Roadmap

Charted 2026-07-10 via /wayfinder from SPEC.md (Rev 3, §21 milestone plan), TODOS.md, and IDEAS.md. This file is an index, not a store: module scope detail lives in SPEC §21; decision detail lives where each decision was made. Statuses here are the working truth.

Destination

Both editions live. A stranger pastes a public spec URL at kedge.review and gets a beautifully rendered doc with zero signup; a company runs docker compose up and reviews private RFCs on its own network — anchored comments that survive re-syncs, version-pinned approvals, and AI agents reviewing over MCP. Launch is inside this effort, not a follow-on (decided 2026-07-10, this charting).

Modules

Modules map 1:1 onto SPEC §21's milestones (M0–M7), which were CEO-approved in B′ (moat-first) order and are already vertical — each ends demoable. Launch is new scope from the destination decision. "Depends on" is build order; a ready-to-spec module behind an unbuilt dependency can still be specced.

Gists (full scope + demo criteria: SPEC §21):

• Scaffold (M0) — monorepo + api/ Laravel 13 recipe (Sanctum, Socialite, Policies, enums; Nova optional), promote the web/ spike, pinned BFF auth handshake. Demo: log in from the Next.js app.
• Import & render (M1) — public GitHub / raw URL / upload / PAT connectors, normalization with warnings, web-owned text projection, Fumadocs rendering, self-hosted Kroki diagrams, MDX allowlist + fallback, share links, instant demo mode.
• Comments & suggestions (M2) — selection anchors, threads/replies/resolve/fork, suggested edits with accept/decline, magic-link reviewer identity, orphan-tray shell.
• Versions, diff & approvals (M3) — manual re-sync, re-anchoring ladder (hypothes.is port), version switcher, diff view with comment overlay, approvals lite with staleness.
• Documents list (M3.5, wedge 2026-07-21) — authenticated home lists all workspace docs with lifecycle/threads/sync chips, live import-status polling, inline retry. Pulls the "Your docs" half of SPEC §11 forward from M5.
• Projects & tracked repos (M3.6, wedge 2026-07-21) — projects as free containers with dedicated pages, doc assignment + Unfiled bucket; tracked repos (URL + ref + path pattern → preview → bulk import) with manual Re-scan; webhook watching stays M6. Term pinned 2026-07-21 (was "repo sources").
• Design refresh (M3.7, wedge 2026-07-23) — the locked Open Harbor baseline product-wide (light-first, self-hosted Space Grotesk display, amended tokens); dashboard upgrade (projects rail, stats strip + workspace summary endpoint, server-side lifecycle filters on shared query scopes, poller-debt fix bundled); workspace General settings with audited rename.
• Activity & landing (M3.8, wedge 2026-07-23) — audit-log activity feed (review-action instrumentation M5 will reuse; aggregate re-sync events; snapshot meta; allowlisted projection — never ip/raw meta); SaaS marketing landing with the demo import in the hero (self-host branch unchanged).
• Web i18n (M3.9, wedge 2026-07-23) — en-US · es-US · mn-MN · de-DE via next-intl without locale routing (strict-allowlist cookie + negotiation, en-US merge fallback); mn-MN display font falls back to the system stack (no Cyrillic in Space Grotesk); chip strings as a constrained glossary; document content never translated. Runs after M3.10 so the glossary snapshots stable strings.
• Source provenance (M3.10, wedge 2026-07-24) — read-only provenance chips on every row (repo path · owner/repo + path · host · pasted) derived server-side from stored columns; project pages group repo-sourced docs under their tracked repo, path-ordered with directory dividers (flattened tree — projects stay the only user-managed hierarchy, wikis/folders non-goal intact); tracked_repo filter + order=path on the shared list query. Group-by-source toggle deferred.
• AI & agents (M4) — digest, improve-prompt, reply drafts, comment split, thread summaries, ai_runs UI; MCP server with agent badges.
• Project access (M4.1, specced 2026-09-26) — invite by email, accept into a project, discover and review its documents within a role, manage pending invitations/members, and remove access. No implicit workspace membership; designed for later workspace invitations. Module spec with confirmed product decisions.
• Notifications & review queue (M5) — in-app inbox, Postmark email, mentions, digest scheduling, per-user prefs, review-queue dashboard.
• Private sources & post-back (M6) — GitHub App with push-webhook auto re-sync, Confluence import via API token, digest post-back to PR/Confluence.
• Self-host distribution (M7) — deploy/ compose + Caddy single-origin, tagged images, migrate-on-boot, telemetry ping + opt-out, backup/upgrade/self-hosting guides, public-repo hygiene (CONTRIBUTING, SECURITY.md).
• Launch (new 2026-07-10) — SaaS go-live: SPEC §20.1 bootstrap checklist (DNS, Postmark DKIM, R2, Forge, OAuth apps), initial demo-mode rate limits, first tagged release, announcement. Gated by user actions (domains, org, trademark — TODOS.md).

