Roadmap to 10/10

Last refreshed: 2026-07-11

This file tracks the remaining work to make Meta Museum defensibly 10/10 for

public production readiness, portfolio review, and Linked Art credibility. The

source of truth is `pnpm review:goals:check`; this page explains the blocker

lanes in human terms.

Current Score Snapshot

| Dimension | Current honest score | 10/10 condition |

|---|---:|---|

| Live public deploy readiness | 7.5/10 | `pnpm review:goals:check` passes with no local-refresh, deployment-environment, or real-world evidence blockers. |

| Job portfolio project | 9.2/10 | Public story is concise, evidence is fresh, demo media is recorded and linked, and dependency/audit messaging is accurate. |

| Linked Art implementation credibility | 9/10 | Local conformance stays green and production evidence proves the same behavior under live traffic. |

| Repeatable SaaS readiness | 4.5/10 | At least one invoice-backed pilot proves onboarding, support load, KPI, retention, billing, and gross-margin evidence. |

Current gate result:

• `pnpm docs:stats:check` passes.
• `pnpm review:goals:check` fails with `status: external-evidence-required`.
• Local gate status is `passed`.
• Strict 10/10 gate status is `failed`.
• Remaining blockers after the latest strict review-goals audit: GitHub CI is green, the July 4 production preflight artifact passes `20/20`, the rotated Neon credential is active in the current Vercel production deployment, the refreshed production launch-evidence packet passes `8/9`, and launch review passes `7/8`. The Te Papa web-form outreach is recorded as sent on July 4, 2026 at 11:30 AM Pacific; MetaHistoryBook, Daily (`daily-metahistorybook-prod`), and Wikidata Explorer are now `3/3` real external ActivityStreams consumers; durable callback rows are restored in `storage/activity-subscriptions.json`, including MetaHistoryBook's signed production `204` callback proof. Strict production proof is still blocked by deployment, Era C, and real-world evidence: `0` local-refresh blockers, `4` deployment-environment blockers, and `19` real-world-evidence blockers for deployed Render service probes, pilots, support-load proof after real pilot activity, 30-day SLO/uptime, ActivityStreams `Delete` type coverage, KPI, retention, and gross-margin proof.
• Blocked goals: launch readiness, Render service probes, managed pilot evidence, 30-day SLO/uptime, and ActivityStreams syndication.

Latest strict handoff snapshot:

• `23` production-proof blockers remain across `5` blocked goals.
• `12` next actions remain, covering `11` distinct commands, `16` artifact targets, and `22` distinct evidence requirements.
• Deployment-environment lane: `4` blockers, `4` next actions, `4` commands, `4` artifact targets.
• Real-world-evidence lane: `19` blockers, `8` next actions, `8` commands, `13` artifact targets.

Already 10/10-Caliber Foundation

The old June 24 checklist is now foundation work, not the remaining blocker

list. These tracks remain important and should stay guarded by tests and CI:

• Reliable CI, generated stats, closeout checks, and documentation drift tests.
• 1,100+ `node:test` coverage with strict TypeScript and production build checks.
• Linked Art `Right` entities, SHACL gate, generated conformance matrix, faceted search, ActivityStreams 2.0 shape, `HEAD`/`OPTIONS`, CORS, and HTTP/2.
• Public trust smoke, crawler preview, a11y, explore smoke, launch review, and preflight artifact machinery.
• Vercel + Neon + Render topology, secured cron drains, and worker visibility.
• Executable AI agent safety controls for editor-gated agent/model routes, anonymous paid-model downgrade, cite-or-refuse gates, human approval defaults, and opt-in AG2 bridge drills.

Track A - Clear Deployment-Environment Blockers

Goal: make launch readiness green before relying on long-running evidence.

`pnpm launch:preflight:production`.

`pnpm launch:evidence:production`.

`pnpm launch:preflight:production`.

`pnpm k6:slo`.

`pnpm launch:review:production`.

