Skip to content

Public Roadmap

What we've discussed building, in priority order. Items move to changelog.md as they ship.

Last updated: 2026-05-18

🎯 Active: 18-Month Moat Build Plan (Phase A — months 0–3)

Approved 2026-05-18, this is the canonical product roadmap. AuditForge's defensibility flywheel: cryptographic engagement identity, tamper-evident audit logs, signed deliverables, cross-engagement findings library, regulator-export archive, end-client portal. The plan is organized around 14 specific moats and is sequenced so the compounding moats (cross-firm data, methodology versioning) start at engagement #1.

🚧 In progress — Phase A (months 0–3)

  • Methodology versioning + tamper-evident chain of custody + regulator-export archive (moat 12) — ✅ PHASE A DEFENSIBILITY CLUSTER COMPLETE 2026-05-18: methodology snapshot + hash-chained audit log + per-firm Ed25519 signing + signed deliverables + signed regulator-export archive. A buyer asking "prove this audit was authentic" gets one tarball, one verifier, and cryptographic guarantees. Three independent verification levels (archive manifest, deliverable provenance, audit-log hash chain) provide defense in depth.
  • Regulator-export endpoint — ✅ GET /auditforge/engagement/{id}/regulator-archive returns the signed tar.gz directly. Partner-or-admin only.
  • Source-system connector consumer wire-up in AuditForge (moat 14) — ✅ PHASE A COMPLETE 2026-05-18. Backend wiring shipped: connectors.py engagement-aware orchestration + /oauth/callback/{provider} router + per-engagement refresh-token isolation in SSM + token-provider closure with invalid_grant handling + 2 new endpoints. Production deployment unblocked by the operator OAuth-app-setup runbook (user-side Azure AD + Google Cloud + SSM provisioning). Frontend ConnectorTab.tsx is the remaining piece for UX completeness; the backend is end-to-end-testable today against mocked OAuth.
  • Cross-firm anonymized findings library schema (moat 11) — ✅ shipped 2026-05-18. AnonymizedFinding schema + CrossFirmLibraryStore + deterministic anonymize_finding() + runner-wired contribute_engagement() at run completion. Default opt-out; founding-firm Tier C contract opts in. Pool runs from engagement #1 so the data is there when Phase C productizes the aggregation surface.
  • Regulator-export archive (moat 12) — signed tarball per engagement bundling audit log, methodology snapshot, methodology paper bytes, all deliverable formats, firm public key.
  • AICPA Auditing Standards Board exposure-draft submission (moats 1, 5) — external-clock work, starts Phase A so 12-month review cycle isn't wasted.
  • Founding-Firm Tier C contract finalization + 2 firms signed (moat 9) — co-delivery-agreement-template.md finalized; outreach to 8 candidate firms.
  • Defensive publication round 1 (moat 7) — IP.com submission foreclosing competitor patents on the methodology-snapshot + hash-chain + signing system; pairs with trade-secret discipline on implementation specifics.

🚧 Phase B (months 3–6): Workflow ownership

  • ✅ B.1 Partner signoff attestation (moat 13) — shipped 2026-05-18. Partner re-authenticates + firm's Ed25519 key signs a canonical attestation payload binding engagement, deliverable, partner user ID, timestamp, nonce, and audit-log terminal hash. End-clients verify offline. 6 tamper-detection categories caught; cross-engagement replay rejected.
  • ✅ B.2 End-client identity (moat 6 partial) — shipped 2026-05-18. Engagement.client_name promoted from free-text to first-class identity (EndClient dataclass + store). Co-branded deliverable covers (firm logo + end-client logo). Longitudinal engagement linkage. Foundational for Phase C.1 end-client portal authentication.
  • ✅ B.3 Methodology learning-loop telemetry (moat 8 deepening) — shipped 2026-05-18. Per-firm accept/reject signal aggregated by primitive / archetype / severity / framework / engagement. Endpoint GET /auditforge/firm/{id}/methodology-telemetry returns the full report. Critically: NOT automated tuning — partner-in-the-loop refinements preserve methodology authorship (the moat) and avoid cross-firm bias propagation.

Phase B engineering COMPLETE. Phase B content (B.4 journal submissions, B.5 conference CFPs, B.6 defensive publication round 2) remains as user-driven external-clock work. - B.4 Peer-reviewed journal submissions to The CPA Journal + Audit: A Journal of Practice & Theory (moats 1, 5) — pending - B.5 Conference circuit CFPs (moats 4, 5) — pending - B.6 Defensive publication round 2 (moat 7) — pending

⏳ Phase C (months 6–12): Outward push

End-client portal (moat 6 — the two-sided network surface), cross-firm library productization (moat 11), insurance carrier positioning to AIG / Travelers / Aon / CAMICO (moat 2), anti-Big-4 sales deck (moat 3), NASBA-accredited CPE course on provenance-anchored audit (moats 1, 5), state-CPA-society strategic alliance — PICPA / NYSSCPA / TXSCPA endorsement programs (moat 10).

⏳ Phase D (months 12–18): Compounding & category leadership

Engagement-archive externalization with end-client countersigning (moat 12), methodology v2.0 release proving the versioning architecture (moat 8), connector-driven auto-ingest (moat 14 matures), AICPA committee participation (moat 4), 5 published case studies + 3 conference talks delivered (moat 4), SOC 2 Type 1 audit kickoff (deferred to month 15+ unless a deal forces it earlier).

