Atlas
kb://research/openalice-embed-roadmap-backlog-2026-05-29stable2026-05-29

OpenAlice Embed — Optimizations & Basics Backlog

researchembedroadmapbacklog

OpenAlice Embed — Optimizations & Basics Backlog

Captured 2026-05-29 (Alex + NAO brainstorm, post-design-handoff). Feeds Tycho after MVP (Action 1-3) works end-to-end — except §0 which are MVP-blocking basics.

0. ⚠️ MVP basics we must NOT forget (resolve before / during build)

0.1 Visitor identity & memory — DECISION NEEDED (spec conflict)

→ Now fully specced in `openalice-embed-visitor-identity-memory-spec-2026-05-29.md` (standalone, for Tycho + Norbert). The summary below stays as the rationale.

The landing promises "remembers every visitor · cross-page memory" and the widget has a returning-visitor state — BUT the eng brief defines embed_mode as "stateless / per-conversation memory." These contradict. Resolve:

  • Cross-page, same session (trivial): sessionStorage + an anon visitor id within the session. Always on.
  • Cross-session / returning (the landing promise): first-party cookie + localStorage anon id (oa_vid). If cleared / incognito → treated as new visitor (graceful, acceptable — tell them, don't fingerprint).
  • Durable / cross-device: only when (a) visitor gives email (lead) or (b) the host site passes a logged-in id via the snippet (data-user="...").
  • NO device fingerprinting — GDPR-hostile, brand-risk.
  • Requires: a per-visitor memory store keyed by anon id, gated by consent + the existing retention policy (7/30/90/365), with GDPR delete. → embed_mode needs an optional persistent per-visitor memory layer, not pure stateless.
  • Action: add this to the architecture spec + persona-server memory model before building the returning-visitor flow.

0.2 Other day-1 basics (mostly already in docs — verify wired)

  • ✅ Per-session + per-visitor token cap + alerting (eng brief risk #3, dashboard /usage) — confirm enforced day 1.
  • ✅ Consent gate + US-LLM consent dialog (GDPR Art 49) — designed in widget.
  • ✅ Retention policy 7/30/90/365/forever (settings + admin).
  • ⬜ Consent revocation + "delete my data" in-widget (GDPR Art 17) — add to widget + persona-server.
  • ⬜ PII redaction before storage/training — settings has the toggle; needs the pipeline.
  • ⬜ Cold-start (empty KB) behavior — Aria must NOT hallucinate before knowledge is ingested; fall back to "let me get a human / book a call."
  • ⬜ Rate-limit + Cloudflare Turnstile on the public/demo widget (recon mentions; confirm).
  • ⬜ Snippet versioning + backward-compat — embed.js versioned so old installs never break.
  • ⬜ CSP compatibility — snippet works under strict Content-Security-Policy (nonce support).
  • ⬜ Timezone-aware scheduling — "book Thursday 2pm" in the VISITOR's timezone.
  • ⬜ Abuse / profanity de-escalation + graceful end.
  • ⬜ Error telemetry — widget errors in the wild reported (Sentry-style).
  • ⬜ Loading / empty / error states on every data screen (in INTERACTION-STATES-SPEC §6 — ensure built, not skipped).

1. Post-MVP optimizations (pull after dogfood-deploy works)

Cost & latency (biggest wins)

  • TTS cache for deterministic utterances (NAO's idea ⭐) — pre-render + cache audio for the static greeting, top-N FAQ answers, fallback lines, and chip replies. Don't re-synthesize what never changes. Huge TTS-cost + latency cut. Greeting especially: same line every first-open → render once, serve forever.
  • Semantic answer cache — embedding-match incoming questions to a cache; identical-intent repeats ("do you have SSO?" asked 100×/day) answer once, then serve cached text+audio. Free + instant for the long tail of repeats.
  • Streaming text + sentence-chunk TTS — token-stream the answer, synthesize per-sentence so voice starts mid-response (the "<800ms / voice mid-sentence" promise). Confirm in widget runtime.
  • Model tiering — cheap/fast model for cached/simple/greeting intents; escalate to the big model only for hard/novel questions. Per-intent routing in openalice-llm-router.
  • Lazy VRM load — don't fetch the 3D model until consent/open; preconnect on launcher hover; snapshot-first then upgrade to live VRM. Mobile defaults to voice-only orb.
  • Idle WebSocket disconnect — drop the socket after N s inactivity, reconnect on activity. Saves server resources at scale.

Conversion & product

  • Proactive triggers — open on exit-intent / time-on-page / scroll-depth / repeat-visit (configurable per widget).
  • Page-context awareness — widget reads the host page (pricing/docs/home) → tailors greeting + chips automatically.
  • Warm human-handoff — pass full transcript + auto-summary to the human so they don't start cold.
  • Lead routing + notify — Slack / email on lead capture (webhooks deliver; add a notify config).
  • Multi-language auto-detect — detect visitor browser language; respond in it (settings already lists languages).
  • A/B everything — greeting, mode, voice, avatar-vs-voice (A/B screen designed).

Trust, ops & lifecycle

  • Data retention auto-purge — honor the configured retention; auto-delete transcripts past the window.
  • Widget uninstall / churn detection — detect when a customer removes the snippet (early churn signal).
  • GDPR data export — customer + visitor data export on request.
  • Audit log (internal) — who-changed-what server-side (trained-by-us is the customer-facing view).
  • Status page / uptime — public widget-uptime signal for enterprise trust.

2. Already covered (in docs / mockups — no action)

  • Token cap + cost alerting · consent gate + US-LLM dialog · retention policy · PII toggle · auto-evaluation · webhooks delivery · transparency log (trained-by-us) · legal docs at /trust · install verification · AI install-helper.

3. Process

  • §0 = resolve in/before build (esp. 0.1 memory decision — flag to Tycho + NAO now).
  • §1 = backlog; Tycho pulls after the product works end-to-end (post Action 1-3 + dogfood). Don't front-load — it dilutes MVP focus.
  • Review this list with NAO before each post-MVP sprint.