vwiebe/conductor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
conductor/MVP_SCOPE.md

4.3 KiB
Raw Blame History

Conductor MVP Scope

Status

Approved on 2026-07-18. All six workflows passed Slice 6 release validation and received explicit product-owner sign-off on 2026-08-07.

AI Decision

IBM Bob and watsonx will not be used. The initial MVP has no AI dependency. Any future AI integration must be provider-neutral and is post-MVP.

Required Authentication Types

All five authentication types currently defined by the project schema are required for MVP release:

  • Anonymous
  • Basic authentication
  • Bearer token
  • API key in a request header
  • API key in a query parameter

Credentials must be resolved and injected by the backend. They must not appear in canonical project JSON, exports, browser-visible configuration, or unsanitized logs.

MVP Acceptance Workflows

These are end-to-end acceptance scenarios. They demonstrate that Conductor can build and run REST-backed interfaces; they do not make Conductor a workflow-orchestration engine.

1. Workflow Launcher

  • Create a project.
  • Add an environment dropdown, hostname input, Submit button, and response display.
  • Define a REST action.
  • Map component values into the request.
  • Bind the button to the action and map the response to the display.
  • Execute the scenario successfully in Preview.
  • Save, reload, and confirm the complete behavior is preserved.

2. Dependent Data

  • Call an API to populate a dropdown.
  • Use its selected value to populate or update another component.
  • Confirm loading, empty, and failure states are usable.

3. Read-Only Dashboard

  • Call an API and populate a table.
  • Select a table row.
  • Display the selected record's details in another component.
  • Confirm refresh and error behavior.

4. Authenticated Request

  • Configure and execute each of the five required authentication modes.
  • Confirm credentials are injected only by the backend.
  • Confirm secrets do not appear in browser-visible data, project JSON, exports, errors, or logs.

5. JSON Editing and Persistence

  • Edit canonical project JSON.
  • Validate and apply it.
  • Confirm the Visual Editor updates to match.
  • Save and reload the project without structural or behavioral loss.

6. Failure Handling

  • Trigger an invalid request.
  • Trigger an invalid or unresolved response mapping.
  • Receive actionable errors in the appropriate UI.
  • Confirm canonical project state is not corrupted.
  • Confirm unsaved work is not lost.

Authentication, Authorization, and Publishing Addendum

Approved on 2026-08-07 for Slice 7a:

  • Local username/password authentication with global admin and user roles is required before v0.1.0 packaging.
  • Admins alone may author projects, manage users/secrets, and publish applications.
  • Publishing creates an immutable validated snapshot under a standalone application URL without editor controls.
  • Published visibility is either public or restricted to all authenticated users; admins can access every active published application.
  • Public snapshots may contain only anonymous REST actions. Authenticated snapshots may use server-resolved credential-backed actions.
  • Published action execution must resolve the server-owned snapshot and must not accept browser-substituted URLs, action definitions, authentication modes, or secret references.
  • Authentication and authorization architecture must remain provider-neutral so post-v0.1.0 OIDC/SSO can reuse the same users, roles, sessions, capabilities, and publication rules.
  • Per-application assignments, custom roles, groups, and OIDC/SSO are not part of Slice 7a.

Release Boundary

The MVP is complete only when all required component, configuration, authentication, security, validation, persistence, local-user/RBAC, publishing, first-run administration, multi-page/scoped-variable, Visual Editor command-ribbon polish, and deployment tasks in ROADMAP.md are complete; all six workflows above pass the Slice 6 release-validation process; and Slice 7a, Slice 7b, Slice 7c, and Slice 7d acceptance pass.

Post-MVP scope includes AI assistance, OIDC/SSO beyond the local authentication architecture, OAuth 2.0 for REST actions, IBM Cloud IAM, mTLS, advanced orchestration, and the future capabilities listed in ROADMAP.md.

Requirement-to-slice and validation traceability is maintained in docs/MVP_TRACEABILITY.md.