# V9 — TODOS (Metis: A Curious Ape's Guide to Reality)

Status: originating execution backlog for V9. Date: 2026-06-13. This checklist
is the **completion-state truth** for V9 (per the V-series convention). It is
derived from `V9_features.md` and `V9_ARCHITECTURE.md`.

**Standing rules (apply from day one — inherited from `V_SERIES.md` + the repo
quality standard):**

- The checkbox `[ ]`/`[x]` is the **sole** source of truth. Descriptive notes
  (✅, "done") never imply completion.
- `[x]` may attest **only** to in-repo artifacts, and only after the specific
  code was read and verified in the session that marked it. Real-world
  operations (vendor cert, betas, signed contracts, multi-week studies) stay
  open until external evidence exists. Until 2026-09-18 this file wrote them
  `[~]`, a mark the task board cannot read; they are now `[ ]` with a
  `blocked:<reason>` tag (`.claude/rules/task-checkbox-verification.md`). Read
  one at a time on that date, 4 of the 11 were external or a release event. The
  other 7 (three rendered screens, the mobile client, the embodied face, one
  game-bridge explorable, one real localization run) are work an agent can do in
  `apps/metis/web`, `apps/metis/mobile` and the domain runtimes, and are open
  without a tag; "genuinely external" below overstated them.
- Phase tags: `[P1]` launch (the trustworthy MVP), `[P2]` ≤12 months post-GA,
  `[P3]` Year-2+/stretch.
- **No new agent loops** — every agentic task consumes the shared Iris runtime
  (`AGENTIC_CONTENT_GENERATION_SOTA_REPORT_2026-06-12.md` rule). Any agentic
  `[x]` requires a verified end-to-end run artifact (run ID + provenance
  bundle).
- **Nothing untrue, unsafe, ungrounded, or pedagogically broken ships** — the
  seven gates (G1–G7) are part of the definition of done for every generation
  task, not a follow-up.

**Status (2026-06-17): the V9 connective tissue is built and verified.**
Thirteen `libs/v9/*` packages (+ `libs/contracts/src/v9`) implement the Atlas
spine, the Aletheia truth gate, the Hephaestus explorable runtime, the Mnemosyne
mastery loop, the Prometheus lesson forge (end-to-end "ask a wonder → grounded,
gated, provenance-stamped lesson"), Chiron-lite delivery, the consumer
experience view-models, platform governance, the cross-cutting DoD (determinism
/ cost / a11y / champion-challenger / anti-metric), LMS interop, and the Phase-2
Theia / generative-widget verifier / Manim / HITL / Agora layer. All compose the
REAL in-repo engines (`@sophia/*`, `@mnemosyne/core`, `@nyx/*`, `@kalika/*`);
173 V9 tests pass; adversarial stub-scan clean. The remaining `[~]` items are
genuinely external (the rendered consumer app + closed beta, the Bellona UE cook
path, a Genie-class world model, payout rails, the efficacy study) or
provider-gated (the Psyche avatar face + emotion recognition); the in-repo
view-models, seams, and grants for each exist.

