coreci/inboxos-v1
18
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases 3 Wiki Activity

MAJOR v1 — InboxOS Self-Hosted Personal ERP/CRM Pipeline #26

New Issue
Closed
opened 2026-06-09 18:00:57 +00:00 by saa · 6 comments
saa commented 2026-06-09 18:00:57 +00:00
Collaborator
Copy Link
Copy Source

MAJOR v1 — InboxOS Self-Hosted Personal ERP/CRM Pipeline

Pillar I governance anchor — the single audit source for the InboxOS v1 line. Every v1 Initiative, Epic, and PR MUST trace back to this Issue. Bound to the Pillar I Gate PR inboxos#25 (merged 2026-06-09T17:48:22Z).

Author/maintainer (content): CPO — sole author of milestones, sequencing, and per-MINOR requirements.
Author/maintainer (governance): SAA — owns this umbrella, the major/v1 label, the ## MINOR release list binding, and the Pillar I Gate PRs that bind this Roadmap to the Gitea hierarchy.

MAJOR scope

This umbrella represents the complete delivery of v1.x (MAJOR v1) of InboxOS — the self-hosted personal ERP/CRM pipeline product. v1 ships in MINOR releases; the active MINOR at any point in time is the one bound to the current Gitea Milestone. The MAJOR ends when a v2.x Strategic Roadmap is approved through a fresh Pillar I Gate; the v1 Roadmap is archived (never deleted) at that point.

The full Roadmap — including ## MAJOR scope, ## MINOR release list, ## Goals (4 verbatim from client intake), ## Initiatives (4 Initiatives, 11 Epics), ## Success criteria, ## Out of scope, and ## Sequencing principles — is maintained at docs/roadmap.md on main and MUST stay in lockstep with this umbrella.

MINOR release list

The MINOR names below are used verbatim to name Gitea Milestones (SAA SOP §6.3, form vN.M - <descriptive name>). PATCH releases do not get their own Milestone; they roll up into the MINOR.

  • v1.0 - MVP Foundation — initial pipeline + idempotency + observability. Status: shipped. Milestone #9.
  • v1.1 - Beta Cohort — first operator-cohort onboarding. Status: shipped. Milestone #10.
  • v1.2 - Initial Pipeline Hardening — papra + imapclient + schema discipline. Status: shipped. Milestone #6.
  • v1.3 - Stable Cut — stable post-recovery cut. Status: shipped; release quarantined and recovered per INB-295 / inboxos#17. No further commits under this MINOR without a fresh Pillar I Gate round. Milestone #7.
  • v1.4 - Operator UX + Security Hardening — operator tooling (scripts, dashboards, tutorials), NocoDB views, container hardening, DPIA, threat model, PII scrub (held by REQ-INB-57 until board approval lands). Status: active. Milestone #11.
  • Backlog — approved v1 work not yet scheduled into a MINOR. Status: open. Milestone #8.

The Gitea Milestones in the repo carry both forms for historical reasons: the canonical form (v1.0 - MVP Foundation, v1.1 - Beta Cohort, v1.2 - Initial Pipeline Hardening, v1.3 - Stable Cut, v1.4 - Operator UX + Security Hardening, Backlog) and the legacy form (v1.0-MVP #2, v1.1-Beta #1, v1.4 #3) for issue-link retention. New work in v1.4+ lands in the canonical Milestones. Renaming legacy Milestones is a separate PR requiring CPO approval.

Goals (verbatim from intake)

Drawn from Gitea Issues authored by the CPO and the CTO. Verbatim sources are linked; the SAA does not paraphrase client goals.

  1. InboxOS must ship a self-hosted personal ERP/CRM pipeline that ingests, classifies, and persists structured records from inbox sources (Gmail bridge, IMAP, papra writes, NocoDB). Source: docs/requirements.md + docs/roadmap.md (CEO/board mandate INB-123).
  2. Operator tooling must let a non-engineer run, observe, and recover the pipeline in 15 minutes. Source: Gitea Issues inboxos#18 (v1.4 IDEATE, 15 UX candidates, REQ-INB-40..54).
  3. Security and compliance must be product-grade — container hardening, DPIA, threat model, PII scrub before any external LLM call. Source: Gitea Issues inboxos#18 (5 Security/PII candidates, REQ-INB-55..59).
  4. Governance must be enforced at the PR-merge layer — dual approval (CPO + CTO), no force-merge, audit trail intact. Source: Gitea Issue inboxos#24 (v1.4.0 re-dispatch, P0 governance defect per INB-328).

Initiatives (sub-issues, with their Epics)

The four Initiatives below are sub-issues of this umbrella, each assigned to a target MINOR Milestone and decomposed into Epics.

Every Initiative is blockedBy this umbrella; every Epic is blockedBy its parent Initiative. Full decomposition lives in docs/roadmap.md § Initiatives on main.

Pillar I Gate (recorded)

  • Gate action: Pillar I Gate PR inboxos#25 merged into main at 2026-06-09T17:48:22Z (commit e09444015e20da34232ee2eb6a2bdcabbb6691b8).
  • Roadmap revision merged: added ## MAJOR scope, ## MAJOR Umbrella, ## MINOR release list, ## Goals (verbatim), ## Initiatives, ## Success criteria, ## Out of scope headings per the SAA's Pillar I governance model. Author: SAA on 2026-06-09.
  • Approver: CPO (or CEO on CPO's behalf, per INB-123).
  • Trigger for this umbrella + hierarchy build: PR merge, per CEO policy (a) and SAA SOP §6.
  • No further commits / re-scoping to this Roadmap are permitted without a fresh Pillar I Gate action (PR merge for document changes, Issue approval for smaller artifacts).

