conductor/ROADMAP.md

# Conductor Unified Roadmap to v0.1.0

## Purpose

This is the master index of completed and remaining work for Conductor v0.1.0. It supersedes the older numbered-step roadmap and legacy task inventory while reconciling `MVP_SCOPE.md` and `SLICE1.md` through `SLICE8.md`.

The slice files remain the detailed implementation plans. When an older list conflicts with the approved MVP boundary or current acceptance evidence, this document follows `MVP_SCOPE.md`, the slice files, and recorded manual acceptance in that order.

## Status Legend

- [x] Implemented and accepted, or a completed product decision.
- [ ] Remaining v0.1.0 work.
- **Partial** means useful work has passed, but the slice-level release gate is not complete.
- **Post-MVP** means deliberately excluded from v0.1.0.

## Slice Summary

| Slice | Function | Status | Remaining gate |
| --- | --- | --- | --- |
| [Slice 1](SLICE1.md) | MVP GUI components | Complete | None |
| [Slice 2](SLICE2.md) | Visual configuration | Complete | None |
| [Slice 3](SLICE3.md) | Authentication and secrets | Complete | None |
| [Slice 4](SLICE4.md) | Proxy security and observability | Complete | None |
| [Slice 5](SLICE5.md) | Validation and error handling | Complete | None |
| [Slice 6](SLICE6.md) | Testing and release validation | Complete | None |
| [Slice 6a](SLICE6a.md) | Editor information density and progressive disclosure | Complete | None |
| [Slice 7](SLICE7.md) | MVP scope decision and requirement governance | Complete | None |
| [Slice 7a](SLICE7a.md) | Local authentication, RBAC, and application publishing | Complete | Implementation, security validation, manual acceptance, cleanup, and explicit sign-off passed |
| [Slice 7b](SLICE7b.md) | Browser-based first-run administrator setup | Complete | Fresh-install setup, takeover prevention, recovery validation, manual acceptance, and explicit sign-off passed |
| [Slice 7c](SLICE7c.md) | Multi-page applications and variable scope | Complete | Page authoring, scoped runtime, deep links, security validation, and explicit sign-off |
| [Slice 7d](SLICE7d.md) | Visual Editor professional command ribbon | Planned | Ribbon implementation, responsive/accessibility validation, manual visual acceptance, and explicit sign-off |
| [Slice 8](SLICE8.md) | Documentation and release packaging | Partial | Unified roadmap complete; broader documentation ownership, reconciliation, guides, and release packaging remain |
| [Slice 9](SLICE9.md) | OIDC and enterprise SSO | Post-MVP | Begins after Slice 7a; provider and provisioning decisions remain |

## 1. MVP GUI Components

### Slice 1 — Complete

- [x] Implement all eleven schema-supported MVP components in the palette, canvas, property editor, Preview, bindings, diagnostics, examples, and tests.
- [x] Keep interactive values in ephemeral runtime state and canonical properties in project JSON.
- [x] Complete manual canvas, Preview, JSON synchronization, save/load, and regression acceptance.

### Slice 2 — Remaining property and presentation work

- [x] Complete the audited component-specific property controls and basic styling controls required by the MVP specification.
- [x] Manually confirm JSON Viewer defaults, Table column widths, required inputs, and basic appearance authoring in Visual Editor and Preview.
- [x] Make the white Preview page/canvas background grow with runtime-rendered output, including Tables that exceed their configured design-time height.
- [x] Manually confirm the rebuilt Preview background expands and contracts with runtime-populated Table content.

### Post-MVP

- [ ] Add tabs, modal dialogs, date pickers, file uploads, charts, and progress indicators.
- [ ] Add reusable themes and component libraries.
- [ ] Add editable Table cells, sorting, filtering, pagination, CSV import/export, row actions, and multi-selection.

Table pagination requires a separate client-side versus server-side design discussion and is not a v0.1.0 release requirement.

## 2. Visual Configuration Workflows

### Slice 2 — Implemented and accepted increments

- [x] Create, edit, duplicate, test, and reference-safely delete anonymous REST actions through the UI.
- [x] Edit action method, URL, headers, query parameters, path parameters, and body templates in canonical `project.actions`.
- [x] Configure Button `onClick` action events visually.
- [x] Insert component and variable request values into executed request templates.
- [x] Create, edit, and delete canonical top-level response bindings.
- [x] Target supported component properties and declared runtime variables.
- [x] Create and edit typed variable declarations and defaults.
- [x] Configure page `onLoad` actions and execute them once per Preview initialization.
- [x] Warn before deleting referenced actions, variables, and components while preserving intentionally broken references for diagnostics.
- [x] Keep Visual Editor, JSON Editor, persistence, and Preview runtime state separated correctly for the accepted increments.

