What To Do Next

This is the plan. It is ordered by what unblocks the most and what gets worse fastest, not by what is most interesting to build.

The roadmap covers the engineering phases. This page covers everything else, and where the two disagree about ordering, this one accounts for the business.

The situation in five lines

• The platform has real, working software: a forum, an API, a desktop analytics client, a phone client. That is not nothing.
• It has no data, because the tier that produces data does not exist.
• It has no revenue mechanism — nothing anywhere can charge anyone.
• It has no licence, and three of the four business lines cannot legally operate without one.
• It has no cost model, so nobody knows whether the plan is affordable.

Nothing is on fire, because nothing is deployed and there are no users. Every item below is about the cost of doing it now versus later — with one exception, immediately below.

Do this first

A live API key is in git history

A Google Gemini API key was hardcoded in demostatics-web/app/Console/Commands/ScrapNewsCommand.php and FindArticleLinks.php. Both files were later deleted, so the key is not in HEAD — but it survives in 20 reachable revisions and was pushed to github.com/Demostatics/demostatics-web.

The repository is private, so exposure is bounded to anyone who has or ever had clone access. That is not the same as safe: private repositories get opened by accident, and a Gemini key bills to your Google Cloud account.

Revoke it in the Google Cloud console today. Deleting a file does not revoke a credential. Rotating the key takes minutes and ends the exposure permanently; rewriting history is optional afterwards and does not help anyone who already cloned.

Details, and the secret-scanning fix that would have caught it, are on Security and Privacy.

The three things already costing you

Most of the 86 findings in the gap register can wait. These three cannot, because their cost increases with every week of delay rather than staying flat.

1. The history clock has not started

Every month you do not collect data is a permanently missing month of history. Satellite passes, traffic conditions, news volume and sentiment for a date you did not record are gone — some can be bought back from archives, most cannot.

The first question any institutional data buyer asks is “how far back does it go?” A quant buyer typically needs years of point-in-time history before a signal is even evaluable. In 2028 you could have a finished, beautiful platform with three months of history, and that outcome is fully determined by what you do this month.

This is cheaper than it sounds

You do not need the worker, the schema, or the pipeline to start. You need a scheduled fetch writing raw responses to object storage under a dated key. No parsing. Parsing can be redone later against the archive; a day not collected cannot. See Minimum Viable Data Set.

2. The cost of the plan is unknown, and might be 100x what you assume

Two readings of the data sources your founding document names differ by roughly a hundredfold in monthly cost. One is fundable by one person. The other needs institutional venture capital before it produces a single row.

You cannot choose an architecture without knowing which one you are building. Getting real quotes for the top three cost drivers is days of work and changes everything downstream. See Cost and Funding.

3. Licensing is a capital requirement, not only a lead time

Every document on this site treats licensing as elapsed months. That is half the picture. Authorised firms generally must also hold minimum regulatory capital, and there is a compliance officer’s salary, a custodian, an auditor and professional indemnity insurance behind it.

Nobody has costed any of that, and there is no instrument to raise against — the pitch deck has ten slides and no numbers. See Regulatory Posture.

This week

Small, concrete, mostly not engineering. All of it is days or hours.

#	Do	Why now	Effort
1	Run composer audit and npm audit, then update	28 advisories in demostatics-web, two of them in the mail path you are about to switch on and the router that gates /api/v1/reports	hours
2	Guard DemoSeeder against non-local environments	It creates an admin account with the password password, published in three places, and it is the only thing that builds the geo store — so an operator has a reason to run it on production	hours
3	Add a CI workflow to demostatics-web and demostatics-mobile_application	Neither has a .github/ directory. The Rust repo’s CI is genuinely good; copy the idea	hours
4	Write down the source shortlist and pick five	You cannot start collecting until you decide what to collect. Data sources has a proposed set	hours
5	Start the archive	One cron, one bucket, dated keys, raw bytes, no parsing. This is the single highest-leverage hour in the plan	hours
6	Write the credential inventory	Bus factor is one. If you are unavailable, nobody can reach anything	hours
7	Fix the TLS certificate on demostatics.com	It currently serves *.srvpanel.com, the host’s default cert, so every visitor gets a browser security warning before the “coming soon” page	~30 min
8	Find out why CI has been dead since 2026-07-29	Six consecutive runs failed with zero steps executed — the runner never started. Consistent with exhausted Actions minutes on a private repo running macOS and Windows on every push	hours