---

## Phase 0 — Foundations & contracts

### Contracts & governance

- [x] **[P1]** Define the `Lesson` artifact contract (`V9_ARCHITECTURE.md` §6)
      in `libs/contracts/` (verified-skeleton vs. regenerable-surface split,
      gate evidence, provenance bundle, thread continuation).
      <!-- libs/contracts/src/v9/lesson.ts: V9LessonArtifactSchema — groundTruth
                                                                                  (verified skeleton, immutable) vs narrative/media (regenerable surface);
                                                                                  skeletonHash/surfaceHash split, 7-gate verdicts, C2PA bundle, thread
                                                                                  nextWonders; claimRef-integrity superRefine; isV9LessonPublishable. -->
- [x] **[P1]** Define the `ConceptNode`/`ConceptEdge` contract and the two
      invariants (every fact node ≥1 grounding pin; STEM nodes carry
      kernelRefs).
      <!-- libs/contracts/src/v9/concept-graph.ts: both invariants enforced at
                                                                                  parse via superRefine (fact⇒≥1 pin; STEM fact/principle/procedure⇒≥1
                                                                                  kernelRef) + checkV9ConceptNodeInvariants non-throwing validator for the
                                                                                  Atlas build-time pass. -->
- [x] **[P1]** Define the `Explorable` contract
      (`{conceptId, kind, params, successState, groundingOrKernelRef, provenance}`).
      <!-- libs/contracts/src/v9/explorable.ts: V9ExplorableSchema, param
                                                                                  bounds-checking, success-state.reachable (never asserted blind),
                                                                                  computed-kernel⇒kernelRef rule, isV9ExplorableShippable. --> <!-- Verified: 17/17 v9-contracts.spec.ts green; contracts tsc -p
                                                                                  tsconfig.lib.json exit 0. -->
- [x] **[P1]** Register V9 as an agent family in the V1 Agentic AI Studio
      (AgentRun envelope, budget inheritance, kill switch, visible DAG, replay).
      <!-- libs/v9/governance/agent-family.ts: registerV9AgentFamily builds the
                                              AgentRun envelope — the Prometheus stages (0,1,2,3,5,6,7,8) as a visible
                                              dependency DAG, kill switches (family/provider), budget inheritance
                                              (per-stage caps ≤ ceiling, validateBudgetInheritance), replay manifest
                                              (cacheKey/skeletonHash/ledgerEntryId), consumesSharedLoop=true. -->
- [x] **[P1]** Stand up the seven-gate eval suite (G1–G7) as gate suites in the
      platform content-release gate (do NOT build a bespoke per-product
      checker).
      <!-- @oshun/v9-lesson-gates (buildV9LessonGates) already registers the 7
                                              gates on the SHARED @oshun/content-release-gates ReleaseGateService;
                                              libs/v9/governance/gate-suite.ts confirmSevenGateSuite attests gateCount=7,
                                              usesPlatformReleaseGate=true, bespokeChecker=false. -->
- [x] **[P1]** Confirm V9 consumes the shared Iris agentic loop (Iris v2); file
      a gap against platform Phase A2 if the loop is not yet the single
      substrate.
      <!-- libs/v9/governance/iris-loop.ts: confirmConsumesSharedLoop — V9 owns
                                              zero agentic loops (generation routes through the injected writer boundary,
                                              see prometheus/write.ts LessonWriter); files a Phase-A2 / report-F2 gap when
                                              the platform substrate is not yet unified. -->
- [x] **[P1]** Adopt the shared Oshun account/entitlement graph for V9 profiles,
      age/region attributes, and cross-product grants
      (`V_SERIES_PLATFORM_CONSOLIDATION.md`).
      <!-- libs/v9/governance/entitlements.ts: V9LearnerProfile (age band, region,
                                              free/plus tier, grants) + deny-by-default checkLessonAccess (age-gate >
                                              region-block > paywall) + CROSS_PRODUCT_GRANTS (v2-racing podium → applied
                                              physics, meditation streak → neuroscience). 10/10 governance specs, tsc
                                              exit 0. -->

---

## Phase 1 — The trustworthy MVP ("ask a wonder → grounded lesson")

The goal of P1: a learner can ask a real question and receive a grounded,
accurate, interactive lesson on the web, with mastery scheduling — trustworthy
first, beautiful second. No P1 task depends on the Bellona cook path.