These items replace the older roadmap's pending Steps 19 and 20. They are not new remaining work.

### Slice 2 — Remaining release work

- [x] Run and record the final workflow-launcher acceptance without hand-editing JSON.
- [x] Run and record the final dependent-data acceptance, including initial Dropdown population.
- [x] Mark the five Slice 2 acceptance criteria complete after those workflows pass.
- [x] Retain and document the fixed 30-second backend request timeout for v0.1.0; defer a bounded canonical per-action timeout to proxy-policy work.
- [x] Correct action and response-binding diagnostics so page `onLoad` counts as a valid trigger and the UI uses clear component-or-page-event wording.
- [x] Manually confirm the corrected Actions & Bindings view no longer reports false untriggered-action or binding warnings for page `onLoad`.
- [x] Manually accept the implemented Actions & Bindings information-architecture improvements for clearer action, binding, and variable cards, hierarchy, spacing, and summaries.
- [x] Finish Slice 2's consolidated tests, examples, documentation reconciliation, and explicit sign-off.

### Slice 2a — Request-reference usability

- [x] Implement contextual component and variable suggestions in template-capable request fields, including after typing `{{`.
- [x] Suggest common REST header names while preserving arbitrary custom header names.
- [x] Align the guided request destination with request keys and the value source with request values.
- [x] Complete proportional manual acceptance.
- [x] Obtain explicit final Slice 2a sign-off.

### Post-MVP

- [ ] Add controlled action chaining or orchestration only after a new canonical design and scope decision.
- [ ] Add advanced transforms, JSONPath or another expression language, conditions, branches, parallel actions, loops, retries, and general workflow graphs.

The older roadmap placed controlled action orchestration in v0.1.0. That conflicts with `MVP_SCOPE.md` and `SLICE2.md`, which explicitly avoid turning Conductor into a workflow engine. It is therefore post-MVP unless the product owner deliberately changes the approved release boundary.

## 3. Authentication and Secrets

### Slice 3 — Design and storage

- [x] Define the MVP threat assumptions and secret-reference model.
- [x] Select and document the server-side secret storage and deployment mechanism.
- [ ] Define secret ownership, creation, replacement, deletion, missing-reference, and restart behavior.
- [x] Add safe secret create, update, lookup, and delete APIs.
- [x] Ensure canonical project JSON, exports, project CRUD responses, and browser state use opaque references rather than credential values.

### Slice 3 — Authentication execution

- [x] Preserve Anonymous execution.
- [x] Implement Basic authentication injection.
- [x] Implement Bearer token injection.
- [x] Implement API-key header injection.
- [x] Implement API-key query-parameter injection.
- [x] Reject missing or incompatible credential references with structured errors.

### Slice 3 — Redaction and validation

- [x] Redact credentials from logs, errors, diagnostics, history, Inspector output, proxy responses, and URLs.
- [x] Test all five modeled authentication modes with controlled endpoints.
- [x] Confirm secrets never appear in saved JSON, exports, browser-visible traffic, frontend state, or unsanitized logs.
- [x] Verify Docker secret provisioning and restart behavior.
- [x] Complete proportional manual secret lifecycle, compatible-selection, execution, redaction, and deletion-safety acceptance.
- [x] Obtain explicit final Slice 3 sign-off.

OAuth 2.0, IBM Cloud IAM, mTLS, and arbitrary authentication scripts remain post-MVP.

## 4. Proxy Security and Observability

### Slice 4 — Destination and request policy

- [x] Document the proxy threat model and default-deny boundaries.
- [x] Define permitted schemes, origins, hosts, ports, and explicit internal-host exceptions.
- [x] Block unsafe local, link-local, metadata-service, and unapproved destinations.
- [x] Revalidate DNS results and redirect targets at every boundary.
- [x] Permit only HTTP and HTTPS.
- [x] Allowlist forwarded headers and strip dangerous or hop-by-hop headers.
- [x] Add request-size, response-size, redirect, and execution-time limits.
- [x] Standardize safe proxy errors and malformed-response behavior.

