From 00ae35c0fe0e9d3a667cbff44469de8f8b522aea Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 17 Jun 2026 20:41:13 +0000 Subject: [PATCH 1/5] =?UTF-8?q?docs(roadmap):=20open=20the=200.8=20cycle?= =?UTF-8?q?=20=E2=80=94=20commit=20to=20the=20has-SBOM=20gate?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 0.7.0 shipped. Stamp the Now section as the sole 0.8 deliverable (`audit --fail-on-no-sbom`, closing the enforcement ladder); Deferred/Later bets stay put until a concrete signal lands. Co-Authored-By: Claude --- docs/roadmap.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 24e1f46f..0441fa55 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -127,13 +127,15 @@ Two of the former *Now* items shipped: reports `with_sbom` / `without_sbom`. The coverage ladder is now four rungs: `uncovered < stamped < signed < has-SBOM`. *(ADR 0029; closed #143)* -## Now — close the has-SBOM gate +## Now — 0.8: close the has-SBOM gate > Theme: the mandate is enforceable and trustworthy, blast-radius reaches package level, and both -> the adoption surface (docs site) and the observational has-SBOM audit have shipped (see -> *Delivered*). One coverage lever remains. +> the adoption surface (docs site) and the observational has-SBOM audit have shipped in 0.7.0 (see +> *Delivered*). **0.8 commits to one coverage lever** — and nothing else; the Deferred bets stay +> deferred until a concrete signal lands. -- **`audit --fail-on-no-sbom` gate.** The observational `--sbom` tier already reports SBOM presence; +- **`audit --fail-on-no-sbom` gate** — *the* 0.8 deliverable. The observational `--sbom` tier already + reports SBOM presence; the remaining step is the CI gate that *fails* the build when a stamped image lacks an SBOM — completing the enforcement ladder `--fail-on-uncovered` → `--fail-on-unsigned` → `--fail-on-no-sbom`. *(ADR 0029, P0.5)* From 0e35ab9d1581db7e7d3b63c3d962de6ec82d9da9 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 18 Jun 2026 09:16:22 +0000 Subject: [PATCH 2/5] docs(roadmap): add 0.8 docs-polish items to Now Architecture presentation, richer examples, inline diagrams, and fenced code blocks alongside the --fail-on-no-sbom gate. Co-Authored-By: Claude --- docs/roadmap.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 0441fa55..b39896fb 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -131,7 +131,7 @@ Two of the former *Now* items shipped: > Theme: the mandate is enforceable and trustworthy, blast-radius reaches package level, and both > the adoption surface (docs site) and the observational has-SBOM audit have shipped in 0.7.0 (see -> *Delivered*). **0.8 commits to one coverage lever** — and nothing else; the Deferred bets stay +> *Delivered*). **0.8 commits to one coverage lever plus a docs polish pass**; the Deferred bets stay > deferred until a concrete signal lands. - **`audit --fail-on-no-sbom` gate** — *the* 0.8 deliverable. The observational `--sbom` tier already @@ -140,6 +140,12 @@ Two of the former *Now* items shipped: completing the enforcement ladder `--fail-on-uncovered` → `--fail-on-unsigned` → `--fail-on-no-sbom`. *(ADR 0029, P0.5)* +- **Docs polish pass.** The docs site shipped in 0.7.0; 0.8 raises its quality bar: + - an **architecture presentation** — a narrative overview of the hexagon (sourced from the C4 model), not just the reference; + - a **richer examples section** — broaden and deepen the worked `MirrorPolicy` walkthroughs; + - **diagrams** woven into the prose (the committed Mermaid C4 exports, inline where they explain); + - **fenced code blocks** throughout — runnable, copy-pasteable commands and policy snippets. + ## Deferred — revisit only on a real signal (YAGNI until then) These are not refused on principle — they are waiting for a concrete trigger that has not appeared: From dcbc89a2a16052288336cc256536f46cc34fc2d5 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 18 Jun 2026 09:38:24 +0000 Subject: [PATCH 3/5] docs(roadmap): add schema-rendering polish to 0.8 Now The generated MirrorPolicy/config reference renders as a deep anyOf>item tree; 0.8 makes it readable. Co-Authored-By: Claude --- docs/roadmap.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index b39896fb..efdf3228 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -144,7 +144,10 @@ Two of the former *Now* items shipped: - an **architecture presentation** — a narrative overview of the hexagon (sourced from the C4 model), not just the reference; - a **richer examples section** — broaden and deepen the worked `MirrorPolicy` walkthroughs; - **diagrams** woven into the prose (the committed Mermaid C4 exports, inline where they explain); - - **fenced code blocks** throughout — runnable, copy-pasteable commands and policy snippets. + - **fenced code blocks** throughout — runnable, copy-pasteable commands and policy snippets; + - **better schema rendering** — the generated `MirrorPolicy` / config reference is currently a deep, + noisy `anyOf > item N` tree (json-schema-for-humans default); make it readable (collapse the union + noise, friendlier property paths, or a different renderer). ## Deferred — revisit only on a real signal (YAGNI until then) From 729868b56217fc3c6936147bfbdeea6ef2534dff Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 18 Jun 2026 09:39:54 +0000 Subject: [PATCH 4/5] docs(roadmap): scope schema-rendering polish to all generated schemas Applies to MirrorPolicy, config HOUBA_*, and the scan predicate /scan/v1. Co-Authored-By: Claude --- docs/roadmap.