What we built, what's
broken, and where
we point next.
Every merged PR, every doc, every open issue in both repos — read, clustered, and sequenced into releases. Thirty minutes. Five blocks. Decisions marked in magenta.
/internal/decks.How this half hour runs
1 · What shipped
Two repos, one quarter. Per-person contributions. The docs layer nobody sees.
2 · Notices
Things that are true in production right now and that you did not necessarily know. Money is being lost in two places.
3 · Decisions
Seven calls that only Liz can make. Each has a recommendation attached. This is the block that must not get cut.
4 · The roadmap
What the backlog is actually about, and the next four releases now that they have contents.
5 · Velocity
The 50%-of-Liz target, what it really costs, and the campaign + gauntlet plan that is the only way to get there.
∞ · Goblins
Closing reminder. Deadlines are made up.
Since May 1st
themultiverse.school
| 44 | Enrollment & payments |
| 40 | Curriculum & content |
| 26 | Design & frontend polish |
| 25 | Observability & incidents |
| 24 | Scholarships & mutual aid |
| 23 | Infra, deploy & CI |
| 23 | Admin & internal tools |
| 21 | Agents & AI |
| 21 | Docs & process |
| 16 | Matrix & chat |
| 15 | Marketing & growth |
multiversecampus
| 43 | Video calls & presence |
| 39 | World & gameplay |
| 30 | Docs & process |
| 24 | Social spaces & rituals |
| 23 | Matrix & chat |
| 23 | Infra, deploy & CI |
| 15 | Agents & AI |
| 13 | Observability & incidents |
| 10 | Curriculum & content |
| 7 | Admin & internal tools |
| 6 | Auth, security & privacy |
The things people will remember
Mutual Aid Intake & Routing
School. Three phases: de-identified board, routing engine, admin queue. A whole subsystem from spec to production.
Campus × School database unification
Two products, one Postgres. The migration that makes cross-service features possible at all.
Proximity call bubbles + teleport
Campus. Walk near someone, you're in a call. The single most product-defining thing shipped this quarter.
70 OpenSpec capability specs
Campus. Every subsystem — agents, pets, payments, captions, quests — has a written spec. This is why agents can work on campus at all.
Tiered scholarship slots
School. Funded per-class pool plus payment-derived capacity. A seat is half list price.
GlitchTip → deduped GitHub issues
Errors become tickets automatically. Validated end to end. The single biggest "make silent failures loud" win.
Wall of Cohorts + Campus Calendar
Campus. Cohort badges, click-to-zoom plaques, a bulletin-board kiosk. Whimsy is load-bearing.
Off-site backups that actually verify
R2 cold storage with a check that fails closed on real object freshness. Layer 3 had been silently dead for months.
Design system extraction
Campus. @multiversecampus/ds with shared tokens. Frontend work stops being bespoke.
Who did what
| Person | PRs 60d | PR/wk | Centre of gravity |
|---|---|---|---|
| lizTheDeveloper | 407 | 47.5 | Everything. Enrollment, curriculum, docs, world, infra. Agent-amplified — see the velocity block. |
| lizthedotdev | 84 | 9.8 | Observability and analytics across both repos, plus campus call reliability. The person who makes things measurable. |
| vrnico | 43 | 5.0 | Campus social spaces and the release mechanics — Wall of Cohorts, paint layers, and the 1.14.0 stable promotion. |
| meganirenegott | 34 | 4.0 | Community Resource Commons on school; Theater Ghost Light and world features on campus. Owns the mutual-aid surface. |
| Aelius23 | 2 | 0.2 | Email and enrollment fixes. |
| HumboldtJoker | 1 | 0.1 | Campus auth. |
| copilot-swe-agent | 2 | 0.2 | Autonomous fixes — scholarship manager, CRM query repair, campus call bugs. |
What each person shipped
lizthedotdev — the instrumentation layer
- Analytics tracking across every user-facing page, both repos
- Nice Things testimonials widget propagated to all admin pages
- Campus call reliability: 11 PRs on camera/mic acquisition, reconnect loops, render churn
- Observability was their top cluster in both repos
vrnico — the world and the release
- Wall of Cohorts: cohort math, click-to-zoom plaque cards, wood cycle-numbers
- Campus paint layers — render plumbing and persistence
- Ran the 1.14.0 stable promotion (main → production)
- Highest lines-per-PR on the team by a wide margin
meganirenegott — the community surface
- Community Resource Commons Phase 2 — dedupe, category, browse, migration
- Agent Crawl + Volunteer Board
- Theater Ghost Light — interactive hope reflection with reusable prompts
- Fixed unmet-needs resource visibility and a 429 rate-limit on load
The agents — a real contributor now
- copilot-swe-agent landed the mark-and-sweep deletion protocol
- Autonomous issue triage closed five campus issues in one PR
- Bug-motel triage runs unattended
- Auto-filed error issues — though see the notice about missing stack traces
221 documents nobody announced
Campus — 145 files
- A 16-chapter player manual. Getting started, calls, agents, quests, economy, housing, pets, moderation, admin tools.