### Slice 4 — Sanitized execution history

- [x] Persist timestamp, project/action identity, method, sanitized URL, status, duration, outcome, sanitized error, and bounded response-preview metadata.
- [x] Mask authorization headers, passwords, tokens, API keys, cookies, credential-resolution details, and sensitive query values.
- [x] Add an execution-history view with recent executions, action/status filtering, useful errors, and no backend stack traces.
- [x] Decide retention, persistence, restart, and clear-history behavior.
- [x] Add successful, failed, redirect, timeout, size-limit, SSRF, redaction, and regression coverage, with socket-level scenarios retained in the separate proportional manual gate.
- [x] Verify proxy policy through Docker Compose.
- [x] Complete proportional manual policy, safe-error, execution-history, filtering, lifecycle, and redaction acceptance.
- [x] Obtain explicit final Slice 4 sign-off. Granted by the user on 2026-08-03 with the exact wording: “I grant explicit final Slice 4 sign-off.”

Enterprise SIEM integration, RBAC, and enterprise audit retention remain post-MVP.

## 5. Validation and Error Handling

### Slice 5 — Canonical validation and persistence

- [x] Inventory validation behavior across JSON Apply, create, update, load, save, and Preview.
- [x] Centralize backend schema validation and use it at every persistence boundary.
- [x] Reject invalid projects without partial database updates.
- [x] Add supported schema-version and compatibility behavior.
- [x] Decide how invalid stored JSON is handled and whether v0.1.0 needs migrations.
- [x] Verify explicit `null`, missing values, empty arrays, and empty objects round-trip correctly.
- [x] Confirm backend default projects are canonical and schema-valid.

### Slice 5 — Semantic validation and diagnostics

- [x] Validate duplicate IDs/names and dangling action, component, variable, event, and binding references.
- [x] Validate component-specific properties and response-binding target compatibility.
- [x] Standardize backend error codes, paths, severities, and response shapes.
- [x] Surface actionable errors consistently in Visual Editor, Actions & Bindings, JSON Editor, Inspector, and Preview.
- [x] Add Preview loading, empty, upstream-error, mapping-error, retry/recovery, and stale-error behavior for all supported targets.
- [x] Preserve unsaved edits when validation or network operations fail.
- [x] Clear stale Secrets lifecycle error feedback after a later successful create, replace, or delete operation.
- [x] Reconcile schema descriptions and examples with canonical top-level `project.bindings`.
- [x] Reconcile free-form binding triggers with the triggers the runtime actually supports.
- [x] Unify and document the path-parameter interpolation contract.
- [x] Prevent new uses of deprecated `action.responseMapping`, inert `ComponentEvent.inputMap`, and unused component-level binding shapes.
- [x] Resolve, remove, document, or explicitly defer every modeled-but-unexecuted field, including `Binding.transform`.
- [x] Strengthen `project.settings` TypeScript typing to match the schema.
- [x] Decide whether backend-supported project deletion requires a v0.1.0 UI control.
- [x] Review deletion confirmations, keyboard accessibility, component disabled/hidden behavior, and Inspector/runtime diagnostic agreement.
- [x] Add malformed, semantic, version, rollback, and recovery regression tests.

## 6. Testing and Release Validation

### Slice 6 — Completed baseline work

- [x] Document and validate the Node 20/npm 10 toolchain.
- [x] Establish frontend, backend, schema, build, and Docker validation commands.
- [x] Validate all current valid and intentionally invalid examples.
- [x] Produce successful frontend and backend builds.
- [x] Verify Docker Compose startup, health, restart, CRUD, and persistence at recorded checkpoints.

### Slice 6 — Remaining automated coverage

- [x] Define the release-critical test layers and coverage boundary.
- [x] Complete frontend component, property-editor, action, event, binding, variable, and Preview tests.
- [x] Add backend health, CRUD, schema-validation, proxy-input, authentication, security, and persistence tests.
- [x] Add proxy integration tests for success, upstream errors, malformed responses, redirects, limits, and timeouts.
- [x] Add canonical-document persistence round-trip tests.
- [x] Add maintainable end-to-end tests for project load, execution, response mapping, dashboard selection, save, reload, and failure recovery; visual authoring remains in the proportional manual gate.
- [x] Resolve the TypeScript 4.9 / `@types/node` incompatibility so the standalone frontend TypeScript check passes, or update the supported toolchain deliberately.
- [x] Run the final security regression suite after Slices 3–5.

