Roadmap

Seven milestones, seventy-one issues. Six milestones are complete and one is at 84%. The counts below are the repository's own, not a summary written separately from them.

The ordering is deliberate and worth stating, because it is the opposite of how this kind of tool usually gets built: the gate came first and the console came second. Phase 1 exists because evidence that only a CLI can read is evidence nobody reads.

Shipped

Phase 1 — See it

100% · 21 issues

Evidence becomes readable without the CLI: verified ingestion, the portfolio dashboard, repository and run views. Useful on its own. WORM-backed ingest is in scope here because the UI increases how much weight rests on the evidence chain.

Phase 2 — Register it

100% · 11 issues

The AI model registry, and the pull-request flow that registers a call site in model-inventory.yaml. Registration happens in Git, where it can be reviewed, rather than through a form.

Phase 3 — Accept it

100% · 5 issues

Waiver creation, renewal and expiry alerting — all through pull requests approved by risk in Git. A waiver granted in a web app would need its own signed audit trail before it meant anything.

Phase 4 — Report it

100% · 8 issues

Control reports, the regulator pack and the AI inventory report, plus the trends behind them.

Phase 5 — Integrate

100% · 5 issues

Model-risk system and ticketing integration, SSO role mapping, drift and orphan alerting.

E-23 model registration

100% · 8 issues

A proper model record in the repository, not a one-off assessment: E-23 model profile, risk dimensions, materiality tier and the governance controls the tier requires — all enforced by the gate and registered through the console.

In progress

Gate and evidence platform

84% · 11 of 13 issues closed

Work on the gate itself that the front end depends on, or that the gaps review identified: WORM storage and anchoring, org-wide rollout, packaging, privacy and key management. Delivered so far includes ledger-head anchoring, S3 Object Lock in compliance mode with legal hold as an independent axis, signing-key rotation and coverage, and an access review of the evidence branch itself.

What remains is rollout: moving the reference policy into its own repository so that a policy change is a reviewable pull request in the place the second line already works.

Companion website and public demo

open

This site, the frozen demo estate, and the published artefacts that let somebody verify a real bundle without installing anything.

What is deliberately not on this list

A hosted, multi-tenant service. The evidence is the product, and it is designed so that you can check it without anything of ours running — which is difficult to reconcile with asking you to send it to us. If that trade-off is the wrong one for your institution, say so; it is a better conversation than a feature request.