What SongForgeAI is building.

Fifteen foundational discipline items, each ratcheting a real CI gate. Tier A = this quarter. Lives at the engineering punch list on GitHub — all 50 items + Tier B/C/D plans.

• #1Kill explicit-any allowlist

  Build 1178

• #2jsdom + first real renderHook test

  Build 1174

• #3Design tokens module

  Build 1175

• #4Bundle-size CI gate

  Build 1176

• #5Golden-evals CI gate

  Build 1177

• #6Kill the unchecked-index allowlist *(B1597 CLOSEOUT: cumulative 166 → 0 (100%). B1595 cleaned components/CoverArt.tsx (15 \u2014 hexToRgb signature widened to absorb 12 + RGBA pixel-stride asserts for 3); B1596 cleaned lib/genre-profile.ts (15 \u2014 ! on every GENRE_PROFILES static-key lookup since each key is guaranteed in the record); B1597 cleaned admin/lineage/page.tsx (30 \u2014 narrow-once locals in the Fruchterman-Reingold force-layout loops). Allowlist now empty. Tier-A item closed.)*

• #7Kill the strict-tsc allowlist *(B1600 CLOSEOUT: cumulative 37 → 0 (100%). B1598 cleaned dashboard/page (4 dead-code orphans deleted: EvalDeleteButton + handleDeleteEval + upgrades pipeline). B1599 cleaned dashboard/SongDetail (10 violations: unused destructured hook returns + handleSunoExport orphan). B1600 cleaned forge/page (56 violations \u2014 ~40 dead imports from EXTRACT-1 factory pattern + 9 dead destructured hook fields + 2 orphan closures + cascading dead-setter cleanup). Allowlist now empty. Tier-A item closed.)*

• #8Kill the console-log allowlist *(B1586 CLOSEOUT: 10 → 0. Cumulative since B1037: 251 → 0. Tier-A target hit. Final 8 calls migrated to logger.info: forge/criticalSend (2 in create-stream-plumbing), mycelial-pathways, data-intelligence/orchestrator, manhattan/creative-debt, manhattan/skill-frontier, side-effects/cover-art, side-effects/focus-group. Two legitimate exclusions documented in the script: observability/logger.ts (the canonical sink) and developer/page.tsx (a JS code snippet inside a multi-line backtick template). The exclusions are commented inline in scripts/check-console-log.ts.)*

• #9Visual regression with Playwright toHaveScreenshot() (every page, every breakpoint) *(B1185: e2e/visual.spec.ts snapshots 8 public surfaces with dynamic-content masks (SongCounter, ShippingThisWeek, leaderboard, hero canvas). Per-platform baseline path (Linux is the CI source of truth). Tightened threshold 0.20 → 0.15. CI auto-uploads new baselines + diff PNGs as artifact for PR review. Single-breakpoint (1280x800) for now; mobile + tablet breakpoints land as follow-up when the desktop baseline is stable.)*

• #10A11y audit with axe-core in CI, block on serious violations

  Build 1179

• #11Storybook for every primitive (Button, Card, Badge, Input, ScoreBadge, etc.) *(B1602 deferred; **B2358 stand-up + B2372 closeout**. B2358 installed Storybook 8.6 + the first 3 stories (Button 12, Chip 10, ScoreBadge 9). B2372 shipped the remaining 7 (Disclosure, Surface, MetadataRow, NextActionPair, TrustBlock, FooterLadder, CrucibleVoiceIcons) in a single Audit 2026-05-14 A16 batch — every design-system primitive now has a story file with realistic args + variant coverage. Item flipped to closed at B2421 (the punch list lagged the actual shipment by ~50 builds; B2421 caught the drift during a punch-list audit).)*

• #12Real component library (replace ad-hoc Tailwind with <Button intent="forge" size="md">) *(B1602 kickoff: Button primitive shipped \u2014 typed intent="forge|ai|outline" + size="sm|md|lg", polymorphic <button> / <Link> via href prop, loading state with spinner, leadingIcon/trailingIcon slots. First migration: dashboard BillingTab upgrade CTA (next/link \u2192 Button href=...). 11 contract tests assert intent/size class composition + canon-compliance (no off-palette utilities, no rounded-3xl, no inline gradients). Closes when 30+ btn-* call sites are migrated to Button + the design-canon gate adds a forbid-rule for raw <button className="btn-*">.)*

