Victor Wiebe
498003f83d
Some checks failed
Release production image / production-image (push) Has been cancelled
91 lines
4.5 KiB
Markdown
91 lines
4.5 KiB
Markdown
# Conductor MVP Scope
|
|
|
|
## Status
|
|
|
|
Approved on 2026-07-18. All six workflows passed Slice 6 release validation and received explicit product-owner sign-off on 2026-08-07. On 2026-08-08, the product owner adopted this accepted MVP scope unchanged as the Conductor v1.0.0 production-release boundary.
|
|
|
|
## AI Decision
|
|
|
|
IBM Bob and watsonx will not be used. The initial MVP has no AI dependency. Any future AI integration must be provider-neutral and is post-MVP.
|
|
|
|
## Required Authentication Types
|
|
|
|
All five authentication types currently defined by the project schema are required for MVP release:
|
|
|
|
- Anonymous
|
|
- Basic authentication
|
|
- Bearer token
|
|
- API key in a request header
|
|
- API key in a query parameter
|
|
|
|
Credentials must be resolved and injected by the backend. They must not appear in canonical project JSON, exports, browser-visible configuration, or unsanitized logs.
|
|
|
|
## MVP Acceptance Workflows
|
|
|
|
These are end-to-end acceptance scenarios. They demonstrate that Conductor can build and run REST-backed interfaces; they do not make Conductor a workflow-orchestration engine.
|
|
|
|
### 1. Workflow Launcher
|
|
|
|
- [x] Create a project.
|
|
- [x] Add an environment dropdown, hostname input, Submit button, and response display.
|
|
- [x] Define a REST action.
|
|
- [x] Map component values into the request.
|
|
- [x] Bind the button to the action and map the response to the display.
|
|
- [x] Execute the scenario successfully in Preview.
|
|
- [x] Save, reload, and confirm the complete behavior is preserved.
|
|
|
|
### 2. Dependent Data
|
|
|
|
- [x] Call an API to populate a dropdown.
|
|
- [x] Use its selected value to populate or update another component.
|
|
- [x] Confirm loading, empty, and failure states are usable.
|
|
|
|
### 3. Read-Only Dashboard
|
|
|
|
- [x] Call an API and populate a table.
|
|
- [x] Select a table row.
|
|
- [x] Display the selected record's details in another component.
|
|
- [x] Confirm refresh and error behavior.
|
|
|
|
### 4. Authenticated Request
|
|
|
|
- [x] Configure and execute each of the five required authentication modes.
|
|
- [x] Confirm credentials are injected only by the backend.
|
|
- [x] Confirm secrets do not appear in browser-visible data, project JSON, exports, errors, or logs.
|
|
|
|
### 5. JSON Editing and Persistence
|
|
|
|
- [x] Edit canonical project JSON.
|
|
- [x] Validate and apply it.
|
|
- [x] Confirm the Visual Editor updates to match.
|
|
- [x] Save and reload the project without structural or behavioral loss.
|
|
|
|
### 6. Failure Handling
|
|
|
|
- [x] Trigger an invalid request.
|
|
- [x] Trigger an invalid or unresolved response mapping.
|
|
- [x] Receive actionable errors in the appropriate UI.
|
|
- [x] Confirm canonical project state is not corrupted.
|
|
- [x] Confirm unsaved work is not lost.
|
|
|
|
## Authentication, Authorization, and Publishing Addendum
|
|
|
|
Approved on 2026-08-07 for Slice 7a:
|
|
|
|
- Local username/password authentication with global `admin` and `user` roles is required for the v1.0.0 release.
|
|
- Admins alone may author projects, manage users/secrets, and publish applications.
|
|
- Publishing creates an immutable validated snapshot under a standalone application URL without editor controls.
|
|
- Published visibility is either public or restricted to all authenticated users; admins can access every active published application.
|
|
- Public snapshots may contain only anonymous REST actions. Authenticated snapshots may use server-resolved credential-backed actions.
|
|
- Published action execution must resolve the server-owned snapshot and must not accept browser-substituted URLs, action definitions, authentication modes, or secret references.
|
|
- Authentication and authorization architecture must remain provider-neutral so post-MVP OIDC/SSO can reuse the same users, roles, sessions, capabilities, and publication rules.
|
|
- Per-application assignments, custom roles, groups, and OIDC/SSO are not part of Slice 7a.
|
|
|
|
## Release Boundary
|
|
|
|
The MVP is complete only when all required component, configuration, authentication, security, validation, persistence, local-user/RBAC, publishing, first-run administration, multi-page/scoped-variable, Visual Editor command-ribbon polish, public production distribution, SkeletonWorks installation, and verified backup/restore tasks in `ROADMAP.md` are complete; all six workflows above pass the Slice 6 release-validation process; and Slice 7a, Slice 7b, Slice 7c, Slice 7d, and Slice 8 acceptance pass.
|
|
|
|
Post-MVP scope includes AI assistance, OIDC/SSO beyond the local authentication architecture, OAuth 2.0 for REST actions, IBM Cloud IAM, mTLS, advanced orchestration, and the future capabilities listed in `ROADMAP.md`.
|
|
|
|
Requirement-to-slice and validation traceability is maintained in `docs/MVP_TRACEABILITY.md`.
|