Hummingbird

Canonical source: ROADMAP.md (commit 46e93c9) — View raw Markdown

Roadmap

Phases are sequential by design. Later phases are not commitments — they are planned or experimental until actually underway.

Phase 0 — Foundation (complete)

Status: complete — verified against this checklist and closed out; see CHANGELOG.md.

Phase 1 — Public Charter Site (complete)

Status: complete — public surfaces are live and the public-repository security baseline has been activated and verified to the extent exposed by GitHub, with remaining repository-setting controls explicitly confirmed by the steward on 2026-09-10 (Pacific Time).

Publishing a Charter Candidate (C1) is a distinct governance action, not automatic upon phase completion — see GOVERNANCE.md.

The repository is public. main is protected with required Checks, test, build and enforcement for everyone including the steward/admin. Repository Actions are restricted and full-length SHA pinning is required. GitHub private vulnerability reporting, secret scanning/push protection, Dependabot security controls, and CodeQL default setup are enabled.

No Hummingbird-owned participant accounts, voting, application-managed payments, financial-governance workflows, reputation, moderation, AI orchestration, feeds, or chat were added in Phase 1. An interim personal-steward voluntary support address remains a narrowly scoped exception to "no payments" — it confers no standing and is not Phase 5.

Phase 2 — Read-Only Commons

Status: in progress

The Phase 2 data-model, workflow-state, retention, and operational-transparency entry gates are resolved in DATA_MODEL.md (internal reference, not yet public), SECURITY.md (internal reference, not yet public), TRANSPARENCY.md, and ADR 0010.

Phase 2 implements public read-only representations of contributions, proposals, needs, relationships, minimal events, statuses, and transparency records. Cloudflare D1 is the first persistence engine, while canonical record meaning remains portable and storage-independent.

Phase 2 generally keeps public mutation authority outside the Hummingbird application. The Seed Bank, defined by ADR 0011, remains an external provider-hosted discussion path without automatically creating canonical records or governance weight. During Phase 2E, ADR 0017 authorizes one narrower first-party exception: temporary, non-canonical experimental ingress whose authority ends at evidence gathering and does not open Phase 3.

Phase 2A — Canonical contract and reference corpus

Status: complete

Completed in PR #26. See ADR 0012.

Exit satisfied: the reference corpus passes CI and is the required round-trip input for persistence work.

Phase 2B — Persistence and deterministic import

Status: complete

Phase 2B proved the same portable canonical contract through both isolated local D1 and the real remote Cloudflare D1 database.

Completed evidence:

See docs/protocols/PHASE_2B_REMOTE_D1.md (internal reference, not yet public) for the execution protocol and recorded evidence.

The broader persistence architecture and dated cost envelope are documented in PERSISTENCE.md. Future Durable Objects/R2 use remains out of scope until a later capability actually requires it.

Exit satisfied: an empty database can be migrated and populated deterministically from storage-independent input, and canonical records can be exported without loss of institutional meaning. Remote-provider configuration is reproducible without making undocumented dashboard state part of canonical correctness.

Phase 2C — Public read model and admission boundary

Status: complete

Completed on 2026-09-11 under ADR 0014 and the Phase 2C protocol (internal reference, not yet public).

Phase 2C proved the complete boundary rather than merely implementing static pages:

Exit satisfied: public projections are rebuildable from canonical records and the deliberate offer/source → admission → publication path is traceable without treating ingress as publication or governance approval.

Phase 2D — Publication buffer, backup, and recovery

Status: complete

Phase 2D focused on durability and safe operational transparency rather than adding new participation features.

Completed evidence:

Exit satisfied: backup and restore have been exercised successfully against current production canonical state through an isolated replacement database, canonical/read-model equivalence has been demonstrated after recovery, the minimized recovery outcome has crossed the publication-buffer/transparency boundary, and the ordinary independently retained encrypted backup has been retrieved, decrypted, and validated outside the hosting/provider boundary. This completes Phase 2D without authorizing Phase 3.

Phase 2E — Phase review and Phase 3 gate

Status: in progress — Phase 2E.1 complete; Phase 2E.2 is next; bounded experimental ingress remains open; Phase 3 remains blocked

The original evidence review, complete open-question inventory, recommended decision order, and Offer Buffer assumption audit were prepared in docs/reviews/PHASE_2_EVIDENCE_AND_GATE_REVIEW.md (internal reference, not yet public). It remains the historical evidence snapshot that began the review. The corrected current Phase 2E.1 state and final review-gate dispositions are recorded in docs/reviews/PHASE_2E1_CLOSEOUT.md (internal reference, not yet public) and ADR 0022. None of those records authorizes Phase 3.

Phase 2E also includes a deliberately narrow evidence-gathering ingress track under ADR 0017. The purpose is to learn from real participation before attempting to settle every unresolved question in the abstract. This track does not create durable participant authority and is not Phase 3.

Phase 2E.1 — Evidence and Phase 2 review

Status: complete

Completed on 2026-09-12. See Phase 2E.1 Closeout (internal reference, not yet public) and ADR 0022.

Exit satisfied: the Phase 2 evidence/review checkpoint is complete without removing any Phase 3 blocker or authorizing automatic canonical mutation.

Phase 2E.P — Experimental ingress pilot

Status: open for testing

The Phase 2E experimental ingress protocol (internal reference, not yet public) defines the authority ceiling, participant-facing contract, and launch evidence. ADR 0020 records the bounded launch profile.

The pilot is live at /offer and may run before all Phase 3 blockers are resolved because its authority ends at temporary non-canonical evidence gathering. It must not be expanded into durable controlled participation by implementation drift.