• #13Type-generated Supabase schema (database.types.ts regenerated on migration; no hand-typed table shapes) *(B1186 prep: workflow + npm script + placeholder + freshness check shipped. CLOSEOUT B1761: four-build chain landed the criteria — B1756 typed factory createTypedServiceRoleClient() scaffold + 6 contract tests; B1757 operator ran npm run db:gen-types + types regenerated against live schema (32 tables, 4 RPCs, schema 14.4); B1758 wave 1 migration (admin/regression-check + admin/costs, launderer ceiling 13 → 11); B1761 wave 2 migration (admin/forge-metrics + admin/cost-per-song, ceiling 11 → 8, including FULL/FALLBACK dynamic-select dead-code removal). Five admin routes now use the typed client; row types narrow against the live schema; the placeholder is gone; the freshness check would fail loudly if a migration drifted the types. Item closed.)*

• #14Zod runtime validation on every SSE event (no trusted casts) *(B1180: PipelineEventSchema + CrucibleEventSchema; runtime validation in withSSEStream, forge create-stream-plumbing, and crucible route. 34 schema tests covering valid variants + drift catalog. Catches typo'd type discriminators, missing required fields, mixed envelope drift (text vs message). Critical events that fail validation get replaced with a generic error envelope so the client never sees a corrupt payload.)*

• #15Discriminated-union state for ForgeResult (Draft | Evaluated | Gauntleted, each with required fields) *(B1181: ForgeSongState union + deriveSongState() pure derive function in src/app/forge/song-state.ts. useSongState() hook combines useForgeSessionState + useGauntletState through deriveSongState. 20 unit tests cover every transition path including the partial-Gauntleted guard. Source-of-truth state stays in the existing hooks; consumers migrate to the union as files are touched.)*

• B4442Surprise me can no longer roll a "Male" vocal over a soprano seed — the Vocal now matches the seed's voice.10-10
• B4441the 2026-10-10 Deep Audit's follow-ups are on the backlog — 5 new rows, 4 folded into existing ones, and the audit's own mistake recorded.10-10
• B4440Deep Audit 2026-10-10 filed; the sitemap parses again, the Crucible stops claiming "zero stored", and the pricing and forge pages describe the pipeline that actually runs.10-10
• B4439album and Song-Novel track forges now show up in cost telemetry — one row per track.10-09
• B4438the admin cover batch can no longer overwrite a good cover with fal's black safety frame; today's builds recorded in the backlog.10-09
• B4437the Song-Novel story pass moves to Claude Opus 5.5 — it won the pre-registered blind test 6-0.10-09
• B4436the Song-Novel story pass gets its own model task, and its Opus-vs-Sonnet test is pre-registered.10-09
• B4435AI cover art no longer saves a black square when fal's safety filter trips — it retries with a people-free prompt, then falls back honestly.10-09
• B4434the Tournament Forge's extra drafts read draft 1's prompt cache instead of each re-writing it (~$0.40 off every song).10-09
• B4433Forge v5 goes live — every single forge is now the Tournament Forge (3 drafts, blind debiased judging, legibility check, repair only on a named wound).10-09
• B4432Forge v5, the Tournament Forge, is built dark and its A/B is pre-registered.10-09
• B4431a rejected repair no longer leaves its lyrics in the saved song; the dead cold-reader call is retired.10-09
• B4430the gauntlet writer moves to Claude Opus 5.5; refine measured worse on Opus and stays on Sonnet 4.6.10-09
• B4429the song writer moves to Claude Opus 5.5 at effort medium — measured first, and only the forge core moves.10-09
• B4428make the request layer Claude-5.x-safe — per-model thinking, max_tokens headroom, thinking-free responses, refusal fallback — and arm the Forge Lab to measure Opus 5.5 on the production prompt. No production route changes model.10-08
• B4427the forge still 400'd after B4426 — the effort strip never reached the wire. Fixed in the fetch shim and proven against the real API.10-08
• B4426forge down in production — roll the model routes back to the last-known-good 4.x generation.10-08
• B4425follow-up (Master Punch List): production RLS verification recorded; the auto-apply migration pipeline found blocked since ~2026-06-06 — 45-row ledger reconciliation prepared. Docs-only; folds into the next deploy.10-08
• B4425close the two database P0s — scope 12 "service role" RLS policies to service_role, enable RLS on 4 unprotected tables, and stop signed-in users rewriting their own tier/credits.10-08
• B4424docs: refresh AUTO-STATE after the cadence sweep10-08

Auto-pulled from git log. Regenerated on every push (the snapshot is committed). Never goes stale.

