docs: add Gitea roadmap and epic map

README.md

@@ -2,6 +2,10 @@
 
 A working mobile-first bowel diary with an optional **photo-first AI assist**: “Your intelligent pooping pal.”
 
+- [Product roadmap and live Gitea epic map](ROADMAP.md)
+- [Product and safety boundary](PRODUCT.md)
+- [Self-hosted stool-vision decision](research/SELF-HOSTED-STOOL-VISION.md)
+
 ## Run with the self-hosted open-weight path
 
 ```bash

ROADMAP.md

@@ -0,0 +1,129 @@
+# Timmy the Talking Turd — Product Roadmap
+
+Canonical forge: [https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd)
+
+## North star
+
+Make bowel logging fast enough to become a habit: take a photo, receive conservative observable-field suggestions, review or correct them, add symptoms yourself, and retain a private portable record. Timmy is playful during routine logging and calm/direct during safety escalation.
+
+## Product boundary
+
+- AI may suggest visible stool form, broad color, and image quality.
+- AI never diagnoses disease, identifies bleeding conclusively, infers pain/urgency/fever/vomiting, clears food, or suppresses deterministic red-flag escalation.
+- Model output remains provisional until the user confirms it.
+- Journal save and training contribution are separate consent decisions.
+- Hermes/Timmy remains release authority; human gates are limited to clinical/privacy review, beta consent, and RC approval.
+
+## Verified baseline at triage
+
+- Installable mobile-first PWA with manual Bristol logging, local ledger, JSON portability, privacy controls, history/calendar, summaries, and deterministic escalation.
+- Photo-first capture, explicit inference consent, strict model schema, confidence/abstention, and user confirmation.
+- Hosted and self-hosted OpenAI-compatible profiles with readiness reporting.
+- Real open-weight stool-photo spike completed: no content refusal, but the known Type 4 image was misclassified; production prefill remains blocked behind abstention and specialist-model evidence.
+- 22 unit/security tests, mobile green path, photo-first acceptance, syntax checks, and zero known npm vulnerabilities passed at triage.
+
+## Milestones
+
+| Milestone | Target | Outcome |
+|---|---:|---|
+| [M0 — Triage & Reproducible Baseline](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/7) | 2026-08-26 | Canonical forge, CI, decisions, reproducible self-host bootstrap. |
+| [M1 — Sovereign Photo Intelligence](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/8) | 2026-09-16 | Smooth camera-first UX, hardened sovereign inference, safety/privacy boundary. |
+| [M2 — Consented Dataset & Specialist Model](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/9) | 2026-10-15 | Consent-governed corpus, evaluation harness, calibrated specialist model candidate. |
+| [M3 — Private Beta & Longitudinal Value](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/10) | 2026-11-15 | User-owned longitudinal utility, grounded Timmy, bounded private beta. |
+| [M4 — Production Readiness & Release](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/11) | 2026-12-15 | Security/load/ops evidence, RC manifest, rollback, explicit release approval. |
+
+## Epic map
+
+### [#1 — EPIC: Photo-first logging experience](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/1)
+
+- [ ] [#11 — Mobile capture: harden camera/gallery permission and retry UX](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/11)
+- [ ] [#12 — Preserve manual fallback and resumable draft when vision is unavailable](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/12)
+- [ ] [#13 — Make AI suggestions visibly provisional and correction-first](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/13)
+- [ ] [#14 — Accessibility and visual QA across photo, alert, and privacy paths](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/14)
+
+### [#2 — EPIC: Sovereign vision inference](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/2)
+
+- [ ] [#10 — Package a reproducible self-hosted SmolVLM2 bootstrap](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/10)
+- [ ] [#15 — Containerize the llama.cpp GPU worker with pinned model receipts](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/15)
+- [ ] [#16 — Harden image ingress: magic bytes, re-encode, limits, metadata stripping, and rate control](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/16)
+- [ ] [#17 — Add bounded inference queue, cancellation, and overload fallback](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/17)
+- [ ] [#18 — Build schema-conformance and real-stool refusal regression corpus](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/18)
+- [ ] [#19 — Instrument privacy-safe model health, latency, abstention, and failure metrics](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/19)
+
+### [#3 — EPIC: Consented stool-image data flywheel](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/3)
+
+- [ ] [#24 — Implement separate opt-in training contribution and withdrawal flow](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/24)
+- [ ] [#25 — Extend dataset ingester with immutable provenance and deletion receipts](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/25)
+- [ ] [#26 — Build reviewer/adjudication tool for Bristol, color, quality, and exclusions](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/26)
+- [ ] [#27 — Publish dataset card, labeling guide, and contributor-level split policy](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/27)
+- [ ] [#28 — Run the 100-image real-world reality check and issue go/hold verdict](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/28)
