Muddy Tires — Full Build Status

Generated 2026-06-18 · internal (noindex) · substrate-grounded inventory of ALL work, verified against git + receipts + the live site

Bottom line: nothing has been pushed to the live site. The live muddytires.ca is unchanged. Everything built sits on the preview (frontend) or on test endpoints (backend) — proven, committed, and waiting for your go to wire to production.

DONEbuilt & verified TEST/PREVIEWlive on a test/preview endpoint, not production PENDINGscoped, not built NEEDS YOUyour decision / go BLOCKEDsource missing / dependency

🌐 Live vs Preview / Test

Live — muddytires.caUNCHANGED

Production untouched. The apex currently serves the existing map; none of the new frontend or backend is wired to it. Cutover happens only on your explicit go.

Preview — oracle-landing-preview.muddytires.pages.devALL NEW FRONTEND

landing · map · branch oracle-frontend-swap

Backend — test Workers + the muddytires-pois D1PROVEN, NOT LIVE-WIRED

Oracle / read / write Workers all run and are receipted, but the live frontend does not call them yet.

✅ Done & delivered

The Oracle Moat — the SOTA differentiator (backend built + proven)

D1 database + 4,000 POIs + read WorkerTEST

muddytires-pois D1, pois table, COUNT(*)=4000 verified. Read Worker returns GeoJSON, live filters (types/bbox). Fixed a real loader bug (missing PK → silent no-op). Receipt: d1/RECEIPTS.md.

Fire-free Road Oracle Worker — the Crown-land legality engineTEST

Road Oracle (/api/oracle): lat/lng → sourced answer — province camping legality with source_url, park point-in-polygon containment (155 park polygons), nearest water/dump, fire degrades honestly.
Loaded 13 sourced camping-legality rules + 155 park boundary polygons. Disciplines: ISNAD (every claim sourced) + TAQWA (fire is never falsely "safe"). Receipt: d1/RECEIPTS-ORACLE.md.

Write backend — contribute/review Worker + 5 tablesTEST

5 D1 tables (community_spot, community_review, spot_photos, user_contributions, contributor) translated from the MariaDB backup; POST /spot + /review round-trip proven. Receipt: d1/RECEIPTS-WRITE.md. (Open: photo upload needs R2; a few test rows to clean.)

This is the wedge no competitor has — sourced parcel-level Canadian Crown-land legality. Built and proven; not yet wired to the live site.

Competition analysis — done

COMPETITOR-MASTER.mdDONE

12 competitors SearXNG-verified + 3-model cross-checked: iOverlander, The Dyrt, AllStays, RV Parky, Harvest Hosts, Boondockers Welcome, Campendium, Outly, FreeCampsites.net, Hipcamp, Roadtrippers, Sēkr, Park4Night — each with verified pricing, weakness, and our counter.
Headline: none provides sourced Canadian Crown-land legality — the moat holds. (Honestly flags niche tools that touch it: CrownAccess.ca, crownlandmap.ca.)
Identified the open-data sources feeding the Oracle (Ontario CLUPA/GeoHub, federal open.canada.ca, provincial open data).
Growth signal: muddytires.ca is essentially invisible in search → near-zero SEO footprint (feeds the SEO/Guides work below).

Knowledge base — built, ingested, queryable

_knowledge-base/ + AnythingLLMDONE

8 pattern cards + INDEX + PATTERNS at missions/corpus-library-and-ingest-1/_knowledge-base/.
Ingested to AnythingLLM workspace nxtlvl-knowledge (10 docs embedded) — queryable, proven with a cited answer to "what can muddytires learn from our KB". Receipt: QUERY-RECEIPT.md.
Reusable lessons the muddytires missions ground in (competitor-failure → positioning; 2boots anti-patterns: server-authoritative roles, no raw innerHTML, atomic rate-limiting).

Frontend features — live on the preview (agent-applied, map verified intact)

Map (/map):

Crown-land legality Oracle control (tap-a-spot, readable sourced card) · map rotation · GPS find-me · legend/filter (Layers) · loading skeleton · Oracle amenity actions (Go to water/dump) · share-this-spot deep link · Roll Out / Roll In sun-times · freshness bar moved clear of search.

Landing (/):

Hero band (free + no-login + sourced legality) · trust strip · contact footer · OG/Twitter meta · site-config · durable landing-at-root.

Migration / housekeeping:

Static about.html + nav repointed .php→.html (fixed dead Pages nav) · honest guides.html placeholder · this status page.

Account login — worker built, committed (not deployed)

auth-accounts.js + schema-users.sqlBUILT · NEEDS DEPLOY

Free email/password accounts: signup / login / logout / verifySession / me. PBKDF2 (100k, salted) hashing, server-side revocable sessions, httpOnly+Secure cookie, SESSION_KEY as a Worker secret. Security-verified, committed (3ff7d9b).
Decision made: adding a location / reviews / photos requires a free account (so content attaches to a profile) — this replaced the earlier anonymous+PIN model.
Not deployed, schema not applied to D1 — those are real changes to your Cloudflare account (need your go).

