🗺️ Phase roadmap: tech + business, with what's already done (companion to #83)

Companion to #83 (business model decision of record). #83 says what we are building and for whom. This issue says in what order, and — just as important — what is already done.
Date: 2026-08-27 · Horizon: 12 months · Operating mode: solo founder, side project alongside a full-time job

---

How to read this

Two umbrellas, five phases each. Every phase has a Definition of Done — a single condition that must be true before the next phase starts.

• [x] = done and verified in the repo today
• [ ] = not done
• 🔴 = blocks the next phase · 🟠 = needed within the phase · ⚪ = nice to have
• 🅿️ = deliberately parked (see #83 Part 8)

Deliberately kept at capability level. Which library implements SSO or rate limiting is not a roadmap decision.

---

Where we actually stand today

Age	~8 weeks (first commit 2026-07-03)
Hand-written app code	33,403 LOC
Pages	77 across 8 route groups
Data models	111 (~34 have zero app code touching them)
Server-action modules	23
Unit tests	102 cases / 13 files ✅ passing in CI
End-to-end tests	14 cases / 2 specs ⚠️ written, not wired into CI
Migrations	4 (schema frozen behind a CI gate)
Open issues	55
Paying customers	0
Revenue collected	₹0
Live payments	No
Legal entity	Not registered

The honest read: the product is roughly 70% of the way to a first B2B sale. The company is roughly 10% of the way there. Almost every remaining blocker is on the business side, not the engineering side — which is the inverse of where the last 8 weeks went.

---

🛠️ UMBRELLA A — TECH

Phase T0 — Foundation ✅ COMPLETE

This is the part that's genuinely done. It is a lot, and it is good.

Identity & tenancy

• Multi-tenant model with distinct tenant types (creator / enterprise / university / hiring partner)
• Email + password and social sign-in, email verification, password reset
• Two-factor authentication
• Organizations, teams, dynamic roles, seat invitations
• Enterprise single sign-on paths (OIDC + SAML) with domain verification — built, never tested against a real identity provider (#63)
• Tenant application → admin approval workflow
• Session storage with a secondary cache layer

Catalog & authoring

• Courses, sections, lessons, categories, resources
• Cohorts with capacity, enrolment windows and lifecycle states
• Creator studio: drag-and-drop curriculum builder
• Quiz authoring with automatic grading
• Assignment authoring with a grading queue
• Per-course and per-cohort pricing set by the seller
• Coupons, member management, earnings view
• Public creator storefronts

Learning experience

• Learner dashboard, lesson player, progress tracking
• Discussion threads per course
• Orders, billing and refund-request surfaces
• In-app notifications
• Community surface with leaderboard

The differentiated loop — mentor-reviewed projects

• Projects as a standalone sellable product across three tiers
• Milestones with review checkpoints
• Submissions with file upload to private storage (type + size validated)
• Mentor application → vetting → assignment workflow
• Versioned, immutable rubrics with per-criterion scoring
• Mentor review queue with SLA flags
• Milestone approve / request-changes and final review
• Completion gates actually enforced — every checkpoint approved, plus a passing defence review where required
• Credential issued on pass, with public verification page, printable certificate and public portfolio page

Money

• Cart and checkout with seat-capacity checks before payment
• Payment provider behind an abstraction, with signed webhooks
• Orders, payments, refunds, subscriptions, subscription plans
• Double-entry ledger — signed, append-only, idempotency-keyed, with cached balances
• Gapless sequential invoice numbering (GST requirement) via row-locked counter
• Commission snapshotted onto the order line at purchase time
• Mentor fee computed and posted to the ledger on pass
• Manual payout recording with reference capture

Enterprise / institutional

• Programs and program cohorts
• Organization licenses, seats, and credit pools with concurrency-safe drawdown
• Roster CSV import
• Report export
• Organization portal for the buyer

Platform & operations

• Admin console — tenants, mentors, projects, orders, refunds, payouts, coupons, licenses, moderation, feature flags, SSO
• Feature-flag infrastructure
• Audit logging
• Error monitoring
• Transactional email with a safe local fallback
• Terms, privacy and refund policy pages (text is solid; the entity behind them is a placeholder)
• Design system and marketing site
• CI: schema-freeze gate, schema-coverage audit, typecheck, lint, unit tests, build — with pinned actions and least-privilege permissions
• Deploy pipeline: PR previews, dev branch deploys, production branch

Definition of Done: ✅ met. A learner can be enrolled, learn, submit work, be reviewed against a rubric, and receive a verifiable credential — and the money movement is correctly recorded.