+
+### [#4 — EPIC: Specialist Bristol classifier & calibration](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/4)
+
+- [ ] [#29 — Build contributor-held-out evaluation harness and calibration report](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/29)
+- [ ] [#30 — Train frozen-encoder baseline with stool/not-stool and Type 1–7 heads](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/30)
+- [ ] [#31 — Fine-tune specialist visual classifier with color and quality heads](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/31)
+- [ ] [#32 — Calibrate confidence and define the production abstention policy](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/32)
+- [ ] [#33 — Export the candidate to ONNX and benchmark CPU, GPU, and device targets](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/33)
+
+### [#5 — EPIC: Clinical safety, privacy & security](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/5)
+
+- [ ] [#9 — Document product decisions, non-diagnostic boundary, and release authority](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/9)
+- [ ] [#20 — Write the end-to-end photo data-flow threat model](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/20)
+- [ ] [#21 — Expand deterministic symptom escalation regression suite](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/21)
+- [ ] [#22 — Finalize photo-analysis consent, retention, deletion, and privacy copy](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/22)
+- [ ] [#23 — Independent clinical review of Bristol and urgent-symptom language](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/23)
+
+### [#6 — EPIC: Journal intelligence & user-owned data](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/6)
+
+- [ ] [#34 — Implement explainable longitudinal pattern summaries](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/34)
+- [ ] [#35 — Version ledger migrations and harden JSON portability](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/35)
+- [ ] [#36 — Add private photo lifecycle controls to history and calendar](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/36)
+- [ ] [#37 — Ground Timmy chat answers in the local ledger with citations](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/37)
+- [ ] [#38 — Run a bounded private beta and synthesize correction/friction evidence](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/38)
+
+### [#7 — EPIC: Production operations, private beta & release](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/7)
+
+- [ ] [#8 — CI: enforce unit, mobile acceptance, audit, syntax, and diff-hygiene gates](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/8)
+- [ ] [#39 — Define production topology, secrets, backup, and rollback runbook](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/39)
+- [ ] [#40 — Execute security, abuse, load, and medical-image leakage tests](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/40)
+- [ ] [#41 — Create release observability and incident-response dashboard](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/41)
+- [ ] [#42 — Produce RC evidence manifest and explicit approval checklist](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/42)
+- [ ] [#43 — Refresh the product film with the real photo-first self-hosted path](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/43)
+
+## Critical sequence
+
+1. **M0:** preserve the green baseline, record the product boundary, and make the local worker reproducible.
+2. **M1:** harden capture and ingress, move inference to private GPU compute, prove real-stool schema/refusal behavior, and finish clinical/privacy language.
+3. **M2:** collect separately consented human-confirmed labels, run the 100-image reality check, then train only if the evidence says GO or NARROW.
+4. **M3:** prove repeated user value through explainable summaries, grounded Timmy chat, portable data, photo lifecycle controls, and a bounded beta.
+5. **M4:** attack the RC, exercise rollback, publish an evidence manifest, receive explicit approval, then refresh the film from the real release path.
+
+## Release gates
+
+- Contributor-held-out macro-F1 ≥ 0.80 across Bristol Types 1–7.
+- Precision ≥ 0.90 among non-abstained suggestions at the selected coverage.
+- Expected calibration error ≤ 0.05.
+- 100% valid Timmy schema or fail-closed response.
+- No inference-body or image-byte logging.
+- No training use without a versioned contribution receipt and tested withdrawal/deletion path.
+- Deterministic symptom escalation passes independently of model state.
+- Clean-checkout build, security/load suite, artifact hashes, rollback exercise, and explicit RC approval.
+
+## Definition of ready
+
+- One bounded outcome with measurable acceptance criteria.
+- Parent epic, milestone, labels, dependencies, privacy/safety boundary, and required evidence are present.
+- No real medical image is copied into an issue or Git history.
+
+## Definition of done
+
+- Focused tests and relevant full suite pass from a clean checkout.
+- PR links the issue and records reproducible evidence.
+- Privacy/safety impact is dispositioned.
+- Documentation and data/model provenance are updated.
+- Gitea issue is closed by the merged PR or explicitly deferred with rationale.
+
+## Planning policy
+
+Gitea issues, milestones, and labels are the source of truth. Do not mirror this backlog into a second kanban unless workers actively consume that board. Keep contributor updates in the forge; surface only human gates or blocked decisions in chat.