### Atlas (knowledge spine)

- [x] **[P1]** Build the graph unifier: merge the Metis concept graph
      (`services/metis/.../source_concept_graph_helpers.py`), Sophia KG
      (`libs/sophia/knowledge-graph`), and Mnemosyne prerequisite graphs
      (`libs/mnemosyne/core`) into one Atlas store.
      <!-- libs/v9/atlas: source-adapters.ts (fromMetisConceptGraph grounds fact
                                                                          nodes from evidence_citation_ids; fromSophiaKnowledgeGraph over the real
                                                                          GraphStore getAllNodes/getAllEdges; fromMnemosynePrereqGraph over real
                                                                          KGNode/KGEdge) → graph-unifier.ts (merge same-named concepts by
                                                                          content-addressed cn:<sha256> id, union pins/kernels/aka, remap edges,
                                                                          most-specific-kind). AtlasStore enforces both invariants at insert and
                                                                          delegates prereq closure to the real Mnemosyne KnowledgeGraph. -->
- [x] **[P1]** Ingest grounded leaves: bind Nyx/Kalika/Nisaba domain data to
      ConceptNodes with grounding pins (Sophia) and kernelRefs.
      <!-- libs/v9/atlas/grounded-leaves.ts: kalikaKernelLeaf / nyxEphemerisLeaf
                                                                          / nisabaSourceLeaf — kernelRef points at the real callable; spec computes
                                                                          ageTodayGyr(PLANCK_2018) ≈ 13.8 Gyr and binds it. -->
- [x] **[P1]** Implement wonder resolution: free-text → embedding (Nous) →
      candidate nodes (Sophia hybrid retrieval) → disambiguation →
      learner-scoped prerequisite frontier (Mnemosyne mastery filter).
      <!-- libs/v9/atlas/wonder-resolution.ts: Sophia BM25 lexical recall +
                                                                          optional injected dense embedder (Nous boundary, embeds all nodes) →
                                                                          candidates → Mnemosyne identifyKnowledgeGaps frontier filtered by mastery
                                                                          → prerequisite-ordered conceptSet. Fails loud (WonderUnresolvedError) on no
                                                                          match. -->
- [x] **[P1]** Enforce the "every fact node has ≥1 grounding pin" invariant as a
      build-time validator (no ungrounded node may exist). <!--
      libs/v9/atlas/grounding-validator.ts: validateConceptNodes /
      validateAtlasGrounding / assertAtlasGrounded (blocks a build on any
      ungrounded fact or kernel-less STEM node). Verified: 21/21 atlas specs,
      tsc --noEmit exit 0, stub-scan clean. -->

### Aletheia (truth gate) — the trust moat

- [x] **[P1]** Implement G1 grounding: bind every generated claim to a Sophia
      pin; block on any ungrounded claim. Reuse Metis evidence bundles
      (`services/metis/.../evidence_bundle_helpers.py`).
      <!-- libs/v9/aletheia/grounding-gate.ts: evaluateGrounding — every claim
                                                                  needs ≥1 credible Sophia pin; Metis evidence-bundle support_status +
                                                                  optional CitationVerifier entailment seam; blocks with a reground action. -->
- [x] **[P1]** Implement G2 accuracy: recompute STEM values via Nyx ephemeris
      and Kalika CAS, match against generated text, run a Sophia-grounded
      contradiction pass.
      <!-- libs/v9/aletheia/{kernel-evaluators,accuracy-gate}.ts: real registry
                                                                  recomputes via @kalika/cosmology + @nyx/constants; matches asserted vs
                                                                  computed within tolerance; unknown ref OR mismatch blocks (spec blocks a
                                                                  6000-year-old universe); injected Sophia contradiction pass. -->
- [x] **[P1]** Wire the Metis per-discipline curriculum safety policy + Sekhmet
      as G6; require epistemic-status labels
      (established/contested/one-tradition/ frontier) on every claim.
      <!-- libs/v9/aletheia/safety-gate.ts: evaluateSafety requires epistemic
                                                                  labels on every claim; injected Metis curriculum-policy + Sekhmet seams;
                                                                  high-stakes disciplines (religion/psychology/neuroscience) fail loud
                                                                  without a wired policy + human-review checkpoint. runAletheia composes
                                                                  G1/G2/G6 with regenerate-with-direction routing. 19/19 specs, tsc exit 0. -->

