12 KiB
12 KiB
Timmy the Talking Turd — Product Roadmap
Canonical forge: https://forge.alexanderwhitestone.com/git/stackchain/timmy-talking-turd
North star
Make bowel logging fast enough to become a habit: take a photo, receive conservative observable-field suggestions, review or correct them, add symptoms yourself, and retain a private portable record. Timmy is playful during routine logging and calm/direct during safety escalation.
Product boundary
- AI may suggest visible stool form, broad color, and image quality.
- AI never diagnoses disease, identifies bleeding conclusively, infers pain/urgency/fever/vomiting, clears food, or suppresses deterministic red-flag escalation.
- Model output remains provisional until the user confirms it.
- Journal save and training contribution are separate consent decisions.
- Hermes/Timmy remains release authority; human gates are limited to clinical/privacy review, beta consent, and RC approval.
Verified baseline at triage
- Installable mobile-first PWA with manual Bristol logging, local ledger, JSON portability, privacy controls, history/calendar, summaries, and deterministic escalation.
- Photo-first capture, explicit inference consent, strict model schema, confidence/abstention, and user confirmation.
- Hosted and self-hosted OpenAI-compatible profiles with readiness reporting.
- Real open-weight stool-photo spike completed: no content refusal, but the known Type 4 image was misclassified; production prefill remains blocked behind abstention and specialist-model evidence.
- 22 unit/security tests, mobile green path, photo-first acceptance, syntax checks, and zero known npm vulnerabilities passed at triage.
Milestones
| Milestone | Target | Outcome |
|---|---|---|
| M0 — Triage & Reproducible Baseline | 2026-08-26 | Canonical forge, CI, decisions, reproducible self-host bootstrap. |
| M1 — Sovereign Photo Intelligence | 2026-09-16 | Smooth camera-first UX, hardened sovereign inference, safety/privacy boundary. |
| M2 — Consented Dataset & Specialist Model | 2026-10-15 | Consent-governed corpus, evaluation harness, calibrated specialist model candidate. |
| M3 — Private Beta & Longitudinal Value | 2026-11-15 | User-owned longitudinal utility, grounded Timmy, bounded private beta. |
| M4 — Production Readiness & Release | 2026-12-15 | Security/load/ops evidence, RC manifest, rollback, explicit release approval. |
Epic map
#1 — EPIC: Photo-first logging experience
- #11 — Mobile capture: harden camera/gallery permission and retry UX
- #12 — Preserve manual fallback and resumable draft when vision is unavailable
- #13 — Make AI suggestions visibly provisional and correction-first
- #14 — Accessibility and visual QA across photo, alert, and privacy paths
#2 — EPIC: Sovereign vision inference
- #10 — Package a reproducible self-hosted SmolVLM2 bootstrap
- #15 — Containerize the llama.cpp GPU worker with pinned model receipts
- #16 — Harden image ingress: magic bytes, re-encode, limits, metadata stripping, and rate control
- #17 — Add bounded inference queue, cancellation, and overload fallback
- #18 — Build schema-conformance and real-stool refusal regression corpus
- #19 — Instrument privacy-safe model health, latency, abstention, and failure metrics
#3 — EPIC: Consented stool-image data flywheel
- #24 — Implement separate opt-in training contribution and withdrawal flow
- #25 — Extend dataset ingester with immutable provenance and deletion receipts
- #26 — Build reviewer/adjudication tool for Bristol, color, quality, and exclusions
- #27 — Publish dataset card, labeling guide, and contributor-level split policy
- #28 — Run the 100-image real-world reality check and issue go/hold verdict
#4 — EPIC: Specialist Bristol classifier & calibration
- #29 — Build contributor-held-out evaluation harness and calibration report
- #30 — Train frozen-encoder baseline with stool/not-stool and Type 1–7 heads
- #31 — Fine-tune specialist visual classifier with color and quality heads
- #32 — Calibrate confidence and define the production abstention policy
- #33 — Export the candidate to ONNX and benchmark CPU, GPU, and device targets
#5 — EPIC: Clinical safety, privacy & security
- #9 — Document product decisions, non-diagnostic boundary, and release authority
- #20 — Write the end-to-end photo data-flow threat model
- #21 — Expand deterministic symptom escalation regression suite
- #22 — Finalize photo-analysis consent, retention, deletion, and privacy copy
- #23 — Independent clinical review of Bristol and urgent-symptom language
#6 — EPIC: Journal intelligence & user-owned data
- #34 — Implement explainable longitudinal pattern summaries
- #35 — Version ledger migrations and harden JSON portability
- #36 — Add private photo lifecycle controls to history and calendar
- #37 — Ground Timmy chat answers in the local ledger with citations
- #38 — Run a bounded private beta and synthesize correction/friction evidence
#7 — EPIC: Production operations, private beta & release
- #8 — CI: enforce unit, mobile acceptance, audit, syntax, and diff-hygiene gates
- #39 — Define production topology, secrets, backup, and rollback runbook
- #40 — Execute security, abuse, load, and medical-image leakage tests
- #41 — Create release observability and incident-response dashboard
- #42 — Produce RC evidence manifest and explicit approval checklist
- #43 — Refresh the product film with the real photo-first self-hosted path
Critical sequence
- M0: preserve the green baseline, record the product boundary, and make the local worker reproducible.
- M1: harden capture and ingress, move inference to private GPU compute, prove real-stool schema/refusal behavior, and finish clinical/privacy language.
- M2: collect separately consented human-confirmed labels, run the 100-image reality check, then train only if the evidence says GO or NARROW.
- M3: prove repeated user value through explainable summaries, grounded Timmy chat, portable data, photo lifecycle controls, and a bounded beta.
- M4: attack the RC, exercise rollback, publish an evidence manifest, receive explicit approval, then refresh the film from the real release path.
Release gates
- Contributor-held-out macro-F1 ≥ 0.80 across Bristol Types 1–7.
- Precision ≥ 0.90 among non-abstained suggestions at the selected coverage.
- Expected calibration error ≤ 0.05.
- 100% valid Timmy schema or fail-closed response.
- No inference-body or image-byte logging.
- No training use without a versioned contribution receipt and tested withdrawal/deletion path.
- Deterministic symptom escalation passes independently of model state.
- Clean-checkout build, security/load suite, artifact hashes, rollback exercise, and explicit RC approval.
Definition of ready
- One bounded outcome with measurable acceptance criteria.
- Parent epic, milestone, labels, dependencies, privacy/safety boundary, and required evidence are present.
- No real medical image is copied into an issue or Git history.
Definition of done
- Focused tests and relevant full suite pass from a clean checkout.
- PR links the issue and records reproducible evidence.
- Privacy/safety impact is dispositioned.
- Documentation and data/model provenance are updated.
- Gitea issue is closed by the merged PR or explicitly deferred with rationale.
Planning policy
Gitea issues, milestones, and labels are the source of truth. Do not mirror this backlog into a second kanban unless workers actively consume that board. Keep contributor updates in the forge; surface only human gates or blocked decisions in chat.