Cambium Execution Backlog

Date: 2026-03-28

Purpose

This backlog is the current ordered list of the meaningful work still outstanding for Cambium.

It replaces the older assumption that repo verification and architectural enforcement were still broken. Those items are now closed. What remains is the real platform work: durability, request-context consistency, production hardening, OAuth hardening, and the newly added AutoResearch primitive.

Current Verification Snapshot

As of 2026-03-28:

• pnpm turbo typecheck passes
• pnpm turbo test passes
• pnpm turbo build passes
• pnpm check:architecture passes
• CI runs those checks in .github/workflows/verify.yml

Backlog Rules

1. Do not start broad new product-surface work before P0 truth gaps are closed.
2. Prefer work that makes an existing claim true over work that only expands scope.
3. Each completed item must leave the repo in a better verified state than before.
4. Every item must define explicit done criteria before implementation begins.

Closed Items

These items are no longer open backlog work:

1. Repo-wide verification integrity
2. Architectural enforcement tooling

Priority Order

P0 — Truth and durability

1. Quorum policy persistence
2. Budget persistence
3. Audit persistence
4. Cortex intent persistence
5. Lifecycle persistence
6. Workspace auth-context propagation

P1 — Operational hardening

7. Loom E2E coverage
8. Production-mode startup and runtime hardening
9. OAuth hardening and operator-path rationalization

P2 — New product capability

10. AutoResearch core primitive
11. AutoResearch safety and governance
12. AutoResearch observability and Loom surface
13. Obadiah integration for AutoResearch

P3 — Follow-up alignment

14. Docs and PRD maturity alignment
15. AutoResearch advanced features

Item 1 — Quorum Policy Persistence

Spec:

• 14-durable-state-completion.md

Outcome:

• Quorum policies are durable in PostgreSQL and no longer memory-only in production mode

Dependencies:

• none beyond the current passing repo baseline

Current repo reality:

• services.ts still wires InMemoryPolicyStore
• pg-policy-store.ts is still a placeholder

Item 2 — Budget Persistence

Spec:

• 14-durable-state-completion.md

Outcome:

• Budget enforcement survives restart and is backed by PostgreSQL

Dependencies:

• Item 1 recommended first

Current repo reality:

• services.ts still wires InMemoryBudgetStore

Item 3 — Audit Persistence

Spec:

• 14-durable-state-completion.md

Outcome:

• Audit trail is durable and type-consistent

Dependencies:

• Item 1 recommended first

Current repo reality:

• services.ts still wires InMemoryAuditStore
• pg-audit-store.ts exists but is not the production path

Item 4 — Cortex Intent Persistence

Spec:

• 14-durable-state-completion.md

Outcome:

• Intent decomposition state is durable and restart-safe

Dependencies:

• Item 1 recommended first

Current repo reality:

• services.ts still wires InMemoryIntentStore
• PgIntentStore exists, but is not currently used in the Loom service graph

Item 5 — Lifecycle Persistence

Spec:

• 14-durable-state-completion.md

Outcome:

• Lifecycle state is no longer process-memory-only

Dependencies:

• Item 1 recommended first

Current repo reality:

• services.ts still wires in-memory cycle, topic, autonomous-intent, and lifecycle-compost stores

Item 6 — Workspace Auth Context and API Consistency

Spec:

• 15-workspace-auth-context-and-api-consistency.md

Outcome:

• Authenticated routes derive workspace from request context instead of hardcoded defaults

Dependencies:

• Item 1 recommended first

Current repo reality:

• middleware.ts authenticates requests but does not propagate a request-context contract
• runs/route.ts still has an explicit TODO and hardcoded workspace
• Multiple API routes still default to 'default' from query/body instead of authenticated context

Item 7 — Loom End-to-End Coverage

Spec:

• 16-loom-e2e-and-production-hardening.md

Outcome:

• Browser-level operator flows are validated in CI

Dependencies:

• Item 6 preferred

Current repo reality:

• There is no Playwright config and no browser-level E2E suite in the repo
• Loom currently only has middleware.test.ts

Item 8 — Production-Mode Startup and Runtime Hardening

Spec:

• 16-loom-e2e-and-production-hardening.md

Outcome:

• Production startup fails fast on missing critical config and does not silently degrade to unsafe modes

Dependencies:

• Item 1 through Item 6 strongly preferred

Current repo reality:

• services.ts still silently falls back to memory mode
• services.ts starts provider monitoring immediately for the hardcoded default workspace
• OAuth routes still rely on permissive env fallbacks like localhost defaults

Item 9 — OAuth Hardening and Operator-Path Rationalization

Spec:

• 11-oauth-and-auth-middleware.md
• 16-loom-e2e-and-production-hardening.md

Outcome:

• The supported OAuth flow is singular, documented, tested, and operator-usable

Dependencies:

• Item 6 preferred

Current repo reality:

• oauth.ts still exports the stub flow alongside the real HTTP flow
• oauth start route encodes state but does not persist it for callback validation
• auth callback route decodes state but does not verify it against server-side session state

Item 10 — AutoResearch Core Primitive

Spec:

• prd-autoresearch-primitive.md

Outcome:

• Cambium has a first-class AutoResearch primitive with typed config, session lifecycle, experiment records, and a Hypha-backed propose/apply/evaluate/compare/decide/log loop

Dependencies:

• Item 1 through Item 6 strongly preferred

Current repo reality:

• AutoResearch is currently present in docs only; there is no @cambium/autoresearch package, session runtime, or API surface

Item 11 — AutoResearch Safety and Governance

Spec:

• prd-autoresearch-primitive.md

Outcome:

• AutoResearch sessions enforce isolation mode, per-session budgets, per-experiment timeout handling, Quorum approval thresholds, Seed rollback, Immune anomaly detection, and composting of failed experiments

Dependencies:

• Item 10

Item 12 — AutoResearch Observability and Loom Surface

Spec:

• prd-autoresearch-primitive.md

Outcome:

• Loom exposes active and completed AutoResearch sessions, experiment history, improvement curves, alerts, and operator controls

Dependencies:

• Item 10
• Item 11 strongly preferred

Item 13 — Obadiah Integration for AutoResearch

Spec:

• prd-autoresearch-primitive.md

Outcome:

• Obadiah can launch, monitor, pause, stop, and summarize AutoResearch sessions, including overnight brief integration

Dependencies:

• Item 10
• Item 11

Item 14 — Docs and PRD Maturity Alignment

Spec:

• 01-current-state.md
• 02-remediation-plan.md

Outcome:

• Reality-check docs reflect the actual repo state and no longer describe already-closed verification gaps as open

Dependencies:

• none

Item 15 — AutoResearch Advanced Features

Spec:

• prd-autoresearch-primitive.md

Outcome:

• Multi-objective optimization, modifier libraries, cross-session learning, and collaborative stigmergic experiments are added after the core primitive is proven

Dependencies:

• Item 10
• Item 11
• Item 12

Suggested Next Implementation Sprint

If Ralph is going to pick these up sequentially, the best next sprint is:

1. Item 1 — Quorum policy persistence
2. Item 2 — Budget persistence
3. Item 3 — Audit persistence
4. Item 6 — Workspace auth context and API consistency
5. Item 4 — Cortex intent persistence

That sequence closes the biggest truth gaps without starting new product surface area too early.

Suggested AutoResearch Entry Sprint

Once Item 1 through Item 6 are sufficiently closed, the best AutoResearch entry sprint is:

1. Item 10 — AutoResearch core primitive
2. Item 11 — AutoResearch safety and governance
3. Add minimal API controls for launch, pause, resume, stop
4. Add minimal session/result visibility before full Loom polish