Open decisions

Work these one per session (/wayfinder work mode):

Project access — engineering review complete (2026-09-27); separate design review pending. Product scope and testing seams are confirmed. The engineering review records decisions 1A–21A and the user-directed ordinary-deployment choice (22), with 29 planned test contract groups. Implementation has not started. The unpublished ticket draft needs reconciliation and granularity approval after design review; no module issues have been created. Module spec.

1. Anchoring port spike (P1, S) — RESOLVED (M3, 2026-07-20): the exact→fuzzy→orphan ladder shipped (#76/#77) on @sanity/diff-match-patch, validated by the Vitest re-anchoring golden corpus (the moat regression net). (TODOS.md)
2. CLA/DCO (P2, S) — decide before the first external contribution; blocks CONTRIBUTING in Self-host distribution and therefore Launch. (SPEC §22.6)
3. Domains, org & trademark (P1, user actions) — register kedge.review/kedge.ink, create the kedgehq org, USPTO/EUIPO search. Gates Launch. (TODOS.md)

Decisions so far

• Project content/moderation confirmed (2026-09-26) — Maintainers manage project details, document lifecycle, pasted/uploaded versions, threads, suggestions, and inappropriate-comment deletion; nobody rewrites another author's comments or approves on their behalf. Reviewers manage their own contributions; Viewers remain read-only. Product decisions are complete. Module spec.

• Project invitation lifecycle confirmed (2026-09-26) — seven-day expiry; resend replaces the link and restarts expiry; acceptance requires the invited verified account; pre-acceptance revocation; loss of inviter authority cancels pending invitations. Module spec.

• Project document moves confirmed (2026-09-26) — Maintainers may move between two projects they maintain in the same workspace; the workspace owner may also move to/from Unfiled. Reauthorize both ends at commit; cross-workspace moves remain out of scope. Module spec.

• Project document sharing confirmed (2026-09-26) — Maintainers may create, list, and revoke document share links within the project. Viewers and Reviewers cannot manage shares. Removal preserves independent share grants until explicit revocation, with clear remaining-access copy and a link-management action (confirmed 2026-09-26). Module spec.

• Project AI access confirmed (2026-09-26) — Reviewers generate Ask answers and reply drafts; Maintainers use all existing AI tools; Viewers read shared results only. Personal questions/drafts remain private; existing provider gates/rate limits apply. Module spec.

• Project source management confirmed (2026-09-26) — Maintainers manage sources, branches/path filters, imports, and scans; private repositories require owner approval per project. Credentials and Repository Approvals stay owner-controlled. Module spec.

• Project roles confirmed (2026-09-26) — Viewer, Reviewer, and Maintainer; Reviewer is the default invitation role. Membership administration is confirmed: Maintainers manage Viewers/Reviewers, only the owner manages Maintainer seats, and members may leave voluntarily. The complete capability matrix is now confirmed. Module spec.

• Project access pulled forward; workspace management follows later — user direction, 2026-09-26. Invitation grants only the project; preserve an expansion path to workspace membership. Module spec records confirmed product decisions; testing uses agreed PHPUnit API features, Playwright journeys, database concurrency checks, and a real-mail deployment smoke test.