- 70 OpenSpec capability specs — one per subsystem, from
agent-tool-systemtophishing-aquarium. - Process docs: automated routines, automation framework, release process, stabilization strategy.
School — 76 files
- 38 design specs and implementation plans under
docs/superpowers/. - Runbooks: disk capacity, Matrix bot, helpdesk triage, error tracking, GDPR retention.
- Strategy: versioning, cohort calendar, release enforcement, junior-dev max impact.
Why this is the highest-leverage thing on the slide
Every agent session boots cold. What is written down is free to every future session — yours, mine, and the fleet's. What is in someone's head is a tax paid on every context switch. The 70 campus specs are the reason a fresh agent can work on the pet system without breaking the economy.
The catch
Campus issue #812 is blunt about it: audit and tech-debt markdown files look like trackers but are unmaintained snapshots. TECH_DEBT.md lists items that were fixed weeks ago. Stale docs misdirect every agent that boots from them — at fleet scale that is not untidiness, it is steering the fleet into a wall.
Money is leaving through two holes
No Stripe webhook points at campus
$19.00 was collected from two students and never fulfilled. Zero of eight paid checkouts have ever completed. The checkout works; the fulfilment half was never wired.
Three more paid things that don't deliver
Animation credits are charged and never fulfilled. Silly-walks has no UI at all, yet its $5 credit pack is live — a purchase buys five unspendable credits. Gift purchases check the cap against the buyer and fulfil against the recipient.
All transactional email on campus is dead
SENDGRID_API_KEY is unset and email.ts never consults Secret Manager. 348 verification emails sent, 0 ever completed. Every one of those is a student who tried to join and couldn't.
An open P0 credential-hygiene item
Labelled P0-critical and still open. Campus #680 is the same shape. Details are deliberately not on this page — see the internal copy.
Things that were quietly broken
Unmet-needs email, silent since June 10
School #776. Sends route through the mark-as-sent endpoint instead of actually sending. Two months.
Mutual-aid pipeline dies mid-run
School #777. InterfaceError: cursor already closed after the board card is created, so group invites never run.
Disk hit 100% and crashed Postgres
School #778 / campus #1071. Happened Aug 2; nobody knew until Aug 4. Fixed, but there was no disk alerting and Redis still has no memory cap.
Agents cannot speak in campus chat
Campus #911. overhead_speak is granted to zero agents, so it has never once been called.
1,107 sent emails belong to nobody
School #779. NULL from_student_id means they appear on no CRM timeline.
Auto-filed error issues have no stack trace
School #770. The pipeline files them; they can't be triaged. The automation looks like it's working.
Agent cost accounting is entirely NULL
Campus #1034. 74,504 rows, five months, no cost data. The only model in use isn't in agent_models.
Migration ledger has false positives
School #708. Three columns recorded as applied but missing in prod. A ledger row is not proof it ran.
Groq quota at 92%, overage discarded
Campus #1053. 13 sites dispatch with a raw fetch and never take a rate-limit slot.
The pattern across all nine: the thing reports success and does nothing. That is this organisation's signature failure mode, and it is why "does it make silent failures loud?" is the first question on the scoreboard.
Seven calls only you can make
Adopt the versioning strategy — and settle the number
Two documents disagree. VERSIONING_STRATEGY.md says school starts at 4.0.0; issue #606 still proposes 2.0.0. The milestones I just filled are all named 4.2.x, so the doc is winning by default. Recommend: ratify 4.0.0 and close #606.
