Engineering roadmap

What is shipping today versus what we invest in as adoption grows. Roadmap items are discovery and planning signals—not promises of general availability dates.

  1. Nowopen-coreavailable

    Manifest + SBOM/scan/sign + control-plane + external evidence

    Shipped: local-first release spine and evidence production.

  2. Nowbusinessavailable

    Evidence-backed policy gates, verify, promote approvals

    Shipped Business Edition foundation; licensing UX continues to harden.

  3. H2 2026open-core

    SARIF scan output

    GitHub Security tab integration; free adoption driver.

  4. H2 2026business

    Compliance report (markdown/JSON)

    Audit-ready package from manifest + evidence.

  5. H2 2026business

    SLSA provenance attestation

    Roadmap — not claimed as GA SLSA Level 3 today.

  6. H1 2027business

    rflow audit — CRA evidence bundle

    Machine-readable compliance package for EU CRA timelines.

  7. H1 2027business

    Env-specific policy overrides

    Staging permissive / prod strict gate profiles.

  8. H2 2027enterprise

    Custom policy-as-code (Rego/CEL)

    Enterprise governance flexibility.