• Approach B′, moat-first milestone order — CEO plan review, TODOS.md decision log 2026-07-01.

• Seven v1 expansions (MCP server, approvals lite, suggested edits, digest post-back, instant demo mode, diff view + comment overlay, review queue) — SPEC.md Rev 2.

• Self-hostable distribution (AGPL-3.0, full parity, compose reference; Fumadocs replaces Protocol code; PAT permanent; Nova optional) — SPEC.md Rev 3, TODOS.md 2026-07-01.

• Text projection owned by the web layer — SPEC §5.4.

• Kroki is the sole diagram engine, self-hosted in both editions — SPEC §6.2, TODOS.md 2026-07-03.

• Design language approved ("Protocol Rebuild", clean-room) — DESIGN.md, mockup docs/designs/review-page.html, 2026-07-03.

• Fumadocs shell validated (spike, web/ in repo) — TODOS.md 2026-07-03.

• Confluence auth: per-user API tokens first, OAuth 2.0 (3LO) when a team adopts — SPEC §22.2.

• Product named Kedge (kedge.review / kedge.ink, org kedgehq) — TODOS.md 2026-07-09.

• Destination includes launch of both editions — this charting, 2026-07-10.

• Sync-agent idea stays in the fog (v1 is pull-based via connectors) — this charting, 2026-07-10.

• Web-side error reporting deferred to Launch (SaaS has no public traffic before go-live; must be off/optional self-hosted either way) — Import & render speccing, 2026-07-11.

• Workspace UX wedge before M4 (M3.5 documents list → M3.6 projects & tracked repos) — dogfooding pain: invisible imports, no multi-import progress, no organization, one-by-one import; M4's agent flows demo far better against an organized repo-full of docs. TODOS.md decision log 2026-07-21.

• Design-refresh wedge before M4, split three ways — the 2026-07-23 Open Harbor design lock turned into modules: restyle + dashboard/activity + SaaS landing + web-UI i18n, full scope user-directed at speccing; the one-L-module bundle was split M3.7/M3.8/M3.9 at eng review (2026-07-23) so each ends demoable with a small merge (the 74-commit M3.6 branch was the cautionary tale). Landing pulled forward from Launch; activity instrumentation front-runs M5's inbox deliberately; i18n runs last against stable strings.

• A PR is a candidate version, not a separate document — constrains the Versions module's lineage schema (lineage-with-candidates, not linear-only) — ADR 0001, 2026-07-15.

• Organization language pinned: Project (container) + Source (origin) — a repo is a source, never the container (monorepos and mixed-source efforts break the 1:1); issues attach as References, never import — CONTEXT.md, 2026-07-15.

Not yet specified

• Demo-mode abuse thresholds — real per-IP numbers only knowable after public traffic; tune in Launch's tail. (SPEC §22.5)
• Confluence macro conversion coverage — which macros beyond panels/code get converters; sharpens against real pages when Private sources & post-back is specced.
• Sync agent (IDEAS.md) — push-model sync: a CLI/CI step pushes content to Kedge instead of Kedge pulling. May fall out of POST /documents {content} plus a thin CLI; post-v1 unless the destination is redrawn.
• Raw/source view (IDEAS.md) — "raw view of html, md" alongside the rendered template; too blurry to phrase as a decision yet.
• References & PR sources (post-v1) — attach external References and resolve PR URLs to candidate versions (ADR 0001). Project containers shipped in M3.6; project access is now planned in M4.1. These remaining source/reference capabilities are separate future scope.

Out of scope

• In-app document editing — Kedge is a review surface; revisions flow through the source. Suggested edits are proposals, not writes. (SPEC §2)
• Raw comment sync-back to GitHub/Confluence — digest post-back only in v1.
• Realtime cursors/presence — polling v1; Reverb later.
• Enterprise SSO/SAML/SCIM — self-hosting is the v1 enterprise trust answer; generic OIDC is post-v1.
• Billing & team workspace management UI — remains later scope; project member/invitation management is the M4.1 exception, with workspace expansion designed in.
• Cross-document search, wikis, folders — the review queue is the only aggregation surface in v1.