Alpha roadmap and completion gate

This checklist defines “alpha” as a developer can deploy one agency-managed, multi-tenant WiseWig installation on Cloudflare; authenticate editors; edit and publish a small-business site; manage core CMS resources and media; install constrained extensions; expose isolated MCP surfaces; and operate/recover it with integration-tested tooling.

Each capability is five percentage points of alpha. A completed alpha represents approximately 50% of the eventual releasable product, so the current 50%-of-alpha milestone is approximately 25% of the full release. A capability counts only when implementation, validating tests, and AI-readable documentation exist. Partial work remains unchecked rather than receiving fractional credit.

Complete — 100%

• Typed component and document contracts — Zod schemas, defaults, field controls, variants, structural/placement policy, and stable slot identities.
• Shared Astro rendering modes — published, preview, and edit use the same components; only edit mounts the React overlay and private modes are no-store.
• Editor vertical slice — Morning Bell supports component selection, field edits, approved variants, structural move/remove/duplicate, preview, and confirmed publish through guarded commands.
• Mutation safety — tenant scope, permissions, confirmation, exclusive durable idempotency claims, optimistic versions, and audit records are shared by UI/API/private MCP effects.
• Cloudflare multitenant boundary — D1 verified-domain routing and authoritative memberships feed a private request gate that enforces origin, signed session, tenant, site, and permission.
• Tenant Durable Object persistence — documents, immutable history/restore, typed site resources, audit, command ledger, and atomic document/theme selections are tenant-local SQLite state.
• Theme migration foundation — appearance/layout separation, stable-slot comparison, explicit loss/addition decisions, typed migrated drafts, and paired theme/document publication.
• Asset storage foundation — tenant/site-scoped R2 keys, MIME/size limits, streamed-byte verification, immutable metadata, and public URL validation.
• Plugin contract and runtime isolation — sandboxed-by-default manifests, capabilities, host allowlists, declarative admin UI, scoped storage, bounded hooks, and native-plugin trust documentation.
• Public/private MCP contracts — public-content-only catalog/rate limiting and role-gated private tools routed through the guarded command layer, including plugin-contributed tools.
• Production deployment wiring — the reference Astro Worker uses D1 routing/identity, a remote tenant Durable Object, R2 media, guarded commands, shared rendering, and edge cache behavior; the dedicated Durable Object Worker is independently deployable.
• Media editor experience — authenticated streamed uploads, durable metadata/quarantine state, signature scanning, picker/replacement UI, bounded transformation URLs, reference checks, and R2/tombstone cleanup.
• Production identity lifecycle — OAuth/OIDC S256 PKCE, single-use state, invited external identities, rotating/revocable sessions, IdP-owned recovery, and extension entry through the same browser login flow.
• Core CMS management UI — guarded draft/publish interfaces for settings/SEO, navigation, forms/submissions, redirects, domains, members/roles, audit, and version restore; published settings/navigation feed rendering.
• Plugin installation lifecycle — signed/provenanced sandbox releases, capability approval UI, forward-only migrations, enable/disable/uninstall, previous-release rollback, quota-metered storage, and a separate no-site-bindings declarative artifact Worker.
• Deployed MCP services — physically separate public/private Workers and bindings, published-content indexing, OAuth 2.1/PKCE, site consent, revocable grants, live role checks, quotas, guarded effects, and tool audit.
• Publish operations — tenant-local schedules/alarms, version-addressed queue delivery, public index/cache refresh, isolated after-publish hooks, bounded retries, dead-letter state, supersession, and management status/retry controls.
• Cloudflare integration and browser security suite — real-workerd D1/SQLite DO/R2/KV/cache/queue tests, tenant escape assertions, actual MCP transport boot, deployment binding allowlists, and Chromium editor/extension/publication E2E.
• Operational resilience — checksummed tenant exports/backups and empty-workspace restore, Durable Object recovery bookmarks, retention, usage quotas, write suspension, telemetry, and asynchronous cross-store tenant erasure.
• Hosted-service control plane — portable host contracts, idempotent onboarding, DNS-challenged domains, environment deployments through a private provider binding, secret references, and owner-approved time-limited support access.

Remaining — 0%

All twenty alpha capabilities have implementation, validation, and AI-readable documentation. Product/monetization planning remains in Notion, not this repository.

Gate result

The repository is 100% complete toward the defined alpha, representing approximately 50% of the eventual releasable product. All twenty evidence gates are checked. The next roadmap must define the beta/release half rather than silently expanding this alpha checklist.

Re-score only by checking a remaining capability after its implementation, validating tests, and documentation are committed. Do not inflate the percentage for scaffolding or design notes.