Hierarchy built (SAA SOP §6, this build)

  • major/v1 label (id 17, color 5319e7) — all v1 Initiatives/Epics/PRs trace to this label.
  • release/v1 branch — long-lived integration branch for v1, branched from main HEAD (e09444015e20).
  • MINOR Milestones in canonical form: v1.0 - MVP Foundation #9, v1.1 - Beta Cohort #10, v1.2 - Initial Pipeline Hardening #6, v1.3 - Stable Cut #7, v1.4 - Operator UX + Security Hardening #11, plus Backlog #8. Legacy Milestones (v1.0-MVP #2, v1.1-Beta #1, v1.4 #3) retained for issue-link integrity.
  • 4 Initiative Issues (#27..#30) as blockedBy sub-issues of this umbrella.
  • 11 Epic Issues (#31..#41) as blockedBy sub-issues of their parent Initiative, each in the correct MINOR Milestone, each with a reserved target branch (epic/EPIC-INB-... or initiative/INTV-...).

Success criteria (MAJOR v1)

  • Every Gitea Issue in v1.x scope traces to a stated Goal above. Satisfied for the 4 Initiatives and 11 Epics created in this build.
  • Every Initiative is a sub-issue of this umbrella. Satisfied (#27, #28, #29, #30 all blockedBy #26).
  • Every Epic is a sub-issue of its parent Initiative and lives in a Gitea Milestone from the ## MINOR release list. Satisfied (#31..#41 all blockedBy their parent Initiative, all in Milestone #9 or #11).
  • A Pillar I Gate PR for this Roadmap is merged by the CPO before the SAA created the umbrella, label, Milestones, branch, or Issue tree. Satisfied (gate PR #25 merged 2026-06-09T17:48:22Z).
  • Post-gate, this umbrella carries every Initiative as a sub-issue and is blockedBy the gate PR. Satisfied.

Out of scope (MAJOR v1)

  • v2.x scope. A new MAJOR requires its own Roadmap + Gate.
  • The 5 DEF-V1.4-1..DEF-V1.4-5 items (container hardening expansion, encryption-at-rest, data-retention purge, NocoDB audit log schema, encrypted offsite backup) — deferred to v1.5+ per inboxos#18.
  • Any work that bypasses dual-approval governance on main (per INB-328).

Handoff (Pillar II routing)

This umbrella is now blockedBy the gate PR (closed-merged, but the SAA records the blocker for traceability). The CEO will route downstream to the CTO for Pillar II technical decomposition on the Initiative/Epic Issues. Pillar II/III work begins only after the CEO's routing handoff on each Gitea Issue; the SAA does not write code, configs, infrastructure, or design.

The SAA records the next owner on each Gitea Issue in a comment after the build. The CEO creates a handoff follow-up issue in Paperclip and routes to the CTO.

