Roadmap¶
This page is auto-synced from docs/roadmap/INDEX.md in the engineering
repo on every docs build. Treat it as a public-facing snapshot of the
backlog. Plan-by-plan deep dives stay in the engineering monorepo.
Sync source
Generated by scripts/sync-docs.sh from
docs/roadmap/INDEX.md.
Single source of truth for plan status + priority.
Treat this file as the backlog. Pick the highest-priority OPEN row, turn it into a task (TodoWrite + branch + PR), and update the row's status here when it ships.
Operator note — CI is quiet (2026-05-13). GitHub Actions auto triggers on
ci.yml(push/PR) and the nightly cron one2e-plan60.ymlare commented out while Actions billing is paused. Workflows remain runnable manually via the Actions tab (workflow_dispatch). Re-enable triggers once billing is restored. See the OPERATOR NOTE in.github/workflows/ci.ymlfor the unpause checklist. Until then, do not interpret a missing CI check as a regression — local pre-commit (ruff / mypy / pytest) is the currently authoritative gate.
Process¶
- Capture — new idea →
docs/roadmap/<date>-<slug>.mdwith header# Plan NN — title,**Status:**,**Priority:**. Add a row here. - Rank — assign P0/P1/P2/P3. P0 = sales blocker, P1 = within 30 days of first paying customer, P2 = within 90 days, P3 = defer to v0.13+.
- Pick up — when starting work: status
OPEN→IN-FLIGHT, create TodoWrite tasks, branchfeat/plan-NN-<slug>orfix/<slug>. - Ship — PR → admin-merge → tag. Status
IN-FLIGHT→SHIPPED, link the merge SHA. - Block — if waiting on external (counsel, customer, vendor): status →
BLOCKED, note the unblock condition in the row.
The TodoWrite tasks are conversation-scoped working memory. The plan numbers + this index persist across sessions.
Numbering¶
- 60–86: Plan 70 admin config gaps + sub-plans + adjacent v0.11 work
- 87: Pluggable LLM extractors Phase 3
- 88: Google sign-in (shipped)
- 89, 90, 91: Marketing manager rewrite / rule-book buyer descriptions / dashboard explainer overlays (shipped)
- 92: Customer onboarding flow (self-serve signup) — shipped v0.10.0
- 93: Customer usage metering
- 94: In-app learning mode
- 95: AI-generated training videos
- 96: RICS vertical pack (UK chartered surveyors) — full pack v1 shipped v0.11.26
- 97: Per-framework counsel review routing
- 98: Multi-regulation homepage rewrite (UK-first)
- 99: UK Defence AI Playbook rule book
- 100: Defence Standard 05-138 (cyber security overlay)
- 101: Secure by Design (UK Government — checklist+maturity, NOT rule book)
- 102: RLB customer pilot (living doc — first paying customer)
- 103: Frameworks as Subscription Products
- 104: docs.secruna.com (MkDocs Material) — shipped v0.11.x
- 105: Extractor response caching — shipped
- 109: Regulations as products (feature manifest + dynamic sidebar) — Phase 1 shipped v0.11.45
- 110: Lambda + GitHub code deep analysis — shipped v0.11.47
- 110-followup: discovery-worker code-analysis hooks wired — shipped v0.11.48
- 111: GitHub connector v1.1 — shipped v0.11.46
- 112: GitHub Apps real-time webhook — shipped v0.11.50
- 113: Architecture cleanup wave (WI-1..WI-5) — shipped v0.11.47
- 114: Self-service Platform Setup Checklist — shipped v0.11.48, sweep b v0.11.49
- 115: Azure connector federated identity (FIC) — shipped v0.11.51
- 116: GCP Workload Identity Federation — shipped v0.11.52
- 117: AWS EventBridge cross-account push — shipped v0.11.53
- 118: Sovereign agent (customer-hosted) — spec only, supersedes Plan 87 WI-4 carve-out
- 119: Connection Method UI rework — shipped v0.11.54 (picker page dropped in Plan 128)
- 120: Setup checklist tabs (other work stream, #202)
- 121: App registration separation — login vs discovery (shipped v0.11.56 as Plan 127)
- 127: App registration separation — login vs discovery — shipped v0.11.56
- 128: Connector UX cleanup — inline tiles + logos + walkthroughs (renumbered from 120 at merge time; spec lives at
