Roadmap

The architecture is written as one timeless design and converges in place as the code catches up: a page moves Design to Partial to Built, it is never forked into a separate “future” copy that later gets deleted. So this page is not a shadow architecture. It is the readable index of direction: the epics in flight, the big architectural arc still ahead, and pointers to where each lands in the spine.

Three surfaces carry the time axis, and this page ties them together:

• Implementation status is the live map of what is built (the per-page badge and the per-slice log).
• Decision log is the dated history of calls, reversals, and divergences.
• GitHub epics are the source of truth for scope and sequencing; this page links them and is not a substitute for them. Nothing here is a commitment that a detail ships unchanged; an epic is where the scope is actually argued and approved (no branch before the issue).

What has landed

The platform half is well past its midpoint. The single binary runs in server / node / migrate modes over a BYO Postgres, and the tiers below are shipped, tested, and live in the console; the per-slice detail (136 entries at this update) is on implementation status.

• Identity and access, end to end. Password, session-cookie, and API-token auth with expiry, lockout, and password policy; the full principal lifecycle (disable, archive, purge); impersonation with dual-actor audit; principal groups with grant-by-group; grants with scope operators; and the append-only audit trail with its admin read surface.
• The estate and its catalogs. The location / system / component trees on the shared scoped-CRUD primitive, system_member multi-membership, system roles with the assignment guard, the standard / product / vendor / driver / capability registries, and location types with allowed_parent_types placement rules.
• The values cascade. Tags, variables, envelope-encrypted secrets, files over the content-addressed blob store, the settings engine (platform rung), and the unified resolution panel that explains which value won and why.
• The collection vertical. The node runtime with enrollment and claim, embedded NATS/JetStream with per-node subject isolation, the icmp and tcp probes, the transition-only reachability verdict and its panel, interface and task authoring, and the raw-log lane with node self-logs (ADR-0066).
• The telemetry ontology. The property_type / event_type / command_type registries, the sample sinks (metric, state, event, log_line), the property latest-value cache, and the command pillar with computed settlement (ADR-0063).
• Delivery and the pipeline. make gen emits the OpenAPI document, the cobra CLI, the typed SPA client, the CLI reference, and the generated ERD; goreleaser builds the release matrix and the multi-arch image; the Helm chart deploys production and powers per-PR preview environments.

Near-term epics

The work currently scoped, each tracked as a GitHub epic. Outcomes are summarized; the epic is authoritative.

Epic	Outcome	Lands in
Identity tier (#27)	Shipped. Password login over an httpOnly cookie session, self-service profile and password change, and admin user / grant management, then well beyond the original scope (lifecycle, impersonation, groups, tokens, lockout). Its exit condition is met: the bearer-only and bootstrap divergences (ADR-0004, ADR-0005) are closed. The identity slices on implementation status carry the detail.	identity and access
Deploy spine: PR previews (#41)	Live. Every open PR gets an ephemeral, Access-gated preview of the console, provisioned by Argo CD from the Helm chart (the chart is also the production deploy artifact). See PR previews.	scaling and deployment
Estate model: groups + dynamic scope (#10)	Ahead: entity-groups as scope anchors and dynamic-membership scope, plus the cross-tier cascade (a location scope reaching its systems and components). Principal groups as grant subjects shipped; group-as-scope has not.	identity and access, groups, cascade
Public releases (#57)	Ahead: signed and notarized binaries for every major OS/arch and one-line installs (Homebrew / Scoop / winget), so a first-time user runs with no security warning.	scaling and deployment
Embedded Postgres run mode (#19)	Ahead: an opt-in single-binary mode with a managed embedded Postgres, for edge, demo, and learning installs with zero external database.	scaling and deployment

The current workstream is the drift-correction program from the 2026-07-30 doc-versus-code audit, tracked as epics #428 (documentation drift correction), #429 (drift prevention tooling), #430 (telemetry integrity), #431 (scope and secrets integrity), #432 (console address honesty and the audit diff), #433 (generated docs facts), and #434 (docs corpus restructure).

The architectural arc ahead

The spine has converged over most of its lower half; what remains Design is concentrated in the automation and read tier. The broad order the remaining work follows, each band pointing at the page that describes the target:

1. Collection at the edge. Substantially landed: the node runtime, the embedded bus, the icmp/tcp probes, edge parsing, and interface and task authoring all shipped. Still ahead: templates (the reusable device shape) and the richer transports (real snmp / http / ssh drivers, webhook listeners; today ssh and http probe as tcp-connect only).
2. The data model. Landed except one piece: properties (the canonical-signal registry and the exclusive-arc owner columns), the sample sinks, config and variables resolved down the cascade all shipped. Still ahead: the expression engine the rules and filters share.
3. Detection and verdict. Events shipped (their registry, sink, and lineage columns), as did commands with settlement, and the verdict half has landed: an alarm degrades a capability, an impaired role sinks its system by its impact, and the transitions record when it changed. What remains is what produces an alarm (the event_rule tier), calculations, and what acts on one (alarms and actions, the automation tier).
4. The machinery underneath. The messaging subject contract, per-node subject isolation, and the durable JetStream telemetry consumer (workers) shipped. Still ahead: the raw/trusted two-lane data plane, time as a primitive, and the CDC bridge on storage.
5. The read side, in full. Views and the ViewResult renderer, composable dashboards, and the exploration surfaces on the UI, plus the MCP and AI seams over the same gateway.

This arc is a reading order, not a schedule. Each numbered band becomes one or more epics with their own scope and approval before any branch; when a slice in it ships, the relevant spine page moves off Design and, if the build differs from the prose, the difference is logged in decisions. That is how directional intent becomes built architecture without ever maintaining two copies of it.