vault

10 — Roadmap

docs/10-Roadmap.mdtype: roadmapupdated: 2026-08-09

Roadmap

Phased plan from PM seat. Dates are targets, not commitments — every phase is gated by the 09-Open Questions that block it.

Phase	Window	Theme	Gate
MVP	done (2026-05)	Mocked end-to-end product	✅ shipped
Beta	Q3 2026	First live providers + first paying merchants	09-Open Questions#Launch market, 09-Open Questions#Custody, 09-Open Questions#KYC vendor
GA	Q1 2027	MiCA-licensed launch, scale-grade infra	09-Open Questions#Tax & regulatory, 09-Open Questions#Multi-region
Scale	2027+	Additional rails, assets, surfaces	revisit at GA

Shipped surfaces (see 03-Domains for status detail):

🟢 Auth — app-local password + TOTP + passkeys + magic link + recovery codes, session revocation, device detection, block flag, admin role, api_keys — all app-owned
🟢 Wallet, Buy, Send, Receive, Sell, Convert
🟢 Invoices (fiat-quoted, per-invoice sub-vault, top-up loop, partial-payment UI)
🟢 Pay-to public links
🟢 Payouts (CSV upload, AML gating, idempotent batches, partial-success handling)
🟢 Admin console (users, transactions, fees, mock email log)
🟢 Fee engine — per-merchant operation rates + global platform_fees knobs (the tier model was retired post-MVP)
🟢 Audit log spine
🟢 Providers behind interfaces (05-External Providers)

Known gaps deferred to Beta — see 08-Risks and Drawbacks.

Delivered on master but never folded back into this roadmap:

✅ pg-boss background queue — 11 queues, dedicated worker; payouts, webhooks, mail, expiry, reconciliation all off the request lifecycle
✅ Durable provider-webhook inbox (provider_webhook_events) and merchant webhook retry via webhook.deliver
✅ Live Fireblocks implementation (LiveFireblocks) behind FIREBLOCKS_MODE=live
✅ Live KYC — Sumsub behind KYC_MODE=live, with review webhook
✅ Live rate oracle — CEX.IO
✅ Live email transport — Resend via EMAIL_PROVIDER
✅ OpenTelemetry tracing wired + Pino/Better Stack logs, browser telemetry, deep health check, worker heartbeat
✅ DB-backed rate limiting (rate_limits) replacing the in-process map
✅ Session revocation list — users.session_version + auth_session_revocation_tokens (was a GA item)
✅ Payee wallet whitelist — Fireblocks external wallets with quorum approval
✅ Balance reconciliation + outbound halt circuit breaker
✅ Notifications — table, SSE stream, /my/notifications
✅ CMS pages + FAQ authoring, /admin/{ledger,invoices,orders,payouts,reconciliation,jobs,logs,history}
✅ Admin log export and invoice CSV export

Goal: first 10 design-partner merchants moving real funds in one jurisdiction.

Live Fireblocks implementation written (LiveFireblocks) — still needs vendor onboarding + a production run
Live Elliptic — AML + sanctions in one product (replaces MockElliptic, keep 24h cache) — critical path, not started
Live KYC vendor — Sumsub (KYC_MODE=live)
Live email transport — Resend (selected with EMAIL_PROVIDER)
Live rate oracle — CEX.IO (09-Open Questions#Oracle)
Live Mercuryo — card acquirer + Buy / Sell on/off-ramp (replaces MockAcquirer) — not started; only the inbound webhook route exists
Live ChainProvider (replaces MockChain) — not started
Live TRES (replaces MockTres) — not started; payload builder exists

Background queue — pg-boss, 11 queues, dedicated worker process
KMS-encrypted secrets at rest — webhook_secret, users.totp_secret, and high-risk PII. 09-Open Questions#Secrets at rest
Persistent rate-limit store — Postgres rate_limits (the platform has no cache tier)
Webhook delivery SLA + dead-letter view (09-Open Questions#Webhook reliability) — delivery is durable; the SLA and review surface are not defined
Audit-log search UI for ops — /admin/logs exists for investigation logs; audit_log itself has no search UI
Perf test for payout 1000 rows (09-Open Questions#Payout perf)
OpenTelemetry tracing wired (observability/better-stack)
Decide the fate of the /v2 UI rewrite — ship, fold in, or delete (08-Risks and Drawbacks#Architecture)

CASP path decided — own MiCA license vs partner with a licensed CASP, plus class (Class 2 / €125k assumed), NCA (member state), and capital plan. Hard deadline: 1 July 2026 for the common transition window across EU member states (09-Open Questions#CASP path, 15-Compliance#MiCA — CASP licensing)
CASP application filed with chosen NCA (or co-CASP contract signed) — gates the legal right to serve EU customers (15-Compliance#Application process)
FATF Travel Rule integration live — vendor/protocol picked, IVMS 101 outbound on Send / Payouts / API-order settle, counterparty-VASP discovery wired (09-Open Questions#Travel Rule integration, 15-Compliance#FATF Travel Rule)
Sanctions screening live — OFAC + EU + UK + UN lists delivered through the live Elliptic integration (combined AML + sanctions product)
Self-hosted wallet attestation UX shipped (09-Open Questions#Self-hosted wallet handling)
TIN + tax-residence collected at signup with country-format validation (15-Compliance#DAC8 / CARF)
DAC8 build path chosen — in-house vs vendor — and aggregation harness running so 2026 activity is captured from day 1 (09-Open Questions#DAC8 build)
Customer DAC8 data-sharing notice in product

Sell payout rail flips pending → completed on real fiat egress (09-Open Questions#Sell payout rail)
Refund/dispute UX for buy (09-Open Questions#Refunds)
In-app dispute ticket flow OR Zendesk (09-Open Questions#Customer dispute resolution)

Goal: open signup in primary jurisdiction with the licensing posture to invite volume.

Goal: growth surfaces once GA is steady-state.

Explicitly not on the roadmap — listed so we don't accidentally drift in:

If these come up, treat them as scope creep — write the trade-off down in 09-Open Questions before committing.