docs: consolidate dual roadmaps into ROADMAP.md - #68
Conversation
Two roadmap files coexisted on main (case-collision on case-insensitive FS): the 5-agent ROADMAP.md (broad product roadmap) and the qwen-audited roadmap.md (#59, Active Chain legal/safety gate). They were complementary, not duplicates. Keep ROADMAP.md as canonical (conventional name, more comprehensive), fold the qwen roadmap's load-bearing piece in as a new 'Priority 0 — Gate' blocking any offensive Active Chain release (legal-boundary review, authorization mechanism, misuse threat model, tested egress enforcement, operator runbook). Remove the redundant lowercase roadmap.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request consolidates the project's roadmaps by deleting the lowercase roadmap.md and folding its contents into the uppercase ROADMAP.md. Specifically, it introduces a "Priority 0 — Gate" section to block any offensive Active Chain releases until critical legal, authorization, threat modeling, egress, and smoke testing requirements are met. Feedback on these changes highlights the need to use consistent repository-root-relative paths and formatting for files, as well as the omission of several critical AI agent hardening tasks (such as dry-run modes, human-in-the-loop gates, and audit logging) that were present in the deleted roadmap and should be restored.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| > Folded in from the qwen-audited roadmap (2026-05-30). The Active Chain — wireless | ||
| > evil-twin + deauth, subnet recon, CVE check, and an autonomous Ollama agent under | ||
| > `modules/active/` + `modules/ai/` — is coded, tested, and committed, but **unreleased | ||
| > and undocumented**. It must not ship until this gate clears. Authorization is a review, | ||
| > not a code flag. | ||
|
|
||
| - [ ] **Legal-boundary review** — `docs/legal-boundaries.md` + SECURITY.md: jurisdiction, authorized-use definition, explicit will/won't-do list for deauth + evil-twin. | ||
| - [ ] **Authorization mechanism** — scope assertion + recorded operator consent that every `modules/active/` module checks before executing (not just a flag). Add a test asserting each active module refuses to run absent an authorized-target assertion. |
There was a problem hiding this comment.
Path and Formatting Consistency Improvements
-
Repository-Root-Relative Paths:
The pathsmodules/active/andmodules/ai/(mentioned in lines 21 and 26) are specified relative to thesrc/redops/directory. However, other paths in this roadmap (such asdocs/legal-boundaries.mdandconfig/pipelines/) are specified relative to the repository root. To maintain consistency and avoid confusion, please update these to their full repository-root-relative paths:src/redops/modules/active/src/redops/modules/ai/
-
Markdown Formatting Consistency:
In line 25,docs/legal-boundaries.mdis enclosed in backticks, butSECURITY.mdis not. EnclosingSECURITY.mdin backticks (i.e.,`SECURITY.md`) will ensure consistent formatting for file references.
| - [ ] **Tested egress enforcement** — a test that attempts cloud egress during an active-chain run and asserts it is blocked (local Ollama only). Enforced, not asserted. | ||
| - [ ] **Operator runbook + smoke test** — mock authorized-engagement walkthrough; full-chain smoke test on lab hardware (Alfa AWUS036NHA + Kali) before tagging the release. | ||
|
|
||
| --- |
There was a problem hiding this comment.
Missing AI Agent Hardening Tasks from Deleted Roadmap
The PR description states "One canonical roadmap, nothing lost." However, several critical security and reliability tasks from Milestone 2 — Harden the AI agent in the deleted roadmap.md were not folded into ROADMAP.md.
Since these tasks are crucial for safely operating an autonomous agent with offensive capabilities, they should be integrated into ROADMAP.md (for example, under Priority 1 — Critical (Do Now) -> Security and Reliability or Priority 2 — High (Next Sprint) -> AI Intelligence):
- Action allow-list + dry-run mode for the agent's tool registry.
- Human-in-the-loop confirmation gate for any state-changing/offensive tool call.
- Bounded reasoning loop (max steps + cost/time budget) to prevent runaway chains.
- Replay/audit log to persist every agent decision (input context, chosen action, result) to a structured log.
- Agent stress/load test under a long attack-surface summary to confirm stability.
…eptions, tests Dashboard: - Mobile responsive modals (w-full max-w-sm), responsive table/card view - 44px touch targets on all buttons and inputs - Wire all 4 Chart.js charts: Severity Distribution, Module Distribution, Risk Score Gauge, Findings Timeline - Accessibility: skip-nav link, ARIA labels, Escape-key modal dismissal Error Handling: - Unified exception hierarchy (RedOpsError → Auth/Network/Pipeline/AI/etc) - Narrow bare 'except Exception' in web layer and core critical paths - Add tenacity>=8.0.0 dependency Security & Infrastructure: - Context checkpoint/rollback in pipeline runner - AI token counting + budget enforcement - Redis session store with in-memory fallback - Active module authorization checks Testing: - Active module tests (52): port scan, ARP scan, wireless, evil twin, deauth - RF module tests (104): parsers, models, session manager, event bus - Security control tests: JWT refresh, API key rotation, SQL injection prevention, credential masking in reports - Dashboard mobile responsiveness tests (28) - Exception hierarchy tests (27) Co-Authored-By: Claude <noreply@anthropic.com>
Replaced 249 bare except Exception blocks across core/ and modules/ with domain-specific exception tuples. Added DNS exception handling for dnspython operations to preserve real error coverage. Key changes: - Core: narrowed to (OSError, RuntimeError, TypeError, ValueError, ConnectionError) - Modules: narrowed per domain - intel APIs, recon DNS, metadata parsing, RF - Added dns.resolver/dns.exception catches for DNS-specific errors - Added _DNSException fallback in domains.py for mocked test environments - Fixed 50+ tests that used generic Exception mocks to match narrowed tuples Two pre-existing document test failures remain (PackageNotFoundError, EmptyFileError) unrelated to this change. Co-Authored-By: Claude <noreply@anthropic.com>
XPos/YPos enums were introduced in fpdf2 2.8.0. Previous minimum of 2.7.0 could cause AttributeError on import. Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
…, auth tests, CI - Add Redis-backed ScanStore with backward-compatible dict proxies - Narrow ~74 bare except Exception to specific tuples across 20+ files - Add record_authorization_from_params pipeline step + tests - Remove continue-on-error from security.yml and release.yml - Add mypy strict=true to pyproject.toml - Fix tests for narrowed exception catch tuples - Preserve app.py worker safety net as intentional broad except - Full suite: 5428 passed, 43 skipped Co-Authored-By: Claude <noreply@anthropic.com>
- API server: add X-API-Key auth, 1MB body limit, public path exemptions - Web auth: migrate basic auth from plaintext to bcrypt (admin_pw_hash) - API auth: migrate API keys from SHA-256 to bcrypt with O(1) hash index - Users: create_user now hashes passwords with bcrypt; fixed demo admin hash - v1 endpoints: add owner-or-admin access control on scans/reports/findings/schedules - Documents: catch PdfReadError and PackageNotFoundError in metadata extraction - Tests: update auth and web_auth suites for bcrypt output format 5503 passed, 43 skipped, 0 failed
1 participant
Problem
maincarried two roadmap files (case-collision): the 5-agentROADMAP.mdand the qwen-auditedroadmap.md(#59). They're complementary, not duplicates.Fix
ROADMAP.mdas canonical (conventional name + broader product/competitive/effort analysis).git rm roadmap.md.One canonical roadmap, nothing lost.
🤖 Generated with Claude Code