Two milestones are both called 1.15.0
One undated holding 98 issues, one dated Aug 27 holding 5. Nobody can tell which is real. Recommend: keep the dated one, rename the undated one to a backlog milestone, and move its contents into the C-series.
Staff read-only infra visibility
34 school issues and 34 campus issues are labelled needs infra access. That is 17% of the entire backlog blocked on one permission decision — the single largest structural blocker we have. Recommend: ship #841 as a C0 item this cycle.
Groq spend: raise the quota or cut the work?
We're at 92% and most of the overage is discarded work, so we're paying for tokens we throw away. Two different fixes with different budgets. Recommend: fix the limiter first (#1035), re-measure, then decide on quota.
Three subsystems are waiting to be told whether they live
Neon database references — clean up or keep for preview branches? Outline wiki — keep, finish, or retire? Which volunteer subsystems survive? All three are labelled needs validation and all three block downstream work. Recommend: answer all three in this meeting; any answer beats the ambiguity.
Campus prod ↔ main reconcile
The branches have diverged in both directions — 171 commits prod-only, 209 main-only. Campus cannot be versioned until a human leads that reconcile, and versioning is a prerequisite for the release gates. Recommend: schedule it as a named cutover, never as an outage.
Secrets hot-swap before the Stripe key rotation
#287 (restart-free rotation) blocks #288 and #290. We will not rotate a live Stripe key without it, so the payments-microservice extraction is stalled behind an infra task. Recommend: confirm that ordering explicitly so nobody re-litigates it.
Open questions about the product, not the code
Do we broaden curriculum beyond AI-only student projects?
School #745. Currently every student project is an AI project. Is that the identity or an accident?
How do mid-cohort joiners enter Founding Federation?
School #744. The cohort structure assumes you start on day one. Most people don't.
Should sponsors be able to fund a seat without taking one?
School #780. The metadata never reaches the enrollment decision in any of the three paths, so today the answer is functionally "no."
Do we push one-time buyers toward membership?
School #666 and #680. A real change in how the school asks people for money. Worth a deliberate yes or no.
What happens to the hard-to-navigate themes?
School #652 and #724. Fifteen themes have a broken enroll path, which is why random theme rolling is off. Repair them, or curate them into a Theme Museum and stop rolling them?
Is quiz-based archetype matching how we pair students?
School #740. A pedagogy question wearing a feature request's clothes.
What 395 open issues are actually about
Campus — 297 open
tech-debt label — the largest single label in either repo.
School — 98 open
The whole backlog is now sequenced
Both backlogs were mostly unsequenced — 96 of 98 school issues and 144 of 297 campus issues had no milestone, and every release milestone for the next month was empty. 241 issues moved. Nothing is unfiled now. 54 of them are labelled needs-triage-confirm, which is the filter to open if you want to correct my guesses in one pass.
| Milestone | Open | The thesis |
|---|---|---|
| 4.2.x off-cadence | 12 | Broken in production right now. Ships when ready, not on a Thursday. |
| 4.2.304 Aug 13 | 19 | Revenue & enrollment integrity, plus the versioning epic. Nothing silently loses money. |
| 4.2.404 Aug 20 | 20 | Mutual aid actually responds, and the job board ships with a conduct policy. |
| 4.2.504 Aug 27 | 29 | Cohort end. Lifecycle email, repeat enrollment, Founding Federation structure. |
| 4.3.0 Sep 3 — new | 18 | Next cohort-end unstable release. The agent and security epics land here. |
| Someday new | 7 | Blocked on a decision, not on capacity. Revisit when slide 10 is answered. |
| C7 new | 24 | Calls are reliable. Created today. The biggest cluster in either repo had no home. |
| C0 | 47 | Platform integrity, machine-verified. Now also holds the R-series automation work. |
| C4 | 31 | Agents behave. Tool-call correctness and the student conversation path. |
| C2 | 23 | The world is solid. Rendering and navigation defects hit before any feature. |
| C1 | 21 | Onboarding works. Every Founding Federation support ticket is one bug in ten costumes. |
| C5 | 20 | The play loop closes. Loops that start and never finish. |
Two new homes were created for work that had nowhere honest to go: 4.3.0 — unstable (cohort end) for the next cohort bump, and Someday — needs a decision first, which holds the seven issues that are genuinely blocked on slide 10's decisions rather than on capacity. Someday is not a graveyard; it is the queue that unblocks the moment you answer.
