timmy-talking-turd/ROADMAP.md

# Timmy the Talking Turd — Product Roadmap

Canonical forge: [https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd)

## North star

Make bowel logging fast enough to become a habit: take a photo, receive conservative observable-field suggestions, review or correct them, add symptoms yourself, and retain a private portable record. Timmy is playful during routine logging and calm/direct during safety escalation.

## Product boundary

- AI may suggest visible stool form, broad color, and image quality.
- AI never diagnoses disease, identifies bleeding conclusively, infers pain/urgency/fever/vomiting, clears food, or suppresses deterministic red-flag escalation.
- Model output remains provisional until the user confirms it.
- Journal save and training contribution are separate consent decisions.
- Hermes/Timmy remains release authority; human gates are limited to clinical/privacy review, beta consent, and RC approval.

## Verified baseline at triage

- Installable mobile-first PWA with manual Bristol logging, local ledger, JSON portability, privacy controls, history/calendar, summaries, and deterministic escalation.
- Photo-first capture, explicit inference consent, strict model schema, confidence/abstention, and user confirmation.
- Hosted and self-hosted OpenAI-compatible profiles with readiness reporting.
- Real open-weight stool-photo spike completed: no content refusal, but the known Type 4 image was misclassified; production prefill remains blocked behind abstention and specialist-model evidence.
- 22 unit/security tests, mobile green path, photo-first acceptance, syntax checks, and zero known npm vulnerabilities passed at triage.

## Milestones

| Milestone | Target | Outcome |
|---|---:|---|
| [M0 — Triage & Reproducible Baseline](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/7) | 2026-08-26 | Canonical forge, CI, decisions, reproducible self-host bootstrap. |
| [M1 — Sovereign Photo Intelligence](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/8) | 2026-09-16 | Smooth camera-first UX, hardened sovereign inference, safety/privacy boundary. |
| [M2 — Consented Dataset & Specialist Model](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/9) | 2026-10-15 | Consent-governed corpus, evaluation harness, calibrated specialist model candidate. |
| [M3 — Private Beta & Longitudinal Value](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/10) | 2026-11-15 | User-owned longitudinal utility, grounded Timmy, bounded private beta. |
| [M4 — Production Readiness & Release](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/milestone/11) | 2026-12-15 | Security/load/ops evidence, RC manifest, rollback, explicit release approval. |

## Epic map

### [#1 — EPIC: Photo-first logging experience](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/1)

- [ ] [#11 — Mobile capture: harden camera/gallery permission and retry UX](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/11)
- [ ] [#12 — Preserve manual fallback and resumable draft when vision is unavailable](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/12)
- [ ] [#13 — Make AI suggestions visibly provisional and correction-first](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/13)
- [ ] [#14 — Accessibility and visual QA across photo, alert, and privacy paths](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/14)

### [#2 — EPIC: Sovereign vision inference](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/2)

- [ ] [#10 — Package a reproducible self-hosted SmolVLM2 bootstrap](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/10)
- [ ] [#15 — Containerize the llama.cpp GPU worker with pinned model receipts](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/15)
- [ ] [#16 — Harden image ingress: magic bytes, re-encode, limits, metadata stripping, and rate control](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/16)
- [ ] [#17 — Add bounded inference queue, cancellation, and overload fallback](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/17)
- [ ] [#18 — Build schema-conformance and real-stool refusal regression corpus](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/18)
- [ ] [#19 — Instrument privacy-safe model health, latency, abstention, and failure metrics](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/19)

### [#3 — EPIC: Consented stool-image data flywheel](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/3)

- [ ] [#24 — Implement separate opt-in training contribution and withdrawal flow](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/24)
- [ ] [#25 — Extend dataset ingester with immutable provenance and deletion receipts](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/25)
- [ ] [#26 — Build reviewer/adjudication tool for Bristol, color, quality, and exclusions](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/26)
- [ ] [#27 — Publish dataset card, labeling guide, and contributor-level split policy](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/27)
- [ ] [#28 — Run the 100-image real-world reality check and issue go/hold verdict](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/28)