### Slice 6 — Six required MVP workflows

- [x] Workflow Launcher: visually build, execute, save, reload, and rerun a request/response UI.
- [x] Dependent Data: populate a component from an API and use its selected value to update another component with usable loading, empty, and failure states.
- [x] Read-Only Dashboard: populate a Table, select a row, show details, refresh, and handle errors.
- [x] Authenticated Request: execute all five authentication modes without exposing credentials.
- [x] JSON Editing and Persistence: validate/apply JSON, synchronize the Visual Editor, and round-trip without structural or behavioral loss.
- [x] Failure Handling: show actionable request/mapping errors without corrupting canonical state or losing unsaved work.

### Slice 6 — Deterministic demonstration and release gate

- [x] Build a deterministic local demonstration project using Label, Text Input, Dropdown, Button, JSON Viewer, and Table.
- [x] Populate Dropdown and Table data, use selected/runtime values in later requests, and display both focused and full responses.
- [x] Use a controlled local mock server with known success, error, Dropdown, and Table responses; do not depend on public HTTPBin-style services.
- [x] Demonstrate save, backend restart, reload, and rerun through automation; proportional human confirmation remains in the workflow gate.
- [x] Run clean-source installation, all automated suites, schema matrix, production builds, Docker integration, restart, backup, and restoration checks.
- [x] Confirm through automated regression and credential-pattern scan that runtime state is never persisted and the repository contains no credentials or generated data.
- [x] Record commands, counts, artifacts, limitations, defects, and accepted risks.
- [x] Confirm no unresolved critical or high-severity defects remain.
- [x] Pass the published final acceptance checklist in `SLICE6_MANUAL_TEST.md`.

Controlled orchestration is not required in the v0.1.0 demonstration. Execution history is included only if Slice 4 retains it as a release requirement.

## 7. MVP Scope and Requirement Governance

### Slice 7 — Completed decisions

- [x] Exclude IBM Bob, watsonx, and other AI dependencies from v0.1.0.
- [x] Require all five modeled authentication modes for v0.1.0.
- [x] Approve the six acceptance workflows in `MVP_SCOPE.md`.
- [x] Keep advanced orchestration and future UI capabilities outside the MVP boundary.

### Slices 6–8 — Completed consistency work

- [x] Make `MVP_SCOPE.md`, requirements, architecture, tasks, roadmap, and slice terminology consistent.
- [x] Ensure every v0.1.0 requirement maps to a slice and a validation criterion.
- [x] Clearly label all deferred capabilities post-MVP.
- [x] Remove or resolve every open question that could materially change the release boundary.
- [x] Produce a definitive Slice 6 release checklist and record product-owner approval.

### Slice 7a — Local identity, RBAC, and publishing

- [x] Implement secure local accounts and sessions with global `admin` and `user` roles.
- [x] Restrict authoring, project, secret, history-management, user-management, and publishing capabilities to admins.
- [x] Implement immutable validated publication snapshots with public/authenticated visibility, republish versioning, and unpublish behavior.
- [x] Render published applications in a standalone runtime shell without editor controls.
- [x] Resolve published actions exclusively from server-owned snapshots and reject browser-substituted execution configuration.
- [x] Block public publication of credential-backed actions; preserve secret-safe execution for authenticated apps.
- [x] Complete automated security/role/publication coverage, proportional manual acceptance, cleanup, and explicit sign-off.
- [x] Keep principal/session/capability architecture independent of the authentication provider for Slice 9.

### Slice 7b — First-run administrator setup

- [x] Replace the normal Docker-command bootstrap experience with a secure browser-based first-run setup screen.
- [x] Make initial-admin creation atomic and available only while the installation contains no users.
- [x] Create an authenticated session after successful setup without exposing passwords or session values.
- [x] Preserve the CLI bootstrap only as a documented emergency/recovery path.
- [x] Complete fresh-install, concurrent-takeover, existing-installation, restart, and manual acceptance coverage.

### Slice 7c — Multi-page applications and variable scope

- [ ] Add stable page slugs, ordering, navigation metadata, and a deterministic default page.
- [ ] Add explicit global/page variable scope with backward-compatible global defaults.
- [ ] Make components and their names page-local while retaining reusable project-level actions.
- [ ] Implement shared Preview/published navigation, default routes, and refreshable deep links.
- [ ] Preserve global and isolated page state across in-session navigation and reset both on reload.
- [ ] Implement first-entry `onLoad` and every-entry `onEnter` lifecycle semantics.
- [ ] Reject cross-page component/page-variable references and crafted cross-page published inputs.
- [ ] Complete compatibility, editor, runtime, publishing, security, browser, and manual acceptance coverage.

