remaining 21 strict blockers are explicitly time-bound or human/external
evidence rather than deployment configuration failures.
August 7 PD0/PD3 checkpoint: the five public outcome events now have a typed,
consent-gated contract that excludes direct identifiers and professional
routes. First artwork completion, artwork continuation, 24-hour return,
rights-qualified download selection, and successful share are instrumented.
A dated baseline artifact and five-session non-specialist
protocol are present, while production observation and the five human sessions
remain open. PD3 has exactly one curated journey—Flowers across two centuries—
spanning Getty and Met records with citations, a high-confidence metadata
label, an explicit no-influence boundary, contract tests, and an editorial
decision packet awaiting attributable human sign-off. Do not expand to three until this first
journey is deployed and the measurement/editorial evidence is reviewed.
August 8 cultural-intelligence checkpoint: the first journey now produces three
synchronized representations from one typed contract: a public visual story, a
research dossier exposing fact/inference labels, method, uncertainties, rejected
hypotheses, novelty status, and rights boundary, plus an evaluation-only JSON
record with the same claim/citation graph and human-review state. Consent-gated
story-completion and reuse-interest signals are instrumented outside the five PD0
outcomes. Institutional usefulness, agent/editorial minutes, independent novelty
verification, five usability sessions, and attributable editorial approval remain
external evidence gates; the one-journey expansion stop is unchanged.
The expansion gate is now executable through `pnpm connections:evidence`: its
privacy-safe artifact requires observed completion plus sharing/reuse, qualified
editorial sign-off, institutional usefulness, agent/editorial labor and cost,
independent novelty review, a real price response, and the valid synchronized
machine record. It reports tested gross value before labor separately from labor
minutes and cannot call that result profit. No real evidence has been imported,
so expansion remains unauthorized.
Internal hidden-pattern work can now proceed without violating that public gate:
`pnpm connections:patterns` emits a review-only collection-intelligence report
from normalized records plus explicit source rows. Deterministic candidates cover
equivalent-record conflicts, possible entity reconciliation, shared materials,
owner/custodian or set references, structured-provenance coverage gaps, and
geographic contrasts. Every lead carries citations, confidence, and a refusal
boundary; uncited records are rejected and unsupported demographic or market
conclusions are listed as refused analyses. No second public journey was added.
The review-only report now also consumes explicit Linked Art event evidence:
matching exhibition identifiers, `used_specific_object` groupings, structured
acquisition/transfer parts, dated event places, and shared activity actors. Its
event graph preserves source-record IDs on every edge. Geographic sequences are
movement candidates rather than transport claims; ownership histories do not
assert completeness, authenticity, custody, or legal title.
Additional explicit-evidence candidates now cover alternative maker assignments,
reversed event timespans, repeated technique identifiers, separate `represents`
and `about` iconographic concepts, and unidentified depicted people. Boundaries
prevent authorship resolution, invented corrected dates, workshop/influence
claims, collapsed depiction semantics, or demographic/underrepresentation
inference from these candidates.
The machine layer now also exposes `/api/cultural-intelligence` as a lifecycle-
aware collection feed. Each item preserves revision, production provenance,
review history, corrections, and separate editorial/licensing decisions. The
feed currently reports one evaluation item and zero licensable items; approval
metadata must be complete and all corrections resolved before eligibility can
change. Underlying source-record and media rights remain explicitly separate.
Five derivative formats now compile from the same versioned claim graph:
newsletter, daily feed, narrated visual essay, classroom package, and licensed
article. Evidence sections preserve claim/citation IDs and all formats repeat the
rights boundary. The derivative endpoint returns only an HTTP 409 release
manifest—not internal copy—while the first record lacks editorial and licensing
approval. Format availability is therefore implemented but audience demand,
quality, labor, accessibility, and price remain unproven external evidence.
Value-based pricing now has an executable evidence ladder through
`pnpm connections:pricing`: hypothesis, tested-no-signal, market signal, one
invoice-validated delivery, and repeatable price evidence. Repeatability requires
three scoped offers and two paid, accepted, value-confirmed, positive-contribution
deliveries across buyer segments. Labor is fully costed at an attributable rate;
interest is never revenue. No real offer artifact exists yet, so pricing remains
unvalidated.
