Roadmap - Lumenstat

Lumenstat is built against the three milestones of its proposal to the Stellar Community Fund RFP Web and API Analytics for Stellar Ecosystem Projects. Much of the first milestone was built before applying, so reviewers can test it rather than read about it. The plan below changes if SCF asks for changes, and this page changes with it. Have something you need that is not here? Suggest it or vote on the board.

Milestone 1: web analytics live

Mostly live

Deliverable	Status
Umami fork with country-only geo, a random daily salt and query stripping	Live
Bot and inflation defense, layers 1 to 4, with flagged traffic stored apart	Live
Versioned, immutable tracker with SRI and ad-block-safe paths	Live, tracker 1.0.0
Byte-for-byte reproducible tracker build, checked in CI and on deploy	Live
Self-service enrollment with a Stellar link, open or approval mode	Live
Project dashboard and operator screens, built with the Stellar Design System	Live
Security policy and private vulnerability reporting	Policy published, reporting channel being enabled
OpenTofu and Ansible for staging and production	In the repository
`@lumenstat/tracker` on npm with provenance	Ready, first publish pending
Public MIT repository	Opening soon
Boundless instrumented in production	In review
Privacy statement reviewed by counsel	Draft published, review pending

Milestone 2: API analytics and the global view

In progress Parts of the API path already run: the collector with spanmetrics, route normalization, the writer with p50, p95 and p99, and a per-project API view. This milestone finishes it and makes the operator view work at the scale of every SCF project.

Attribute allowlist at the collector, and ingest keys checked at the edge instead of only in the writer.
Hourly and daily rollups for API metrics, with retention jobs.
Operator global dashboard for web and API, with CSV export.
Operator API keys, and suspend and remove for projects.
An anomaly view for sudden changes in traffic or flagged share.
A published load test at ten times the target volume.
Three SCF projects live on web analytics and one on API analytics.

Milestone 3: production and handover ready

Planned

Ingest in two locations with a buffer, and a rehearsed failover.
t. and otlp. served directly from EU servers, so no CDN sees visitor IP addresses.
Alerts and a public status page.
Off-site backups in the EU, with a restore drill.
Self-service data deletion for projects, and the event retention job (25 months, then daily totals).
Runbooks for deploys, Umami upgrades, restores, incidents, key rotation and handover.
An outside security review, with its fixes.
A handover dry run by someone outside the team, with the log published.
Final statements on data residency, jurisdiction and erasure.

After milestone 3

Lumenstat is meant to outlive its builders. After the third milestone the service runs for twelve months with monthly Umami and dependency updates, a monthly restore test and a published service report. At a point SCF chooses, it moves to a community operator that SCF names: that operator rebuilds the stack from this repository, the data is restored and checked table by table, DNS moves, and every secret is rotated. Tracker URLs do not change, so projects do nothing.

How releases work

The service deploys from main. Every change is listed in the changelog.
The tracker is versioned on its own. A published version never changes; a fix ships as a new version and projects upgrade on purpose. See Tracker releases.