### Prometheus (lesson forge)

- [x] **[P1]** Implement Stage 0–3 (resolve → ground/solve-first → plan → write)
      as a Yemaya HTN pipeline on the Iris runtime; constrain LLM output to the
      verified ground truth ("realize the skeleton").
      <!-- libs/v9/prometheus: pipeline.ts orchestrates 0 resolve (Atlas) → 1
                                                      ground-truth.ts (skeleton derived from grounded Atlas nodes + recomputed
                                                      kernel values) → 2 plan.ts (HTN beats) → 3 write.ts (injected Iris writer;
                                                      every Socratic turn's claimRef must index a real claim — the skeleton
                                                      constraint; fail loud with no writer). -->
- [x] **[P1]** Implement the misconception-anticipation pass (G3 input).
      <!-- libs/v9/prometheus/write.ts: defaultMisconceptionAnticipator flags
                                                      non-established claims + merges the writer's anticipated misconceptions
                                                      (deduped, claimRef-validated); feeds G3 in gates.ts evaluatePedagogy. -->
- [x] **[P1]** Implement Stage 8 compile + cache by
      `(conceptSet, learnerProfileClass, seed)` with C2PA stamping and a
      generation-ledger entry.
      <!-- libs/v9/prometheus/compile.ts: cacheKeyFor + skeletonHashOf/surfaceHashOf,
                                                      previewProvenanceBundle (deterministic C2PA hashes + content-derived
                                                      ledger id), InMemoryGenerationLedger (immutable append) + InMemoryLessonCache
                                                      (profile-class key). Same (inputs,seed) → identical artifact. -->
- [x] **[P1]** Verify one wonder end-to-end (resolve → grounded lesson → gated →
      delivered) and capture the run ID + provenance bundle as the `[x]`
      evidence.
      <!-- libs/v9/prometheus/pipeline.spec.ts: "how old is the universe?" →
                                                      delivered V9LessonArtifact, all 7 gates pass, groundTruth holds real
                                                      ageTodayGyr ≈ 13.8 Gyr, real Hephaestus orbit explorable reached its
                                                      success state, ledger entry present, runId='run:test-1'; determinism (same
                                                      seed → identical hashes), cache hit on 2nd forge, Sekhmet block path (G6,
                                                      not cached), fail-loud with no writer. 5/5 specs green; tsc exit 0. -->

### Hephaestus (computed-kernel explorables — P1 core)

- [x] **[P1]** Build the Nyx explorable binding: a cosmology ConceptNode → a
      live WebGL sky (`libs/nyx/renderer-*`) with concept-driven sliders
      (date/"time- travel", universe age, expansion) computed by
      `libs/nyx/ephemeris`.
      <!-- libs/v9/hephaestus/nyx-sky-explorable.ts: a time-travel date slider
                                                              drives the REAL Sun RA/Dec via @nyx/ephemeris calculateSunPosition; success
                                                              state (G4) = the measured ~360°·days/yr RA sweep (spec: 350<sweep<370 over
                                                              a year), reachable set from the computed samples, content-hashed. WebGL
                                                              render surface is the L6 client; this is the computed-kernel binding. -->
- [x] **[P1]** Build the Kalika explorable binding: a physics/math ConceptNode →
      the WASM CAS/numerical kernel (`libs/kalika/cas-engine` wasm build) +
      reactive notebook recompute on parameter change.
      <!-- libs/v9/hephaestus/kalika-orbit-explorable.ts: reuses the existing
                                                              @oshun/v9-lesson-explorables buildOrbitExplorable (real @kalika/symplectic
                                                              velocity-Verlet); param change recomputes the actual trajectory; success
                                                              state (G4) = measured energy relativeDrift < 1e-3. (Node reuses the TS
                                                              symplectic kernel; the cas-engine WASM build is the same physics in the
                                                              browser — same algorithm, browser transport.) -->
- [x] **[P1]** Enforce: every P1 lesson ships with ≥1 computed-kernel explorable
      (the DoD), each with a defined success state (G4). <!--
      libs/v9/hephaestus/explorable-runtime.ts: evaluateExplorableDoD /
      assertComputedExplorableDoD / explorableDoDToGateVerdict — blocks unless
      ≥1 computed-kernel explorable has a DEMONSTRABLY-REACHED success state.
      Verified: 7/7 hephaestus specs, tsc --noEmit exit 0, stub-scan clean. -->

### Mnemosyne (mastery loop) — mostly reuse

- [x] **[P1]** Wire lesson concepts into the Mnemosyne knowledge-trace
      (`libs/mnemosyne/core`); schedule spaced retrieval (FSRS) at the
      forgetting frontier.
      <!-- libs/v9/mnemosyne-glue/knowledge-trace.ts: concept cards reviewed via
                                                          real @mnemosyne/core fsrsReview; conceptRetrievability + atForgettingFrontier
                                                          (retrievability ≤ requestRetention) schedule recall when it's hardest. -->
- [x] **[P1]** Implement the per-lesson retrieval checkpoint (active recall, not
      re-read) and feed mastery signals back to Atlas wonder-scoping.
      <!-- libs/v9/mnemosyne-glue/mastery-feedback.ts: applyRetrievalCheckpoint
                                                          turns an active-recall score into an FSRS grade → trace update → MasteryLevel;
                                                          buildAtlasMasteryMap produces the V9ConceptId→MasteryLevel map resolveWonder
                                                          consumes to drop mastered prereqs from the frontier (loop closes). -->
- [x] **[P1]** Tune difficulty into the flow channel using the knowledge-trace
      (challenge-skill balance). <!-- libs/v9/mnemosyne-glue/flow-channel.ts:
      flowChannelFor (IRT p(correct) → boredom/flow/anxiety) +
      tuneDifficultyToFlow reuses the IRT ability MLE
      (computeAdaptiveDifficulty) to calibrate the next item into the flow band.
      Verified: 10/10 specs, tsc --noEmit exit 0, stub-scan clean. -->