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index efdf3228..7e044f39 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -145,9 +145,10 @@ Two of the former *Now* items shipped: - a **richer examples section** — broaden and deepen the worked `MirrorPolicy` walkthroughs; - **diagrams** woven into the prose (the committed Mermaid C4 exports, inline where they explain); - **fenced code blocks** throughout — runnable, copy-pasteable commands and policy snippets; - - **better schema rendering** — the generated `MirrorPolicy` / config reference is currently a deep, - noisy `anyOf > item N` tree (json-schema-for-humans default); make it readable (collapse the union - noise, friendlier property paths, or a different renderer). + - **better schema rendering — across *all* generated schemas** (`MirrorPolicy`, config `HOUBA_*`, + the scan predicate `/scan/v1`): each currently renders as a deep, noisy `anyOf > item N` tree + (json-schema-for-humans default); make them readable (collapse the union noise, friendlier + property paths, or a different renderer). ## Deferred — revisit only on a real signal (YAGNI until then) From 270e317429050c58fc2b3e2acf1c9e56d2806ef5 Mon Sep 17 00:00:00 2001 From: Tristan Rivoallan Date: Thu, 18 Jun 2026 12:08:40 +0200 Subject: [PATCH 5/5] docs(roadmap): name the ladder-complete milestone, split schema-rendering line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reframe the 0.8 Now theme: the --fail-on-no-sbom gate closes the *whole* enforcement ladder (all four rungs now carry an observational tier + a --fail-on-* gate), not just the has-SBOM rung. Record the standing posture — no 1.0 commitment until a Deferred/Later signal lands. Pull "better schema rendering" out of the docs-polish sub-bullets into its own line, flagged as tooling that carries renderer-swap risk — it is the one 0.8 item with real uncertainty, not free prose polish. Co-Authored-By: Claude --- docs/roadmap.md | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 7e044f39..b0acb3d0 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -127,28 +127,30 @@ Two of the former *Now* items shipped: reports `with_sbom` / `without_sbom`. The coverage ladder is now four rungs: `uncovered < stamped < signed < has-SBOM`. *(ADR 0029; closed #143)* -## Now — 0.8: close the has-SBOM gate +## Now — 0.8: close the enforcement ladder + docs polish -> Theme: the mandate is enforceable and trustworthy, blast-radius reaches package level, and both -> the adoption surface (docs site) and the observational has-SBOM audit have shipped in 0.7.0 (see -> *Delivered*). **0.8 commits to one coverage lever plus a docs polish pass**; the Deferred bets stay -> deferred until a concrete signal lands. +> Theme: 0.7.0 made the mandate enforceable, trustworthy, and package-deep, and shipped the +> adoption surface (docs site) + the observational has-SBOM audit. **0.8 closes the enforcement +> ladder** — the last coverage rung gets its CI gate — **and raises the docs quality bar.** The +> Deferred bets stay deferred until a concrete signal lands; no 1.0 commitment until one does. -- **`audit --fail-on-no-sbom` gate** — *the* 0.8 deliverable. The observational `--sbom` tier already - reports SBOM presence; - the remaining step is the CI gate that *fails* the build when a stamped image lacks an SBOM — - completing the enforcement ladder `--fail-on-uncovered` → `--fail-on-unsigned` → `--fail-on-no-sbom`. - *(ADR 0029, P0.5)* +- **`audit --fail-on-no-sbom` gate** — *the* 0.8 feature deliverable. The observational `--sbom` tier + already reports SBOM presence; the remaining step is the CI gate that *fails* the build when a + stamped image lacks an SBOM. This **closes the enforcement ladder**: all four rungs + (`uncovered < stamped < signed < has-SBOM`) now carry both an observational tier and a + `--fail-on-*` gate. *(ADR 0029, P0.5)* - **Docs polish pass.** The docs site shipped in 0.7.0; 0.8 raises its quality bar: - an **architecture presentation** — a narrative overview of the hexagon (sourced from the C4 model), not just the reference; - a **richer examples section** — broaden and deepen the worked `MirrorPolicy` walkthroughs; - **diagrams** woven into the prose (the committed Mermaid C4 exports, inline where they explain); - - **fenced code blocks** throughout — runnable, copy-pasteable commands and policy snippets; - - **better schema rendering — across *all* generated schemas** (`MirrorPolicy`, config `HOUBA_*`, - the scan predicate `/scan/v1`): each currently renders as a deep, noisy `anyOf > item N` tree - (json-schema-for-humans default); make them readable (collapse the union noise, friendlier - property paths, or a different renderer). + - **fenced code blocks** throughout — runnable, copy-pasteable commands and policy snippets. + +- **Schema rendering — readable generated reference (tooling, carries risk).** Distinct from the prose + polish above: the generated `MirrorPolicy`, config `HOUBA_*`, and scan-predicate `/scan/v1` reference + each render as a deep, noisy `anyOf > item N` tree (json-schema-for-humans default). Make them + readable — collapse the union noise, friendlier property paths, or a different renderer. Tracked as + its own line because the renderer swap/config is real work, not free polish. ## Deferred — revisit only on a real signal (YAGNI until then)