# GrantFlow Backlog

Product and engineering items not yet scheduled. Last updated: 2026-05-19 (v2.3.3).

---

## P1 — Needed before enterprise pilot

### ~~BL-01 · Billing / usage metering~~ — DECIDED (out-of-scope for v2.x)
- **Decision (2026-05-19):** Hard-block enforcement is already implemented via `GRANTFLOW_TENANT_QUOTA_HARD_BLOCK=true` (see BL-04). A billing engine is out-of-scope for v2.x.
- **Integration point for operators:** `GET /tenants/{tenant_id}/usage` returns `jobs_today`, `ingest_today`, `chunks_ingested_today`, quota limits, and `quota_remaining`. Poll this endpoint from your gateway or billing system on any cadence you need. No custom metering code required inside GrantFlow.
- **What to tell enterprise pilots:** Quota hard-blocks are available today. For invoice-ready metering, connect your billing system to the `/usage` endpoint or add a metering sidecar at the gateway.

### ~~BL-02 · Production OAuth guide~~ — DONE
- `docs/deployment/oauth-gateway.md` added. Covers Auth0, Okta, Keycloak with Nginx and Kong examples.

---

## P2 — Operational hardening

### ~~BL-03 · Cross-replica credential revocation~~ — DONE
- `docs/deployment/credential-revocation.md` added. Covers Redis-backed cross-replica enforcement (already wired), Nginx auth_request sidecar pattern, and Kong plugin example.

### ~~BL-04 · Hard quota enforcement flag~~ — DONE
- `GRANTFLOW_TENANT_QUOTA_HARD_BLOCK=true` enforced in `POST /generate` and `POST /ingest*`. 429 `tenant_quota_exceeded` on breach.

### ~~BL-05 · Coverage threshold tightening~~ — DONE
- Baseline measured 2026-05-14: 92% (809 tests). CI now enforces `--cov-fail-under=85`. `pytest-cov==6.1.0` added to dev deps.

---

## P3 — Future product

### BL-06 · In-app RBAC
- **What:** Auth is API-key scoped (`generate:write`, `status:read`, etc.) but there is no per-user, per-object, or role-based access control inside the app.
- **Gap:** Multi-user teams cannot have different permissions on the same tenant.
- **Decision needed:** Implement in-app or defer to gateway/IAM layer permanently. Currently documented as future work (`docs/enterprise-access-layer.md:160`).

### ~~BL-07 · New donor strategies~~ — DONE
- **Added:** FCDO (logframe, VfM 4Es, safeguarding, OECD DAC), AFD (cadre logique, climate/gender markers, French expertise), JICA (PCM/PDM, Important Assumptions, ODA rationale, tech transfer), ADB (DMF, Strategy 2030 OPs, climate finance, gender equity category).
- RAG namespaces pre-registered in catalog: `fcdo_guidance`, `afd_guidance`, `jica_guidance`, `adb_guidance`.
- Full strategy class, Pydantic ToC + MEL schemas, and role-specific system prompts for each.

### ~~BL-08 · UI for HITL review~~ — DONE
- `GET /ui/hitl`: zero-dependency vanilla HTML page served from FastAPI. Lists pending checkpoints, approve/reject with feedback, resume button. No npm, no paid services.

### ~~BL-09 · Persistent job store~~ — DONE
- `RedisJobStore` added to `core/stores.py`. Activate with `GRANTFLOW_JOB_STORE=redis`.
- Falls back to in-process dict if Redis is unavailable. 90-day TTL.

---

## Done / Out of scope

| Item | Status |
|---|---|
| Structured agent error contract (100%) | Done v2.3.x |
| Conformance smoke 7/7 | Done v2.3.3 |
| Redis-backed idempotency | Done v2.2.0 |
| Redis-backed rate limiting | Done v2.2.0 |
| Self-serve OAuth (in-app) | Done v2.2.0 |
| Webhook delivery + signature verification | Done v2.0.1 |
| HITL checkpoints (graph-level) | Done v2.0.1 |
| Multi-format export (docx/xlsx/json/zip) | Done v2.0.1 |
| Grounding gate (off/warn/strict) | Done v2.0.1 |
| Tenant provisioning + usage metering | Done v2.2.0 |
| Chatbot UI | Out of scope |
| Donor portal submission bot | Out of scope |
| Marketplace / generic agent platform | Out of scope |