2026-05-13-plan-120-connector-ux-inline-tiles.md) - 129: NCSC Cyber Assessment Framework (CAF) + GovAssure — UK gov + CNI gateway framework
- 130: Multi-tenant sign-in + org onboarding — shipped v0.11.64
- 131: NIS2 Directive v2 (EU cyber gateway) — see
2026-05-14-plan-131-nis2.md - 132: DORA — Digital Operational Resilience Act (EU financial entities) — see
2026-05-14-plan-132-dora.md - 133: Multi-framework incident classifier (NIS2 substantial/significant + DORA major) — see
2026-05-14-plan-133-multi-framework-incident-classifier.md - 134: ICT third-party register beyond AI (NIS2 Art. 21(2)(d) + DORA Art. 28) — see
2026-05-14-plan-134-ict-third-party-register.md - 135: DORA major-incident classifier (Art. 18 thresholds) — see
2026-05-14-plan-135-dora-major-incident-classifier.md - 136: Accessible language + SEO foundation — shipped v0.11.67
- 137: Cyber Essentials Plus — UK government supplier certification — see
2026-05-15-plan-137-cyber-essentials-plus.md - 138: ICO Statutory AI + ADM Code of Practice — see
2026-05-15-plan-138-ico-ai-adm-code.md - 139: On-prem endpoint posture agent (Cyber Essentials Plus full scope) — see
2026-05-15-plan-139-on-prem-endpoint-posture-agent.md - 140: ICO bias testing surface — see
2026-05-15-plan-140-ico-bias-testing-surface.md - 141: Article 22 ADM contest workflow — see
2026-05-15-plan-141-article-22-adm-contest-workflow.md - 142: Verdict queue scaling / triage — see
2026-05-15-plan-142-verdict-queue-scaling.md - 143: Context-aware sidebar (operator vs tenant) — shipped v0.11.73
- 145: Mondoo-style marketing simplification — shipped v0.11.81
- 146: Self-serve scan tier (free inventory, paid classification) — see
2026-08-18-plan-146-self-serve-scan-tier.md - 147+: free for next captures
P0 — sales blockers (ship now)¶
| # | Plan | Status | Notes |
|---|---|---|---|
| 146 | Self-serve scan tier (free inventory, £99 classification) | OPEN 2026-08-18 | Founder direction 2026-08-18 — simplify to a product a stranger can buy without a sales call. £99/mo, £990/yr, one SKU, all ten rulebooks. Three tiers keyed on tenant_framework_subscriptions: no rows = free (inventory only, zero LLM cost), plan='basic' = £99 scan, plan='full' = enterprise workflow (HITL, counsel, incidents, sovereign agent). No schema change. WI-1..WI-5 are mostly configuration over Plans 87/103/109; billing is the only new subsystem; WI-6 (distribution) is the real constraint and is unscoped — ~100 customers needs 2,000–5,000 signups and there is no traffic engine today. Spec: 2026-08-18-plan-146-self-serve-scan-tier.md. |
| 102 | RLB customer pilot (living doc) | IN-FLIGHT | First paying customer. UK chartered surveying + UK government / defence supplier. Pilot kickoff TBD with founder. Unchanged by Plan 146 — stays on the sales-assisted onboarding path. |
P1 — within 30 days of first paying customer¶
| # | Plan | Status | Notes |
|---|---|---|---|
| 110 | Lambda + GitHub code deep analysis | SHIPPED v0.11.47 | PR #170. Plan 110-followup discovery-worker wiring shipped v0.11.48 (#177). |
| 111 | GitHub connector v1.1 — catalog + workflow shell + PR mining + confidence score | SHIPPED v0.11.46 | PR #166. |
| 112 | GitHub Apps real-time webhook | SHIPPED v0.11.50 | PR #188. Sub-minute discovery after push / pull_request. |
| 113 | Architecture cleanup wave (auth + cache + aggregation + test cost gating + CHANGELOG policy) | SHIPPED v0.11.47 | PR #169. |
| 114 | Self-service Platform Setup Checklist | SHIPPED v0.11.48 | PR #178. Sweep b (rotate + split-brain recovery + 8th catalog item GCP discovery OAuth) shipped v0.11.49 (#185). |
| 115 | Azure connector federated identity (FIC) | SHIPPED v0.11.51 | PR #190. Kills ENTRA_CLIENT_SECRET via federated identity credentials. |
| 116 | GCP connector Workload Identity Federation | SHIPPED v0.11.52 | PR #192. Kills GOOGLE_OAUTH_CLIENT_SECRET via WIF + OIDC trust. |
