[Ahmustufa]

Adds ROADMAP.md, and stops keeping the schedule in two places.

Why a separate file

The parity plan has been doing two jobs — backlog and schedule — and it drifted far enough that five shipped features still read as outstanding, nearly sending work to rebuild the webhooks UI, the scheduled-job ledger and the storage seam.

So the split is explicit: the parity plan stays the backlog (what is missing), ROADMAP.md is the schedule (what we are doing next and why), and the roadmap states at the top that it is reconciled against the tree rather than against its own previous contents. The parity plan's "immediate list" is marked spent — all four items in it have shipped — and now points here.

What it records that was otherwise only in PR descriptions

Three things that would have been lost:

The merge order for the open stack. #245 consumes an API that only exists in #248. Merging it first breaks the build. That is currently knowable only by reading two PR comments.

The question P1.3 must answer in its schema. Nothing in this repo ever deletes from suppression. The verification row carries an expiry; the suppression it writes does not. So an address suppressed because its domain was briefly NXDOMAIN is suppressed permanently, and the only evidence expires. Either a sweep re-verifies expired invalid verdicts, or undeliverable suppressions carry their own expiry — but it has to be decided in the schema, not deferred.

Two standing environmental hazards, both of which cost real debugging time this cycle: DB↔host clock skew (measured between −1711 ms and −37 ms on one machine in a day) failing clock-sensitive tests on any branch including main; and the golangci-lint action cache reporting findings in files a branch never touched, including paths that no longer exist.

QA as a Petri agent

Sets out the intent rather than a design.

The existing QA agent executes 135 Go integration files, 9 Playwright specs and the Vitest suite — it verifies what we thought to assert, and structurally cannot find what nobody thought to assert. Every significant bug found this cycle was in that second category:

• a wrapper that compiled, started, and silently registered no handlers
• two errors.New values meaning an errors.Is check had never once been true in production
• a localized junk folder making warmup report a clean inbox rate for a mailbox going to spam
• a connect test and a sender that disagreed about the same mailbox — test green, every send failing

A judge rubric aimed at "did the system report success while doing nothing", "did two paths disagree about the same object" and "did a failure surface anywhere a user could see it" would have caught all four.

Inroad suits this unusually well because it already exposes a typed agent surface (internal/app/mcpserver with a documented tool reference), so an auditor can drive the product through its own MCP tools rather than a browser.

Sequenced as a spike first — stand it up against the MCP surface with a handful of seeds and find out whether the transcripts are judgeable. Output is an answer, not infrastructure. Petri's current API, its judge configuration, and whether it drives a non-model target cleanly are all explicitly marked unverified and need checking upstream before any of it is scheduled.

Also

README.md's docs table links the roadmap, so it isn't orphaned. The relative link from the parity plan was checked and resolves. No docs-site content changed — the roadmap is a repo-root file, not a Starlight page.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VECELVAKe8Xcp7GH9wGR5t

[Ahmustufa]

Closing — not the right call. The roadmap content isn't lost; it's in the PR history if any of it is wanted later.