Read-ahead: the next three releases
Nothing silently loses money
- #780 Direct class sponsorship — metadata never reaches the enrollment decision in all three paths
- #768 Dashboard says "eligible to enroll" for tiers that
POST /enrollrejects - #665 Daily Stripe → DB reconciliation alert
- #664 Webhook error-rate alerting + regression test for
process_single_charge - #663 Enrollment heartbeat — alert when the flow stalls
- #735 Synthetic monitoring on the signup funnel
- #724 Repair the enroll path in 15 broken themes
Mutual aid actually responds
- #736 Automate unmet-needs responses by tag and geography, with clinical-intake summarisation P0
- #737 Community resource library — sparse packs and a hard limit at 10
- #729 Stop auto-routing scholarship applicants into the unmet-needs form
- #733 / #732 / #731 Clean mistagged data, fix admin summaries, add a location field
- #420 Pack quality, analytics and Matrix provisioning
- #455 / #456 Volunteer visibility and the resource vetting workflow
Cohort end: lifecycle and growth
- #680–#687 Seven lifecycle email campaigns: upgrade frequent buyers, win back lapsed, superfans, next class
- #666 Convert one-time buyers into recurring members
- #667 Suggested next classes to drive repeat enrollment
- #688 Auto-answer student FAQs from inbound triage
- #110 Post-class email
Note: SendGrid does not honour our unsubscribes. Confirm suppression handling before any campaign goes out.
The C-series is the better idea
Campus milestones aren't named after dates — they're named after claims that can be machine-verified. "Money works." "Agents behave." "The world is solid." Each one is falsifiable, which means it can actually be closed.
C0 — Platform integrity
33 open. Migrations, config drift, alerting, retention, job delivery.
C1 — Onboarding works
14 open. 348 verification emails, 0 completions. Class auto-placement has never fired.
C2 — The world is solid
14 open. Collision is dead in prod; the maps table is empty and isAreaBlocked fails open.
C3 — Safety and moderation
8 open. Faculty can ban admins; the moderator role is shadowed by requireAdmin.
C4 — Agents behave
22 open. 47 tool-grant mismatches; 24 implemented tools granted to nobody.
C5 — The play loop closes
13 open. 7,684 open housing tasks with no resolver; 0 of 130 catches ever submitted.
C6 — Money works
5 open. See the notices. This is the one with a dollar figure attached.
C7 — Calls are reliable
21 open. New today. The product's core promise and its biggest cluster.
A measure, and deliberately not a target
Read the first card before the chart. The number below is something to look at, not something to hit. Liz has been explicit that the moment it becomes a target it stops being a useful measure — and that applies to the agents as much as to people.
Read this first
Liz's rate is one person with an agent fleet and no approval queue. Comparing a human's week against it compares two different machines, not two people. Nobody here is behind.
The Soviets judged every factory on tonnage. Chandelier factories responded rationally, and buildings fell down. When a measure becomes a target, it ceases to be a good measure.
What the gap is actually made of
Leverage, not effort. Nobody closes a gap this size by working harder — and trying to is the failure mode, not the fix. It closes by running campaigns instead of tasks and building verifiers once instead of hand-checking every change.
Which is why the next three slides are about machinery, and this one is only about arithmetic.
The number worth watching instead
Verified merges per person per week — a merge with a breadcrumb saying what was verified and how. That is the thing that actually describes this job.
For completeness: 50% of the trailing 60-day average is 23.1 PRs/week. I checked whether release plumbing inflates it — 11 of 407, about 3%. Look at it once, then go read the scoreboard.
Campaigns, not tasks
A campaign is: a defined "done", a fan-out of parallel agents, centralised verification, and a continuous stream of small landed PRs. A 118-file logging sweep is one campaign; treating it as 118 tasks is how humans stay slow. Here are the campaigns the backlog is already asking for.