Success criteria at month 18 (3 of 6 failure invalidates the moat thesis)

  1. 5+ moats actively compounding (cross-firm library running, methodology versioning live, signing infrastructure operational, founding-firm Tier C in production, state-society endorsement active)
  2. Written acknowledgment from AICPA committee OR insurance carrier OR state CPA society
  3. ≥10 completed engagements with full signed archive + partner signoff + tamper-evident audit log
  4. End-client portal deployed with 1+ active end-client login
  5. Category-leadership signal: 5 case studies / 2 journal papers / 3 conference talks / 1 CPE course / 2 defensive publications
  6. Trade-secret + open-methodology IP posture intact

⏳ Next up (weeks)

  • Edge-case PDF coverage — text-heavy NIST docs work cleanly. Still need validation against scanned (OCR-only) PDFs, password-protected docs, and embedded-font edge cases. Promote when a real customer corpus surfaces one of these.

📋 Considered (months)

These have been discussed but aren't actively in flight. Customer signal moves them forward.

Item Status Notes
Classification override UI Considered Partners can override doc-type/jurisdiction classifications pre-ingest. full_rebuild does internal classification today; real corpora will tell us if it bites
True resumable multipart uploads Considered Per-file granularity is the pragmatic substitute today; a 50MB-PDF mid-upload drop requires re-uploading that file. Worth fixing if real corpora include many large files
Per-engagement bucket for indexes Considered Source documents already isolated; index files (FAISS, BM25) still live in the shared bucket. Hardening pass when a customer asks
SAML / SSO via Auth0 or Cognito Considered At $1,000–2,000 per engagement pricing, mid-market firms don't demand it. Promote if Big-4 conversations materialize
WebAuthn / FIDO2 Considered Would replace TOTP for hardware-key-based auth. Lower priority than SSO
Audit-tech integrations (CCH, Caseware, Thomson Reuters) Considered JSON export is the current integration surface. Top-100 firms will eventually demand this
Saved searches + webhook notifications Considered "Notify me when a finding matches X" workflow. Blocked on SES sandbox + Resend integration
Cross-region S3 replication Considered Single-region us-east-1 today; deploy when first 10 paying customers or one contractual requirement
Custom audit primitives Considered Firms define domain-specific check patterns. Significant scope; defer until volume justifies
Cost analytics dashboard Considered Per-firm spend, archetype averages, projected per-engagement cost. Helpful for partner pricing conversations
SCIM provisioning Considered Manual user-create only today. Promote with SSO
SIEM forwarding Considered CloudWatch logs only today. Worth wiring when a partner asks
API documentation (OpenAPI/Swagger) published Considered FastAPI auto-generates one; publishing is a few hours of polish
Status page (statuspage.io free tier) Considered Half-day of work; defer until first customer impact
Reference customer + case study Critical Highest-impact non-engineering item — one real co-delivery engagement closes case-study, real-corpus-cost-data, and real-PDF-stress-test gaps simultaneously
SOC 2 Type 1 audit Critical, deferred Substantive controls in place; auditor-signed report not started. ~3 months, $15–30K. Defer to month 6+ at current pricing
Penetration test Critical, deferred Table stakes for procurement-heavy enterprise. ~$8–15K. Same timing as SOC 2
Cyber liability insurance Critical, admin $2–5K/yr. Limits cumulative exposure across engagements
DPAs signed with Anthropic + OpenAI Critical, admin Both vendors offer ready-to-sign DPAs. ~1 week of admin work, $0

✅ Recently shipped

See changelog.md for the full history. Recent highlights:

  • In-product guided walkthrough (Phase 29) — 2026-05-11
  • Auto-launching interactive tour built with react-joyride
  • 21 steps covering the complete audit workflow
  • Restartable via "Take tour" header button — demo-ready
  • Admin-token rotation + per-token rate limits — 2026-05-11
  • Closed admin-token leak (was published in user-manual.md)
  • Daily rate limits on run, investigate_further, recompute, intake_extract endpoints
  • Hygiene pass — 2026-05-11
  • Signed-URL S3 lifecycle rule (auto-expire exports after 30 days)
  • 15 pre-flag engagements migrated to per-engagement isolated buckets
  • Real-PDF stress test (2 NIST docs, 2.6 MB) ingested in ~50 seconds
  • Multi-reviewer collaboration + budget cap UX (Phase 28) — 2026-05-10
  • Self-serve corpus onboarding (Phase 25–27) — 2026-05-10
  • Per-engagement bucket isolation default-on — 2026-05-10
  • Audit log signed URL (Phase 24) — 2026-05-09
  • Engagement template library (Phase 23) — 2026-05-09
  • Cluster diff over time (Phase 22) — 2026-05-09
  • Engagement archive (Phase 21) — 2026-05-08
  • Engagement freeze on deliver (Phase 20) — 2026-05-08

How this list is maintained

This roadmap is curated rather than mechanically generated. When a feature is discussed with a customer or in an internal review, it lands here as "Considered." When work starts, it moves to "In progress." When it ships, the entry moves to changelog.md with the ship date and a one-paragraph summary.

Items are removed only when explicitly de-scoped (rare). The default disposition is to keep them visible so customers can see what's been weighed.

Contact: chris@base2ml.com to suggest priorities or signal a customer need.