# B2B Readiness Gap Map

This map compares the current `canopy-lang-site` repository against the
autonomous-week B2B readiness gates. The repository is a static landing page
with `index.html`, `README.md`, and no build step.

## Current Evidence

- `index.html` is the public landing page and links to PyPI, GitHub,
  changelog, and issue tracker.
- `README.md` documents local preview, Vercel deployment, and custom domain
  setup.
- `docs/data-readiness.md` documents synthetic quickstart data, static-site
  collection boundaries, provider responsibilities, retention boundaries,
  analytics status, support data expectations, and unsupported trading claims.
- `docs/operations.md` documents static-site deployment validation, rollback,
  smoke checks, CDN review, analytics ownership status, incident owner
  category, and release communication boundaries.
- `index.html` includes buyer-facing readiness copy covering personas,
  supported alpha workflows, compatibility expectations, non-goals, and
  upgrade/support assumptions.
- `README.md` mirrors buyer-facing deployment, data, compatibility, and
  support assumptions for maintainers.
- The static-site merge gate confirms that at least one HTML or CSS file is
  tracked: `test -n "$(git ls-files "*.html" "*.css" | head -n 1)"`.
- Documentation regression checks cover security reporting, B2B readiness,
  operations readiness, and credential hygiene.

## Readiness Gates

| Gate | Current state | Gap | Recommended next step |
| --- | --- | --- | --- |
| Product readiness | The landing page explains installation, alpha status, quickstart usage, buyer personas, supported alpha workflows, compatibility expectations, non-goals, and upgrade/support assumptions in `index.html`. `README.md` mirrors the deployment and support assumptions. | Commercial support ownership, legal readiness, and production-positioning decisions remain pending review. | Keep buyer-facing copy aligned with `docs/data-readiness.md` and `docs/operations.md`; assign support and legal owner categories before adding stronger public commitments. |
| Security readiness | The site is static and does not collect credentials or user input. | There is no published security contact, vulnerability reporting path, or dependency posture for the CDN-delivered Tailwind script. | Add `SECURITY.md` and document the CDN tradeoff or pinning plan in `README.md`. |
| Data readiness | The quickstart uses synthetic data in `index.html`, and `docs/data-readiness.md` describes provider responsibility, retention boundaries, logs and analytics status, support data expectations, and unsupported financial claims. | Provider adapters, commercial support intake, and analytics ownership remain pending review before business commitments are published. | Review provider-adapter policy, commercial support ownership, and analytics ownership before adding production data commitments. |
| Operations readiness | `README.md` covers manual Vercel deployment and domain setup, and `docs/operations.md` covers deploy validation, rollback, smoke checks, CDN review, analytics ownership status, incident owner category, and release communication boundaries. | Commercial support and analytics ownership remain pending review; no uptime or compliance commitment is published. | Assign owner categories for commercial support and analytics before adding public commitments or tracking. |
| Support readiness | The footer links to GitHub Issues from `index.html`. | There is no support policy, response expectation, or commercial inquiry path. | Add `SUPPORT.md` and link support options from `index.html`. |
| Legal readiness | `README.md` identifies the upstream MIT license. | There is no site privacy notice, terms link, trademark ownership note, or financial-risk disclaimer for trading content. | Add `docs/legal-readiness.md` and expose clear legal links in `index.html`. |

## Next worker-ready issues

1. Add a public security reporting path.
   - Files: `SECURITY.md`, `README.md`
   - Acceptance: security contact, supported surfaces, and responsible
     disclosure expectations are documented without sensitive values.

2. Review commercial support ownership for buyer-facing product readiness.
   - Files: `index.html`, `README.md`, `docs/operations.md`
   - Acceptance: support owner category, public intake path, and response
     expectations are reviewed before any stronger buyer-facing commitment is
     published.

3. Review provider-adapter and data ownership policy.
   - Files: `docs/data-readiness.md`, `docs/operations.md`, `README.md`
   - Acceptance: provider-adapter responsibilities, analytics ownership, and
     commercial support intake are reviewed before production data commitments
     are published.

4. Assign operations ownership decisions.
   - Files: `docs/operations.md`, `README.md`
   - Acceptance: commercial support and analytics owner categories are reviewed
     before public commitments or tracking are added.

5. Add support and legal readiness pages.
   - Files: `SUPPORT.md`, `docs/legal-readiness.md`, `index.html`
   - Acceptance: support paths, response expectations, privacy notice,
     terms placeholder, license reference, and trading-risk disclaimer are
     linked from the landing page.