Roadmap

Nothing is dated here. Order is what matters: each release has gates, and the status word of every product changes only when they pass. Status words are the five of the catalog, and the product chips on this page are read from the docs’ code mirror (docs/lib/content.ts), not typed by hand. The pilot is positioned as “non-GxP decision support with a light validation package”. Every decision stays human and recorded. Timing claims wait for measured data.

Where the products stand

The transition console, Evidence, Plans and Review designed -> preview happens in one commit across forge.config.json, contract section 1, CLAUDE.md, the docs status page and CLAIMS-REGISTER.md once the two phase-2 measurements (cold start, streaming ceiling; contract 10.12) are registered. Progress follows at R3 exit under the same condition. Clinical and manufacturing objects stay designed throughout.

What exists after phase 2 and the site wave

The site wave (phase 3, wave 1)

Records and the public site, built before any twin, released on 2026-09-15 (contract 11.6: the live audit was green with one recorded warning). The status transition of console, Evidence, Plans and Review to preview was made the same day after the two phase-2 measurements were registered.

Gates: the site copy gate (status literals, illustrative labelling, placeholder guard, forbidden marketing words, timing words), the metadata gate, zero-console-error screenshots at 1440 and 390, check_routes: 157 designed, the public endpoint tests, and the live audit after deploy (www 301, real 404, robots.txt and sitemap.xml, headers on every response).

R2: pilot go-live (unchanged)

Gates: evaluation suite passes with register rows and context-of-use notes; light validation package v1; data-processing agreement with retention, purge and offboarding procedures; zero fixtures in the demo path.

R3: twins for program personas (built, awaiting its gates)

Wave 2 built R3 in the repositories on 2026-09-15 (contract 11.7). Every item keeps the status word designed until the R3 gates below pass and the release is recorded; the chips change in one commit with forge.config.json, the contract and CLAIMS-REGISTER.md.

Status on exit: twins designed -> preview only when the R3 gates pass (the two phase-2 measurements are already registered); otherwise twins stay designed. Progress designed -> preview at R3 exit under the same condition. Gates: pins 87/189/60/61 green in api, web, docs, contract and register; the persona v3 bundle test; the approval matrix generated from BUILTIN_ROLES; allowlist intersection per persona (viewer: zero write tools); the bound-user test; detached interrupts leave the run status; per-item batch permission and audit; stale_proposal on basis_hash; the audit-actions registry and the TRIGGERABLE_ACTIONS exclusion test; savepoint-hook and coalescing tests; pause on role removal and deactivation; mentions never fire; permission_exercised = program.twins.use on plan approval; delegation checks; metrics under a viewer principal; the export carries no arguments; no “Requested by” footer; e-mail content; usage.cost_usd contract test; agent make verify; check:mobile in check; a baseline registered for each partner program before enable; twin scenarios in the evaluation suite; zero-console-error screenshots of home, inbox and board at 1440 and 390 with illustrative chips.

R4: workbench roles, the evidence panel, skills, harnesses and memory tiers

Phase 4 (contract section 12, decisions 0027 to 0034, 2026-09-16) puts the workbench first and moves stage gates to R5 (ADR 0032). Every count below is an R4 target, re-derived on release by the owning test; every item is designed until the gate list passes, then preview on the illustrative program and, under the partner condition, on partner programs.

Status on exit: the console, Evidence, Plans and Review keep preview; workbench roles, the evidence panel, skills and memory tiers designed -> preview only when the R4 gate list passes; Progress and the twin surfaces follow their own conditions above. Gates: check and verify green on every repository; permissions in sync: 87; EXPECTED_TABLE_COUNT = 63; EXPECTED_ROUTE_COUNT = 206; EXPECTED_HARNESS_COUNT = 20; the renderer-per-licence and abstract-withheld tests; the two-organisation and two-program memory tests; the injection fixture through every provider handler and memory.propose_note; the container tests (flagged tools absent, documents.list_assets present, harness_denied handled, refusal lines present); the skill golden tests and skill-references-check (5/13 references verified); no-popups.lint.test.ts and the plumbing-word copy test in the web app’s npm run check (recorded 2026-09-16; verified in web/package.json: check calls no vitest yet, the two lints run under npm run test, which verify calls, so the web writer adds them to check before the gate); the screenshot set taken by npm run shots:workbench (two role homes; one CC BY article with figure and attribution line, PMC10000000.1; one no-derivatives source as quote in context; one publisher-copyright source as metadata and link; one notebook entry; one rendered PDF page; zero console errors at 1440 and 390); a live twin cycle under a harness on the illustrative program.

R5: lens reviews, role memory, stage gates and organisation twins

Status on exit: twins available for discovery and preclinical only if the event-anchored metrics are registered from at least three partner programs and the evaluation suite holds; otherwise preview. Gates: test_stage_change_only_via_gate; close advances current_stage_id in one transaction; reviewer_role_required through a group assignment; gate_stage_restricted; same_signer; the scorecard tests (no aggregate, no verdict word, no numeric column on export; a scorecard never a required record, check input or attachment); the lens plan read-only test; two-party curation; auto-keep default off; the approval matrix at version 4; periodic review minutes covering twin proposals; re-validation impact assessment; the tenant offboarding runbook covers the twin and memory tables; register rows dated with cohort.

R6: patents, connector grants, simulation and organisation twins

Not planned

Compliance claims of any kind, market or productivity figures, timing words before a registered measurement, model names in code, docs or copy, agents that approve, sign, notify or send, twins with their own persona or an agent-to-agent channel, writes into the ELN or the QMS, and any capability sentence that presents a designed product as live. Agents prepare, compare, propose and flag; a person decides.

Source: PRODUCT-PLAN.md Part 5, Part 6 (A1 to A8), Part 7 section 9, Part 8 and Part 9 section 8; PRODUCT-CONTRACT.md sections 10.11, 10.12, 11.6, 11.7, 12.1, 12.7 and 12.11; forge.config.json; api/scripts/designed-routes.json (206 rows); api/tests/test_migrations.py (HEAD = "0006", EXPECTED_TABLE_COUNT = 63); api/tests/test_harness.py; api/tests/test_workbench_roles.py; api/app/auth/permissions.py (87); api/app/auth/personas.py (PERSONA_VERSION = 3); web/lib/status.ts (61); docs/lib/content.ts (products, R4_TARGETS); decisions/0017-pilot-scope-validation-and-status-transitions.md; decisions/0021-persona-twins.md to decisions/0034-inline-interaction-no-popups.md