Voyage Roadmap

Voyage's events authoring + operator workspace. Currently in Polish-7 (simulator realism + operator QA feedback).

Operator dashboard + system-of-record for all Voyage tenant deployments. Live; federation Phase 2 + super-admin console build-out still open. 2026-06-08: Fleet admin 502 diagnosed + FIXED (admin-identity worker was missing the shared service secret → synced into both workers + reset the super-admin password; /v1/admin/summary 200); all 3 new tenants registered (16 total); Meridian edge-session fixed; and a ★ auto-register hook now self-registers every new deployment in the control-plane (live-verified idempotent: re-register Meridian → stays 16, no dup/FK). The ★ identity-architecture revisit (central super-admin IdP + per-account SSO federation, instead of injecting creds per tenant) is signed off (OIDC-first, central IdP at voyage-idp.porivo.com, Fleet-owned SSO config, cutover excludes JimWorld/NickWorld) and Phase 1 is building now — adding OIDC-provider endpoints to the central fleet/admin identity. Additive: no tenant login changes yet. North-star: Fleet grows into the super-admin console — a union of the JRNI Super-Admin Portal design + Voyage-specific controls (per-tenant module composition, provisioning, SSO federation, drift). Visibility is live today; the provision/deploy controls are the build-out (internal end-to-end est. late this week).

Mobile + desktop day-of coordinator surface. v-next design polish + guest ticket-type deployed 2026-05-31 (commit 495cecb4, Pages 2c9dbcd7) — feature markers grep-confirmed in the live bundle.

Generic demo tenant (appointments + queuing). Rebranded from "Golden 1" on 2026-06-12 following Cloudflare report 6d929a10b7d389d1 (trademark complaint). All Golden 1 Credit Union branding permanently removed. New hostnames: studio.demoone.porivo.com · coord.demoone.porivo.com

Forensic triage of Jim's Studio / Journey Builder feedback on studio.jimworld.porivo.com. 16 issues reproduced + root-caused with Playwright against the live UI, then queued. No fixes land yet — these touch the shared Voyage core repo the Coord redesign is actively changing, so this runs read-only until Coord settles. Jim's thread is pulled every loop; new issues append automatically.

The canvas-first WYSIWYG Journey Builder inside Studio — appointments · events · walk-in queues. Deployed + live on Aperture. Every operator-reported issue from this run is fixed, deployed, and live-verified: filter pills now list/filter all formats; events save with no staff host required; the eye icon is preview (not unpublish); booking links are now public customer pages (Staff pages) rather than studio-edit links; templates render in flex/grid layout. Latest (2026-06-08, deployed + live-walked across all 4 tenant studios): (1) ★ studio-shell now bounces unauthenticated users to login — the fake "Studio" placeholder user is gone; (2) staff/employee landing pages publish to a public host — meet.vxge-aperture.porivo.com/<employee> renders a clean public booking page (no studio chrome).

Voyage deployments (cross-sections of platform modules, not forks), all on the personal Cloudflare account + GitHub as peers of voyage-aperture. Fleet is the system of record — registry at 16, new deployments self-register. All four tenant Studios are live (login [email protected]):

• Aperture (events-only): studio.vxge-aperture.porivo.com
• Meridian (bank — events + appts + queues, 12 branches): studio.vxge-meridian.porivo.com
• JimWorld (empty events): studio.jimworld.porivo.com — login + create→publish working (regression GREEN live)
• NickWorld (empty events): studio.nickworld.porivo.com — login + events layer fixed (same deploy)

Operator 2026-06-08: stop declaring testing "complete" with untested swaths. The fix is a machine-checked coverage gate, not a promise.

• Each test plan's cases become a required-coverage manifest (Coord = 121 cases / 24 areas, extracted). A coverage-gate.mjs cross-checks the suite's tagged case-IDs against it and exits RED on any MISSING / SKIPPED / .fixme / FAILING case — silent skips forbidden. "Complete" = 121/121 implemented + passing + walked on the live host, real records read back. Per-case PASS/FAIL/MISSING report published here every run. (Gate built + proven: currently 0/121, RED.)

• 1. #70 Aperture full-stack (events + appointments + queues) — building now.
• 2. #75 Coord Events redesign — implement the Claude Design handoff (auth/dashboard/event-view/check-in/+1-group/run-an-app 8 apps/desktop) pixel-faithfully in apps/coord.
• 3. #76 Coord 121-case E2E + gate — every plan case as a live, read-back e2e; gate green = done.
• 4. #77 Page-building matrix — canvas/kiosk/staff-page/event design + events·appointments·queues composed in a landing page, same rigor + its own coverage gate (depends on #70 + #66).

Operator 2026-06-08 (hard mandate): the platform must NOT ship sample-data arrays / hardcoded "bags of strings". Everything renders from a live database; empty/loading state when no data — never fake. The bank staff leaking into Jim/Nick's accounts was one symptom.

Deep-scrub audit complete (2026-06-08): the read-only audit found 104 findings — 56 CRITICAL · 25 MODERATE · 23 LOW. It's platform-wide, not one fallback. Cleanup runs serially through 5 areas (each Claude deploys + live-walks):

• ~18 SAMPLE_* in App.tsx (session, account, CSV, segments, invites, campaigns, notification templates, locations, branding, plans, billing, help, guest imports, workspace general, hubs, email/SMS drafts) → real data hooks with empty/loading/error states; fixtures only behind the no-API local harness. (Landing-pages already done in L23.)

