Roadmap

The local command is the whole product today, and the boundaries it declares are the roadmap’s table of contents.

The nearest lane is verified external controls. The request wire, a signed envelope carrying the evaluation request and the five controls described in Controls and policy, is specified in the project record and deliberately unbuilt; the report already carries its fields as none. When those formats revise, they also pick up the report’s second-contract path union, closing the gap where a finding on a byte-named document is reportable but not yet waivable. When it lands, organization floors, adoption debt, waivers, trusted time, and execution constraints become usable in required checks, each tied to the exact tree it authorizes. The same revision is where controls learn hosts other than github.com: the scanner already evaluates any declared forge identity, but a control document can bind to one only when its format can spell it and a trust anchor exists there. The amiss-bootstrap wrapper and the release manifest chain, which validate a pinned action tree and launch a verified engine, ship in the repository now and wait on that same lane.

Reference support grows only where a boundary can be made exact. Heading-anchor resolution is the most requested candidate, and it enters only with a slug algorithm pinned the way the parsers are pinned, because a wrong guess about slugs is a false pass. reStructuredText and AsciiDoc parsers would slot in the way the MDX parser does today: pinned grammar, test corpus, honest opacity for whatever the grammar cannot see.

The governed layer, typed claims, acceptance records, verified review, everything the rejected predecessor wanted to be, stays closed behind the project record’s gates. The contracts exist and the semantics are worked out, but none of it is authorized until the scanner has earned adoption evidence and the storage experiments pass. The position has not changed: a check that cannot yet be made trustworthy does not ship wearing a trustworthy costume.

Performance work follows measurement. The published ceilings bound the worst case, a benchmark job watches the common case, and the known slow corners in the pinned upstream grammars are documented in the corpus notes rather than papered over.

The specified future, in claim kinds

The project record specifies a ladder of claim kinds beyond the v0 scanner, each named after the question it answers and each grounded in an observed failure from the evidence base. Deterministic kinds: a snippet claim (displayed code equals the selected source), a value claim (a number or name in prose equals a value extracted from code, for the hand-written counts that were wrong everywhere), an inventory claim (a documented set equals an extracted set, two-sided, because the audited page that listed only correct files still failed by omission), a tree claim, a graph claim, and a transcript claim (a recorded command run, fingerprinting the binary that produced it, because transcripts against a stale binary stayed green). Two review kinds sit above them: a narrative claim, free prose attested against fingerprinted evidence, and an external claim, prose that depends on the world outside the repository and re-checks on a schedule, the one place wall-clock time is a sanctioned input.

Extraction wider than explicit links is specified and deliberately deferred, because the noise classes are documented: prose that tells the reader to create a file matches every existing-directory heuristic forever, gitignored build artifacts look like broken references, and a bare filename that binds uniquely today becomes ambiguous the day a same-named file appears. Each of those has a worked answer in the record, and none of the answers is free, so none of them ships until the simple layer has earned its keep.

The enforcement model for all of it is tiered by proof strength, a lesson from the failure-mode study: hard blocks only for what is deterministically wrong, required human acknowledgment for impact, advisory discovery for everything heuristic, and no bulk acceptance gesture anywhere, because the audit’s cheapest-bypass finding applies to any gate this project ever ships.