The `pd0:evidence` intake command now validates a real GA4 export and moderated
session records, rejects direct identifiers or invented counts, and derives
completion only from five sessions plus attributable product-owner approval.
Its package namespace, script, artifact directory, and product-governance owner
are registered in the executable evidence-ownership and operations-risk controls.
Responsive browser review found the initial action block below the full image on
mobile; it now precedes the image and remains overflow-free at 390 px and 1440 px.
The Vercel ignore contract excludes local provider source mirrors, the `.tools`
binary cache, and the upstream `linked.art` checkout except its required schema
subtree. However, deployment `dpl_GiNFmNpo2UZs4uGEm4Y3B54Bya3b` still archived
79,077 files (669.1 MB), so CLI archive filtering remains an open packaging
optimization; the deploy itself completed and passed its runtime build.
P2 - Productize Only After The Pilot Loop Works (Later, 6-12 Weeks)
| ID | Outcome | Trigger | Exit criteria |
|---|---|---|---|
| P2.1 | Guided organization onboarding and first-value dashboard. | One invoice-backed pilot completes activation and its friction is documented. | A new managed org can be provisioned with a sample or customer dataset in under 15 minutes; progress and first value are visible without engineering inspection. |
| P2.2 | Repeatable subscriptions and usage visibility. | Pricing, support load, and gross margin are validated on at least one pilot. | Checkout or invoice-backed subscription sync, webhook/audit evidence, quotas, usage, billing state, cancellation reason, and customer portal are supportable. |
| P2.3 | Institution procurement package. | A buyer starts security/legal review. | Deployment-specific subprocessors, DPA/legal artifacts, access review, incident drill, retention controls, backup/restore proof, status reporting, and SLA/SLO packet are buyer-reviewable. |
| P2.4 | Production agent bridge decision. | A named operator accepts the review workload and risk boundary. | AG2 bridge has explicit sign-off, eval evidence, rollback, auditability, and human-publication approval. A2A/AG-UI remain deferred. |
---
Readiness Scorecards
Launch Readiness
| Lane | Score | Decision | Next evidence |
|---|---:|---|---|
| Internal development and portfolio demo | 9.0/10 | Safe to use and present with the strict-readiness caveat. | Reproduce the canonical local gate and resolve the public evidence inconsistencies. |
| Controlled public beta | 8.4/10 | Technically credible on Vercel + Neon, but the formal beta gate remains evidence-red. | Clear P0, then maintain narrow acceptance criteria while the 30-day window accumulates. |
| General public production | 6.5/10 | Do not claim complete readiness. | Passing long-window SLO/uptime, production KPI, and coherent launch evidence. |
| Institution-grade / strict 10/10 | 5.5-6.0/10 | Blocked by external and time-based proof. | `pnpm review:goals:check` passes with no production-proof blockers. |
SaaS Readiness
| Lane | Score | Decision | Next evidence |
|---|---:|---|---|
| Technical SaaS foundation | 7.0/10 | Strong enough for concierge pilots. | Prove onboarding, support load, usage, and tenant operations with one buyer. |
| Paid pilot readiness | 8.2/10 | The offer and operator path are ready; revenue proof is not. | Reply or qualified follow-up, signed scope, invoice-backed entitlement, real activation. |
| Self-serve SaaS readiness | 3.0/10 | Deferred. | Start only after the pilot validates pricing and activation friction. |
| Profitable SaaS business | 4/10 | Credible wedge, but repeatable revenue is not proven yet. | Retention, support minutes, infrastructure cost, conversion, and gross-margin evidence. |
The primary wedge remains the Managed Linked Art Launch Pilot for small and
mid-size museums, archives, galleries, digital-humanities labs, and artist estates
that need standards-compliant collection publication without a semantic-web team.
Manual invoicing is correct for the first 1-3 pilots. Creator-side provenance and
self-serve billing stay deferred until the B2B pilot loop produces evidence.
