Mentor PR bundle
← back to index
# Mentor — PR Bundle for Review (v67 / v68 / v69)
*Prepared 2026-07-26 · REVIEW-ONLY — nothing here is deployed. Mentor is a LIVE backend with real testers + PII; per Byron's instruction this is a bundle to review before executing, and email SENDING is never autonomous.*
Aligns with Fable spec `/Users/byronarnao/harness-specs/03-mentor-tenancy.md` (isolation architecture) and supersedes the stale `mentor-review/PRD.md` (written when app was v66; confirmed still v66 today).
---
## Confirmed prod state (2026-07-26)
- **Live:** mentor.arnao.ai · **v66** · containerized **Express + Postgres** backend (`api/server.js`, 520 lines; Dockerfile + docker-run.sh), `agents/interview-agent.js`, `db/schema.sql`.
- **Routes that exist:** `GET /health` · `POST /api/register` · `POST /api/chat` · `GET /api/status/:user_id` · `POST /api/approve/:user_id` · `POST /api/complete/:user_id`.
- **Does NOT exist yet:** any feedback/ledger endpoint, any release-email path, any voice/realtime. So v67–v69 are net-new additions, not edits to shipped behavior. Good — low regression risk to existing testers.
---
## v67 — Release-email + feedback ledger *(gated: PII read APPROVED by Byron; SENDING stays manual)*
**What:** (1) pull the ~15 first-hand tester feedback items that live only in prod (DB/logs) into a triageable ledger; (2) a release-email composer that writes a personalized "your suggestion shipped" note per contributor.
**Build:**
- New `GET /api/feedback` (owner-token gated via existing `middleware.js`) + a fleet script that reads tester items from the Postgres store into `feedback-ledger.json` for triage. **PII handling:** owner-gated, never public, no third-party exposure.
- Release-email composer runs **DRY BY DEFAULT** — writes draft emails to a review queue; **does not send**. A `--send` flag (owner-run, after Byron reads the drafts) is the only path that transmits. Idempotent: a per-(user,release) sent-marker so no double-emails.
**Risk:** low if dry-run discipline holds. **Gate:** Byron reads the drafts before any send. **Decision for Byron:** confirm the send channel (gog/Gmail as Byron vs a Mentor-branded address).
## v68 — Live voice interview, dark-shipped *(reuse the gallery's confirmed pattern)*
**What:** an optional spoken intake interview, flag OFF.
**Build:** clone the gallery's working realtime pattern — mint via `POST /v1/realtime/client_secrets` (NOT the deprecated `/v1/realtime/sessions`), model `gpt-realtime-2.1-mini`, WebRTC. Wire `agents/interview-agent.js` as the tool/persona layer. **Guards:** feature flag default OFF, per-user session cap, daily budget cap (copy the gallery's reserve-based Blob guard), text fallback always available. Nothing user-visible until flipped.
**Risk:** low (dark). **Dependency:** the gallery voice pass (v75) proves the config; reuse its `session.update` + tool-dispatch shape once it lands.
## v69 — Voice pilot + name/fact handoff *(after v68 review)*
**What:** flip voice ON for ONE named tester; solve the name/fact handoff (the interview agent must carry the mentee's name + stated facts into the profile-generation context without leaking across users).
**Gate:** this is where **spec 03's A-vs-B isolation test becomes the ship gate** — tenant A's private facts must be provably unreachable from tenant B's session before pilot. Do not flip v69 until that test passes.
---
## Tenancy note (ties to the multi-tenant pivot)
Mentor IS the "engine repackaged for others." Per spec 03: isolation lives in **context-assembly, not the model**; Haiku 4.5 workhorse / Sonnet 5 for narrative; the falsifiable A/B isolation test gates any multi-tenant flip. **This same isolation model is being reused for multi-tenant City** (spec 05) — one pattern, not two. Confirm the partition decision (hard per-tenant partition vs shared store + assembly-time filter) from spec 03 before building v69.
---
## Backlog carried from PRD (unchanged, still valid)
U7 (Google-at-Start drop-off) · F6 (mentee picks mentor) · F8 (Operator→? rename in data layer).
## What I need from Byron to execute
1. **Send channel** for v67 release-emails (and OK to move from dry-run → send after you read drafts).
2. **Partition call** (spec 03 tension) before v69.
3. A **go** to execute v67/v68 as an actual deploy (they're dark/low-risk); v69 waits on the isolation-test gate.