This month

#	Do	Why	Effort
7	Get real quotes for the top three cost drivers	Resolves the 100x question and decides the architecture	days
8	Write the one-page financial model	Burn, runway, break-even seat count. There is no number anywhere today	days
9	Engage counsel on jurisdiction and entity structure	Longest lead time of anything. Everything in lines 2–4 waits on it	not engineering
10	Decide: does the platform sit inside or outside the regulated entity?	It determines whether line 1 can raise capital and ship on its own timetable	not engineering
11	Name your competitors and their prices	The first institutional conversation opens with “how is this different from X”	days
12	Backups, error tracking, and something polling /health	You built a health endpoint that reports three silent failures and nothing calls it	days

Items 9 and 10 are the ones that get deferred

They are not engineering, they have no satisfying feedback loop, and they are the two that block the most. Do them anyway, and do them before the fun parts.

This quarter

Ship the data product. Roadmap Phases 0–4 remain the right target — numeric data with history, browsable and charted, behind a working paywall, on a real deployment, sold from the web. That is a product, it is line 1, and none of it needs a licence.

Two additions to those phases that the four-line decision forces:

Provenance ships in Phase 2, not Phase 4. Source, method, method version, measured_at and ingested_at, append-only revisions, point-in-time reconstruction. A column set now; a full backfill later. See Data Pipeline.

Data quality gates ship with the first ingest. Plausibility bounds per series, an outlier check, and a comparison against a second source where one exists. Today a decimal-place error is not even type-detectable, because value is a string column. See Model Risk and Ground Truth.

The order, and why

  START THE ARCHIVE ─────────────────────────► history accrues from today
         │                                      (only item that decays)
         ▼
  RESOLVE THE COST QUESTION ─────────────────► decides the architecture
         │
         ▼
  ENGAGE COUNSEL ────────────────────────────► starts the longest clock
         │                                      (parallel, not blocking)
         ▼
  SHIP LINE 1 (roadmap phases 0-4) ──────────► first revenue, no licence needed
         │
         ▼
  LICENCE ARRIVES ───────────────────────────► lines 2 and 3 become legal
         │
         ▼
  CONFLICTS + MONEY LAYER (phases 8.5, 9) ───► lines 2, 3, 4 operate

Three things run in parallel from day one because they have nothing to do with each other: the archive accrues, counsel runs the licensing clock, and engineering ships line 1.

What not to do

Worth stating, because the failure mode here is not laziness — it is doing too many things.

Do not build lines 2, 3 or 4 yet. They cannot legally operate, they consume capital, and every hour spent on them is an hour not spent on the only line that can earn.

Do not build the worker against the expensive source list before the cost question is answered. That is how a pipeline gets architected around sources that then have to be ripped out.

Do not merge a money schema before there is a licence and a named custodian. This reasoning survived the repositioning intact: a half-designed money schema is a liability the day it merges, not the day it is used.

Do not fix the things that are already right. The gap register ends with roughly fifty things this project genuinely does well — the security hygiene, the Rust CI, the statistical correctness, the honest status vocabulary. Leave them alone.

Do not add the fifth language. Four is already too many for one person.

The one-sentence version

Start collecting data today, find out what it costs this month, start the licensing clock in parallel, and ship line 1 before touching lines 2 through 4.

Next

• Gap Register — all 86 findings, and the fifty things already right
• Risk Register — what could kill this
• Cost and Funding — the 100x question
• Minimum Viable Data Set — what to start collecting
• Roadmap — the engineering phases