Milestones

List view

• Backlog — deferred (Tier 5)

  Parked deliberately: sophistication without traction. Reopened only when a killer workflow needs them.

  No due date

  •0/9 issues closed
  0% complete9 open0 closed

• Release 1.6 — IT-native & Ecosystem

  Phase 6. CLI, ingestion/decision API, OSCAL interchange, SDK. OpenRisk as the risk infrastructure other tools feed.

  No due date

  •0/14 issues closed
  0% complete14 open0 closed

• Release 1.5 — Governed AI

  Phase 4. AI as a reasoning layer over structured data: guardrails, decision record, deterministic fallback. AI proposes, never decides.

  No due date

  •0/19 issues closed
  0% complete19 open0 closed

• Release 1.4 — Evidence Fabric

  Phase 3b/5. Killer workflow B: Requirement -> Control -> Test -> Evidence -> Gap -> Risk -> Remediation, continuously evidenced.

  No due date

  •7/36 issues closed
  19% complete29 open7 closed

• Release 1.3 — Risk Auto-Draft

  Phase 3a. Killer workflow A: Signal -> Risk -> Action -> Evidence, closed loop, human supervises instead of copy-pastes.

  No due date

  •1/34 issues closed
  2% complete33 open1 closed

• Release 1.2 — Risk Data Plane

  Phase 2. Canonical model, data contracts, signal ingestion, normalization, provenance. The layer that turns connectors into contracts.

  No due date

  •2/16 issues closed
  12% complete14 open2 closed

• gtm-v1

  Proof, regulatory content ownership, and channel. Mostly not code.

  No due date

  •0/10 issues closed
  0% complete10 open0 closed

• trust-v1

  What a regulated buyer's CISO tests before any feature matters: honest README, auth, audit trail, restore, export, published self-assessment.

  No due date

  •21/71 issues closed
  29% complete50 open21 closed

• ds-v1

  Design System v1: primitive layer, Tailwind v4 migration, licensing hygiene.

  No due date

  •22/26 issues closed
  84% complete4 open22 closed

• Wave 7 — Launch polish

  No due date

  •9/65 issues closed
  13% complete56 open9 closed

• Wave 6 — Enterprise

  No due date

  •0/9 issues closed
  0% complete9 open0 closed

• Wave 5 — Resilience

  No due date

  •0/6 issues closed
  0% complete6 open0 closed

• Wave 4 — GRC

  No due date

  •0/9 issues closed
  0% complete9 open0 closed

• Wave 3 — Risk intelligence

  No due date

  •0/4 issues closed
  0% complete4 open0 closed

• Wave 2 — Security intelligence

  No due date

  •10/18 issues closed
  55% complete8 open10 closed

• Wave 1 — Product foundation

  No due date

  •40/60 issues closed
  66% complete20 open40 closed