---

Phase T1 — Make it possible to take money 🔴 CURRENT PHASE

Nothing here is optional. Each item independently prevents a first rupee.

• 🔴 Go live on payments — currently test mode only · #38
• 🔴 Replace fabricated marketing content — the landing page's mentors, testimonials and statistics are hardcoded arrays. This is a compliance liability the moment a real buyer reads it · #37
• 🔴 Real legal and support surface — support and grievance addresses are @example.com; legal entity reads "pending incorporation" · #36
• 🔴 B2B tax invoices for contracts — a company will not pay without a compliant GST invoice · #46
• 🔴 Product analytics — without this the 90-day gate in #83 cannot be evaluated at all · #12
• 🟠 Fix free-course enrolment + coupon tenant-scope leak · #58
• 🟠 Enforce entitlements beyond the player page; tighten the permissive catalog-scope default · #51
• 🟠 Enforce tenant-type gating at the route level (navigation-only today) · #47
• 🟠 Security and auth hardening pass · #35
• 🟠 Point the real domain at production — every link shared before this trains people on a URL that will change
• ⚪ Wire the existing 14 e2e tests into CI; add action rate-limiting · #65
• ⚪ Remove shipped example/scaffolding routes

Definition of Done: a real company can be invoiced, can pay, and the payment lands in a real bank account — and we can see it happen in analytics.

---

Phase T2 — Deliver the first engagement 🟠

Only starts once T1 is done and a pilot is signed. Scope is driven by what the first buyer actually needs — do not pre-build.

• 🔴 Buyer-facing outcome report — completion plus rubric scores per learner, exportable. This is what the customer is actually paying for.
• 🟠 Verify enterprise SSO end-to-end against a real identity provider · #63
• 🟠 Revoke credit-pool project instances on seat revoke / licence cancel · #48
• 🟠 Wire subscription-credit redemption — credits are granted today but never consumable · #50
• 🟠 Handle subscription resumed → restore active status · #49
• 🟠 Reconcile credit notes and ledger reversals when refunds fail · #45
• 🟠 Content authoring gaps — sales description, thumbnails, richer editor, real free preview · #64
• ⚪ Clean up abandoned uploads · #68
• ⚪ Roster import dry-run and validation preview

Definition of Done: one cohort of real learners from one paying organisation completes, and the buyer receives a report they find credible.

---

Phase T3 — Make delivery repeatable ⚪

Only justified once there are 3 paying logos. Every item here is automating something currently done by hand — do it when the hand-work hurts, not before.

• Payout automation and creator/mentor KYC — payouts are manual today · #14
• Notification infrastructure with WhatsApp-native reminders (review SLAs, deadlines) · #10
• Bulk seat provisioning and self-serve org onboarding
• Auto-generated proof-of-work portfolio pages · #6
• Search and recommendations upgrade · #16
• Rubric calibration tooling — the quality risk that scales with volume
• Disaster-recovery documentation and restore drill · #65

Definition of Done: a second and third customer can be delivered without the founder touching the pipeline manually.

---

Phase T4 — Scale surfaces ⚪

Nothing here before ₹1L/month recurring.

• Hiring-partner talent marketplace over verified portfolios · #18
• SCORM/xAPI export for enterprise LMS interoperability · #23
• Subdomain and custom-domain storefronts · #13
• Mobile app evaluation · #29
• Verification API for employers — the one genuine venture-scale door; pursue immediately if an employer ever asks unprompted

---

🅿️ Parked — explicitly not doing

#52 #53 #59 #60 #61 #62 #66 — video DRM, live sessions, live-join fallback, chat, sandbox/judge, vendor decision gate.