| 117 | AWS EventBridge cross-account real-time push | SHIPPED v0.11.53 | PR #194. Real-time alternative to AWS assume-role discovery — customer pushes events to our bus instead of granting IAM. |
| 118 | Sovereign agent (customer-hosted) | SHIPPED v0.11.55 | PR #199. Customer runs full discovery + classifier stack in their VPC; only verdicts ship back over mTLS. Supersedes Plan 87 WI-4 carve-out. Phase 118.5 follow-ups captured in spec (poll work distributor, JWT replay-nonce cache, CDN direct upload). |
| 119 | Connection Method UI rework | SHIPPED v0.11.54 | PR #196. 3-step picker (vendor → method → confirm) with trust-posture badges. |
| 129 | NCSC Cyber Assessment Framework (CAF) + GovAssure | SHIPPED v0.11.60 + follow-ups v0.11.61 | UK gov + CNI gateway framework. Absorbs overlaps with Plan 100 (DS 05-138) and Plan 101 (Secure by Design). Spec: 2026-05-14-plan-129-ncsc-caf.md. |
| 130 | Multi-tenant sign-in + org onboarding | SHIPPED v0.11.64 | Switches /auth/login from External ID single-tenant authority to /organizations. Wires unknown-user branch to existing onboarding queue (Plan 117). Spec: 2026-05-14-plan-130-multi-tenant-signin.md. |
| 131 | NIS2 Directive v2 | SHIPPED v0.11.66 | EU cyber gateway for essential + important entities. 22 IGPs across Art. 20 / 21 / 23 / 24 / 28 / 29. Shipped jointly with Plan 132 (PR #240). Spec: 2026-05-14-plan-131-nis2.md. |
| 132 | DORA — Digital Operational Resilience Act | SHIPPED v0.11.66 | Every EU financial entity in scope since 2025-01-17. 33 IGPs across the five pillars. AI inventory reused as partial Art. 28 register. Shipped jointly with Plan 131 (PR #240). Spec: 2026-05-14-plan-132-dora.md. |
| 133 | Multi-framework incident classifier | IN-FLIGHT 2026-05-14 | NIS2 substantial/significant + DORA major + ICO breach severity auto-classification. Absorbs Plan 135. Sibling table incident_framework_classifications + per-framework classifier + classify / override / list endpoints + filter chips + Regulatory classification card. Shipped jointly with the merged Plan 135 work on feat/plan-133-135-incident-classifier. Spec: 2026-05-14-plan-133-multi-framework-incident-classifier.md. |
| 134 | ICT third-party register beyond AI | OPEN | DORA Art. 28 register over non-AI ICT third parties + NIS2 Art. 21(2)(d) supply-chain. Scaffolded from Plan 131 / 132. Spec: 2026-05-14-plan-134-ict-third-party-register.md. |
| 135 | DORA major-incident classifier | MERGED-INTO-133 2026-05-14 | Folded into Plan 133 — both plans targeted the same surface (incidents model + UI per-framework classification). DORA-specific Art. 18 + Delegated Reg 2024/1772 threshold encoding lives inside the shared classifier. Spec: 2026-05-14-plan-135-dora-major-incident-classifier.md. |
| 137 | Cyber Essentials Plus | IN-FLIGHT 2026-05-15 | UK government supplier certification + private-sector RFP gate. 18 IGPs across the five Cyber Essentials Plus control families (FW / SC / UAC / MP / SU). Plus tier adds independent IASME-registered assessor visit. Shipped jointly with Plan 138 on feat/plan-137-138-cyberessentials-ico. Spec: 2026-05-15-plan-137-cyber-essentials-plus.md. |
| 138 | ICO Statutory AI + ADM Code of Practice | IN-FLIGHT 2026-05-15 | UK ICO Code on AI and Automated Decision-Making. Statutory under DPA 2018 ss. 121-129. 22 IGPs across seven themes. Shipped jointly with Plan 137. Spec: 2026-05-15-plan-138-ico-ai-adm-code.md. |
| 139 | On-prem endpoint posture agent | OPEN | Cyber Essentials Plus full coverage — covers on-prem endpoints not reachable through cloud connectors. Scaffolded from Plan 137. Spec: 2026-05-15-plan-139-on-prem-endpoint-posture-agent.md. |
| 140 | ICO bias testing surface | OPEN | ICO Code F.01 full coverage — bias-testing evidence-capture surface. Scaffolded from Plan 138. Spec: 2026-05-15-plan-140-ico-bias-testing-surface.md. |