The participant surface is deliberately low-friction:

Launch verification completed the dedicated offer-store provisioning/migration/binding, preserved the public read plane, verified the offer route/binding without mutation, and completed a one-time production accept → status → withdraw → withdrawn status exercise. The test offer remains withdrawn. The pilot uses the published payload, retention, duplicate, backpressure, receipt, withdrawal, cleanup, and pause boundaries; material operating evidence should continue to be summarized without exposing participant material or correlation-rich telemetry.

The public front door now acts as the intended truthful funnel:

  1. the project — what exists and what principles already apply;
  2. the plan — where Hummingbird is headed and what remains intentionally unresolved;
  3. open now — the specific interaction available for input and testing.

Public status labels distinguish exists now, open for testing, and planned. The first-party offer surface is the primary low-friction participation call to action. The Seed Bank remains available as a higher-friction durable public discussion/archive path.

Evidence from the pilot may inform unresolved questions. Volume or repetition is evidence of salience, not a vote or automatic governance weight.

Phase 2E.2 — Constitutional and governance decisions

Status: next

Phase 2E.3 — Security, ingress, and runtime decisions

Status: pending Phase 2E.2 constraints

Explicit Phase 3 authorization

Phase 3 may begin only after Phase 2E.1–2E.3 are complete, all Phase 3 blockers are substantively resolved, the Offer Buffer design is reconciled with those decisions, and the then-authorized governance process records an explicit Phase 3 entry decision. A successful Phase 2E experimental-ingress pilot does not itself satisfy or bypass that gate.

Phase 2 completion requires all of the following:

  1. migrations reproduce the persistence layer from empty state;
  2. canonical reference/import data round-trips without loss of meaning;
  3. public projections are rebuildable and require no participant origin classification;
  4. the external-ingress → deliberate-admission boundary is demonstrated;
  5. publication-buffer behavior is tested;
  6. backup and restore are documented and exercised;
  7. no secret/security-sensitive fields are exposed by the public read model;
  8. Phase 2 review-gate decisions are recorded or explicitly deferred with rationale;
  9. if the Phase 2E experimental ingress pilot is deployed, its handling contract and material evidence/limits are documented before Phase 2 closes.

Phase 3 — Controlled Participation

Status: planned — offer architecture documented, gate not yet open

Phase 3 begins with a narrow durable capability pilot rather than a private read beta or broad account registration. Public reading remains open. The temporary evidence-only Phase 2E ingress pilot does not count as entry into Phase 3.

The participant-facing concept is an offer, defined by ADR 0016. An offer may be small or foundational: it may correct a sentence, add evidence, challenge an ADR, propose a space, recommend a governance change through the appropriate process, or argue that Hummingbird itself should substantially change. Broad possible consequence does not grant authority merely because the offer was made.

The intended boundary is:

make an offer
    ↓
choose an offer delivery option
    ↓
Offer Buffer (bounded, operational, non-canonical)
    ↓
consideration / synthesis
    ↓
optional explicit admission
    ↓
canonical memory
    ↓
optional publication

The first Phase 3 Hummingbird-owned durable participation pilot should grant only a bounded, revocable offer-making capability with payload bounds, rate/resource limits, schema validation, replay/duplicate controls, and no implied publication, canonical admission, moderation, treasury, or governance authority. See ADR 0014 and the Offer Buffer working design (internal reference, not yet public).

Future broader access may offer multiple offer delivery options. Those options may regulate throughput or resource cost, but they must not be assigned to presumed participant-origin categories and must not become hidden content priority, trust/reputation, or governance weight. An accessible uncredentialed path should remain part of the broader design once participation expands beyond the initial controlled pilot.

The live Phase 2E first-party ingress experiment is now the primary low-friction entrance. The Seed Bank remains a durable public discussion/archive path rather than the default front door.

Entry into Phase 3 remains blocked by the constitutional, governance, architecture, and security questions listed in the Open Questions Registry. A successful Phase 2E experiment, working Phase 2 database, or accepted Offer Buffer design is not permission to bypass those decisions.

Future participatory-space track — after basic controlled participation

The ideas in SPACES.md are preserved now so Phase 3 does not accidentally design itself into an account/feed model, but they are not a promise to build all of them during Phase 3.

Candidate experiments, in increasing order of governance/security complexity, include:

  1. optional presence pads and a simple public activity with bounded actions;
  2. a persistent/sealed mosaic wall and one persistent turn-based game such as chess;
  3. public mutual pad connections and temporary joined work surfaces;
  4. scheduled spaces that open/close and execute bounded declarative local rules;
  5. durable guild formation;
  6. scoped, expiring guild capability grants such as extended shared-space retention.

A game/wall experiment should favor visible explanation, uncertainty, prediction, revision, coordination, and other consequential interaction rather than global participant scores or leaderboards.

Self-governed spaces and resource-amplifying guild capabilities remain blocked by their specifically registered open questions even if simpler Phase 3 offer-making already exists.

Phase 4 — Governance Workflows

Status: deferred

Proposals, reviews, validated needs, disputes, decisions, fulfillment tracking.

Future guild-grant review may eventually reuse Phase 4 governance primitives, but a guild is not a higher participant class and a grant is not transferable personal standing.

Phase 5 — Financial Support

Status: deferred

Donations, validated expenditures, steward compensation where appropriate, public aggregate financial transparency. Donation must never automatically grant influence. Only begins after the needs process (Phase 4) is functioning.

The infrastructure cost analysis in PERSISTENCE.md is planning information only; it does not create a treasury, authorize spending, or move financial governance forward in the roadmap.