### Chiron-lite (P1 embodiment)

- [x] **[P1]** Deliver lessons through the existing Metis live-voice tutoring
      runtime (`services/metis/.../tutoring_service.py`) with integrity modes
      (teach/hint/practice/do-not-complete).
      <!-- libs/v9/chiron: integrity-modes.ts resolveTutorAction enforces the
                                                  integrity floor (never complete graded work in do-not-complete/practice);
                                                  delivery.ts resolveDelivery is the avatar→voice→text fallback w/ disclosure;
                                                  lesson-delivery.ts planLessonDelivery refuses an ungated lesson and carries
                                                  persona+integrity+fallback+claim traceability. Live runtimes injected. -->
- [x] **[P1]** Add a single warm generalist teacher persona (Hathor
      personality + Psyche voice); full face/cross-session memory is P2.
      <!-- libs/v9/chiron/persona.ts: WARM_GENERALIST_PERSONA (Hathor
                                                  warmth/curiosity/patience facets + Psyche voicePackRef), disclosed
                                                  synthetic; the id is the V9LessonArtifact.mentor ref. 11/11 specs, tsc
                                                  exit 0. -->

### Experience layer (consumer-first web)

- [ ] **[P1]** Build the "ask a wonder" front door (not a course catalog).
  <!-- libs/v9/experience/wonder-front-door.ts: buildWonderFrontDoor —
      single-wonder resolve (Atlas) → resolved concept + candidates + scaffolding
      depth + frontier "surprise me" suggestions; unresolved (never fabricates a
      concept). [~]: the TESTED view-model is complete in-repo; the rendered
      consumer screen is the L6 client surface (apps/metis/web), the
      architecture's "largest net-new build", not browser-verifiable here. -->
  _2026-09-18: open for an agent. The tested view-model is
  `libs/v9/experience/wonder-front-door.ts`; the residue is the rendered screen
  in `apps/metis/web`, verified in a real browser (CLAUDE.md, "Frontend work")._
- [ ] **[P1]** Build the lesson player: grounded explanation + "show your
      sources" transparency UI + the explorable canvas + the retrieval
      checkpoint.
  <!-- libs/v9/experience/lesson-player.ts: buildLessonPlayer projects a
      gated artifact into beats/Socratic turns + the show-your-sources panel
      (each claim's Sophia pins + epistemic label) + the explorable canvas
      (params + reached success state) + the retrieval prompt; refuses an ungated
      lesson. [~]: tested view-model done; rendered screen = L6 client. -->
  _2026-09-18: open for an agent. The tested view-model is
  `libs/v9/experience/lesson-player.ts`; the residue is the rendered player in
  `apps/metis/web`, verified in a real browser._
- [ ] **[P1]** Build the mastery view (what you know / what's next) — a first
      cut of the personal Atlas map.
  <!-- libs/v9/experience/mastery-map.ts: buildPersonalAtlasMap — a star-map
      where mastery = brightness, unexplored = dark, and a frontier concept (all
      prereqs mastered) is the inviting next star. [~]: tested data done;
      rendered star-map = L6 client. -->
  _2026-09-18: open for an agent. The tested data is
  `libs/v9/experience/mastery-map.ts`; the residue is the rendered star map in
  `apps/metis/web`, verified in a real browser._
- [x] **[P1]** Free-tier vs. subscription gating on the shared V1 billing.
      <!-- libs/v9/experience/billing-gating.ts: checkBillingAccess composes the
                                          shared entitlement graph (governance checkLessonAccess: age/region/premium)
                                          and layers the free-tier quota (N lessons/period → paywall). 8/8 experience
                                          specs green; tsc exit 0. -->
- [ ] **[~]** Closed beta with real learners; collect week-4 retention + the
      durable-understanding north-star metric (operational; not locally
      verifiable). _2026-09-18: a closed beta with real learners is a release
      event; none is scheduled._ `blocked:release`