• 2. StudioShell public routes + builder defaults ✅ done + live (3 tenants) — public routes derive from payload / empty; no Aperture/Memory-Bank/Boston/Seaport/sample copy.
• 3. Journey runtime + JB staff/placeholders ✅ done + live (3 tenants) — journey/canvas render empty when no real data; defaults empty; events-worker no longer auto-seeds staff/availability.
• 4. ★ Workers + D1 migrations (most serious — persisted, not just UI) ✅ events scope done + live — migrations that SEED Aperture rows into live D1 (settings, segments, campaigns, billing, security controls/evidence, booking config, simulator events) must split schema-from-data; persona-manifest staff APIs → ✅ Operations → Staff screen RETIRED + aperture-base.json manifest deleted (#72, live on 3 tenants) — Team & roles is the single staff directory; auth session must not auto-create a demo admin.
• 5. Coord fixtures + story artifacts ✅ done + live — confined to DEV _Isolate; deployed Coord bundle has 0 sample tokens.

Each area completed gets marked here. Full finding table in the audit artifact (task #71).

• Team & roles / staff management — wired + walked. SettingsTeamRoute now hits the REAL identity admin API. Live on Aperture: real member list (20), Invite teammate persists (status invited) → appears under Pending after reload, role change persists (viewer→admin), remove works (20→19). No mock/no-op data.
• Integrations crash fixed on JimWorld/NickWorld. "Unexpected token '<' … not valid JSON" is gone — graceful-degrade + module-gate; event-only tenants hide it cleanly, Aperture stays surfaced. Walked live on both. Deployed: aperture c0a9a928, jimworld 0c89a1c5, nickworld 9c5839cc.

• ✅ Just shipped (L22): the single-kind "What kind of journey?" create screen is skipped for event-only accounts — opens straight on the starter step, no lone giant Event card. Deployed + live on Aperture.
• ✅ Done + walked (#69): JimWorld/NickWorld /landing-pages show NO staff booking pages and NO bank personas (appointments-gated; sample-bank fallback removed). Seeded both with real DB content (2026-06-08): 5 upcoming events each over the next 2 weeks (calendar populated, verified) + 3 event-facilitating staff each (active Team members — JW: Jordan Avery/Priya Raman/Marcus Hale; NW: Elena Vasquez/Devin Park/Aisha Bello — no appointments, no booking pages). Enough to test event creation.

• Aperture event create→publish→list→public: ✅ validated live. The publish-blocking 308 is FIXED (deployed to voyage-aperture-studio-api); the events-list discoverability bug is FIXED (new events were buried behind 2,442 rows); pages render correctly at studio.vxge-aperture.porivo.com/public/events/<slug> and meet.vxge-aperture.porivo.com/public/events/<slug>.
• ⚠️ Apex serves the legacy salon booking app: vxge-aperture.porivo.com/public/events/<slug> routes (via the site-router) to voyage-aperture-booking.pages.dev — wrong app. Operator: delete that old booking app (minor follow-up, task #66).
• JimWorld + NickWorld event public-page walks: ⏳ pending (deploy 308/list fix to their event workers + walk).
• Staff landing pages (bank/Meridian only — appointments-gated): ⏳ pending; Meridian has no public staff host yet. Event-only tenants (Aperture/JW/NW) correctly get NO staff pages.

Operator 2026-06-08: Aperture is a full-stack event-planning org — runs events, takes appointments (planners w/ availability), AND has walk-in queues. Building now: flip Aperture to event,appointment,queue + seed real planning data + purge bank/salon placeholder (absorbs the Area-4 live-D1 deletion). Manifest already composes booking/coord/events; services tables exist.

• Compose the appointments module (+ services + staff booking) into Aperture's deployment — events + appointments coexist.
• Real services: wedding planning, corporate product-reveal planning, gala/launch planning, … with event-planner staff (specializations) who take appointments + get real meet.* staff booking pages.
• Purge ALL bank/salon placeholder data — the Amara Okafor/Wealth Planner, Neville/Mortgage Adviser, Sarah/Senior Banker personas everywhere (SAMPLE_LANDING_PAGES fallback, seed SQL, catalog seed) → event-planning equivalents. (#70)
• JimWorld/NickWorld stay event-ONLY: no appointments/staff-booking pages; module-gate the staff-pages feature; seed only event-facilitating staff (team members/hosts, not appointment-takers). Fixes the JW/NW bank-staff-pages bug. (#69)

• Retire legacy voyage-aperture-booking app at the apex (#66) — re-point apex to the studio build + delete the salon app. Operator-confirmed; minor.
• Coord on JimWorld/NickWorld — deploy the per-tenant Coord stacks (queue + coord-api + frontend + hostnames + locations seed) per the turn-9 runbook; bake Coord into the tenant deploy pipeline.
• Remove useWhoami overrides (JimWorld/NickWorld) + redeploy normal studio — no per-tenant fake-user shim.
• De-Aperture-default sweep — ~13 hardcoded-Aperture fallbacks in shared workers (DEFAULT_TENANT_ID, CORS, publicBaseUrl, preview suffix) → explicit config + fail-loud.
• Event-publish → landing-page WIZARD redesign (new vs existing page; one-click event-as-only-thing) + module-gated create-types (Landing / Staff[appointments-only] / Kiosk) + per-tenant landing-page hosting in the deploy pipeline — design-first (Claude Design).
• Fleet federation Phase 2 (tenant OIDC RP → central IdP; Aperture/Meridian; operator-checkpointed) + the super-admin-console build-out.

Per-turn detail of every Polish-2 phase: turn-by-turn inbox, cumulative gate, operator-direction timestamps. The events-studio session republishes this on every oversight pass.