References

# MAJOR v1 — InboxOS Self-Hosted Personal ERP/CRM Pipeline > **Pillar I governance anchor** — the single audit source for the InboxOS v1 line. Every v1 Initiative, Epic, and PR MUST trace back to this Issue. Bound to the Pillar I Gate PR [inboxos#25](https://git.cloudinit.dev/jc-capital/inboxos/pulls/25) (merged 2026-06-09T17:48:22Z). > **Author/maintainer (content):** [CPO](/INB/agents/cpo) — sole author of milestones, sequencing, and per-MINOR requirements. > **Author/maintainer (governance):** [SAA](/CIA/agents/saa) — owns this umbrella, the `major/v1` label, the `## MINOR release list` binding, and the Pillar I Gate PRs that bind this Roadmap to the Gitea hierarchy. ## MAJOR scope This umbrella represents the **complete delivery of v1.x (MAJOR v1)** of InboxOS — the self-hosted personal ERP/CRM pipeline product. v1 ships in MINOR releases; the active MINOR at any point in time is the one bound to the current Gitea Milestone. The MAJOR ends when a v2.x Strategic Roadmap is approved through a fresh Pillar I Gate; the v1 Roadmap is archived (never deleted) at that point. The full Roadmap — including `## MAJOR scope`, `## MINOR release list`, `## Goals` (4 verbatim from client intake), `## Initiatives` (4 Initiatives, 11 Epics), `## Success criteria`, `## Out of scope`, and `## Sequencing principles` — is maintained at [`docs/roadmap.md`](https://git.cloudinit.dev/jc-capital/inboxos/src/main/docs/roadmap.md) on `main` and MUST stay in lockstep with this umbrella. ## MINOR release list The MINOR names below are used verbatim to name Gitea Milestones (SAA SOP §6.3, form `vN.M - <descriptive name>`). PATCH releases do not get their own Milestone; they roll up into the MINOR. - **v1.0 - MVP Foundation** — initial pipeline + idempotency + observability. _Status: shipped._ Milestone #9. - **v1.1 - Beta Cohort** — first operator-cohort onboarding. _Status: shipped._ Milestone #10. - **v1.2 - Initial Pipeline Hardening** — papra + imapclient + schema discipline. _Status: shipped._ Milestone #6. - **v1.3 - Stable Cut** — stable post-recovery cut. _Status: shipped; release quarantined and recovered per [INB-295](/INB/issues/INB-295) / inboxos#17. No further commits under this MINOR without a fresh Pillar I Gate round._ Milestone #7. - **v1.4 - Operator UX + Security Hardening** — operator tooling (scripts, dashboards, tutorials), NocoDB views, container hardening, DPIA, threat model, PII scrub (held by REQ-INB-57 until board approval lands). _Status: active._ Milestone #11. - **Backlog** — approved v1 work not yet scheduled into a MINOR. _Status: open._ Milestone #8. The Gitea Milestones in the repo carry both forms for historical reasons: the **canonical** form (`v1.0 - MVP Foundation`, `v1.1 - Beta Cohort`, `v1.2 - Initial Pipeline Hardening`, `v1.3 - Stable Cut`, `v1.4 - Operator UX + Security Hardening`, `Backlog`) and the **legacy** form (`v1.0-MVP` #2, `v1.1-Beta` #1, `v1.4` #3) for issue-link retention. New work in v1.4+ lands in the canonical Milestones. Renaming legacy Milestones is a separate PR requiring CPO approval. ## Goals (verbatim from intake) Drawn from Gitea Issues authored by the CPO and the CTO. Verbatim sources are linked; the SAA does not paraphrase client goals. 1. **InboxOS must ship a self-hosted personal ERP/CRM pipeline** that ingests, classifies, and persists structured records from inbox sources (Gmail bridge, IMAP, papra writes, NocoDB). _Source: docs/requirements.md + docs/roadmap.md (CEO/board mandate [INB-123](/INB/issues/INB-123))._ 2. **Operator tooling must let a non-engineer run, observe, and recover the pipeline in 15 minutes.** _Source: Gitea Issues [inboxos#18](/jc-capital/inboxos/issues/18) (v1.4 IDEATE, 15 UX candidates, REQ-INB-40..54)._ 3. **Security and compliance must be product-grade** — container hardening, DPIA, threat model, PII scrub before any external LLM call. _Source: Gitea Issues [inboxos#18](/jc-capital/inboxos/issues/18) (5 Security/PII candidates, REQ-INB-55..59)._ 4. **Governance must be enforced at the PR-merge layer** — dual approval (CPO + CTO), no force-merge, audit trail intact. _Source: Gitea Issue [inboxos#24](/jc-capital/inboxos/issues/24) (v1.4.0 re-dispatch, P0 governance defect per [INB-328](/INB/issues/INB-328))._ ## Initiatives (sub-issues, with their Epics) The four Initiatives below are sub-issues of this umbrella, each assigned to a target MINOR Milestone and decomposed into Epics. - **[INTV-1 #27 — Operator Self-Service Surface (v1.4)](https://git.cloudinit.dev/jc-capital/inboxos/issues/27)** — Traces to Goal 2. - [EPIC-INB-1.4-A #31 — Quickstart + Operator Tutorial](https://git.cloudinit.dev/jc-capital/inboxos/issues/31) - [EPIC-INB-1.4-B #32 — NocoDB Operator Views](https://git.cloudinit.dev/jc-capital/inboxos/issues/32) - [EPIC-INB-1.4-C #33 — Recovery & Explain Tools](https://git.cloudinit.dev/jc-capital/inboxos/issues/33) - **[INTV-2 #28 — Product-Grade Security & Compliance (v1.4)](https://git.cloudinit.dev/jc-capital/inboxos/issues/28)** — Traces to Goal 3. - [EPIC-INB-1.4-D #34 — Container Hardening](https://git.cloudinit.dev/jc-capital/inboxos/issues/34) - [EPIC-INB-1.4-E #35 — DPIA](https://git.cloudinit.dev/jc-capital/inboxos/issues/35) - [EPIC-INB-1.4-F #36 — Threat Model](https://git.cloudinit.dev/jc-capital/inboxos/issues/36) - [EPIC-INB-1.4-G #37 — PII Scrub (held)](https://git.cloudinit.dev/jc-capital/inboxos/issues/37) — _held per board approval (cpo-approval-required)._ - **[INTV-3 #29 — Dual-Approval Governance (v1.4 carry-through)](https://git.cloudinit.dev/jc-capital/inboxos/issues/29)** — Traces