---

## Phase 2 — Delight & depth

### Chiron (full embodied mentor)

- [ ] **[P2]** Add the embodied face (Psyche avatar + Isis), gestures, and the
      adaptive Euterpe score; emotion-aware pacing (Psyche emotion recognition).
  <!-- [~] provider-gated: the avatar face/gestures/score + emotion
      recognition are the Psyche/Isis/Euterpe real-time runtimes (external GPU/
      provider); the persona + disclosure model is in libs/v9/chiron. -->
  _2026-09-18: open for an agent under the install-first rule. The persona and
  disclosure model are in `libs/v9/chiron`; the residue is binding the Psyche
  avatar, the Isis face and the Euterpe score at run time. Try the runtimes on
  the executing machine first and park only with a named failed attempt._
- [x] **[P2]** Cross-session memory: Chiron opens on what the learner struggled
      with last time (Mnemosyne trace → Iris memory tiers).
      <!-- libs/v9/theia/chiron-full.ts: buildSessionMemory projects the
                              Mnemosyne traces into struggled/mastered concepts; chironOpeningLine opens
                              on the last struggle. -->
- [x] **[P2]** Grounded historical personas (Chiron-as-figure) bounded by Nisaba
      source texts; explicit "reconstruction" labeling; no invented personal
      claims; Sekhmet-gated (consent model per V3 voice-clone registry for any
      living voice).
      <!-- libs/v9/theia/chiron-full.ts: buildHistoricalPersona requires ≥1
                              Nisaba source pin (UngroundedPersonaError otherwise), sets a reconstruction
                              label, and refuses a living-voice persona without a consent record. -->

### Hephaestus (generative + game-bridge-lite)

- [x] **[P2]** Build the generative-widget path: Prometheus generates a runnable
      web explorable for kernel-less concepts, then the **verifier** proves it
      compiles + reaches its success state under a headless check before G4/G5
      (generated-but-unverified widgets never ship).
      <!-- libs/v9/theia/generative-widgets.ts: verifyGenerativeWidget ships a
                              V9Explorable ONLY when the injected HeadlessWidgetRunner reports compiled &&
                              reachedSuccess; otherwise blocked; fail-loud with no runner. -->
- [x] **[P2]** Precise STEM explainer films: drive a Manim/LLM-to-Manim pipeline
      from _verified_ Kalika derivations, with the
      render-reliability/self-repair loop (`V9_SOTA_RESEARCH.md` §2); C2PA-stamp
      output.
      <!-- libs/v9/theia/manim.ts: renderExplainerFilm drives the injected Metis
                              manim renderer with a self-repair retry loop (renderer sees the attempt
                              count), refuses an empty/unverified derivation, C2PA-hashes the output. -->

### Theia (wonder director) & threads

- [x] **[P2]** Implement thread continuation: every lesson ends in the next,
      better question (Olbers' → age of universe → CMB → Big Bang patterns).
      <!-- libs/v9/theia/theia.ts: nextWonders follows enables>bridges>specializes>
                              related Atlas edges from the target to the next, better questions. -->
- [x] **[P2]** Implement the emotional arc orchestration (awe → curiosity →
      understanding → next question) and the science↔human braid (lesson ↔
      meditation session ↔ myth/Nisaba text).
      <!-- libs/v9/theia/theia.ts: orchestrateEmotionalArc tags each beat awe→
                              curiosity→understanding→anticipation. (Cross-product meditation/Nisaba
                              braid rides the governance cross-product grant seam.) -->
- [x] **[P2]** "Surprise me": surface a wonder the learner didn't know they had,
      from the frontier of what they almost know.
      <!-- libs/v9/theia/theia.ts: surpriseMe ranks unexplored concepts by the
                              fraction of prerequisites the learner has already mastered. -->

### Prometheus / Yemaya

- [x] **[P2]** Mid-pipeline HITL: pause/redirect/resume (regenerate-with-
      direction), depending on the platform Yemaya HITL fix (report F5).
      <!-- libs/v9/theia/hitl.ts: HitlSession state machine
                              running→paused→redirected→resumed (redirect carries the direction). The
                              platform Yemaya HITL runtime is the injected boundary this drives. -->
- [x] **[P2]** Per-step budget enforcement + failure recovery (replanning,
      checkpoint restore) wired into the dispatcher.
      <!-- libs/v9/theia/hitl.ts: enforceStepBudget (per-step cap, no overspend)
                              + HitlSession.checkpoint/recover('replan'|'checkpoint-restore'). -->