### [#4 — EPIC: Specialist Bristol classifier & calibration](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/4)

- [ ] [#29 — Build contributor-held-out evaluation harness and calibration report](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/29)
- [ ] [#30 — Train frozen-encoder baseline with stool/not-stool and Type 1–7 heads](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/30)
- [ ] [#31 — Fine-tune specialist visual classifier with color and quality heads](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/31)
- [ ] [#32 — Calibrate confidence and define the production abstention policy](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/32)
- [ ] [#33 — Export the candidate to ONNX and benchmark CPU, GPU, and device targets](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/33)

### [#5 — EPIC: Clinical safety, privacy & security](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/5)

- [ ] [#9 — Document product decisions, non-diagnostic boundary, and release authority](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/9)
- [ ] [#20 — Write the end-to-end photo data-flow threat model](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/20)
- [ ] [#21 — Expand deterministic symptom escalation regression suite](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/21)
- [ ] [#22 — Finalize photo-analysis consent, retention, deletion, and privacy copy](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/22)
- [ ] [#23 — Independent clinical review of Bristol and urgent-symptom language](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/23)

### [#6 — EPIC: Journal intelligence & user-owned data](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/6)

- [ ] [#34 — Implement explainable longitudinal pattern summaries](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/34)
- [ ] [#35 — Version ledger migrations and harden JSON portability](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/35)
- [ ] [#36 — Add private photo lifecycle controls to history and calendar](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/36)
- [ ] [#37 — Ground Timmy chat answers in the local ledger with citations](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/37)
- [ ] [#38 — Run a bounded private beta and synthesize correction/friction evidence](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/38)

### [#7 — EPIC: Production operations, private beta & release](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/7)

- [ ] [#8 — CI: enforce unit, mobile acceptance, audit, syntax, and diff-hygiene gates](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/8)
- [ ] [#39 — Define production topology, secrets, backup, and rollback runbook](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/39)
- [ ] [#40 — Execute security, abuse, load, and medical-image leakage tests](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/40)
- [ ] [#41 — Create release observability and incident-response dashboard](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/41)
- [ ] [#42 — Produce RC evidence manifest and explicit approval checklist](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/42)
- [ ] [#43 — Refresh the product film with the real photo-first self-hosted path](https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd/issues/43)

## Critical sequence

1. **M0:** preserve the green baseline, record the product boundary, and make the local worker reproducible.
2. **M1:** harden capture and ingress, move inference to private GPU compute, prove real-stool schema/refusal behavior, and finish clinical/privacy language.
3. **M2:** collect separately consented human-confirmed labels, run the 100-image reality check, then train only if the evidence says GO or NARROW.
4. **M3:** prove repeated user value through explainable summaries, grounded Timmy chat, portable data, photo lifecycle controls, and a bounded beta.
5. **M4:** attack the RC, exercise rollback, publish an evidence manifest, receive explicit approval, then refresh the film from the real release path.

## Release gates

- Contributor-held-out macro-F1 ≥ 0.80 across Bristol Types 1–7.
- Precision ≥ 0.90 among non-abstained suggestions at the selected coverage.
- Expected calibration error ≤ 0.05.
- 100% valid Timmy schema or fail-closed response.
- No inference-body or image-byte logging.
- No training use without a versioned contribution receipt and tested withdrawal/deletion path.
- Deterministic symptom escalation passes independently of model state.
- Clean-checkout build, security/load suite, artifact hashes, rollback exercise, and explicit RC approval.

## Definition of ready

- One bounded outcome with measurable acceptance criteria.
- Parent epic, milestone, labels, dependencies, privacy/safety boundary, and required evidence are present.
- No real medical image is copied into an issue or Git history.

## Definition of done

- Focused tests and relevant full suite pass from a clean checkout.
- PR links the issue and records reproducible evidence.
- Privacy/safety impact is dispositioned.
- Documentation and data/model provenance are updated.
- Gitea issue is closed by the merged PR or explicitly deferred with rationale.

## Planning policy

Gitea issues, milestones, and labels are the source of truth. Do not mirror this backlog into a second kanban unless workers actively consume that board. Keep contributor updates in the forge; surface only human gates or blocked decisions in chat.