Roadmap — deferred items

Living list of agreed-but-not-built work. Each item becomes a spec
(docs/superpowers/specs/) when picked up.

Next up (picked by Efran, 2026-07-08)

Answer-quality feedback loop — 👍/👎 on public answers → eval corpus +
admin view; link each rating to its audit trace_id so a bad answer jumps
straight to its trace in /admin/observe/threads.
Knowledge manual-entry export/backup — admin knowledge rows created via
the console live only in the agent DB and are dropped by
load_knowledge --recreate; add an export/restore path (see
infra/OPS-NOTES.md caveat, 2026-07-03).
App error monitoring + uptime/latency alerting — AI-call audit is live
(observatory), but there's no crash tracking (Sentry-equiv) or paging.

/admin/public/rag — Korpus RAG management (Milvus collections, re-ingest). Needs a new backend (Milvus admin + re-ingest trigger).
~~/admin/public/persona + /admin/internal/persona — Prompt & Persona editors~~ DONE 2026-07-08 (spec 2026-07-08-console-selfservice-accounts-design.md): public = persona_preamble in orchestrator config (applies next turn); internal = /data/persona.json + live hot-swap on the agent.
~~/admin/internal/schema — Skema DB browser~~ DONE 2026-07-08 (UI over existing agent endpoints).
~~/admin/observe/threads — Threads & Sessions explorer~~ DONE 2026-07-07.
/admin/shared/model-gateway + /admin/shared/provider — standalone pages; their functionality currently lives in /admin/settings sections.

LLM request queue / priority gateway — decided 2026-07-04: deferred to a
future GPU/LLM management service (needed when the 16x B200 cluster is
shared). A tested thin-proxy design + implementation exists in git history
(reverted at git revert of 3f4525f/5b2feed/1e4b4d7 — spec:
2026-07-04-llm-gateway-design.md) and can be resurrected when contention
is real. Callers already send X-Priority headers and route via
MODEL_GATEWAY_URL/SYNTHESIS_GATEWAY_URL env vars, so insertion stays an
env flip.
SSO Kemenkumham — replaces only /api/auth/login; cookie/middleware/guard/staff_users stay (Plan D design).
Public DB replica — flip PUBLIC_DB_URL, retire shared read-only MySQL creds (blocked: no replica exists).
Production launch — chatbot-neo.val.id / chatbot-neo-staff.val.id via Hermes DNS once the project officially starts (see environment topology spec 2026-07-03).

~~Per-account chat history~~ DONE 2026-07-08 — Akun threads persist in
PUBLIC_DB (ThreadStore), written by /api/orchestrate, served by
/api/threads/doc.
~~Password lifecycle (transport-free part)~~ DONE 2026-07-08 —
self-service change-password + staff reset via /admin/shared/public-users
(temp password shown once). Email-based forgot-password remains blocked on
email transport; real Dukcapil NIK integration remains blocked on MoU +
Kemendagri creds.
On-prem synthesis — blocked on B200 / an on-prem large model in the
gateway registry; CONVENTIONS §4 forbids external upstreams in prod.
Turnstile widget — server verify ships dormant (TURNSTILE_SECRET);
composer-side widget + site key is the fast-follow when Cloudflare keys land.
Dependency vulns (2026-07-08 triage) — JS workspace at zero known
vulns (vitest 3, pnpm-workspace overrides); Python 51→19, remainder
deferred with reasons: starlette 1.x (fastapi-coupled major), cryptography
48.x (major), pytest 9 (dev-only), agno CVE-2026-10105 (no fix released —
re-check on agno upgrades). Reconcile the GitHub Dependabot list after push.
Stale operator docs — docs/SMOKE-TEST.md references the pre-split
:8110 direct path and compose.dev.yaml; rewrite for the orchestrator +
staging deploy loop.