• [x] Re-run production preflight from a production-env shell until it passes:
• [x] Ensure current production evidence resolves storage as Postgres, not local file mode.
• [x] Ensure the current `DATABASE_URL` evidence shows `sslmode=verify-full`.
• [x] Remove production test-role override evidence; keep researcher smoke tokens in staging only.
• [x] Run a Postgres restore rehearsal that satisfies the DR drill check in the same evidence packet.
• [x] Verify Render validation/reconciliation service health probes through public HTTPS URLs in the current packet.
• [x] Refresh production launch evidence for preflight, security/DR, public trust, crawler preview, a11y, public explore smoke, k6, Era C, and launch review:
• [x] Refresh production preflight after the secret-rotation/history selected checks landed:
• [x] Add explicit-env production preflight mode with `METAMUSEUM_SKIP_ENV_FILES=1` so local `.env*` staging secrets cannot contaminate the launch artifact.
• [x] Keep strict `/api/validate` closed by default in production unless `METAMUSEUM_STRICT_VALIDATION_PUBLIC=1` is set; when public strict validation is enabled, preflight still requires paid/no-sleep Render capacity.
• [x] Collect an initial passing deployed k6 SLO sample and trend evidence; the standalone deployed run passed cached record hit (`66.30ms` p95), cold record read (`267.60ms` p95), keyword facet search (`63.17ms` p95), SPARQL (`252.22ms` p95), and IIIF tile (`75.88ms` p95) thresholds. Shipped mitigations: anonymous public record-detail requests skip auth/session scope lookup, public unscoped record-detail and search hits emit short-lived shared cache headers while tenant/org reads remain `no-store`, cached reads use an id index, Postgres-backed cache-miss detail reads use direct JSONB by-id lookup instead of loading the full managed records document, read-only direct lookups skip storage schema setup, direct by-id misses populate a per-id in-process cache, deployed reads use an indexed Postgres JSON-array item projection (`storage_json_array_items`), hot record-by-id reads skip the `storage_documents` freshness join, transactional record writes refresh that projection, direct managed-record reads skip redundant runtime migration, and indexed reads skip normal-path projection-table DDL checks while still self-healing on a missing-table error.
• [x] Deploy and prove the current SLO stabilization candidate: anonymous public record-detail responses now use a Next shared data-cache wrapper keyed by record ID and tag-invalidated on public writes, then continue to schedule a deduped background record-cache warm from the indexed Postgres array projection. Only the default public records file gets a 120-second in-process cache TTL, scoped/org caches keep the 30-second default, and public file-extension assets such as `/icon.jpg` skip Proxy so Vercel can serve them as plain static CDN assets without locale/auth cookie work. Multiple post-deploy k6 repeats passed every threshold; the newest sample measured cached record hit (`78.03ms` p95), cold record read (`169.38ms`), keyword facet search (`80.20ms`), SPARQL (`245.08ms`), and IIIF/static (`61.64ms`), all with 0% scenario failures.
• [x] Deploy and re-prove live public record reachability after the rotated Vercel `DATABASE_URL`; production preflight now records `/api/records` as `200`, while focused tests continue to keep the unscoped public seed-read fallback fail-open only for public reads and scoped org/tenant storage fail-closed.
• [x] Re-run launch review after live records, k6, a11y, public-trust, and Era C evidence are current:

Latest evidence, 2026-07-04:

• `pnpm storage:export:postgres` exported the managed document set into Postgres.
• The July 4 explicit-env `pnpm launch:preflight:production` artifact passes `20/20`. It proves Postgres storage shape, `sslmode=verify-full`, live Neon authentication, active Vercel deployment freshness after the recorded secret rotation, auth route reachability, public base/social URL parity, public-read reachability, validation and reconciliation Render `/health` probes, no production smoke override token, IIIF tile reachability, selected `security.secretRotation` plus `security.secretHistory` rows, and operator-only strict-validation posture. Strict `/api/validate` remains closed by default in production unless `METAMUSEUM_STRICT_VALIDATION_PUBLIC=1` is set; if public strict validation is enabled, preflight again requires paid/no-sleep capacity and a within-budget health probe.
• The latest full `pnpm launch:evidence:production` artifact is refreshed and passes `8/9`: hardening security/DR, deployment preflight, public-trust smoke, crawler preview, a11y, explore matrix, deployed k6 SLO, and Era C artifact generation all pass. The only failing step is final launch review because Era C policy thresholds are still not met.
• Local and production mitigation are both represented now: unscoped `loadSeed: true` record reads return bundled seed data if managed storage cannot persist the seed, scoped org/tenant reads still reject on storage failure, anonymous public reads bypass Auth.js and pilot-ledger lookups unless scoped context is present, focused route/service tests cover those branches, and the July 4 production preflight proves the active live `/api/records` path returns `200`.
• `pnpm launch:review:production` is refreshed and passes `7/8`. Deployment preflight, hardening audit, DR drill, public trust, crawler preview, a11y, and explore smoke rows pass; the single remaining launch-review failure is `evidence.eraCExitGate`.

Done when: the launch-readiness goal no longer appears in

`blockedByExternalEvidenceGoals`, and the Era C row has enough real production

evidence for deployment-environment blocker count `0`.

Track B - Prove 30-Day Reliability and SLO Evidence

Goal: convert "good demo" into measured public production reliability.

`pnpm monitoring:telemetry:public`, `pnpm era-c:exit-gate:public`, and `pnpm longterm:evidence:public`; the long-term public command now emits both runway and maintenance artifacts.

• [x] Keep scheduled public-read probes running against `https://www.metamuseum.org`: the nightly Era C evidence workflow defaults `METAMUSEUM_PUBLIC_READ_BASE_URL` to the production public URL and runs `pnpm era-c:exit-gate:public`, which requires probe-backed uptime evidence before writing the Era C packet.
• [ ] Retain 30 distinct days of uptime evidence with at least 99.9% availability.
• [ ] Retain 30 complete deployed SLO samples.
• [x] Persist compact nightly evidence inputs back to `main` so k6 trend and public-read uptime history accumulate across scheduled workflow runs instead of living only as transient GitHub Actions artifacts.
• [ ] Retain or replace enough samples so the 30-day SLO window contains complete passing five-scenario evidence; the latest public runway reports `20/30` retained deployed SLO samples across `7/30` observed UTC days, with `13/30` passing samples across `6/30` passing days and `7` failed/incomplete retained rows. SLO trend intake now reports `23` raw timestamped rows, `20` inside the current report window, and `3` older than the window. Daily sample-depth evidence is ready no earlier than `2026-07-29T09:15:00.000Z` if every future sample passes. Collect 30 complete passing deployed k6 SLO samples across 30 distinct UTC days.