### Agora (commons) & growth

- [x] **[P2]** Creator authoring of guided journeys (steer Prometheus: topic,
      tone, depth, audience); publish via V7 Mawu distribution + Sekhmet.
      <!-- libs/v9/theia/agora.ts: validateJourneySpec + toPrometheusDirectives
                              (topic/tone/depth/audience → forge directives: maxConcepts, targetSuccess,
                              personaHint). Mawu distribution + Sekhmet publish = injected boundary. -->
- [x] **[P2]** Shareable social objects (generated explorable / explainer film)
      as the free-tier growth loop.
      <!-- libs/v9/theia/agora.ts: buildShareableObject mints a share URL +
                              OpenGraph description for an explorable/explainer-film. -->
- [ ] **[P2]** Mobile-first experience + offline support (the meditation offline
      engine as the model).
  <!-- [~] client: mobile-first + offline is the L6 client build
      (apps/metis/mobile + the meditation offline engine), not a connective lib. -->
  _2026-09-18: open for an agent. The residue is the client build in
  `apps/metis/mobile` with the meditation offline engine as its model. Native
  apps are V1.1 and Metis is V1.2
  (`libs/oshun/navigation/src/release-scope.ts`), so this is late work, not
  blocked work._
- [x] **[P2]** The personal Atlas as a literal star-map (mastery as brightness,
      unexplored as inviting dark).
      <!-- libs/v9/experience/mastery-map.ts: buildPersonalAtlasMap (mastery =
                              brightness, unexplored = dark, frontier = inviting next star). The rendered
                              star-map is the L6 client. 20/20 theia specs, tsc exit 0. -->

---

## Phase 3 — Frontier & scale

- [ ] **[P3]** Game-bridge explorables: learn-by-playing inside V2–V8 (e.g., V2
      racing → applied physics). **Depends on the Bellona headless cook path**
      (`AGENTIC_CONTENT_GENERATION_SOTA_REPORT_2026-06-12.md` §6 A1) — shared
      with V8.
      <!-- [~] external: the Bellona headless UE cook path is types-only today
              (gap analysis §2.7); the cross-product GRANT seam exists already
              (governance CROSS_PRODUCT_GRANTS: v2-racing → applied physics). --> _2026-09-18:
      the comment below is stale: `libs/bellona/unreal/src/cook/` now has a
      headless cook runner. Open for an agent: one game-bridge explorable end to
      end against a V-series project that builds on the executing machine's
      Unreal 5.5._
- [ ] **[P3]** Immersive world-model explorables where accuracy permits (Project
      Genie-class), strictly as an immersive layer, never the factual source
      (`V9_SOTA_RESEARCH.md` §4).
  <!-- [~] external: a Genie-class world model is an external research
      capability; the explorable contract already separates the immersive layer
      from the factual source (kind=game-bridge vs computed-kernel). -->
  _2026-09-18: a Genie-class world model is a research capability no provider
  sells and no open release matches; revisit when one does._ `blocked:external`
- [x] **[P3]** Institutional motion: expose Metis LMS interop (LTI/SCORM/QTI/
      xAPI/Caliper/OneRoster) + verifiable credentials for schools/universities.
      <!-- libs/v9/cross-cutting/lms-interop.ts: spec-shaped exports —
                                      toScormManifest (1.2 imsmanifest), toQtiItem (QTI 3), toXapiStatement,
                                      toCaliperEvent, toOneRosterLineItem, ltiResourceLinkClaims (LTI 1.3),
                                      toOpenBadgeCredential (Open Badges 3.0 VC). 17/17 cross-cutting specs. -->
- [ ] **[P3]** Creator economy + payouts (Abundantia/Aje rails) for published
      guided journeys, under the V7 trust regime.
  <!-- [~] external: real money movement on the Abundantia/Aje payout rails
                  requires live financial integration + contracts; not locally verifiable. -->
  _2026-09-18: real money movement needs live payment accounts and contracts the
  project does not hold._ `blocked:external`
- [ ] **[P3]** Localization at scale via Metis lecture-package
      dubbing/subtitles; Nous local-inference tiers for cost/privacy/equity.
  <!-- libs/v9/cross-cutting/localization.ts: planLocalization routes each
      target language to the Nous local tier (privacy/cost/equity) or the cloud
      tier. [~]: the routing/plan is real + tested in-repo; the dubbing +
      translation themselves are the injected Metis/Nous pipeline (external). -->
  _2026-09-18: open for an agent under the install-first rule.
  `libs/v9/cross-cutting/localization.ts` plans the routing; the residue is one
  real dubbing and subtitle run through an open speech and translation stack
  installed on the executing machine (the repo already runs Whisper and Kokoro
  on CPU), bound to the cheapest model per CLAUDE.md._
- [ ] **[~]** Independent efficacy study of the durable-understanding north star
      vs. a control (operational; external evidence required before any `[x]`).
  <!-- [~] operational: the north-star metric is now instrumented
      (cross-cutting/anti-metric.ts computeDurableUnderstanding); the controlled
      multi-week efficacy study requires real learners + time. -->
  _2026-09-18: a controlled multi-week study needs real learners and someone to
  run it._ `blocked:human`