### Slice 7d — Visual Editor command ribbon

- [ ] Replace dense native-looking Visual Editor command rows with a grouped professional ribbon.
- [ ] Distinguish project, page, page-settings, lifecycle, primary, disabled, and destructive controls.
- [ ] Preserve Slice 7c behavior while improving desktop responsiveness, keyboard access, focus, and visual hierarchy.
- [ ] Complete automated regression and accessibility checks plus manual visual acceptance and explicit sign-off.

## 8. Documentation, Packaging, and Release

Slice 8 release packaging now depends on completed Slice 7a authentication/RBAC/publishing, Slice 7b first-run setup, Slice 7c multi-page/scoped-variable behavior, and Slice 7d Visual Editor ribbon polish and documentation. Slice 9 OIDC/SSO remains post-v0.1.0 unless the product owner explicitly changes the boundary.

### Slice 8 — Documentation ownership and reconciliation

- [x] Create and link a unified v0.1.0 roadmap grouped by function and slice.
- [x] Designate `docs/` as the authoritative specification location.
- [x] Remove exact duplicate root requirements, architecture, and future-idea documents after verifying links and replacements.
- [x] Reconcile requirements and architecture with the approved MVP scope.
- [ ] Update schema and response-mapping documentation to match canonical runtime behavior.
- [ ] Reconcile `ROADMAP.md`, `CODEX.md`, and all slice handoffs as implementation progresses.

### Slice 8 — User and operator documentation

- [ ] Update README prerequisites, commands, and documentation index.
- [ ] Publish installation, Docker Compose, first-project, Visual Editor, JSON Editor, component, REST Action, template, variable, binding/event, and troubleshooting guides.
- [ ] Publish authentication, secret provisioning, redaction, proxy policy, security, known-limitations, and deployment guidance.
- [ ] Document SQLite backup, persistence, recovery, upgrade, and schema-version policy.

### Slice 8 — Developer documentation

- [ ] Publish architecture, canonical model, frontend state, runtime state, binding flow, proxy flow, database, test structure, mock-server, and contribution documentation.
- [ ] Publish verified build, test, Docker, and release commands.
- [ ] Publish the final acceptance checklist with links to evidence.
- [ ] Check internal links, paths, examples, and documented commands.

### Slices 6 and 8 — v0.1.0 packaging

- [ ] Review examples, demo, open issues, deferred work, and release criteria.
- [ ] Complete fresh-clone validation and final Docker images.
- [ ] Prepare release notes and update version references.
- [ ] Commit the release documentation and code.
- [ ] Tag `v0.1.0` and push the release commit and tag.

## Post-MVP Backlog

- [ ] Multi-page application authoring and advanced page management.
- [ ] OAuth 2.0, IBM Cloud IAM, mTLS, and custom authentication scripts.
- [ ] OpenAPI import and generated forms/actions.
- [ ] Reusable templates, themes, and component libraries.
- [ ] Version history, Git integration, and team collaboration.
- [ ] Role-based access control and enterprise audit retention.
- [ ] Tabs, modals, date pickers, file uploads, charts, and progress indicators.
- [ ] Table sorting, filtering, pagination, editing, CSV import/export, row actions, and multi-selection.
- [ ] Advanced response transforms and expression languages.
- [ ] Action chaining, conditions, branches, parallelism, loops, retries, and workflow graphs.
- [ ] Provider-neutral AI editing or chat assistance.
- [ ] Richer variable-management UI beyond the MVP declaration/default editor.

## Reconciliation Notes

- Older Step 19 (REST Action Manager) and Step 20 (Binding and Event Editor) are represented by accepted Slice 2 work, not remaining milestones.
- Older Step 21 maps to Slice 3.
- Older Step 23 maps to Slice 4.
- Older Step 24 maps to Slice 6, minus the conflicting orchestration requirement.
- Older Step 25 is divided among Slices 4, 5, and 6.
- Older Step 26 maps primarily to Slice 8, with the final validation gate in Slice 6.
- Older audit findings that are already resolved—page `onLoad` execution and the schema/runtime component mismatch—must not remain listed as pending.
- The older roadmap's completed persistence checkpoint records working functional round trips; comprehensive automated persistence round-trip coverage remains a Slice 6 release task.
- Slice 7's status is complete because its product decisions were approved. Its unchecked cross-document consistency criteria are carried forward under Slices 6 and 8 rather than treated as a new scope decision.
- Passing an incremental automated suite does not complete a slice. Manual acceptance and final release gates remain separately recorded.