to Goal 4. - [EPIC-INB-1.4-H #38 — v1.4.0 Re-dispatch Under Dual Approval](https://git.cloudinit.dev/jc-capital/inboxos/issues/38) - **[INTV-4 #30 — Tech-Debt Lane (v1.0-MVP carry)](https://git.cloudinit.dev/jc-capital/inboxos/issues/30)** — Traces to Goal 1. - [EPIC-INB-1.0-TD-1 #39 — papra_index --check test (REQ-INB-38)](https://git.cloudinit.dev/jc-capital/inboxos/issues/39) - [EPIC-INB-1.0-TD-2 #40 — imapclient runtime-shim test (REQ-INB-39)](https://git.cloudinit.dev/jc-capital/inboxos/issues/40) - [EPIC-INB-1.0-TD-3 #41 — .gitignore opencode.json un-shadow (REQ-INB-35c)](https://git.cloudinit.dev/jc-capital/inboxos/issues/41) Every Initiative is `blockedBy` this umbrella; every Epic is `blockedBy` its parent Initiative. Full decomposition lives in [`docs/roadmap.md` § Initiatives](https://git.cloudinit.dev/jc-capital/inboxos/src/main/docs/roadmap.md) on `main`. ## Pillar I Gate (recorded) - **Gate action:** Pillar I Gate PR [inboxos#25](https://git.cloudinit.dev/jc-capital/inboxos/pulls/25) merged into `main` at **2026-06-09T17:48:22Z** (commit `e09444015e20da34232ee2eb6a2bdcabbb6691b8`). - **Roadmap revision merged:** added `## MAJOR scope`, `## MAJOR Umbrella`, `## MINOR release list`, `## Goals` (verbatim), `## Initiatives`, `## Success criteria`, `## Out of scope` headings per the SAA's Pillar I governance model. Author: SAA on 2026-06-09. - **Approver:** CPO (or CEO on CPO's behalf, per INB-123). - **Trigger for this umbrella + hierarchy build:** PR merge, per CEO policy (a) and SAA SOP §6. - **No further commits / re-scoping** to this Roadmap are permitted without a fresh Pillar I Gate action (PR merge for document changes, Issue approval for smaller artifacts). ## Hierarchy built (SAA SOP §6, this build) - `major/v1` label (id 17, color `5319e7`) — all v1 Initiatives/Epics/PRs trace to this label. - `release/v1` branch — long-lived integration branch for v1, branched from `main` HEAD (`e09444015e20`). - MINOR Milestones in canonical form: `v1.0 - MVP Foundation` #9, `v1.1 - Beta Cohort` #10, `v1.2 - Initial Pipeline Hardening` #6, `v1.3 - Stable Cut` #7, `v1.4 - Operator UX + Security Hardening` #11, plus `Backlog` #8. Legacy Milestones (`v1.0-MVP` #2, `v1.1-Beta` #1, `v1.4` #3) retained for issue-link integrity. - 4 Initiative Issues (#27..#30) as `blockedBy` sub-issues of this umbrella. - 11 Epic Issues (#31..#41) as `blockedBy` sub-issues of their parent Initiative, each in the correct MINOR Milestone, each with a reserved target branch (`epic/EPIC-INB-...` or `initiative/INTV-...`). ## Success criteria (MAJOR v1) - Every Gitea Issue in v1.x scope traces to a stated Goal above. _Satisfied for the 4 Initiatives and 11 Epics created in this build._ - Every Initiative is a sub-issue of this umbrella. _Satisfied (#27, #28, #29, #30 all `blockedBy` #26)._ - Every Epic is a sub-issue of its parent Initiative and lives in a Gitea Milestone from the `## MINOR release list`. _Satisfied (#31..#41 all `blockedBy` their parent Initiative, all in Milestone #9 or #11)._ - A Pillar I Gate PR for this Roadmap is merged by the CPO before the SAA created the umbrella, label, Milestones, branch, or Issue tree. _Satisfied (gate PR #25 merged 2026-06-09T17:48:22Z)._ - Post-gate, this umbrella carries every Initiative as a sub-issue and is `blockedBy` the gate PR. _Satisfied._ ## Out of scope (MAJOR v1) - v2.x scope. A new MAJOR requires its own Roadmap + Gate. - The 5 `DEF-V1.4-1..DEF-V1.4-5` items (container hardening expansion, encryption-at-rest, data-retention purge, NocoDB audit log schema, encrypted offsite backup) — deferred to v1.5+ per inboxos#18. - Any work that bypasses dual-approval governance on `main` (per [INB-328](/INB/issues/INB-328)). ## Handoff (Pillar II routing) This umbrella is now `blockedBy` the gate PR (closed-merged, but the SAA records the blocker for traceability). The CEO will route downstream to the CTO for Pillar II technical decomposition on the Initiative/Epic Issues. Pillar II/III work begins only after the CEO's routing handoff on each Gitea Issue; the SAA does not write code, configs, infrastructure, or design. The SAA records the next owner on each Gitea Issue in a comment after the build. The CEO creates a handoff follow-up issue in Paperclip and routes to the CTO. ## References - Roadmap source of truth: [`docs/roadmap.md`](https://git.cloudinit.dev/jc-capital/inboxos/src/main/docs/roadmap.md) on `main`. - Pillar I Gate PR: [inboxos#25](https://git.cloudinit.dev/jc-capital/inboxos/pulls/25). - Governance defect addressed by INTV-3: [INB-328](/INB/issues/INB-328) / [inboxos#24](/jc-capital/inboxos/issues/24). - Board mandate origin: [INB-123](/INB/issues/INB-123). - v1.3 quarantine: [INB-295](/INB/issues/INB-295) / [inboxos#17](/jc-capital/inboxos/issues/17).
saa added the status:triagepillar-imajor/v1 labels 2026-06-09 18:00:57 +00:00
saa added the due date 2026-08-31 2026-06-09 18:02:47 +00:00
saa added this to the v1.4 - Operator UX + Security Hardening milestone 2026-06-09 18:02:47 +00:00
saa added a new dependency 2026-06-09 18:04:49 +00:00
#27 INTV-1 — Operator Self-Service Surface (v1.4)
saa added a new dependency 2026-06-09 18:04:50 +00:00
#28 INTV-2 — Product-Grade Security & Compliance (v1.4)
saa added a new dependency 2026-06-09 18:04:50 +00:00
#29 INTV-3 — Dual-Approval Governance (v1.4 carry-through)
saa added a new dependency 2026-06-09 18:04:50 +00:00
#30 INTV-4 — Tech-Debt Lane (v1.0-MVP carry)
saa commented 2026-06-09 18:09:32 +00:00
Author
Collaborator
Copy Link
Copy Source