Campaign: kill the ON CONFLICT class
Campus #1061. 563 upsert sites, one carries a predicate, two confirmed silently failing. Enumerable, parallelisable, mechanically verifiable — the ideal fan-out.
owner: lizthedotdevCampaign: agent tool-grant reconciliation
Campus #1015. 47 mismatches — 20 granted tools with no LLM definition, 24 implemented tools granted to nobody. One agent per mismatch.
owner: meganirenegottCampaign: structured logging sweep
~118 files of raw console.log, no levels, no structure. Low-risk, directory-parallel, and it directly upgrades production debuggability.
Campaign: the tsc + failing-test burn-down
~113 pre-existing tsc errors and ~100 failing tests are why campus CI gates are continue-on-error. Burn each baseline to zero, then flip the gate.
Campaign: the seven lifecycle emails
School #680–#687. Same shape seven times: segment, template, send, measure. One agent per campaign, one human verifying the segment SQL.
owner: meganirenegottCampaign: re-audit the stale docs
Campus #812. One agent per debt category, rewrite TECH_DEBT.md against reality. Shrinking that file is a scoreboard win in itself.
Test gauntlets: the racetrack, not the trophy
The rule that makes velocity safe: the faster you go, the cheaper and louder verification must be. Our defining incident was enrollment webhooks silently broken for four months. Moving at agent velocity with hand-verification habits doesn't avoid that incident — it delivers it ten times faster.
Gauntlet 1 — the PR gate has to bite
Campus #653. Build, typecheck, lint, test, migrations as a required status check. Today typecheck and lint swallow their own failures and the test job is continue-on-error. A gate that cannot fail is decoration, and at fleet pace decoration is dangerous.
Gauntlet 2 — a scratch Postgres in CI
Campus #893, flagged as the highest-yield detection change available. Most of C0's findings — empty tables, dead collision, unfired auto-placement — are things a test against a real database would have caught on the PR.
Gauntlet 3 — per-PR verify harness
Campus #659. Evidence attached to every PR, so review is "read the evidence" rather than "re-derive the claim." This is what makes one human able to verify a fleet's output.
Gauntlet 4 — auto-rollback on failed smoke test
Campus #656. Plus #654 prod↔main drift report and #655 armed-flag / env-drift audit. Three of our worst incidents this quarter were env drift, not code.
Gauntlet 5 — synthetic monitoring on the funnel
School #735, plus #663–#665. A robot buys a class every hour. If it can't, we know before a student does. This is the direct antidote to the four-month webhook outage.
Gauntlet 6 — adversarial review before human eyes
Every implementing agent gets a fresh-context agent told to attack the diff. No shared session — shared context means shared blind spots. You end up reading pre-hardened diffs.
The 90 days, in three moves
Build the racetrack
- Burn the tsc and failing-test baselines to zero
- Flip campus CI gates to blocking (#653)
- Scratch Postgres in CI (#893)
- Branch protection on both repos (#667, school #608)
- Ship staff read-only infra visibility (#841) — unblocks 68 issues
Exit: a red build stops a merge, in both repos, without a human asking it to.
Run the campaigns
- Each engineer owns one named campaign from slide 17
- Five or six lanes each: 2–3 background, 1 review, 1 spec, 1 human
- Mornings write specs, afternoons verify and merge
- Launch the long fan-outs at end of day — wake up to a review queue, not a to-do list
Exit: the PR-per-week line bends, and it bends because of fan-out, not overtime.
Close the C-series
- C6 first — it has a dollar figure
- C1 next — 348 students bounced off the front door
- C7 next — every support ticket lives here
- Then C0 as continuous background work
Exit: each closed milestone is a claim we can defend with a machine check, not a feeling.
How we'll know it worked
The scoreboard, in order
1 · Does it make silent failures loud?
Highest value in this org, always. Nine of the notices on slide 9 existed because something reported success and did nothing.
2 · Does it make the other four people — or the agents — faster?
This is what a gauntlet is. Build the verifier once, get it free on every future change.
3 · Does a student feel it directly?
348 people could not finish signing up. That outranks almost everything.
4 · Does it compound?
Docs, specs and skills make every future session smarter. That is why 221 documents is a headline number.
