roadmap(selfhost): production hardening and first release readiness

[JSONbored]

Context

The self-hosted Gittensory review stack is now running from the Git-backed Docker deployment path and has the core review engine, AI provider support, private repo config, observability profiles, dashboards, and release-image workflow pieces in place.

The remaining work before treating this as an official community-ready self-hosted product is production hardening, operational safety, documentation accuracy, release packaging, and cleanup of cloud-era migration surfaces.

REES runtime hardening is intentionally out of scope here because it is tracked separately under the REES analyzer/runtime roadmap.

Goals

• Make the stack safe to operate without overwriting private configs, rules, auth, data, or secrets during updates.
• Verify backup and restore paths before encouraging real maintainers to rely on the service.
• Prepare the first official self-host image/release path with clear tags, rollback, source maps, and support expectations.
• Expand observability and Sentry context so failures are actionable without exposing sensitive review data.
• Verify Orb broker/relay/outcome telemetry end to end for brokered self-host deployments.
• Inventory hosted/cloud-era resources and migrate or retire them deliberately, with no destructive cleanup until approved.
• Reduce self-host runner pressure and CI queue stalls without weakening fork security.
• Keep website documentation aligned to runtime truth and avoid loose or stale docs.

Requirements

• Preserve all operator-owned .env, mounted repo config, auth volumes, database volumes, Grafana data, dashboards, and local compose overrides.
• Keep Sentry, OTEL, dashboards, and backup integrations optional for other self-hosters.
• Sentry must remain off by default for community self-hosters unless they set their own DSN.
• No official image may include secrets, private configs, local auth material, source maps, local data volumes, or deployment-specific overrides.
• Fork PRs must never run untrusted code on secret-bearing self-hosted runners.
• Cloudflare/D1/KV/R2/Worker cleanup must be inventory-first and explicitly approved before deletion.
• Documentation work belongs in the website docs surface, not loose repo docs, unless a root runbook is intentionally part of the operator package.

Child work

• chore(selfhost): verify backup and restore posture #1821 — chore(selfhost): verify backup and restore posture
• build(selfhost): finalize first official image release #1822 — build(selfhost): finalize first official image release
• docs(selfhost): define safe update and rollback flow #1823 — docs(selfhost): define safe update and rollback flow
• feat(observability): expand self-host Sentry context and monitors #1824 — feat(observability): expand self-host Sentry context and monitors
• chore(orb): verify brokered self-host relay and telemetry #1825 — chore(orb): verify brokered self-host relay and telemetry
• chore(migration): inventory hosted resources before self-host cleanup #1826 — chore(migration): inventory hosted resources before self-host cleanup
• ci(runners): rebalance CI load for self-host reliability #1827 — ci(runners): rebalance CI load for self-host reliability
• perf(selfhost): profile stack resources and tune defaults #1828 — perf(selfhost): profile stack resources and tune defaults
• docs(selfhost): audit website docs against runtime defaults #1829 — docs(selfhost): audit website docs against runtime defaults
• fix(observability): repair Grafana Tempo trace pipeline #1845 — fix(observability): repair Grafana Tempo trace pipeline
• feat(observability): add GitHub Issues stats to the Reviews & PRs maintainer dashboard #3716 — feat(observability): add GitHub Issues stats to the Reviews & PRs maintainer dashboard
• fix(observability): clarify manual/commented/ignored panel semantics on the Reviews & PRs dashboard #3717 — fix(observability): clarify manual/commented/ignored panel semantics on the Reviews & PRs dashboard

Related work

• epic(enrichment): REES modular analyzer runtime roadmap #1499 tracks REES modular analyzer runtime hardening and is intentionally separate.
• roadmap(selfhost): harden review stack and reduce hosted cost #1667 is the earlier broad hardening roadmap; this issue narrows the remaining production/release readiness work.
• build(selfhost): prepare official images after stack validation #1677 tracks official image preparation and is covered by the release child above.

Definition of done

• A clean operator can install, configure, back up, update, roll back, observe, and troubleshoot the self-host stack from official docs and released artifacts.
• The maintainer deployment can update from main or a released image without custom one-off steps and without overwriting private configuration or secrets.
• The first official image release has a repeatable checklist, smoke tests, source-map/release validation, and rollback instructions.
• Operational failure classes create actionable, scrubbed Sentry/log/dashboard signals.
• Hosted-era resources have a reviewed keep/migrate/retire plan before any destructive action.

Ownership

Maintainer-only. Assigned to JSONbored. No gittensor:* labels.