# ROADMAP — what is deliberately after M6

Everything here was **optional by the master prompt** and is *not* built. Nothing in this list
substitutes for a mandatory capability; each item states what exists today so the next step is
concrete rather than aspirational.

## 1. Neo4j projection (optional second store)

- **Today:** SurrealDB is the single authority. Relations are stored as native `entity_link` records
  with real record links in `in`/`out`, and journey/check 2 proves a traversal reads them rather than
  replaying UI edge arrays. `docs/ARCHITECTURE.md` records the decision to defer a second graph store.
- **Next step:** a one-way projector that replays the event journal into Neo4j, plus a reconciliation
  report comparing node/edge counts and a few named paths per workspace. The journal cursor is the
  natural checkpoint; `snapshot_part` chunking already solves the >1 MB body problem for bulk reads.
- **Watch out:** Neo4j CDC is edition-gated in some configurations — verify the exact edition before
  depending on it, and keep SurrealDB authoritative so the projection can be rebuilt at any time.

## 2. AI Assurance pack

- **Today:** capability probing (`/api/ai/status`), query-plan validation, grounded answers with
  clickable citations, an honest `AI UNAVAILABLE` state, and refusal to render unparseable model
  output. Journey 17 measures citations (60 uids) and latency; nothing grades answer *quality*.
- **Next step:** a versioned eval set of questions with expected cited uids and expected numeric
  claims, run against the local provider on demand, reported as pass/fail per case rather than a
  single score. Then prompt/model pinning, drift detection across model versions, and an evidence
  trail for each eval run.

## 3. Generalized workflow builder

- **Today:** the seven action types are authored in code with typed inputs, preconditions
  (blocking vs advisory), previews, idempotency keys and audit rows. The two mandatory stories are
  driven through that same reviewed path, not a special demo route.
- **Next step:** author action types as stored definitions (inputs, effect patches, precondition
  expressions) with an editor in the Ontology screen, versioned like `ontology_type` already is.
  The scenario branch/patch engine is the closest existing machinery to reuse.

## 4. Optimization and planning depth

- **Today:** deterministic metrics (readiness margin, shortage by deadline, costed interventions in
  integer minor units) and what-if branches that compare against live without writing stock.
- **Next step:** a solver that proposes the cheapest set of transfers/expedites meeting every order
  deadline, constrained by real capacity and transit times, then shows the plan as a branch so it can
  be compared before commit. `Ask for proposals` is the current LLM-based stand-in, not an optimizer.

## 5. Enterprise identity and authorization

- **Today:** a loopback demo session cookie with `owner`/`viewer` roles, workspace scoping enforced
  server-side per request, and check 11 proving cross-workspace reads, actions, evidence and SSE
  events are refused. Secrets never reach the browser.
- **Next step:** OIDC/SAML identity, group→workspace mapping, per-object-type and per-action
  permissions, field-level redaction in the graph payload, and an append-only audit export. TLS is
  required before any of this leaves loopback, because the cookie is currently first-party HTTP on
  127.0.0.1 only.

## 6. Geospatial

- **Today:** `lat`/`lon` and `region` are stored properties (visible in the inspector for sites and
  warehouses), so a map view has real data to bind to. There are no map tiles and none are fetched —
  journey 19 proves zero non-local requests.
- **Next step:** a self-hosted tile server or vector tiles bundled locally, plus distance/routing
  derived from stored coordinates rather than asserted in the seed.

## 7. Production hardening (measured, not hypothetical)

- **Bundle:** one JS file at **1,318.47 kB / 359.63 kB gzip** with Vite warning about no
  code-splitting. Route-level `import()` for the nine screens and lazy Three.js would cut first
  paint materially.
- **Scale evidence:** the perf sample covers a bounded scope (500 nodes / 1,465 edges of 548
  matching). The expanded-scope cap (1,000/3,000) and the `seed --stress <n>` fixture have **no
  latency or fps numbers yet** — that is the first thing to measure before claiming scale.
- **Layout:** `d3-force-3d` runs in a worker, but large layouts still need incremental pinning and
  possibly a precomputed layout cache per scope.
- **Ops:** structured request logs exist (`data/logs/api.log`); missing are metrics export, health
  probes wired to a supervisor, log rotation, and a tested multi-gigabyte backup/restore path
  (restore of this store re-verified at 12:38: 8.0 MB / 4,434 rows in 23.7 s, `failures: []`,
  all 141 evidence files hash-checked).
- **Known cosmetic defects to clear while hardening:** `changes[].field` for a `relation.create`
  carries the target uid; `/health` reports database version as `unknown`; `compareResultSchema` in
  `packages/contracts/src/index.ts:554` is unused and no longer matches the live compare payload.
- **Cleared 2026-10-17:** seeding a dirty store no longer prints "stored N, expected M" — it reports
  per-table `missing` / `extra` with named `extraUids`, and non-seed rows survive (measured:
  `preserved: 14`, imported evidence kept, `validationIssues: []`).

## Explicitly not planned

No cloud dependency for the demo path: fonts, assets, inference and storage stay local. Any feature
that would require a hosted service to demonstrate belongs behind the same honest unavailable state
the copilot already uses.