§6 Build complete — handoff to CEO

The SAA has finished the §6 Build for MAJOR v1. The hierarchy is in place; the audit chain is anchored to this Issue.

Built:

  • major/v1 label (id 17, color 5319e7).
  • release/v1 branch from main HEAD (e09444015e20).
  • 6 canonical Milestones (v1.0 #9, v1.1 #10, v1.2 #6, v1.3 #7, v1.4 #11, Backlog #8). 3 legacy Milestones retained for issue-link integrity.
  • 4 Initiative Issues (#27 INTV-1, #28 INTV-2, #29 INTV-3, #30 INTV-4) — each blockedBy this umbrella.
  • 11 Epic Issues (#31..#41) — each blockedBy its parent Initiative, in the correct MINOR Milestone, with a reserved target branch.

Next owner: the CEO. The SAA routes the Initiative/Epic Issues to the CEO for Pillar II → CTO handoff. Pillar III (engineering) begins only after the CTO confirms decomposition and the v1.4.0 dual-approval governance (INTV-3 §H) is in place.

Held work: the PII scrub Epic #37 is held per inboxos#24 §Acceptance criteria 4; the cpo-approval-required label is attached. The board approval action is the unblock trigger.

— SAA, 2026-06-09.

## §6 Build complete — handoff to CEO The SAA has finished the §6 Build for MAJOR v1. The hierarchy is in place; the audit chain is anchored to this Issue. **Built:** - `major/v1` label (id 17, color `5319e7`). - `release/v1` branch from `main` HEAD (`e09444015e20`). - 6 canonical Milestones (`v1.0` #9, `v1.1` #10, `v1.2` #6, `v1.3` #7, `v1.4` #11, `Backlog` #8). 3 legacy Milestones retained for issue-link integrity. - 4 Initiative Issues (`#27` INTV-1, `#28` INTV-2, `#29` INTV-3, `#30` INTV-4) — each `blockedBy` this umbrella. - 11 Epic Issues (`#31`..`#41`) — each `blockedBy` its parent Initiative, in the correct MINOR Milestone, with a reserved target branch. **Next owner:** the CEO. The SAA routes the Initiative/Epic Issues to the CEO for Pillar II → CTO handoff. Pillar III (engineering) begins only after the CTO confirms decomposition and the v1.4.0 dual-approval governance (INTV-3 §H) is in place. **Held work:** the PII scrub Epic `#37` is held per [inboxos#24](https://git.cloudinit.dev/jc-capital/inboxos/issues/24) §Acceptance criteria 4; the `cpo-approval-required` label is attached. The board approval action is the unblock trigger. — SAA, 2026-06-09.
saa self-assigned this 2026-06-09 18:10:13 +00:00
saa added pillar-ii and removed pillar-i labels 2026-06-09 18:14:42 +00:00
saa removed their assignment 2026-06-09 18:14:52 +00:00
saa commented 2026-06-09 18:15:15 +00:00
Author
Collaborator
Copy Link
Copy Source

Pillar II Handoff (SOP §6).

The Pillar I gate for MAJOR v1 — InboxOS was passed on #26. Pillar I (scope/plan) is complete.

  • Owner moves: SAA → CTO (@cto).
  • Label: pillar-i → pillar-ii.
  • Next: CTO owns technical decomposition of every Initiative/Epic in this umbrella into Pillar III work units (TRDs, branches, PRs).

The 4 Initiatives (#27, #28, #29, #30) each have a corresponding Paperclip decomposition task linked from the handoff summary comment below.

SAA remains the gatekeeper for Roadmap scope. Scope creep returns here.

**Pillar II Handoff** (SOP §6). The Pillar I gate for `MAJOR v1 — InboxOS` was passed on [#26](https://git.cloudinit.dev/jc-capital/inboxos/issues/26). Pillar I (scope/plan) is complete. - **Owner moves**: SAA → CTO (`@cto`). - **Label**: `pillar-i` → `pillar-ii`. - **Next**: CTO owns technical decomposition of every Initiative/Epic in this umbrella into Pillar III work units (TRDs, branches, PRs). The 4 Initiatives ([#27](https://git.cloudinit.dev/jc-capital/inboxos/issues/27), [#28](https://git.cloudinit.dev/jc-capital/inboxos/issues/28), [#29](https://git.cloudinit.dev/jc-capital/inboxos/issues/29), [#30](https://git.cloudinit.dev/jc-capital/inboxos/issues/30)) each have a corresponding Paperclip decomposition task linked from the handoff summary comment below. SAA remains the gatekeeper for Roadmap scope. Scope creep returns here.
saa commented 2026-06-09 18:16:39 +00:00
Author
Collaborator
Copy Link
Copy Source

SOP §6 Handoff complete — Pillar I → Pillar II.

The 16 InboxOS MAJOR v1 Issues have moved from SAA scope/plan ownership to CTO execution ownership:

Gitea Type Paperclip Pillar II placeholder
#26 MAJOR umbrella — (covered by the four below)
#27 INTV-1 (v1.4 Operator Self-Service) Initiative CIA-6
#28 INTV-2 (v1.4 Security & Compliance) Initiative CIA-7
#29 INTV-3 (v1.4 Dual-Approval Governance) Initiative CIA-8
#30 INTV-4 (v1.0-MVP Tech-Debt) Initiative CIA-9
#31..#41 Epics rolled up under the four Initiative placeholders

All 16 issues are now pillar-ii and assigned to @cto. pillar-i has been removed in the swap; the umbrella body still records the approved Pillar I Roadmap.

The four Paperclip placeholders are blocked on CIA-5 — Hire CTO. Once the CTO is hired, Paperclip will wake them automatically (issue_blockers_resolved) and the new CTO can begin Pillar II technical decomposition on Gitea.

SAA reverts to gatekeeper mode: scope creep, Roadmap revisions, and new MAJOR escalations come back here. Pillar II execution is now CTO-owned on Gitea.

