docs: record hosted-beta waitlist triage for Metafor (#74)

docs/2026-08-30-hosted-beta-waitlist-metafor.md

@@ -0,0 +1,175 @@
+# Hosted beta waitlist triage: Metafor (issue #74) — status and decision record
+
+**Date:** 2026-08-30 · **Verified against:** `main` @ `8487d1e` (2026-08-26) ·
+**Issue:** [OpenCoven/coven-github#74](https://github.com/OpenCoven/coven-github/issues/74)
+(open, created 2026-07-14, no labels, no assignees)
+
+This is the repo's status/decision record for the first hosted-beta waitlist
+intake. Facts only; every claim links to a file on `main` or a dated upstream
+issue/commit. It complements — and does not modify — the
+[backlog DAG status ledger](backlog-dag.md).
+
+## What the issue asks
+
+[Issue #74](https://github.com/OpenCoven/coven-github/issues/74) is a waitlist
+intake, not a feature request: org **Metafor**, team size **1**, repos/backlog
+shape **"?"** (unanswered), model provider (BYOM) **"Oss models"**, plus two
+questions — *"What would you assign first?"* and *"i want to find out more
+about this"*. The issue states no acceptance criteria; its actionable asks are
+the first-assignment recommendation and more information about the hosted beta.
+
+Prior handling: one failed automation attempt —
+[covencat[bot] comment, 2026-07-14](https://github.com/OpenCoven/coven-github/issues/74#issuecomment-4969344751):
+"Status: failure", 0 files changed, 0 commits. No human response since.
+
+## What exists on main today (evidence and dates)
+
+1. **All six hosted beta code gates are shipped.**
+   [HOSTED.md § Beta Gate](../HOSTED.md) (commit `12be5b6`, 2026-07-08, PR
+   [#71](https://github.com/OpenCoven/coven-github/pull/71)) states: "All six
+   code gates are shipped" — persistent task store, durable queue, tenant-scoped
+   task API auth, worker isolation with cleanup and timeouts, usage metering,
+   Cave oversight dashboard. Design history: durable task store
+   ([docs/durable-task-store.md](durable-task-store.md), `26090d0`, 2026-07-06,
+   PR #43 for issue #2).
+2. **The operational half has a committed runbook and stack.**
+   [docs/hosted-deploy.md](hosted-deploy.md) (commit `12be5b6`, 2026-07-08) and
+   [deploy/hosted/](../deploy/hosted/) (`provision.sh`, `compose.yaml`,
+   `Caddyfile`, `litestream.yml`, `.env.example`): one VM, Docker Compose,
+   Caddy TLS, Litestream → Cloudflare R2, `/healthz`, first-deploy steps, and
+   an explicit rule to *"run a restore drill before onboarding paying
+   tenants"*. The same commit wires `[[installations]]` entries for
+   "grandfathered beta tenants" into the production config step. No evidence in
+   the repo that the stack is actually deployed anywhere.
+3. **Pricing exists as a proposal.** [docs/pricing.md](pricing.md) (tier matrix
+   added `a86f742`, 2026-07-07, PR #61 for issue #17 — closed 2026-07-07;
+   last touched `7298f32`, 2026-07-14, "make dedicated pricing contact-led").
+   Status line: "**proposed** — numbers below are a launch proposal for review,
+   not a commitment." Tiers: Community (free, self-host) · Hosted Starter
+   $99/mo (1 familiar, 25 tasks/day, 1 concurrent, 30-day retention, email) ·
+   Hosted Team $399/mo · Hosted Dedicated (contact, annual). Principle 3:
+   "**BYOM everywhere.** Model keys are the customer's at every tier." Open
+   decisions still listed: final Starter/Team figures, trial policy (proposal:
+   14-day trial, no free hosted tier).
+4. **Marketplace launch runbook exists.**
+   [docs/marketplace-listing.md](marketplace-listing.md) (`9271bf8`,
+   2026-07-08, PR #67): publish Starter/Team plans, 14-day native trials,
+   `[billing] require_plan = true` at go-live; Stripe fallback documented.
+   Beta tenants before go-live are entitled via explicit `[[installations]]`
+   entries, not a purchased plan.
+5. **The operating loop is demonstrable offline.**
+   [docs/demo.md](demo.md) + `examples/demo/run-demo.sh` (`3ea97ec`, 2026-07-06,
+   PR #40 for issue #19 — closed 2026-07-07): real adapter, signed webhook
+   deliveries, issue assignment → Check Run → edited-in-place status comment →
+   maintainer commands → draft PR, self-verifying in about a minute.
+6. **Landing page + waitlist capture shipped outside this repo.** Upstream
+   issue [#16](https://github.com/OpenCoven/coven-github/issues/16) ("Ship
+   opencoven.ai/github landing page and hosted beta waitlist") was **closed as
+   completed on 2026-07-08** by `BunsDev`, with no PR or cross-reference in
+   this repo — the opencoven.ai site is not in this codebase. Note a docs
+   staleness: [ROADMAP.md](../ROADMAP.md) and
+   [docs/backlog-dag.md](backlog-dag.md) (both last touched `c0791d6`,
+   2026-07-07, one day before the close) still list #16 as the single
+   remaining item.
+7. **Nothing in this repo implements waitlist capture or waitlist triage.**
+   `waitlist` appears only in docs (ROADMAP, backlog-dag, hosted-mvp-plan);
+   there is no waitlist code, intake template, or triage-record location —
+   this file is the first triage record. The engineering backlog itself is
+   drained per the [backlog DAG](backlog-dag.md): "the engineering spine and
+   all of Waves 0–4 are shipped."