• [x] Carry maintenance precision into strict review-goals handoffs: `pnpm review:goals:local` now reports retained-vs-passing SLO samples, failed/incomplete retained rows, distinct SLO and uptime days, uptime availability, and missing ActivityStreams activity types while preserving the local-green/strict-red boundary.
• [x] Add a manual public telemetry command that bypasses local `.env.local` base URLs: `pnpm monitoring:telemetry:public` runs `scripts/monitoring-telemetry-sync.ts --probe-base-url=https://www.metamuseum.org --require-probe`, and `pnpm era-c:exit-gate:public` uses that snapshot before writing the Era C artifact.
• [x] Add read-only long-window maintenance diagnostics: `pnpm longterm:evidence:maintenance` writes `artifacts/long-term-evidence/long-term-evidence-maintenance-latest.md`/`.json` with failed SLO samples, failed uptime probe paths, grouped repair-queue rows by SLO metric and uptime path, passing distinct days, per-failed-sample age-out dates, earliest failure-free window date, remaining external consumer count, and acceptance rows for SLO depth, SLO failure-free status, uptime depth, uptime availability, ActivityStreams consumer depth, activity-type coverage, and strict long-term packet refresh.
• [x] Make failed-sample aging and SLO trend intake explicit in the runway: the July 5 maintenance artifact now shows the retained failed SLO/uptime samples aging out no later than `2026-07-28T20:28:03.851Z`, with SLO trend rows split into raw, timestamped, inside-window, older-than-window, and newer-than-report counts. Daily sample-depth evidence is ready no earlier than `2026-07-29T09:15:00.000Z` if every future sample passes and external adoption evidence is satisfied.
• [x] Publish the maintenance report in nightly Era C evidence automation so the repair view is committed and uploaded with the rolling runway instead of relying on local-only diagnostics.
• [ ] Retain a clean public-read uptime window; the latest maintenance report counts `111/114` passing public-read checks across `8/30` observed UTC days, with `0.9737` availability against the `0.999` target.
• [x] Add operator-safe SOTA §26 KPI evidence export commands: `pnpm monitoring:kpi-evidence` writes `monitoring/kpi-evidence.json` from current record-enrichment and reconciliation distribution counts, while `pnpm monitoring:kpi-evidence:production` requires Postgres storage before writing production-labeled source metadata. Both accept real reviewed/accepted auto-link counts only when supplied together and require `--reviewed-precision-source` before reviewed precision can count. The export now counts unique recognized authority references for the enrichment KPI, carries acceptance rows for production record export, enrichment denominator, production reconciliation export, reviewed precision counts/source, and Era C refresh readiness, a capped `diagnostics.evidenceNeeds.enrichment.sampleRecordGaps[]` repair sample for under-enriched record IDs with existing recognized authority URIs and suggested Linked Art fields, `diagnostics.capturePlan.rows[]` for the production record-enrichment, reconciliation distribution, reviewed precision, and strict-refresh fields/operators must capture, and `diagnostics.handoffSummary` with ready-row counts, metric blocker count, source-shape next evidence, and `nextMetricCommand`/`nextMetricEvidenceNeeded` for the first KPI threshold blocker.
• [ ] Export real production KPI evidence for SOTA section 26 thresholds with `pnpm monitoring:kpi-evidence:production`, then rerun telemetry and Era C gates.
• [ ] Re-run:

Done when: 30-day SLO/uptime and Era C exit-gate rows are green, with no

selected `collecting`, `blocked`, `missing`, or `fail` checks.

Track C - Prove ActivityStreams Syndication

Goal: show that the feed is not merely conformant, but adopted externally.

Use `docs/ops/external-evidence-request-pack.md`(ops/external-evidence-request-pack.md) for the partner request, declared consumer check, durable subscription payload, and verification commands.

`pnpm activity:subscription:verify` for each real callback proof, then `pnpm activity:syndication:evidence`.

• [ ] Onboard 3 real external consumers for `/api/activity`.
• [x] Generate a partner-specific ActivityStreams onboarding handoff with `pnpm activity:partner-pack`; generated packs stay honest-blocked until real partner-owned IDs complete the feed-read, activity-type coverage, durable-subscription, callback-verification, and strict-gate-refresh rows. The no-ID pack carries three placeholder outreach slots, copy-ready partner outreach text, partner response templates, and structured per-consumer acceptance rows while keeping placeholder rows as `pending-consumer-id` and `consumerIds: []`, so they cannot count as external adoption evidence.
• [x] Add community outreach capture for broad Linked Art/Slack asks: `pnpm activity:community-outreach` records channel, message reference, posted timestamp, and owner while keeping `strictEvidence: false` until real partner-owned consumer IDs, feed-read telemetry, and callback verification arrive; `/readiness` surfaces those acceptance rows as outreach context without counting them as strict adoption proof.
• [x] Add ActivityStreams adoption controls: `src/services/activitystreams-adoption-controls.ts` and `tests/services/activitystreams-adoption-controls.test.ts` keep `/api/activity`, `/api/activity/collection`, and `/api/activity/page/{page}` feed-read telemetry, partner-pack rows, durable callback verification, review-goals selected checks, and placeholder/derived/local evidence rejection executable while strict adoption remains blocked. The latest tracked syndication artifact records `metahistorybook-harvester-prod`, `daily-metahistorybook-prod`, and `wikidataexplorer-metamuseum-prod` as `3/3` real external consumers, observed `Create` and `Update`, missing `Delete`, and restored `3/3` durable callback rows.
• [ ] Ensure each consumer has a declared external ID and recent read evidence.
• [ ] Register durable HTTPS callback subscriptions for those same consumers.
• [x] Add an operator-safe callback verification writer: `pnpm activity:subscription:verify` records recent 2xx callback evidence into `storage/activity-subscriptions.json` without hand-editing and rejects placeholder evidence refs.
• [x] Initialize the durable subscription ledger in the syndication evidence command: `pnpm activity:syndication:evidence` creates an empty `storage/activity-subscriptions.json` when absent and reports `subscription ledger: 0 row(s)`, keeping operator state explicit without counting empty rows as proof.
• [x] Restore recent 2xx callback verification evidence for each accepted subscription; Daily, Wikidata Explorer, and MetaHistoryBook have accepted durable callback rows again in `storage/activity-subscriptions.json`.
• [x] Guard the durable callback ledger: `pnpm activity:subscriptions:guard` now validates the three accepted partner callback subscriptions, public HTTPS callback URLs, `Create`/`Update`/`Delete` event coverage, recent 2xx verification, and real callback proof artifact refs; it runs as part of `pnpm activity:syndication:evidence` and in the nightly Era C workflow.
• [x] Record MetaHistoryBook's post-callback alignment: they rechecked `type=Update` and `type=Delete` as explicit zeroes, MetaMuseum independently observed `totalItems: 0` for both at `2026-07-05T17:21:34Z`, and their reader is ready to re-read once real reviewed update and upstream `404`/`410` tombstone rows deploy.
• [x] Add feed-read activity-type telemetry and evidence checks: `/api/activity` records each declared consumer's observed `Create`/`Update`/`Delete` types, and `pnpm activity:syndication:evidence` blocks when type coverage is incomplete.
• [x] Surface observed/missing activity-type coverage in `pnpm activity:adoption:matrix`, `pnpm longterm:evidence`, and `pnpm longterm:evidence:maintenance` so long-window reports cannot hide missing `Create`/`Update`/`Delete` evidence behind consumer counts.
• [x] Add honest source-event paths for missing activity types: existing-record POSTs now audit as `record.update` so reviewed metadata corrections can emit `Update`, and `pnpm activity:tombstone:evidence` writes `Delete` tombstone rows only with real upstream `404`/`410` evidence refs.
• [ ] Collect real partner feed-read evidence covering `Create`, `Update`, and `Delete` activity types.
• [ ] Re-run:

Done when: both selected rows pass: `activity.declaredConsumers` and

`activity.durableSubscriptions`, with the durable row backed by accepted

subscriptions that include verified callback evidence.

Track D - Prove Managed Pilot Evidence

Goal: make the SaaS/pilot claim real, not just well scaffolded.

Use `docs/ops/external-evidence-request-pack.md`(ops/external-evidence-request-pack.md) for the first-outreach ask, evidence commands, and monthly packet checklist.

`pnpm pilot:buyer-pack`, `pnpm pilot:outreach`, `pnpm pilot:activation`, `pnpm pilot:support`, `pnpm pilot:kpi`, and `pnpm pilot:evidence`.