🔜 Pending — grouped by theme

Login / accounts

NEEDS YOU Deploy the account system — create the auth DB, apply the users schema, deploy the worker + set the session secret. (Safety system blocked me from creating the DB without your OK.)
PENDING Add-a-spot (login-required submit) — wire the UI to the write Worker. Depends accounts live.
PENDING Security hardening (XSS-safe + rate-limit login/submit). Depends add-spot.
PENDING Admin moderation queue (review before publish, server-authoritative roles). Depends accounts.
PENDING Reviews & check-ins · confidence badge · photo uploads · profile page — the account-attached community features.

Map system — future change (the redesign)

DONE Path A: leaflet-rotate (spin/bearing) — already shipped, additive, keeps the Leaflet map.
PENDING / FUTURE Path B — migrate the map core to MapLibre GL: native rotation plus true tilt/pitch + vector tiles (app-like, AllStays/iOverlander feel). Documented decision: this rewrites the entire map core (everything currently sits on Leaflet APIs) — a deliberate, resourced rebuild, only if a modern tilting map becomes a core selling point. Not started.

More POIs / data expansion

GATED Data-expansion program — goal: the widest legal public-data coverage on the Canadian map. Stage 1 = audit the existing data + produce a gap list; Stage 2+ = one small ingestion mission per source. Candidate sources: Crown-land legality per province (BC/AB/SK/MB/ON/QC/Atlantic), provincial rec sites & trails, forestry/backroad access, Parks Canada + provincial parks, RV services (sani-dump/water/propane), conservation areas, cell coverage. Gov open data only (never crawl competitors). Blocked behind: the DB must be fully queryable (resilience-2 / local restore).

AI track (aimlapi / Gemma 4 31b)

Model decision is OPEN — and conflicted (read this)NEEDS YOU

aimlapi + Gemma-4-31B is the candidate you named (first-class in the CGSports/Tidal projects). BUT the substrate flags AIMLAPI as compromised/forbidden in your own rulings — the AIMLAPI key was exposed in plaintext and a rotation is owed. The muddytires AI missions themselves strawman Gemini Flash (your Google AI Ultra, zero marginal cost) as the safer default.
So: which model powers the AI layer is an explicit decision you need to make — aimlapi/Gemma-4-31b (after a key rotation + security review) vs Gemini Flash vs Workers AI.

The three AI missions (all built-to-spec, all held on the model choice):

NL Oracle (mt-25) — a natural-language briefing layer that rephrases only the deterministic sourced facts; the exact sourced answer is always preserved as fallback (never invents legality).
AI moderation (mt-26) — scores new spots/reviews for spam/safety, routes low-confidence to the human queue, never auto-publishes. Depends the admin queue + submit path.
POI enrichment (mt-27) — proposes legal-field enrichments with a candidate source, written to a staged/proposed state, human-gated before "gold" (AI never marks legality authoritative).

Community / social platform (your biggest-leverage idea)

SCOPED, GATED Vanlife community + "create once, post everywhere" engine — evolve muddytires from a map into a community where users connect their socials and muddytires auto-distributes their content. Locked: community = open; the social-posting management = private to you + wife.
Cheapest MVP first: rent Post-for-Me ($10/mo, unlimited accounts) to validate you+wife across FB/IG/TikTok/YT before building. Reference implementation to port (not rebuild): nxtlvlyt/website-pipeline. Compute moves to Cloudflare Workers AI (Whisper, thumbnails) + browser ffmpeg.wasm.
Blocked behind: the Cloudflare foundation (resilience-2) + accounts must land first.

Resilience — full Cloudflare (zero NAS dependency)

PARTIAL 7-stage program. DONE: the read + write + Oracle stages on D1 (above). REMAINING: (1) fire ingest — a Cloudflare Cron Worker pulling external feeds (CWFIS / NASA VIIRS); (2) wire the live frontend to the D1 Workers — touches the live site, needs your go; (3) photos → R2 (earlier perms wall).
GATED Off-machine backup of the 1.4 GB DB tar — needs an upload path (fix R2 perms / install rclone / accept it stays on E:).

Guides & SEO

SOURCE-MISSING Real guides — the old guides were a PHP markdown app (now dead on Pages); an honest placeholder is shipped. The real guide markdown needs locating/staging before a static-gen mission (it's fabrication-prone without the real source). Sitemap/robots depend on the real guide URLs. This is also the lever for the SEO gap (site not findable in search).

⚠️ The roots (why things are where they are)

The site is half-migrated: PHP→Pages converted the map + landing to static; guides/add/partners/contribute were still PHP and dead on Pages (about + nav now fixed; the rest pending).
The autonomous engine can't reliably do large frontend edits or authoring — so this work shipped via dispatched agents / hand-application, verified each time. The daemon itself is idle and stable; fixing its planner is a separate engine-reliability track.
Live cutover is gated on you (your standing rule) — all recovery work sits on the preview branch; backend Workers are on test names, not wired to live.
The AI model choice is open and conflicted (aimlapi compromised vs Gemini Flash) — must be decided before the AI missions run.
resilience-2 gates the chain: data-expansion and the community platform both sit behind "DB fully queryable + frontend wired to Cloudflare."

Source files: COMPETITOR-MASTER.md · SOTA-MISSION-ROADMAP.md · ROADMAP-2026-06-16.md · MUDDYTIRES-IMPROVEMENT-BACKLOG.md · _knowledge-base/{INDEX,PATTERNS,QUERY-RECEIPT}.md · d1/RECEIPTS*.md · frontend git log (oracle-frontend-swap).