---
Evidence Workstreams
| Workstream | Current state | Completion condition |
|---|---|---|
| Local quality | Review-goals local status passes and direct ESLint passes; full canonical reproducibility was not demonstrated in the July 12 audit. | P0.2 is green from a clean generated state. |
| Deployment | Preflight `20/20`, both Render probes, all public smokes, and deployed k6 pass; launch review is `7/8`. The strict handoff has zero deployment-environment blockers because its remaining launch and Era C wrappers depend only on real-world evidence. | Preserve the green concrete deployment matrix while the real-world evidence windows mature. |
| Long-window SLO and uptime | The latest strict handoff reports `11` retained deployed SLO samples across `10/30` distinct UTC days, with `11` passing samples and no failed or incomplete rows in the active report window; the Era C artifact still reports only `15/30` samples toward its exit gate. | Continue distinct-day collection until the complete 30-day threshold is genuinely met. |
| ActivityStreams | Operator endpoint probes pass for three named IDs, but the retained real external consumer evidence is stale and therefore counts as `0/3`; genuine `Delete` evidence is pending. | Collect three fresh real external consumers covering `Create`, `Update`, and `Delete`, with verified callbacks. |
| Production KPI | Local enrichment is promising; production reconciliation distribution and reviewed precision are incomplete. | P1.2 passes the SOTA KPI acceptance rows from named production sources. |
| Managed pilot | The offer, runbook, entitlement, activation, support, and evidence tooling exist. The latest no-pricing buyer pack is specific to the recorded Te Papa outreach and has a real account, organization, and owner, but no paid-pilot tenant or invoice-backed entitlement exists. | Obtain a real buyer reply plus signed scope or invoice reference, provision the tenant, then use P1.3 tooling to record activation, retention, support load, and margin evidence. |
The buyer-review surface now includes a standalone ten-record demonstration at
`/museum-linked-art-pilot-demonstration.html`. It uses traceable public API records
to show source preservation, event-centric Linked Art JSON-LD, rights review
boundaries, validation findings, and museum questions. It proves a review pattern,
not a completed customer engagement or permission to reuse source images.
A one-page buyer brief at `/managed-linked-art-pilot-brief.html` now packages the
problem, five-day process, required inputs, deliverables, privacy and security
boundaries, and post-pilot decision into a printable pre-call handout. It links to
the ten-record demonstration and preserves the same evaluation-only claim boundary.
The first-call workflow now has a timed guide at
`/museum-pilot-discovery-call-guide.html`: a one-minute permission-based opening,
five fit questions, a boundary recap, three explicit decision paths, and a
follow-up record. The call qualifies a bounded pilot before any product tour and
links directly to the buyer brief and demonstration when supporting proof is useful.
The post-call handoff now has a public-data request at
`/museum-pilot-data-request-template.html`. It supplies a copy-ready museum message,
accepts CSV, JSON, XML, LIDO, or a public API, distinguishes minimum from optional
fields, excludes credentials and restricted material, and records the reviewer,
publication boundary, transfer method, receipt evidence, and agreed deletion date.
The conversion and delivery packet now adds a counsel-review sample agreement,
four-level introductory pricing, and a reusable results report. The public pilot
offer uses the same `$0` evaluation, `$3,500` fixed paid pilot, implementation from
`$12,000`, and ongoing service from `$1,250` monthly hypothesis, so buyer surfaces
no longer conflict. These remain unvalidated prices until invoice-backed delivery,
acceptance, retention, and gross-margin evidence exists.
The refined demonstration presents one primary path on desktop and mobile:
collection record, Linked Art mapping, validation, then reviewable result. Source
evidence is collapsed beneath the interaction, and the final state names open
museum decisions and the human publication gate.
The current outreach ledger records the eight user-confirmed August 5 submissions,
their real recipient or form channel, zero assumed replies, and August 12 follow-up
dates. `docs/sales/museum-outreach-pipeline.md` contains eight unsent follow-up
drafts plus a second official-source-researched group of eight prospects that must
remain `research_only` until first-round feedback is reviewed and sending is
authorized. `docs/ops/paid-pilot-commercial-evidence-process.md` closes the
invoice-to-margin capture design without treating placeholders as proof.