| 141 | Article 22 ADM contest workflow | IN-FLIGHT 2026-05-15 | ICO Code ADM.04 specialised data-subject-facing contest workflow. Public submission form at /contest-an-ai-decision/{tenant_slug} on the marketing site + dashboard queue at /adm-contests + 30-day deadline tracking + auto-emailed acknowledgement and outcome. Branch feat/plan-141-adm-contest-workflow. Spec: 2026-05-15-plan-141-article-22-adm-contest-workflow.md. |
| 142 | Verdict queue scaling / triage | IN-FLIGHT 2026-05-15 | Plan 60 fixture tenant queue grew past 47k pending_review rows once ten frameworks shipped. Adds per-tenant auto-approve rules (status auto_approved), batch (framework, severity, ai_system_class) operations with single audit row, risk-weighted queue ordering (severity × business impact × age decay), and a fifth dashboard KPI tile. Spec: 2026-05-15-plan-142-verdict-queue-scaling.md. |
| 89 P3 | Counsel review of legal pages | DEFERRED | Plan 97 routing shipped. Unblocks once counsel relationship exists. [TBD — pending counsel review] placeholders stay until then. |
| 62 | Rule book v1.1 (generic LLM + shadow AI rules) | DEFERRED | Plan 97 routing shipped. Rule YAMLs scaffolded on main but firing scoped to test fixtures pending first counsel sign-off. |
P2 — within 90 days of first paying customer¶
| # | Plan | Status | Notes |
|---|---|---|---|
| 97 | Per-framework counsel review routing | SHIPPED v0.11.x | Shipped 2026-05-11 (PR #145, SHA cb62dfc). Magic-link click + optional PDF (Option C). Engineering audit-trail doc closure PR #183 on 2026-05-12. Unblocks Plans 62 + 89 P3 + counsel-gated rules across RICS/Defence/EU AI Act once a counsel relationship exists. |
| 98 | Multi-regulation homepage rewrite (UK-first) | PARTIAL — P1+P2 shipped | Phase 1 + Phase 2 shipped 2026-05-09 (PRs #109, #128). Further phases (Phase 3+) on hold until RLB pilot stable. |
| 100 | Defence Standard 05-138 (cyber security) | SHIPPED v0.11.x | v1 shipped 2026-05-09 (PRs #117, #121, #122, #123 — rules + signals + evidence pack + marketing). No further v2 investment until customer demand — out of AI scope per 2026-05-11 founder decision. |
P3 — defer to v0.13+¶
| # | Plan | Status | Notes |
|---|---|---|---|
| 94 | In-app learning mode | OPEN | Onboarding polish. |
| 95 | AI-generated training videos | OPEN | Sales asset, not core product. |
| 87 WI-4 | Pluggable extractors — production OSS hosting | SUPERSEDED | Replaced by broader Plan 118 sovereign agent (covers full discovery+classifier stack, not just extractor layer). |
Shipped — v0.11 wave (2026-05-06 → 2026-05-08)¶
| # | Plan | Tag |
|---|---|---|
| 60 | Plan 60 (initial v0.11 scoping) | v0.11.0 |
| 61 P1 | Discovery worker — cron Phase 1 | v0.11.x |
| 61 P2 | Discovery worker — cp-api invokes worker job | v0.11.x |
| 62 | Rule book matcher schema (artifact_metadata) — Phase 1 | v0.11.x |
| 65 | 17 Annex III synthetic Lambda fixtures + extractor validation | v0.11.x |
| 66 | Onboarding session refresh + invite-second-admin nudge | v0.11.x |
| 67 | Tenant slug collision auto-retry | v0.11.x |
| 68 | Corporate-email-domain enforcement | v0.11.x |
| 69 | Azure connector account-picker + cross-account warning | v0.11.x |
| 70 | Frontend admin config gaps — meta-plan | v0.11.x |
| 71 P1 | Tenant member management — invitations + member routes + frontend | v0.11.x |
| 71 P2 | Tenant member management — role taxonomy rename | v0.11.x |
| 72 | Connector re-authorisation flow | v0.11.x |
| 73 | Manual AI system entry | v0.11.x |
| 74 | Tenant settings page (display block) | v0.11.x |
| 88 | Google sign-in | v0.11.x |
| 89 P1 | Marketing manager-buyer homepage rewrite | v0.11.x |
| 90 | Rule book customer descriptions | v0.11.x |
| 91 | Dashboard explainer overlay | v0.11.x |
| 92 | Customer onboarding flow (self-serve signup) | v0.10.0 |
