docs(roadmap): open the 0.8 cycle — commit to the has-SBOM gate#151
Closed
trivoallan wants to merge 5 commits into
Closed
docs(roadmap): open the 0.8 cycle — commit to the has-SBOM gate#151trivoallan wants to merge 5 commits into
trivoallan wants to merge 5 commits into
Conversation
0.7.0 shipped. Stamp the Now section as the sole 0.8 deliverable (`audit --fail-on-no-sbom`, closing the enforcement ladder); Deferred/Later bets stay put until a concrete signal lands. Co-Authored-By: Claude <noreply@anthropic.com>
Architecture presentation, richer examples, inline diagrams, and fenced code blocks alongside the --fail-on-no-sbom gate. Co-Authored-By: Claude <noreply@anthropic.com>
The generated MirrorPolicy/config reference renders as a deep anyOf>item tree; 0.8 makes it readable. Co-Authored-By: Claude <noreply@anthropic.com>
Applies to MirrorPolicy, config HOUBA_*, and the scan predicate /scan/v1. Co-Authored-By: Claude <noreply@anthropic.com>
…ring line Reframe the 0.8 Now theme: the --fail-on-no-sbom gate closes the *whole* enforcement ladder (all four rungs now carry an observational tier + a --fail-on-* gate), not just the has-SBOM rung. Record the standing posture — no 1.0 commitment until a Deferred/Later signal lands. Pull "better schema rendering" out of the docs-polish sub-bullets into its own line, flagged as tooling that carries renderer-swap risk — it is the one 0.8 item with real uncertainty, not free prose polish. Co-Authored-By: Claude <noreply@anthropic.com>
Owner
Author
|
Closing — the premise of this PR has dissolved. This PR opened the 0.8 cycle around Working through it surfaced that none of the candidate 0.8 contents actually need a version cut:
So: no manufactured 0.8. Ship the gate as a small PR when convenient, keep docs flowing, and build the demo on 0.7.0. Staying in 0.x — 0.8 gets cut when a real product increment lands (Deferred bets have no signal; #142 is design-only), not before. No roadmap change needed to record a non-event. |
trivoallan
added a commit
that referenced
this pull request
Jun 18, 2026
… to adoption (#153) * docs(roadmap): decouple forward direction from versions; re-theme Now to adoption Closing the 0.8-cycle PR (#151) left the roadmap on `main` crowning `audit --fail-on-no-sbom` as the active frontier and marking *Later* empty — both now stale. #140 (SBOM on both copy + rebuild paths) means every freshly-placed image already carries an SBOM, so the gate only guards pre-unification backfill and regressions; it is no longer a headline. This restates the forward view by *direction, not version*: - Intro: the frontier is adoption (making the mandate demonstrable to a target org), and forward direction lives in Now/Deferred/Later decoupled from release tags — a version is cut when a real increment lands, but the roadmap always shows the heading. - Now: re-themed to "make the mandate demonstrable (adoption)" — the end-to-end CVE-to-owner blast-radius story on the reference deployment (the XZ loop + bypass blind spot already ship; the owner/runtime join and migration-parity narrative remain). The gate is demoted to a minor backfill-guard line. Notes that per-team fan-out is a policy `destinations` list, so houba replaces registry replication (which strips OCI referrers). - Later: populated with the developer coverage portal (Backstage TechInsights + an off-the-shelf SBOM/vuln platform) as the consumption surface — design captured, implementation Later, thesis-true (houba stamps, the portal consumes). No model change ⇒ no docs/reference drift. Co-Authored-By: Claude <noreply@anthropic.com> * docs(roadmap): carry the docs-polish pass into the adoption Now The version-decoupling edit re-themed Now to adoption but dropped the docs-polish work that was scoped for the cycle. Adoption has two faces — a demonstrable end-to-end story and a self-serve docs surface — so restore the polish pass under the same theme: architecture presentation, richer examples, inline C4 diagrams, fenced runnable code blocks, and the readable-schema rendering item (kept as its own line since the renderer swap carries risk). Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Opens the 0.8 cycle on the roadmap now that 0.7.0 has shipped.
audit --fail-on-no-sbom— the sole committed lever, closing the enforcementladder
--fail-on-uncovered→--unsigned→--no-sbom(ADR 0029).untouched — nothing promoted, per the scoping decision.
Single-line-of-thought change; no code touched.
🤖 Generated with Claude Code
Generated by Claude Code