Standing Evidence Controls
`generatedAt` separate from source `sourceUpdatedAt` and `sourceUpdatedDoc`
checksum metadata.
`wikidataexplorer-metamuseum-prod` and the other real consumers distinct,
retain durable callback evidence, and preserve the zero rejected subscriptions
state without allowing placeholders to satisfy strict proof.
`pnpm longterm:evidence:public` output remain strict gates; a frontend Core Web
Vitals baseline is added in P1.5 rather than inferred from API SLO evidence.
remain separate scopes. No aggregate badge may silently promote one scope into
another.
- Public docs metadata freshness: `/api/docs/manifest` must keep response
- ActivityStreams onboarding ledger: partner rows must keep
- Performance evidence: the cold-record budget, 30-day SLO depth, and
- Claim boundary: local success, deployment success, and real-world success
---
Product And Engineering Guardrails
- Linked Art JSON-LD remains canonical; UI DTOs are projections at boundaries.
- Preserve rights, source attribution, provenance, multi-value arrays, event
semantics, carrier/content/surrogate separation, and opaque URI handling.
- Adapters do not import each other; provider parsing stays in adapters;
cross-provider mapping stays in `src/utils/artwork-builder.ts`; contracts remain
leaf modules.
- AIDD + TDD remains mandatory for behavior changes. Standards-critical work
cites reference rounds and fixture anchors before implementation.
- Public publication and agent-generated claims require citations, refusal paths,
audit evidence, and human approval.
- Keep Next.js, React, TypeScript, custom CSS, Postgres/JSONB, Solr, GraphDB, and
canonical ID decisions locked as documented in CLAUDE.md(../CLAUDE.md).
- No new runtime dependency, provider, service, database, or architecture era is
started while P0 is red without explicit approval.
Deliberately Deferred
economics and activation are real.
by measured scale or customer evidence.
- New provider integrations beyond the current 14 production lanes.
- Self-serve signup, checkout, billing portal, and growth automation before pilot
- Synthetic ActivityStreams `Delete` evidence.
- Broad production agent autonomy or public publishing without operator sign-off.
- A microservice, triple-store, vector-store, or framework expansion not justified
---
Cadence And Ownership
| Cadence | Required action |
|---|---|
| Every behavior change | Red-green-refactor tests, focused smoke/evidence, README + roadmap update, and `pnpm session:closeout`. |
| Every 72 hours during active shipping | Canonical local gate plus fresh P0 evidence checks. Stop expansion when a required gate is missing. |
| Weekly | Refresh long-window evidence, inspect failed-sample age-out dates, review pilot pipeline, and update only changed roadmap decisions. |
| Monthly or before a buyer review | Refresh production preflight, launch evidence/review, procurement packet, access/DR evidence, and the strict handoff. |
The roadmap records current decisions and measurable outcomes, not every merged
change. Completed implementation detail belongs in
progress/era-history.md(progress/era-history.md), specialized docs, generated
artifacts, and git history.
---
History And References
history, including the milestones consumed by `/api/roadmap`.
artifact handoff.
contract.
command ownership and preferred entry points.
standards rounds and fixture anchors.
architecture and SOTA acceptance criteria.
- progress/era-history.md(progress/era-history.md): full Era A, B, and C slice
- roadmap-to-10.md(roadmap-to-10.md): executable strict-readiness checklist and
- risk-register.md(risk-register.md): open engineering and operating risks.
- ops/review-goals.md(ops/review-goals.md): review-goals policy and command
- ops/evidence-script-ownership.md(ops/evidence-script-ownership.md): evidence
- linked-art/LinkedArtModel1.0-Reference.md(linked-art/LinkedArtModel1.0-Reference.md):
- linked-art/LinkedArtSOTAWebApp.md(linked-art/LinkedArtSOTAWebApp.md): target