The roadmap is outcome-oriented. Dates are intentionally omitted until the project has measured delivery capacity.
- Establish product and security boundaries, ADRs, project memory, contributor workflows, and CI.
- Prove Rust workspace boundaries with deterministic synthetic fixtures.
- Keep all operating-system writes and remediation out of scope.
Exit condition: the repository is understandable, reviewable, and ready for the first collector issue without pretending the product already works.
Status: complete. The first two Collector vertical slices and a guided desktop development slice now build on this foundation.
User outcome:
systemdiff snapshot -o before.json
systemdiff snapshot -o after.json
systemdiff diff before.json after.json
Required scope:
- Registry Run/RunOnce entries. Implemented in the development CLI; pre-release validation continues.
- Windows services configuration. Implemented in the development CLI with conservative current-token partial coverage.
- Scheduled Tasks 2.0 configuration.
- Versioned snapshot and diff JSON.
- Human-readable terminal report.
- An unsigned, expiring Windows x64 CI Developer Preview that proves the existing CLI can run from a downloaded portable package without Cargo. Implemented; this is not an official release.
- Independent collector failures and clear privilege/coverage reporting.
- Deterministic fixtures and snapshot-to-diff integration tests that do not need administrator privileges.
Explicitly excluded: whole-drive crawling, remediation, telemetry, cloud analysis, broad persistence coverage, and a large multi-page GUI. The first small guided desktop workflow is being validated in parallel without changing the CLI evidence milestone.
- Tauri 2 + React + TypeScript was accepted after a narrow security-focused spike. Implemented for the first development vertical slice; distribution validation continues.
- Guide users through start capture → make a change → finish and compare without file handling or Snapshot terminology. Implemented for the first development vertical slice.
- Show plain-language Startup and Windows Services summaries without hiding raw technical evidence. Implemented for the first development vertical slice.
- Ship maintained
en-USandzh-CNlocales. Implemented in the first desktop UI; localization review remains ongoing. - Establish Windows packaging and code-signing strategy before encouraging ordinary-user installation.
The first slice intentionally has no history, baseline management, settings center, dashboard, risk score, updater, or desktop Release artifact. It proves the product workflow; it is not yet the polished v0.2 distribution milestone.
- Implement tested redaction/sanitization with explicit policy metadata.
- Add shareable report formats and issue-safe export guidance.
- Introduce a small, reviewable rule catalog with stable IDs and localized explanation keys.
- Add collectors only when their evidence, stability, privilege, privacy, and test strategy are understood.
- Candidate work includes targeted filesystem analysis, Authenticode and executable metadata, firewall and network configuration, Defender exclusions, installed applications, browser extensions, and additional documented persistence mechanisms.
- Consider plugin or external collector contracts only after real in-tree collector diversity demonstrates a need.
Product engineering precedes promotion:
- v0.1 must solve one real install-and-compare workflow reliably.
- A short hero demo should make the value obvious without security hype.
- README installation and trust claims must match released artifacts.
- Broader launch waits for a result worth sharing, not merely a completed scaffold.
The first CI Developer Preview intentionally stops short of a release: browser download requires GitHub sign-in, artifacts expire, and the executable is unsigned. A public alpha additionally requires clean-machine validation, a publisher-signing decision, stable version semantics, and a durable Release channel.