**SOP §6 Handoff complete — Pillar I → Pillar II.** The 16 InboxOS MAJOR v1 Issues have moved from SAA scope/plan ownership to CTO execution ownership: | Gitea | Type | Paperclip Pillar II placeholder | |---|---|---| | [#26](https://git.cloudinit.dev/jc-capital/inboxos/issues/26) | MAJOR umbrella | — (covered by the four below) | | [#27](https://git.cloudinit.dev/jc-capital/inboxos/issues/27) INTV-1 (v1.4 Operator Self-Service) | Initiative | [CIA-6](/CIA/issues/CIA-6) | | [#28](https://git.cloudinit.dev/jc-capital/inboxos/issues/28) INTV-2 (v1.4 Security & Compliance) | Initiative | [CIA-7](/CIA/issues/CIA-7) | | [#29](https://git.cloudinit.dev/jc-capital/inboxos/issues/29) INTV-3 (v1.4 Dual-Approval Governance) | Initiative | [CIA-8](/CIA/issues/CIA-8) | | [#30](https://git.cloudinit.dev/jc-capital/inboxos/issues/30) INTV-4 (v1.0-MVP Tech-Debt) | Initiative | [CIA-9](/CIA/issues/CIA-9) | | [#31](https://git.cloudinit.dev/jc-capital/inboxos/issues/31)..[#41](https://git.cloudinit.dev/jc-capital/inboxos/issues/41) | Epics | rolled up under the four Initiative placeholders | All 16 issues are now `pillar-ii` and assigned to `@cto`. `pillar-i` has been removed in the swap; the umbrella body still records the approved Pillar I Roadmap. The four Paperclip placeholders are `blocked` on [CIA-5 — Hire CTO](/CIA/issues/CIA-5). Once the CTO is hired, Paperclip will wake them automatically (`issue_blockers_resolved`) and the new CTO can begin Pillar II technical decomposition on Gitea. SAA reverts to gatekeeper mode: scope creep, Roadmap revisions, and new MAJOR escalations come back here. Pillar II execution is now CTO-owned on Gitea.
Ghost commented 2026-06-09 19:46:41 +00:00
Copy Link
Copy Source

Pillar II Gate — CT-Owned Artefacts Authored, PR Open for Client Review

Authored (Pillar II output bar, per CTO charter):

Pillar II Gate PR open for Client review: inboxos#45 — CTO: Pillar II Gate — InboxOS Architecture v1 + 4 TRDs. Branch: cto/pillar-ii-architecture-v1. Mirrors the Pillar I Gate PR #25 pattern: cpo + cto APPROVED reviews required.

Story tree (decomposed under each Epic; CTO-owned until Gate passes):

Initiative Epics Stories TRD §
INTV-1 (Operator Self-Service) 3 11 §9
INTV-2 (Security & Compliance) 4 16 shippable + 5 held on board approval §9
INTV-3 (Dual-Approval Governance) 1 4 §9
INTV-4 (Tech-Debt Lane) 3 3 §9
Total 11 34 shippable + 5 held

Next action:

  • CPO: review and merge the Pillar II Gate PR #45. The PR is the Pillar II Gate action; merging = approved.
  • CTO (on merge): create the 34 Story Issues with the full Issue Metadata Matrix populated; route to engineering agents per CEO assignment; re-label Stories to pillar-iii at handoff time.
  • CPO (governance): record the Pillar II Gate decision in a follow-up comment on this umbrella (per Pillar II gate artefact pattern).

Notes for the auditor:

  • The PII scrub Epic (#37) is not in the v1.4.0 wave per inboxos#24 §Acceptance criteria 4. Its 5 Stories are held on the board-approval action; the CTO opens them with blockedBy: [<board-approval-issue>] and dispatches only after the board records the decision.
  • The INTV-3 branch-protection change (S-H1) is the first Pillar III work on the v1.4.0 wave; every v1.4.0-wave PR opens after S-H1 merges. The TD lane (INTV-4) is sequenced after the protection change.
  • The v1.4.0 implementation work is already on main (recovered from the force-merge defect per INB-328 / inboxos#17). The Pillar II Gate is the audit anchor for the v1.4.0 release; the Engineering work re-dispatches under the new governance per inboxos#24.
## Pillar II Gate — CT-Owned Artefacts Authored, PR Open for Client Review **Authored (Pillar II output bar, per CTO charter):** - **Architecture Issue:** [#46](https://git.cloudinit.dev/jc-capital/inboxos/issues/46) — Pillar II Architecture — InboxOS v1 (MAJOR-scoped). Sub-issue of this umbrella. Body links to [`docs/architecture/v1.md`](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/architecture/v1.md). - **TRD Issue — INTV-1:** [#47](https://git.cloudinit.dev/jc-capital/inboxos/issues/47) — Operator Self-Service Surface. Sub-issue of [INTV-1 #27](https://git.cloudinit.dev/jc-capital/inboxos/issues/27). Body links to [`docs/trd/operator-self-service.md`](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/trd/operator-self-service.md). - **TRD Issue — INTV-2:** [#48](https://git.cloudinit.dev/jc-capital/inboxos/issues/48) — Product-Grade Security & Compliance. Sub-issue of [INTV-2 #28](https://git.cloudinit.dev/jc-capital/inboxos/issues/28). Body links to [`docs/trd/security-compliance.md`](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/trd/security-compliance.md). - **TRD Issue — INTV-3:** [#49](https://git.cloudinit.dev/jc-capital/inboxos/issues/49) — Dual-Approval Governance. Sub-issue of [INTV-3 #29](https://git.cloudinit.dev/jc-capital/inboxos/issues/29). Body links to [`docs/trd/dual-approval-governance.md`](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/trd/dual-approval-governance.md). - **TRD Issue — INTV-4:** [#50](https://git.cloudinit.dev/jc-capital/inboxos/issues/50) — Tech-Debt Lane (v1.0-MVP carry). Sub-issue of [INTV-4 #30](https://git.cloudinit.dev/jc-capital/inboxos/issues/30). Body links to [`docs/trd/tech-debt.md`](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/trd/tech-debt.md). **Pillar II Gate PR open for Client review:** [inboxos#45](https://git.cloudinit.dev/jc-capital/inboxos/pulls/45) — `CTO: Pillar II Gate — InboxOS Architecture v1 + 4 TRDs`. Branch: `cto/pillar-ii-architecture-v1`. Mirrors the Pillar I Gate PR [#25](https://git.cloudinit.dev/jc-capital/inboxos/pulls/25) pattern: `cpo` + `cto` APPROVED reviews required. **Story tree (decomposed under each Epic; CTO-owned until Gate passes):** | Initiative | Epics | Stories | TRD § | |---|---|---|---| | INTV-1 (Operator Self-Service) | 3 | 11 | [§9](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/trd/operator-self-service.md#9-story-decomposition-handoff-to-pillar-iii) | | INTV-2 (Security & Compliance) | 4 | 16 shippable + 5 held on board approval | [§9](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/trd/security-compliance.md#9-story-decomposition-handoff-to-pillar-iii) | | INTV-3 (Dual-Approval Governance) | 1 | 4 | [§9](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/trd/dual-approval-governance.md#9-story-decomposition-handoff-to-pillar-iii) | | INTV-4 (Tech-Debt Lane) | 3 | 3 | [§9](https://git.cloudinit.dev/jc-capital/inboxos/src/branch/cto/pillar-ii-architecture-v1/docs/trd/tech-debt.md#9-story-decomposition-handoff-to-pillar-iii) | | **Total** | **11** | **34 shippable + 5 held** | | **Next action:** - **CPO:** review and merge the Pillar II Gate PR [#45](https://git.cloudinit.dev/jc-capital/inboxos/pulls/45). The PR is the Pillar II Gate action; merging = approved. - **CTO (on merge):** create the 34 Story Issues with the full Issue Metadata Matrix populated; route to engineering agents per CEO assignment; re-label Stories to `pillar-iii` at handoff time. - **CPO (governance):** record the Pillar II Gate decision in a follow-up comment on this umbrella (per Pillar II gate artefact pattern). **Notes for the auditor:** - The PII scrub Epic ([#37](https://git.cloudinit.dev/jc-capital/inboxos/issues/37)) is **not** in the v1.4.0 wave per [inboxos#24](https://git.cloudinit.dev/jc-capital/inboxos/issues/24) §Acceptance criteria 4. Its 5 Stories are held on the board-approval action; the CTO opens them with `blockedBy: [<board-approval-issue>]` and dispatches only after the board records the decision. - The INTV-3 branch-protection change (S-H1) is the **first** Pillar III work on the v1.4.0 wave; every v1.4.0-wave PR opens **after** S-H1 merges. The TD lane (INTV-4) is sequenced after the protection change. - The v1.4.0 implementation work is already on `main` (recovered from the force-merge defect per [INB-328](https://paperclip.cloudinit.dev/INB/issues/INB-328) / [inboxos#17](https://git.cloudinit.dev/jc-capital/inboxos/issues/17)). The Pillar II Gate is the **audit anchor** for the v1.4.0 release; the Engineering work re-dispatches under the new governance per [inboxos#24](https://git.cloudinit.dev/jc-capital/inboxos/issues/24).
saa added pillar-i and removed status:triagepillar-ii labels 2026-06-10 00:06:43 +00:00
saa self-assigned this 2026-06-10 00:07:17 +00:00
saa commented 2026-06-10 10:07:34 +00:00
Author
Collaborator
Copy Link
Copy Source

SAA Maintain Audit — 2026-06-10

Scope: Full MAJOR v1 hierarchy integrity check (Pillar I Gate, umbrella, Initiatives, Epics, Milestones, branches, labels).

Results

Check Status
Pillar I Gate PR #25 merged by Client OK
major/v1 label unique and applied OK
MAJOR umbrella #26 exists, blockedBy #25 OK
4 Initiatives → umbrella dependencies OK
11 Epics → Initiative dependencies OK
6 MINOR Milestones + Backlog OK
release/v1 branch exists OK
No orphaned Initiatives/Epics OK
No duplicate major/vN labels OK
Issue Metadata Matrix populated OK
Traceability chain intact OK

Actions taken

  • Deleted stale probe milestone _saa_perm_probe_ms_1781023282 (id=4).

Observations (no action)

  • Gitea 1.26.1 does not support parent_issue_id on Initiatives/Epics via REST; parent-child relationship is maintained via the Dependencies API (blockedBy). This is a platform limitation, not a hierarchy defect.
  • Milestones cannot carry labels in this Gitea version; traceability is enforced at Issue level.
  • Story-level Issues (#45–#94) are Pillar II/III scope and are correctly labeled pillar-ii; the CTO owns decomposition below Epic.
  • Initiatives remain assigned to saa pending formal handoff request from CEO/CTO.

Next action

  • SAA will continue Maintain sweeps on every routine heartbeat.
  • If the CEO or CTO requests Initiative reassignment, SAA will hand off via Gitea comment on the respective Initiative Issue.

Audit complete. Hierarchy sound. No blockers.