Rationale: async B2B delivery (content → assignment → rubric-scored human review → credential) needs none of it. This also retires the largest structural risk in the codebase — a stated differentiator depending entirely on a vendor that was acquired mid-transition, whose signup is paused, and for which we hold no API key.

Un-park trigger: a paying customer asks for live delivery in writing.

---

💼 UMBRELLA B — BUSINESS

Phase B0 — Research and positioning ✅ COMPLETE

• Full market research across Indian K-12/test-prep, global course marketplaces, cohort platforms, and solo-operator economics (~190 searches, 4 independent sweeps)
• Competitive teardown of direct comparables
• Audited-financial review of every named competitor — established that exactly one (Jaro Education) has positive PAT
• Unit-economics model with an explicit price floor
• Business model decision of record — B2B-first · #83 (pinned)
• Vendor risk register with a graded verdict
• Commission and payout economics designed and implemented
• Legal policy text drafted (terms, privacy, refunds)
• Brand name chosen, domain purchased
• Prior business viability review with kill criteria

Definition of Done: ✅ met. We know who the buyer is, what the price floor is, and which channels are arithmetically dead.

---

Phase B1 — Become a company that can invoice 🔴 CURRENT PHASE

This is the actual critical path. None of it is engineering. All of it is unglamorous.

Legal and financial

• 🔴 Register the legal entity
• 🔴 GST registration (18% applies to private training — it is not optional)
• 🔴 Business bank account
• 🔴 Payment gateway KYC and live keys
• 🟠 Real support and grievance contacts, published
• 🟠 Professional indemnity / basic business insurance check

Commercial paperwork

• 🔴 B2B pricing sheet — day rate, per-seat rate, engagement packages. Anchor at ₹50,000+ and validate against published market rates on the first three calls.
• 🔴 Standard services agreement / MSA template
• 🟠 Data processing addendum template (enterprise buyers will ask)
• 🟠 Mentor engagement agreement + payout terms
• ⚪ Purchase-order and procurement-form readiness

Positioning assets

• 🔴 One-page offer — what we sell, to whom, at what price, with what outcome. One page, not a deck.
• 🟠 Short capability deck for L&D buyers
• 🟠 Case-study template, ready to fill the moment a pilot completes

Definition of Done: we can legally issue a compliant invoice to an Indian company and receive money for it.

---

Phase B2 — First paying customer 🔴 (the 90-day gate — target 2026-11-25)

Choose the beachhead — one, not four

• 🔴 Pick a single vertical and commit for 90 days. Ranked by evidence of budget, not interest:
  1. GCC engineering upskilling — 2,100+ centres, 2.36M professionals, stated #1 problem is "finding the right talent," explicit preference for precise skill fit over volume. Strongest evidence.
  2. AI/ML for working engineers — 76.6% of Indian orgs prioritising it; crowded, so verticalise by role or industry
  3. Semiconductor/VLSI specialisations — government-identified gap in non-generic specialisations; too small for the giants ⚠️ price by phone; no public fee data exists
  4. Tier-2/3 college placement prep — real gap, but slow-paying and seasonal

Build the supply bench (target 5, cap 10)

• 🔴 Recruit 5 practising senior engineers who can review async against a rubric
• 🟠 Calibrate them on a shared rubric — run 2 sample reviews each and compare scores
• 🟠 Agree payout terms and SLA expectations in writing

Sell

• 🔴 Build a named target list of 50 companies/institutions
• 🔴 25 outreach conversations via LinkedIn + WhatsApp + warm intros
• 🔴 5 qualified discovery calls
• 🔴 1 pilot signed — free or discounted, explicitly in exchange for a public case study and a named reference
• 🔴 1 paid engagement ≥ ₹50,000, invoiced and collected
• 🟠 Written loss reasons captured from everyone who said no

Discipline

• 🔴 ₹0 on Google/Meta/Instagram ads. At ₹1,500–4,000 CAC against products we keep 20% of, small budgets are a pure leak. Revisit only at AOV ≥ ₹40,000 or for warm retargeting.
• 🔴 Gate review on 2026-11-25 against #83 Part 7

Definition of Done — PASS if ANY: ≥1 paid corporate/GCC engagement collected · ≥1 institution on a paid seat licence · ≥3 paying B2B logos with <8% refunds.
FAIL all three → stop feature work entirely, two-week diagnosis interviewing everyone who said no, then narrow to whichever segment showed warmth or make the deliberate call to treat this as a portfolio asset. An honest stop beats a slow fade.