• Build 4422 — migrate to Claude 5.x generation

  Build 4422

  Opus 5.5 / Sonnet 5.5 / Haiku 5.5

• new skill songforge-forge-frontend — the /forge client/React conventions the 25-skill k…

  Build 4421

  new skill songforge-forge-frontend — the /forge client/React conventions the 25-skill k…

• recalibrate the prosody FATAL threshold — the 79%-FATAL /admin/prosody-report reading w…

  Build 4420

  recalibrate the prosody FATAL threshold — the 79%-FATAL /admin/prosody-report reading w…

• admin forge-metrics compares real production songs by promptPath — the lean-prompt cuto…

  Build 4419

  admin forge-metrics compares real production songs by promptPath — the lean-prompt cuto…

• forge parse-rejects now leave a durable, queryable footprint — the failure rate is meas…

  Build 4418

  forge parse-rejects now leave a durable, queryable footprint — the failure rate is meas…

• the two forge-failure paths fixed — a false-positive regression removed, and the trunca…

  Build 4417

  the two forge-failure paths fixed — a false-positive regression removed, and the trunca…

• the Substack initiative enters the record — content half done, operator queue tracked.

  Build 4416

  the Substack initiative enters the record — content half done, operator queue tracked.

• the newsletter is assembled and claims-cleared — one publication-create away from launch.

  Build 4415

  the newsletter is assembled and claims-cleared — one publication-create away from launch.

• the market-and-engage plan enters the record — "Measured Craft", one ICP, ~3 hrs/week…

  Build 4414

  the market-and-engage plan enters the record — "Measured Craft", one ICP, ~3 hrs/week…

• the autonomous stretch enters the record — three deep-validity items now wait only on t…

  Build 4413

  the autonomous stretch enters the record — three deep-validity items now wait only on t…

• the human panel is one Prolific link away — the blinded rating surface ships.

  Build 4412

  the human panel is one Prolific link away — the blinded rating surface ships.

• the judge-tier pin lands before anything can breach it, and the counterfactual bracket…

  Build 4411

  the judge-tier pin lands before anything can breach it, and the counterfactual bracket…

• the nightly run enters the record — two closes, four partials, the flip-window cluster…

  Build 4410

  the nightly run enters the record — two closes, four partials, the flip-window cluster…

• the lab claims enter the register, the stale flagship claim is struck, and the /vs clai…

  Build 4409

  the lab claims enter the register, the stale flagship claim is struck, and the /vs clai…

• DATA: Make the taste-test the homepage secondary CTA. Move from `/leaderboard` footer…

  Make the taste-test the homepage secondary CTA. Move from `/leaderboard` footer to homepage hero slot.

• STANDARDS: Ship `npm install @songforgeai/scoring-rubric` — pure data + helper functions,…

  Ship `npm install @songforgeai/scoring-rubric` — pure data + helper functions, MIT-licensed. Every install is a citation.

• DISTRIBUTION: Free tier: 100 calls/month, no card required. Get the SDK in every developer's…

  Free tier: 100 calls/month, no card required. Get the SDK in every developer's hands.

• VELOCITY: Continue ratchet stack expansion: cyclomatic complexity ceiling,…

  Continue ratchet stack expansion: cyclomatic complexity ceiling, dependency-cycle ceiling, untested-public-API ceiling, prompt-token-budget ceiling.

Five public commitments with target dates. Slipping a date isn't fatal — but it's logged, and the next Bet Review explains why. No vapor.

• First real testimonial on the homepage

  Distribution

  Due 2026-05-14

  176d overdue

  One named, attributed quote from a real user — not staff, not company-authored. Lands in the TestimonialsSection registry (lib/testimonials.ts); the section currently renders an honest "we don't ship fabricated testimonials" disclosure card while the registry is empty (B2025).

• Founder Loom walkthrough (10 min)

  Distribution

  Due 2026-05-09

  181d overdue

  Solo-operator + AI-pair tour through the forge → score → refine loop. Posted on the homepage above the fold + the about page.