• [x] Send and record first outreach for at least one named account: Te Papa web-form outreach is recorded at `2026-07-04T18:30:00.000Z` with `1` sent and `0` replies; this is outreach evidence only, not paid-pilot, invoice, activation, KPI, retention, or gross-margin proof.
• [x] Generate a buyer-specific pilot capture handoff with `pnpm pilot:buyer-pack`; the current latest pack is honest-blocked until real account, tenant, organization, owner, and invoice reference fields are supplied, and every run now leaves a timestamped `artifacts/pilot-evidence/runs/pilot-buyer-onboarding-pack-<timestamp>.json` audit copy. Even the no-buyer pack carries copy-ready buyer outreach text, a buyer response template, and `pending-buyer-evidence` acceptance rows for outreach, invoice-backed entitlement, activation, support, required KPIs, retention signal, gross-margin proof, and strict packet refresh; the support-load row now verifies through `pnpm pilot:support -- --tenant <tenant-id> --summary` so support evidence is not hidden behind the broader packet command. These rows are capture tasks, not paid-pilot proof.
• [x] Add commercial readiness controls: `src/services/commercial-readiness-controls.ts` and `tests/services/commercial-readiness-controls.test.ts` keep the pre-revenue claim boundary, buyer-pack ledger, invoice entitlement guard, monthly KPI/retention/margin packet, and manual-vs-subscription packaging gate executable while real paid-pilot proof remains absent.
• [ ] Record an active manual pilot entitlement with a real invoice reference.
• [ ] Execute one real pilot dataset through the runbook.
• [ ] Record activation milestones with dated tenant-specific evidence.
• [ ] Record support load and response evidence.
• [ ] Record monthly KPI evidence, including first-value days, imported record count, customer view count, support minutes, critical validation count, retention signal, and gross-margin percentage.
• [ ] Re-run:

Done when: paid-pilot evidence no longer appears as blocked, and `/pilot`

can truthfully show real paid-pilot progress instead of `0` paid pilots.

Track E - Portfolio Polish

Goal: make a reviewer understand the project quickly without reading the whole

evidence system.

• [x] Record and link the 60-90 second product walkthrough from `docs/demo-script.md`; current no-narration public-site recording lives at `public/media/metamuseum-product-walkthrough.webm`.
• [x] Add a short "strict readiness" summary near the README top that points to this file and `docs/ops/review-goals.md`.
• [x] Save a concise standalone project overview/architecture HTML page for reviewers at `docs/metamuseum-project-overview.html`.
• [x] Keep dependency language precise: the full moderate audit is currently clean after resolving the Storybook transitive `uuid` path to `uuid@11.1.1`; keep `pnpm audit --audit-level moderate` in launch closeouts.
• [x] Prune long review-goals schema-version prose out of the README and point fast reviewers to `docs/ops/review-goals.md` for the detailed artifact contract.
• [x] Add a formal GA4 consent-posture audit: `pnpm privacy:consent:check` writes `artifacts/privacy/analytics-consent-latest.json` and verifies denied-by-default Consent Mode v2, persisted banner controls, `/privacy` disclosure, root tag wiring, and the no-ad-personalization expansion guard.
• [x] Keep public `/docs` metadata believable on Vercel: `/api/docs/manifest` now separates response `generatedAt` from source `sourceUpdatedAt` and `sourceUpdatedDoc` checksum metadata, while `/api/docs/content` remains `no-store` with per-document timestamps and fingerprints.
• [x] Add portfolio product polish controls: `src/services/portfolio-product-polish-controls.ts` and `tests/services/portfolio-product-polish-controls.test.ts` keep `/projects`, the walkthrough video, overview HTML, public docs freshness copy, shared navigation, and strict-readiness boundary from drifting.

Done when: a hiring reviewer can see the live demo, core architecture, evidence

discipline, and remaining production blockers in under five minutes.

Required Final Gate

The final 10/10 claim is allowed only when:

pnpm review:goals:check

returns `strict 10/10 gate status: passed`.

Until then, the honest status is:

Live and product-review strong, with local gates green, but strict public

production 10/10 still blocked by launch evidence/review and Era C handoff

refreshes, long-window SLO/uptime evidence, and real-world ActivityStreams,

KPI, paid-pilot, retention, and gross-margin proof.