---

Phase B3 — Make it repeatable 🟠 (months 4–6)

• Publish the first case study with real numbers — no invented statistics, ever again
• Reach 3 paying logos
• Raise the price on customer #3 and see if it still closes
• Secure 2 referenceable customers willing to take a call
• Document the sales motion: what the pitch is, what objections come up, what closes
• Grow the mentor bench to ~10 with calibrated rubric scoring
• Measure, don't estimate: contribution per engagement, effective CAC, refund rate, review SLA breach rate
• Land one second engagement from an existing logo without discounting — the real signal
• Decide whether colleges are worth the slow-payment cycle, on evidence

Definition of Done: a repeatable, written sales motion that has closed three times, with measured — not projected — economics.

---

Phase B4 — Scale ⚪ (months 7–12)

• Reach ₹1L/month — roughly 2 billable days, or 90 enterprise seats, or one high-ticket cohort seat every six weeks
• Open a second vertical only after the first is repeatable
• Explicit fork in the road: stay solo · make a first hire · raise capital
  • ⚠️ Indian edtech funding was $118M–$249M across 22–31 deals in 2025, an 8-year low. Assume no institutional capital. Plan to be default-alive.
• Pursue a verification/API conversation only if an employer initiates it
• Consider productising the assessment layer once ~10 logos exist

Definition of Done: revenue covers the founder's time at market rate, or a deliberate decision has been made not to pursue that.

---

🔗 Where the two umbrellas block each other

Business step	Blocked by tech	Tech step	Blocked by business
Issue any invoice	#36 entity surface, #46 B2B invoices	Go live on payments (#38)	Entity + bank account + gateway KYC
Send any prospect a link	#37 real content, domain cutover	Buyer outcome report (T2)	Knowing what the first buyer wants
Evaluate the 90-day gate	#12 analytics	Everything in T2	A signed pilot
Close an enterprise deal	#63 SSO, #35 security	Payout automation (#14)	Enough mentors to make it hurt

The single most important line in this table: going live on payments is blocked by company registration, not by code. Registering the entity is currently the highest-leverage hour available, and it cannot be done in an editor.

---

📅 Indicative sequence

Window	Tech	Business
Weeks 1–4	T1 blockers: analytics, real content, entity surface, B2B invoices	B1: register entity, GST, bank, gateway KYC, pricing sheet, one-page offer
Weeks 5–8	Finish T1: live payments, entitlements, security, domain	B2: recruit 5 mentors, build target list of 50, start outreach
Weeks 9–13	T2 only as the pilot demands	B2: discovery calls → pilot signed → first paid engagement
Gate: 2026-11-25	—	Evaluate #83 Part 7. Pass, narrow, or stop.
Months 4–6	T2 completion, selective T3	B3: case study, 3 logos, raise price, measure
Months 7–12	T3 automation	B4: ₹1L/month, second vertical, the fork

---

🚨 Standing tripwires (from #83 — repeated because they matter)

• Any rupee on paid ads before AOV ≥ ₹40,000 → stop, revert to outreach
• Mentor review SLA breach >20% for two consecutive weeks → pause all selling, fix supply first
• Refund rate >12% → freeze acquisition, re-price
• New feature work >25% of founder hours while zero gate items are met → scope quarantine
• Two consecutive months with <5 qualified B2B conversations → the motion isn't real; re-target

---

The uncomfortable summary

Eight weeks produced 111 data models, 77 pages, 33,000 lines of well-tested code, and zero customer conversations. The engineering is not the constraint and never was.

Phase T0 is genuinely impressive work. Phase B1 is four government forms and a bank appointment. B1 is worth more than T2, T3 and T4 combined right now, and it is the phase most likely to be postponed — because it produces no diff.

The next artifact should be a signed pilot, not a merged PR.