docs(roadmap): delivered-to-date section + Aug–Oct replan - #347
Merged
Conversation
July's actual output diverged from the plan, so the roadmap now records what shipped and reschedules around it. Adds a "Delivered to date" section: a cumulative inventory of shipped capability (governance, bot platform, developer/agent surface, notifications, testing/CI, platform), plus a table of what landed ahead of its planned month. The bot platform and developer portal arrived ~4 months early, which frees the M7/M8 slots. Replans M4-M6 and adjusts M7-M10 accordingly: - August leads with closing the production release gap - FROST kickoff moves to August so the October go/no-go keeps runway - Discover page moves up to M5 to ride the delivered Wallet V2 discovery - M7 bot work reduces to webhooks; adds an MCP server and #135 - #221 and the UX papercuts (#196, #30, #22) get slots Records verified state as of 2026-07-26: - Mesh 2.0 cutover stays blocked upstream (npm latest is still 1.9.1), demoted from a monthly task to a standing watch item - Production has applied no migration since 2026-05-10; four are outstanding and preprod is 75 commits ahead of main - The RLS advisory is an open exposure in production: the remediation migration is merged but undeployed Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
July's output diverged from the plan enough that the roadmap needed to record what actually shipped and reschedule around it.
What's new
A dedicated "Delivered to date" section — a cumulative inventory of what the product can do today (governance, bot platform, developer/agent surface, notifications, testing/CI, platform), verified against the codebase rather than against PR titles. It ends with a table of capability that landed ahead of its planned month.
M4–M6 replanned, M7–M10 adjusted. The bot platform and the developer portal arrived roughly four months early, so the M7/M8 slots that held them are freed and refilled.
Three findings that drove the replan
Production release gap. The production database has applied no migration since 2026-05-10. Four are outstanding (
add_proposal_tally,add_notification_center,enable_rls_followup_tables,pending_bot_optional_address), andpreprodis 75 commits ahead ofmain. The Node-22 fix landed, butdeploy-migrations.ymlonly fires on pushes tomaintouchingprisma/migrations/**, so it never re-triggered the failed June 17 run. Governance tallies error, the notification center has no tables, and address-less bot registration cannot work in production.The RLS advisory is an open exposure, not a review item. Seven tables (
Contact,BotKey,BotUser,WalletBotAccess,PendingBot,BotClaimToken,AuditLog) still have RLS disabled in production and are reachable by theanon/authenticatedPostgREST roles. fix(db): enable RLS on tables added since the original RLS migration #332 wrote the fix; it is merged and undeployed. Supabase also reports pending Postgres security patches.Mesh 2.0 is still blocked upstream. npm latest for
@meshsdk/core/core-cst/core-cslis 1.9.1 as of 2026-07-26 — no 2.x exists. It is demoted from a monthly task to a standing watch item, since it can't be scheduled against an unpublished dependency.Also recorded:
pr-multisig-v1-smoke.ymlstill hard-fails when secrets are absent, and dependabot runs never receive them, so all 7 open dependency PRs are red for systemic reasons. The siblingci-smoke-preprod.ymlalready has the guard to copy.Changes by month
prisma migrate statusgate so "merged" and "applied" can't silently diverge again. FROST kickoff moves here so the October go/no-go keeps its runway. Document Sign-Off build starts, with finalizing PRD-001 (stillstatus: Draft) as its first sub-task.signDataconstraint as an explicit input to hardware-wallet scoping — Ledger/Trezor support for it is limited and Sign-Off approvals depend on it — plus a UX papercut batch (ability to check full address is a must #196, need pagination for transactions #30, Better 404 page #22).Docs only — no code paths touched.