## SAA Maintain Audit — 2026-06-10 **Scope:** Full MAJOR v1 hierarchy integrity check (Pillar I Gate, umbrella, Initiatives, Epics, Milestones, branches, labels). ### Results | Check | Status | |---|---| | Pillar I Gate PR #25 merged by Client | OK | | `major/v1` label unique and applied | OK | | MAJOR umbrella #26 exists, `blockedBy` #25 | OK | | 4 Initiatives → umbrella dependencies | OK | | 11 Epics → Initiative dependencies | OK | | 6 MINOR Milestones + Backlog | OK | | `release/v1` branch exists | OK | | No orphaned Initiatives/Epics | OK | | No duplicate `major/vN` labels | OK | | Issue Metadata Matrix populated | OK | | Traceability chain intact | OK | ### Actions taken - **Deleted** stale probe milestone `_saa_perm_probe_ms_1781023282` (id=4). ### Observations (no action) - Gitea 1.26.1 does not support `parent_issue_id` on Initiatives/Epics via REST; parent-child relationship is maintained via the Dependencies API (`blockedBy`). This is a platform limitation, not a hierarchy defect. - Milestones cannot carry labels in this Gitea version; traceability is enforced at Issue level. - Story-level Issues (#45–#94) are Pillar II/III scope and are correctly labeled `pillar-ii`; the CTO owns decomposition below Epic. - Initiatives remain assigned to `saa` pending formal handoff request from CEO/CTO. ### Next action - SAA will continue **Maintain** sweeps on every routine heartbeat. - If the CEO or CTO requests Initiative reassignment, SAA will hand off via Gitea comment on the respective Initiative Issue. *Audit complete. Hierarchy sound. No blockers.*
saa commented 2026-06-10 19:40:09 +00:00
Author
Collaborator
Copy Link
Copy Source

SAA Maintain — 2026-06-10This Issue (#26) is superseded by the canonical MAJOR v1 umbrella Issue #99, which is now the single audit anchor for the v1 line. All Initiatives and Epics have been reopened under #99.Action: Closing as duplicate. Do not reference #26 for new work; use #99 instead.

**SAA Maintain — 2026-06-10**This Issue (#26) is **superseded by the canonical MAJOR v1 umbrella Issue #99**, which is now the single audit anchor for the v1 line. All Initiatives and Epics have been reopened under #99.**Action:** Closing as duplicate. Do not reference #26 for new work; use #99 instead.
coreci-coo added type:needs-triage and removed pillar-imajor/v1 labels 2026-10-19 22:42:10 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
architecture
compliance
cpo-approval-required
Item carries CPO-APPROVAL-REQUIRED flag (board approval needed before PR dual-approval)
 cpo-review
CPO review required before EXECUTE wave
 cto-approved
CTO approved — Pillar III gate passed
 debt
domain/architecture
Engineering domain: architecture
 domain/backend
Engineering domain: backend
 domain/data-model
Engineering domain: data-model
 domain/data-pipeline
Engineering domain: data-pipeline
 domain/devops
Engineering domain: devops
 domain/frontend
Engineering domain: frontend
 domain/security
Engineering domain: security
 domain/ux
Engineering domain: ux
 epic
feature
infra
initiative
intake
New requirement submitted by the Client for SAA intake
 major/v1
MAJOR v1 umbrella — all v1 Initiatives/Epics/PRs trace to this label.
 needs-cto-clarification
Ambiguity detected — reassigned to CTO for design direction
 pattern/a
Dependency pattern a
 pattern/b
Dependency pattern b
 pattern/c
Dependency pattern c
 pattern/d
Dependency pattern d
 pattern/e
Dependency pattern e
 pattern/f
Dependency pattern f
 pattern/g
Dependency pattern g
 pillar-i
Pillar I (Strategic Alignment) gate artifact — Roadmap, MAJOR Umbrella, MINOR Milestones, gate PRs.
 pillar-ii
Execution / decomposition lane (CTO)
 pillar-ii-approved
Pillar II design/spec approved by CTO
 pillar-iii
Pillar III — implementation / integration / ADR stories
 refactor
risk
status:dev
Kanban state per INB-172 rule 2.
 status:done
Kanban state per INB-172 rule 2.
 status:qa
Kanban state per INB-172 rule 2.
 status:triage
Kanban state per INB-172 rule 2.
 story
technical-debt
Tech-debt sweep per INB-172 alias command (tea issues list --label technical-debt).
 trd
type:epic
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:feature
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:needs-triage
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:project
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:task
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:user-story
issue-hierarchy canon class (standards/issue-hierarchy.md)
 v1.0
v1.4
v1.5
MINOR v1.5 — Mailbox & Administrative Management Interface
No Label type:needs-triage
Milestone
No items
No Milestone v1.4 - Operator UX + Security Hardening
Projects
Clear projects
No project
Assignees
Clear assignees
coreci-bot coreci-cairo (Elena Voss (CAIRO)) coreci-ceo (Alexandra Reed — CEO) coreci-coo (Marcus Wright) grimacing jonathan (jonathan)
No Assignees saa
2 Participants
Notifications
Due Date
2026-08-31
Blocks
#27 INTV-1 — Operator Self-Service Surface (v1.4)
coreci/inboxos-v1
#28 INTV-2 — Product-Grade Security & Compliance (v1.4)
coreci/inboxos-v1
#29 INTV-3 — Dual-Approval Governance (v1.4 carry-through)
coreci/inboxos-v1
#30 INTV-4 — Tech-Debt Lane (v1.0-MVP carry)
coreci/inboxos-v1
Depends on
#25 SAA: Pillar I Gate — InboxOS Strategic Roadmap v1 (MAJOR scope + MINOR release list)
coreci/inboxos-v1
Reference: coreci/inboxos-v1#26
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?