Skip to content

Critical path

Status: design draft for review · decided, not built

This page orders the build. It carries no dates: no team sizing exists, so a duration would be an invented number, and the roadmap's rule against invented numbers applies to schedules too. What this page commits is order and dependency — which milestone must exist before which, and why. A milestone is done when its exit criteria close — mostly roadmap FR rows with verifiable criteria — not when its code merges.

M0 — De-risking spikes, before any milestone

Goal. Retire the ecosystem assumptions that could invalidate recorded decisions, before code accumulates on top of them. In order:

  1. delta-rs transaction-identifier conformance. Verify that applied-version state survives a checkpoint written mid-sequence, VACUUM, restart, and the transaction-identifier retention settings — and pin those settings; run the same cases on file:// (the standalone profile's backend, ADR-0023), including the local-filesystem conditional-put self-test and the NFS refusal. A failure here invalidates ADR-0003 d4 (the Delta log as sole recovery authority); the named fallback is a Postgres applied-ledger as the recovery authority. Feeds FR-3's extended harness.
  2. Conditional put under degraded quorum. Test conditional PUT on MinIO with a degraded read quorum and verify lockless delta-rs commits on both MinIO and S3; pin the exact MinIO release.
  3. RLS hardening. FORCE ROW LEVEL SECURITY on every tenant table, the owner/migration-role split, SET LOCAL tenant discipline in pooled transactions — the assumptions commitments C6 names. Cheap; do immediately.
  4. pgvector ceiling probe. HNSW build memory at corpus scale, per-tenant LIST-partition overhead at thousands of tenants, iterative-scan caps. Folds into FR-4 and FR-7.

Exit. Each spike's finding recorded; any invalidated decision re-opened as an ADR amendment before M1 builds on it. Everything depends on M0's findings standing.

M1 — System of record

Goal. The one commit point exists and the constitution is code.

Items. The oml-domain pure crate with invariant property tests (ADR-0019 d1); the Postgres schema with per-tenant chains, advisory-lock commit and the outbox (storage); a minimal oml-server — submit, review, promote, read-own — with keys, grants and the bootstrap ceremony (roles and keys); the CLI minimum (ADR-0015); the standalone profile (ADR-0023) — the cheapest end-to-end rig and the dev profile the whole build runs on; nothing in M1's exit needs an orchestrator.

Exit. Invariant tests over the pure core pass; one-commit-point and chain-order semantics demonstrated on the standalone profile. Every later milestone depends on M1.

M2 — Provider floor

Goal. OML is usable as an agent's only memory. This is the milestone that makes the product a provider rather than a governance demo — and it is exactly the /v1 provider ring of ADR-0022, whose compatibility covenant (FR-21) is declared against the surface this milestone finishes.

Items. Retrieval (FTS plus pgvector, retrieval); attachments (ADR-0004); the MCP facade with idempotency (ADR-0014); the read log (ADR-0013); the docker-compose profile joins here (ADR-0023) — the provider-floor milestone is when early users first want a trivial install; and the hot-path discipline of ADR-0024 binds from the first provider-ring endpoint, with FR-25's harness built alongside. Plus five gaps carried as first-class items, not polish:

  • own-held recall (include_own_held) and oml_get on MCP — FR-10;
  • oml_supersede on MCP and the journalled author retire-proposal — FR-10;
  • max_tokens on recall with deterministic truncation — FR-11;
  • batch submit with per-item idempotency, and generated Python/TypeScript SDKs — FR-12;
  • boundaries hygiene on the positioning page: no automatic extraction, no profiles, consolidation lives client-side — named decisions, not omissions.

Exit. FR-10, FR-11 and FR-12 close. M2's definition of done includes the agent-only-memory scenario passing: an agent that stores to OML and nothing else can read back what it wrote, search it under a token budget, update it, and propose retiring it. Depends on M1.

M3 — Derived lakehouse

Goal. The derived side exists and its exactly-once claim is verified, not assumed.

Items. Outbox → lake-writer → bronze/silver with the FR-3 extended conformance harness (kill, restart, checkpoint, VACUUM, retention — run per object-store backend: file://, pinned MinIO, S3); FR-16 throughput and commit-latency measurements; reconciler v1 with the closed finding vocabulary (reconciliation, ADR-0017); the Kubernetes local profile (k3d + CloudNativePG + pinned MinIO) joins here — the first milestone that exercises the k8s-specific machinery (leases, CronJob) against the lake (ADR-0023).

Exit. FR-3 closes; FR-16 has numbers. Depends on M1 (the outbox) and M0 spikes 1–2.

M4 — Governance completeness

Goal. The differentiator milestone: everything the evidence story promises exists end to end.

Items. The full workarea ladder (workareas); simulations (ADR-0011); crypto-shredding with the copy-class inventory and KEK rotation (ADR-0005); evidence export (audit and lineage); bans; and the vocabulary slice (ADR-0021, FR-19) — prefixes, the term lifecycle with atomic deprecation, releases with the materialized closure, the vocab scanner and read surface. Vocabularies depend on M1 (pipeline, claim edges, domain invariants) and M2 (MCP facade, the recall terms filter) but not on M3's lake; they sit here because the held_by attestation and the human-gated ceremonies are governance machinery.

Exit. FR-1's erasure path demonstrated end to end; FR-17's erasure-SLO bounds measured; FR-19's vocabulary slice demonstrated end to end. Depends on M1–M3 — the evidence export reads the journal, and the inventory is only checkable once the reconciler runs. FR-20's vocabulary measurements join M6's campaigns.

M5 — Dataset onboarding (post-v1)

Goal. ADR-0020's smallest useful slice: pinned file sources only (Parquet/CSV by digest), full-replace only, a hard 1M-row cap, no FTS or vector indexing.

Items. The import manifest pipeline, import_rows, seeded sampling review, the per-manifest wrapping-key tier, the resurrection fence in its reduced form.

Exit. FR-13 closes; FR-14 has numbers; RS-4 through RS-8 decided. This milestone sits after FR-2, FR-3 and FR-7 have numbers, deliberately: pouring ten million rows into a system whose single-row review throughput, exactly-once behavior and storage ceiling have no numbers would be measuring nothing against nothing. Depends on M2–M4.

M6 — Scale and measurement

Goal. The claims become numbers.

Items. The scaled Helm profile with cluster mode (followers, lead failover — FR-24); the measurement campaigns — FR-2 review drain rate, FR-4 search quality, FR-7 store ceiling, FR-15 scan latency, FR-18 reconciler runtime and quorum write latency, FR-25 provider-ring latency against targets, FR-20 vocabulary measurements; FR-22 profile conformance (the three-profile matrix) and FR-23 migration rehearsal; a security pass against security's threat model; and FR-9 re-verified at any publication.

Exit. The named rows close with dates and setups. Depends on everything above.

What is deliberately not on the path

  • Question answering over memories. OML serves hits, not answers — ADR-0013 declines it.
  • Automatic extraction from conversations. The explicit-claims thesis declines it; the positioning page carries the boundary.
  • User or agent profiles. Declined; derived_fact claims and dreamer crews are the substitute, per the same boundary.
  • A web console. Declined in ADR-0015.