| 87 WI-1 | Pluggable extractor — per-tenant UI | v0.11.15 |
| 89 P2 | /use-cases rewrite with article anchors |
v0.11.16 |
| 85 | Bulk operations on verdicts | v0.11.x (pre-existing on main; never tracked here) |
| 87 WI-2 | Pluggable extractor — BYO endpoint | v0.11.17 |
| 78 | Webhooks (push events to SIEM/Slack/Teams) | v0.11.17 |
| 86 | Connector credential rotation UI | v0.11.17 |
| 96 WI-0 | RICS POC — loader multi-framework + AVM rule | v0.11.19 |
| 96 WI-1 | RICS — 4 remaining rules (GIS, GenAI drafting, due-diligence, chatbot) | v0.11.20 |
| 96 WI-2 | Multi-framework load + per-tenant enabled_frameworks |
v0.11.24 |
| 96 WI-3 | Per-framework category taxonomy (EU + RICS enums) | v0.11.25 |
| 96 WI-4 | Surveying connector signal patterns | v0.11.25 |
| 96 WI-7 | Marketing landing /use-cases/rics + GTM |
v0.11.25 |
| 96 WI-5 | AI Use Disclosure Statement export | v0.11.26 |
| 96 WI-6 | Firm AI Register export (PDF + CSV) | v0.11.26 |
| 96 WI-8 | RICS eval golden set (20 cases, F1=1.000) | v0.11.26 |
| 87 WI-2 | Pluggable extractor — BYO endpoint | v0.11.17 |
| 78 | Webhooks (push events to SIEM/Slack/Teams) | v0.11.17 |
| 86 | Connector credential rotation UI | v0.11.17 |
| — | P0 fix: admin verdict detail 404 → /admin/verdicts/{id} | v0.11.18 |
| 96 WI-0 | RICS POC — loader multi-framework + AVM rule | v0.11.19 |
| — | Plan 72 follow-up: reauthorize button AJAX + toast | v0.11.15 |
| 76 | Notification routing rules per-tenant | v0.11.x |
| 77 | API tokens + bearer auth + scope enforcement | v0.11.x |
| 79 | Discovery schedule per connection | v0.11.x |
| 80 | Branded PDF templates + per-tenant logo upload | v0.11.x |
| — | Migration 0035 down_revision fix (multiple-heads) | v0.11.x |
| 99 wave | UK Defence AI Playbook (PDF extract + 6 rules + connector signals + Defence AI Use Statement export + eval + marketing) | v0.11.x |
| 100 wave | Defence Standard 05-138 — v1 (20 rules + cyber connector signals + DS Compliance Evidence Pack export + eval + marketing). No v2 investment per 2026-05-11 founder direction. | v0.11.x |
| 101 wave | Secure by Design (foundation + 58 checklist + endpoints + export + marketing) | v0.11.x |
| 103 | Frameworks as Subscription Products — per-tenant subscription metadata + admin framework picker | v0.11.x |
| 98 P1 | Multi-regulation homepage rewrite Phase 1 (UK-first) | v0.11.x |
| 98 P2 | /use-cases directory + EU AI Act deep page |
v0.11.x |
| 104 wave | docs.secruna.com (MkDocs Material + deploy + i18n) | v0.11.x |
| — | Impersonation fix: platform admin bypass org_admin role | v0.11.37 |
| 75 | Compliance officer roster + HITL routing + verdict reassign | v0.11.38 |
| 81 | Platform-admin promote/demote UI | v0.11.39 |
| 84 | Per-tenant rule book version pinning | v0.11.39 |
| 87 WI-3 | Pluggable extractors — failover chain | v0.11.39 |
| — | Docs nginx redirect leak fix (no Azure FQDN exposure) | v0.11.39 |
| 82 | Per-tenant feature flags + rate limits + retention | v0.11.41 |
| 61 P2 | Event-triggered discovery worker close-out (Option B chosen) | v0.11.41 |
| 83 | Tenant lifecycle — suspend / archive / restore + hard-delete cron | v0.11.41 |
| 93 MVP | Customer usage metering — counters + 4 metrics + /usage page | v0.11.41 |
Strategic / context (read-only — not implementation work)¶
2026-05-01-roadmap.md— early roadmap snapshot2026-05-03-eu-ai-act-gap-analysis.md— regulation vs product2026-05-03-mvp-priorities.md— MVP priority stack2026-05-03-onetrust-gap-analysis.md— competitive annex
Conventions¶
- Filename:
YYYY-MM-DD-<slug>.md(older docs without plan-NN in filename are fine — header# Plan NN — …is the truth). - Header order:
# Plan NN — title→**Status:** ...→**Priority:** ...→ optional**Captured:** YYYY-MM-DD. - This INDEX is the truth when status drifts in individual docs. Touch the doc when convenient; the index is updated every time a plan moves states.