+
+## Verdict against the issue's asks
+
+- **"What would you assign first?"** — answerable from `main` today: a
+  low-risk maintenance issue on a non-critical repo (dependency bump or docs
+  fix) assigned to the familiar. Grounds:
+  [docs/hosted-mvp-plan.md](hosted-mvp-plan.md) names "safe dependency, docs,
+  and maintenance PRs" as the ideal first work for small teams; the Starter
+  tier trigger surface is "assignment, labels, commands"
+  ([docs/pricing.md](pricing.md)); [docs/demo.md](demo.md) shows exactly what
+  that assignment produces (Check Run, status comment, draft PR, Cave link).
+- **"I want to find out more about this"** — the hosted beta is documented
+  end-to-end on `main` ([HOSTED.md](../HOSTED.md),
+  [docs/hosted-vs-self-hosted.md](hosted-vs-self-hosted.md),
+  [docs/hosted-deploy.md](hosted-deploy.md),
+  [docs/pricing.md](pricing.md),
+  [docs/demo.md](demo.md)); nothing on main blocks an onboarding conversation.
+- **Tier fit (decision, proposal-grade):** Hosted Starter — team size 1 maps to
+  1 familiar, 25 tasks/day, 1 concurrent. Caveats: pricing is explicitly a
+  proposal with open decisions 1–2 (final figure, trial policy), and "OSS
+  models" BYOM compatibility is a property of the `coven-code` familiar, not
+  this adapter — no doc in this repo verifies specific OSS models work; flag
+  it as an onboarding question.
+- **Intake gap:** repos/backlog shape is unanswered ("?"), so the recommended
+  first assignment stays generic until Metafor names a repo.
+
+## What remains
+
+1. Deploy the hosted stack per [docs/hosted-deploy.md](hosted-deploy.md)
+   (runbook committed; no evidence of an actual deployment).
+2. Run the restore drill before onboarding a paying tenant (runbook rule).
+3. Resolve [docs/pricing.md](pricing.md) open decisions 1–2 (final Starter
+   figure, trial policy) before quoting Metafor.
+4. Ask Metafor: repos/backlog shape + which OSS models they intend to run.
+5. Sync [ROADMAP.md](../ROADMAP.md)/[docs/backlog-dag.md](backlog-dag.md) with
+   the actual #16 close (2026-07-08) — docs are one day stale on that point.
+6. At Marketplace go-live, flip `[billing] require_plan = true` and move
+   grandfathered beta tenants to purchased plans (runbook step 3 +
+   [docs/marketplace-listing.md](marketplace-listing.md)).
+
+## Critical path (Metafor → onboarded beta tenant)
+
+Operational, not code (all six code gates shipped, 2026-07-08):
+answer the intake questions → deploy VM + restore drill →
+`config/production.toml` with an `[[installations]]` beta entry for Metafor →
+install the hosted GitHub App → assign the first maintenance issue →
+verify Check Run + draft PR + Cave oversight link.
+
+## Onboarding prep checklist (sources: hosted-deploy.md, HOSTED.md, pricing.md)
+
+- [ ] Ubuntu 24.04 VM (CPX41-class) + DNS A/AAAA for the webhook domain
+- [ ] `provision.sh` run; `/opt/coven-github/.env` filled; `keys/app.pem` at 0600
+- [ ] `config/production.toml`: `storage.path`, `worker.backend = "container"`,
+      `api.mode = "token"`, `[[installations]]` entry for Metafor
+- [ ] `doctor` preflight, `docker compose up -d`, `GET /healthz` → 200
+- [ ] App webhook URL set; ping delivery → `pong` recorded
+- [ ] Restore drill completed and inspected (pre-tenant requirement)
+- [ ] Uptime monitor on `/healthz`; queue/usage/audit alert thresholds set
+- [ ] Tenant runbook handed over: upgrade, incident, and compromise procedures
+      (hosted-deploy.md "Upgrades" / "Incident basics")
+- [ ] Pricing open decisions 1–2 resolved; trial terms chosen
+- [ ] OSS model availability confirmed with the `coven-code` familiar team
+      (outside this repo)
+
+## Draft outreach (NOT sent — this token cannot comment on upstream issues)
+
+> Hi Metafor — thanks for joining the hosted beta waitlist. Answers to your
+> questions, all verifiable in the open adapter:
+>
+> **What to assign first:** one low-risk maintenance issue on a repo you don't
+> mind an agent touching — a dependency bump or a docs fix. Assign the issue to
+> the familiar (or add the trigger label) and you get a Check Run with
+> evidence, a status comment that updates in place, and a draft PR back, all
+> under Cave oversight. A one-minute offline version of the whole loop is at
+> examples/demo/run-demo.sh in the repo.
+>
+> **What hosted adds:** managed durable queue and task history, isolated
+> workers, tier caps that are enforced in the adapter (not just promised), and
+> Cave oversight links. Self-hosting the same adapter stays free if you'd
+> rather inspect everything yourself.
+>
+> **BYOM:** your model keys at every tier — we never mark up tokens. Tell us
+> which OSS models you plan to run and we'll confirm compatibility before your
+> onboarding slot.
+>
+> **To tailor your onboarding:** which repos would you start with, and what
+> does the backlog look like? Starter tier is the intended fit for a team of
+> one; final launch pricing is still being confirmed, and beta participants
+> keep grandfathered terms.
+
+## Decision
+
+Triage #74 as **onboarding-ready, operationally blocked**: no code work remains
+on `main` to serve this waitlist entry; the path is the hosted-deploy runbook,
+two pricing decisions, and one unanswered intake question. Record only — no
+code change accompanies it.