• Inngest Phase 2B — audio generation off SSE

  Velocity

  Due 2026-05-31

  159d overdue

  Multi-step Suno API pattern routed through the queue so the user-facing forge stream is no longer blocked on audio. Phase 1 (cover-art) and 2A (focus group) already shipped in B1429 + B1550.

  Track status →

• First external academic citation of the Lyric Scoring Standard

  Standards

  Due 2026-06-30

  129d overdue

  A music school, ISMIR paper, or third-party tool that imports @songforgeai/scoring-rubric and credits the standard by name + version. The npm package shipped at v1.1.0 in B1759.

  Track status →

• 100 npm installs of @songforgeai/scoring-rubric

  Distribution

  Due 2026-07-31

  98d overdue

  Adoption-counter milestone. Today: 0 installs. The badge on /scoring/standard updates live; this is the first crossing of the threshold where the standard has measurable real-world reach.

  Track status →

• DATA: Recruit 10 paid songwriter raters at $500/quarter each. (45-day milestone.)

  Recruit 10 paid songwriter raters at $500/quarter each. (45-day milestone.)

• DATA: Recruit 50 paid contributors active by month 12.

  Recruit 50 paid contributors active by month 12.

• DATA: Hum Test corpus (B1303): once 6 months of data lands, publish first…

  Hum Test corpus (B1303): once 6 months of data lands, publish first longitudinal-recall analysis.

• DATA: Quarterly calibration report cadence: "Rubric v1.X was calibrated against N…

  Quarterly calibration report cadence: "Rubric v1.X was calibrated against N human preferences with Y% agreement at 13+pt score gaps."

• STANDARDS: Quarterly RFC cycle, public. RFC-0002 (Anti-Platitude) shipped privately at…

  Quarterly RFC cycle, public. RFC-0002 (Anti-Platitude) shipped privately at B1255. Future RFCs go through 7-day public comment via `/rfc`.

• STANDARDS: Academic paper route: submit to ICCC 2027 or ISMIR. The rubric + anti-inflation…

  Academic paper route: submit to ICCC 2027 or ISMIR. The rubric + anti-inflation discipline + calibration corpus = a real paper.

• STANDARDS: Lyric Scoring Foundation prep: when corpus reaches 10K+ entries and 3+…

  Lyric Scoring Foundation prep: when corpus reaches 10K+ entries and 3+ third-party citations, file the non-profit paperwork.

• DISTRIBUTION: Co-branded proposal to Suno + Udio: API tier, integration docs, OG-cards on…

  Co-branded proposal to Suno + Udio: API tier, integration docs, OG-cards on shared songs that show our seal.

• DISTRIBUTION: "Powered by Lyric Scoring Standard" badge: SVG + HTML snippet at…

  "Powered by Lyric Scoring Standard" badge: SVG + HTML snippet at `/developer/embed`.

• DISTRIBUTION: B2B sales motion: music supervisors, sync licensors, music-rights orgs.…

  B2B sales motion: music supervisors, sync licensors, music-rights orgs. Reproducibility seal IS the legal-grade evidence they need.

• DISTRIBUTION: Zapier/Make integration on top of the existing webhook outbound (B1274).

  Zapier/Make integration on top of the existing webhook outbound (B1274).

• VELOCITY: `/engineering/punch-list` public page that updates from `docs/PUNCH-LIST.md`.…

  `/engineering/punch-list` public page that updates from `docs/PUNCH-LIST.md`. Recruiting tool.

• VELOCITY: Codify the Deep Pass Protocol cadence: 4x/year, one major subsystem per quarter.

  Codify the Deep Pass Protocol cadence: 4x/year, one major subsystem per quarter.

• VELOCITY: Open-source `@songforgeai/quality-tools`: Forbidden Archive parser, audit…

  Open-source `@songforgeai/quality-tools`: Forbidden Archive parser, audit scripts, ratchet checkers.

• VELOCITY: Quarterly "X builds shipped, Y ratchets tightened, Z punch list items closed"…

  Quarterly "X builds shipped, Y ratchets tightened, Z punch list items closed" public report.

• Mobile-first forge UX

  Current flow is responsive but desktop-first.

• Songwriter-craft certification program

  Pass X metrics → get a badge. B2B-adjacent and community-building.

• Cluster-pillar SEO reorganization

  33 songwriting guides regrouped into hub-and-spoke clusters. Current structure is flat.