Compliance Hub — Decision Decks

1

GitHub + Docker Migration

Where does the code live? Does it run locally too?

Context

Compliance Hub currently lives in a local git repo only. Moving to GitHub gives you CI/CD, team access, and a foundation for Docker. The standards corpus (100k+ clause files) is IP and must never be in GitHub.

Decision A — GitHub Migration

Yes — move to GitHub now Recommended 2–4 hrs

Private company repo, CI/CD to Cloudflare on push to main, corpus excluded via .gitignore, GitHub Secrets for API tokens. Zero risk. Reversible.

Post-launch 2–4 hrs later

Stay local until after launch. More things to juggle at launch time.

Decision B — Docker Local Hosting

You gain

Runs fully on-prem, behind firewall
Corpus never leaves your building
No per-query Cloudflare costs
Works offline / air-gapped

You lose

Cloudflare edge performance
Managed scaling (you manage infra)
Zero-ops (must maintain Docker stack)
3–5 days engineering to build

Post-launch Recommended

Get cloud product live first. Docker becomes a product tier / sales option for clients who want on-prem. Proposal is written and ready when you want it.

Build now 3–5 days

If on-prem is a hard requirement before launch or a client is waiting.

Skip entirely

Cloud-only is fine. No on-prem needed.

Also need from you (if doing GitHub)

GitHub org:
Repo name:
Who runs the push?

2

MCP Build

Connect Compliance Hub to Claude Desktop, Cursor, Windsurf

What it is

MCP = Model Context Protocol — Anthropic's open standard for connecting AI tools to data sources. An MCP server lets any Claude Desktop / Cursor / Windsurf user query your corpus directly from inside their tool. Auth is already built — key issuance, mint/revoke, UsersView all shipped. This is a clean 1-day build.

When to build

Build now Recommended 1 day

Auth is done, API is done — MCP is just the adapter. Ships before launch as a differentiator. Very few compliance tools have MCP support.

Post-launch

Keep scope tight for launch. Add MCP as a v1.1 feature.

Skip

Not needed for our use case.

Access scope

Internal RAD team only Recommended

Same audience as the web tool. Keys issued from admin portal. No public exposure.

Customer-facing feature

Clients can connect their own Claude Desktop to your corpus. Needs pricing / quota decisions.

3

Compliance File Store

Turn query answers into a durable, exportable record system

The problem

Opus gap review verdict: "excellent retrieval instrument wearing the paperwork of a system-of-record it hasn't built." Every query answer disappears. There's no audit trail, no product record, no defensible export. This is the gap between a search tool and a compliance management system.

Options — ranked by value vs effort

Option B — Save answers only Recommended 1–2 days

Add "Save this answer" button to query results. Answers stored in D1 with user + timestamp. Users can pin/bookmark answers and return to them. Stepping stone to full store without over-building before launch.

Option C — Post-launch Safe choice

Launch without it. A few real customer conversations will tell you exactly what format they want. Then build it right. Risk: tool feels incomplete if evaluators expect records.

Option A — Full compliance store 4–7 days High effort

Product SKU linking, compliance files per product, signed/dated/corpus-stamped PDF export. The full system-of-record vision. Correct architecture but risky to build before you know the exact product schema your clients use.

If building (A or B) — export format needed?

PDF only

PDF + CSV

PDF + CSV + JSON

N/A — going post-launch

4

Pre-Launch Check Plan

What's the bar before we say "ready"?

Must-fix first (before any review)

3 silent bugs that will read as "broken" to any fresh evaluator:

Maintenance toggle does nothing — admin off-switch writes wrong table. Fix: ~2 hours.
Inbox Approve is a dead-end — approvals park forever, nothing processes them. Fix: ~1 hour.
Verification pills show GOLD corpus as "Unknown" — hardcoded map over empty column. Fix: ~half a day.

Launch bar — pick your standard

Option B — Pragmatic Recommended

Fix 3 credibility bugs. Run code review + AI audit + smoke test (layers 1–3). No critical findings = green light. Load test deferred to post-launch monitoring.

Option C — Soft launch

Fix 3 bugs. Quick Opus audit only. Launch to limited internal audience. Fix findings. Then broader launch. Fastest to first real user.

Option A — Strict Slower

All 5 review layers pass, no open security issues, full load test. Most thorough. Adds ~2 days to launch timeline.

Target launch date

Review findings delivery

Summary deck after each layer Recommended

I'll write up findings as I go. You stay informed without waiting for everything.

Final go/no-go only

Just tell me when it's ready or what's blocking. No interim reports.

5

Phase 2c Backend — Dig Deeper

Should the map show ranked-but-cut clauses, and get a proper expand API?

Context

Phase 2c frontend (ghost nodes, absent nodes, cross-ref chips) is shipping now — no decision needed. Two backend items need your call:

Decision A — Cut frontier (show ranked-but-cut clauses)

Right now the worker retrieves clauses and silently discards any that scored highly but fell past the 16-clause limit. Users can't see them. Fix: emit those discards as not_retrieved[reason='topk_limit'] so the map can show "▸ +9 more ranked" chips per standard group. Fix is ~3 hours worker change.

Yes — build it Recommended ~3 hours

High value. Surfaces more of the corpus without re-querying. Users can see what scored highly but was cut, and dig into it.

Skip / post-launch

Ghost nodes for cross-ref clauses are enough for now. Cut frontier is a nice-to-have.

Decision B — /api/query/expand endpoint

A proper batch API for expanding multiple clauses in one call. More powerful than the single-clause materialise in Phase 2c. Enables multi-clause "dig deeper" expansion. Effort: ~1 day.

Post-launch Recommended

Single-clause materialise (Phase 2c) covers the ghost use case. The full expand API is v1.1.

Build now ~1 day

If you want the full multi-clause dig-deeper experience before launch.