Not on the scoreboard
Lines of code
398,730 added lines in 60 days from one person. It means almost nothing on its own.
Agent-hours burned
Tokens are the cheapest resource we have. Verification attention is the most expensive.
PR count, taken literally
A task that generates 5,000 lines nobody can verify is a bad task at any speed. Chase the count and we'll get splitting.
The one number worth adding
Verified merges per person per week. A merge with a breadcrumb saying what was verified and how. That is the number that actually describes this job.
Things the team should know
The campus manual exists
Sixteen chapters, docs/manual/. If a student asks how something works, the answer is probably already written.
70 OpenSpec specs exist
openspec/specs/ on campus. Read the spec before touching a subsystem — it is why agents can work here.
Preview deploys are real
PR + deploy-preview label → your branch in the live world on an isolated DB. One click, behavioural verification. Capped at 6 per repo.
You can query prod without SSH
The prod DB query MCP is live. 90-day hashed tokens, Redis kill-switch, same safety rails as sql_agent.
Hetzner CI is the only gate
ci/hetzner-lint via scripts/ci-check.sh. GitHub Actions was removed. School's gate runs the unit suite; campus's is typecheck-only today.
PRs target production, not main
On school. main is far behind. Merging to production auto-deploys staging, which auto-migrates the shared prod database.
Deploy skills exist
deploy-school, deploy-campus, setup-local. Ride the rails before building your own.
Never plan an outage
Restructure it as a live cutover with a rollback plan. This is a standing rule, not a preference.
Whimsy is load-bearing
A broken quest isn't whimsical, it's sad — and a soulless one is worse. Delight holds the same bar as correctness.
What breaks if this meeting changes nothing
We keep taking money we don't fulfil
Eight paid checkouts, zero completions, and four separate purchase paths that charge without delivering. This is the kind of thing that stops being an engineering problem and becomes a trust problem.
The front door stays shut
348 verification emails, zero completions, and class auto-placement that has never fired once. Every marketing campaign on slide 14 pours students into a door that doesn't open.
17% of the backlog stays frozen
68 issues blocked on needs infra access. That is not a prioritisation problem we can solve by prioritising harder.
The gates stay decorative
While CI can't fail, every velocity increase raises risk linearly. Move 2 without Move 1 is the four-month webhook outage at fleet speed.
Campus can't be versioned
Until the prod↔main reconcile, a version number for campus would be a claim we can't honestly make — and the release gates depend on it.
The docs rot faster than they're written
221 documents is only an asset while they're true. Stale docs actively misdirect the fleet, which is worse than no docs.
Leaving this room with
Seven decisions answered
Versioning number, duplicate 1.15.0, infra access, Groq spend, the three keep-or-kill calls, campus reconcile scheduling, and the secrets-rotation ordering. Any answer beats the ambiguity.
Six product questions triaged
Not necessarily answered — but sorted into "decide now", "needs student data", and "not this quarter".
The data map read, before the next schema change
463 tables, 207 empty, and one identity fracture sitting under a dozen open bugs. It is the shortest path to understanding why campus features look broken.
One campaign owned per engineer
Named, with a defined "done", starting this week. Slide 17 has the candidates and a proposed owner for each.
Move 1 sequenced ahead of everything
Gates that bite, a scratch Postgres in CI, branch protection, and #841. Agreement that this goes first in priority.
We are goblins.
Deadlines are
made up.
Every date on every milestone in this deck is a story we tell so that work has a shape and so that we can notice when something has quietly stopped moving. Thursday is release day because we said so, and it is a good rhythm, and it is completely invented.
What is real
A student who can't sign up. Money taken and not delivered. A test that would have caught it. Those are real and they don't care what day it is.
What is made up
Aug 13. Aug 20. Aug 27. The 90 days. The number 23.7. All of it is scaffolding. If the scaffolding starts carrying more weight than the building, tear it down and build new scaffolding.
What we don't compromise
Verification. Nobody gets to ship what they haven't checked because a made-up date was approaching. That is the one place the goblin rule does not apply.
Miss a date, move the date. Miss the verification, and you have given the whole team a bug to find later at ten times the cost. Go be goblins about the calendar and be ruthless about the evidence.