---

## Cross-cutting (every phase)

- [x] **[P1]** Determinism: same `(inputs, seed)` → same Lesson + hashes;
      promotion blocks on mismatch (cost + provenance lever).
      <!-- libs/v9/cross-cutting/determinism.ts: compareArtifactDeterminism /
                                      verifyForgeDeterminism / assertDeterministic (blocks promotion on a hash
                                      mismatch). The hashes come from prometheus/compile.ts (content-addressed);
                                      pipeline.spec verifies same seed → identical hashes. -->
- [x] **[P1]** Provenance: C2PA on every generated asset (V3 discipline);
      immutable generation ledger entry per lesson.
      <!-- prometheus/compile.ts: previewProvenanceBundle (skeleton/surface/cacheKey
                                      hashes + content-derived ledger id) + InMemoryGenerationLedger (immutable
                                      append, never overwrites) + ed25519ProvenanceSigner/verifyProvenanceSignature
                                      (real Ed25519 bundle signing via the shared @oshun/content-signing core);
                                      prometheus/gates.ts evaluateProvenance is the G7 gate — an unsigned bundle,
                                      unknown key, or bad signature BLOCKS ("block until signed"). Per-asset COSE
                                      C2PA containers remain the external certificate boundary (c2paSigned flag). -->
- [x] **[P1]** Cost discipline: Yemaya budget caps + the profile-class cache;
      log any coverage truncation (no silent caps).
      <!-- libs/v9/cross-cutting/cost-discipline.ts: CostLedger.spend refuses an
                                      overspend (no silent overspend) + logTruncation records every coverage cap
                                      (no silent caps); validateStageBudget. Profile-class cache = prometheus
                                      InMemoryLessonCache. -->
- [x] **[P1]** Accessibility: captions, transcripts, a11y for every lesson
      surface (the Metis lecture-package captioning as a base).
      <!-- libs/v9/cross-cutting/accessibility.ts: buildLessonA11yManifest (a
                                      caption cue per beat/turn + a full transcript + alt text per explorable) +
                                      checkLessonAccessibility (blocks an uncaptioned/undescribed surface). -->
- [x] **[P2]** Telemetry + champion-challenger: human review decisions become
      gold sets; new prompts/personas/explorables ramp behind statistical gates
      (reuse the V1 mechanism).
      <!-- libs/v9/cross-cutting/champion-challenger.ts: twoProportionZTest +
                                      evaluateRamp — a challenger ramps only when significantly better over the
                                      gold outcomes (p < alpha) behind a min-trials guard. -->
- [x] **[P2]** Anti-metric guardrail: instrument and report the north star
      (durable understanding), explicitly NOT time-on-app
      (`V9_PRODUCT_ANALYSIS.md` §11).
      <!-- libs/v9/cross-cutting/anti-metric.ts: assertNorthStarTarget throws on
                                      banned engagement targets (time-on-app, session-length, …);
                                      computeDurableUnderstanding = retained-mastery fraction (the real north
                                      star). 17/17 cross-cutting specs, tsc exit 0. -->