Roadmap

In progress. Parts of these are already in the product; the item stays here until the whole of it has shipped.

• Kill switch, retention, one send pathMailS · days

  The platform and per-mailbox kill switches exist; a retention job and routing every sender through one send function so caps, audit and headers apply everywhere are still open.

• Publish MX, SPF, DKIM, DMARC and PTRMailS · days

  The DNS records that make mail arrive and be trusted. The deliverability card shows the state; publishing the records is operator work.

• Rate limits and daily capsMailS · days

  Per-mailbox hourly and daily caps are in the policy; token buckets on the send endpoint, the relay per account and the chat tool are still to come.

• Malware scanning and content disarm on premiseDocument StoreM · weekssovereignQ4 2026

  An uploaded file is refused outright when its bytes say executable or macro-enabled Office, scanned by a local malware daemon when one is configured, refused rather than accepted unscanned when that daemon cannot answer, and read by the identifier detector so a file carrying a citizen service number is filed under at least the class it demands. Still open: the sandboxed content-disarm rebuild, the quarantine of an infected original, and the same gate on files arriving over file transfer.

• Shared timeline component setObservabilityM · weeksQ4 2026

  Timeline, StatusBadge and IdChip ship in the component suite and the transaction timeline is drawn with them. Still open: Waterfall, DurationChip, TokenChip and ExportMenu, and the other pages that show a transaction moving onto the same components.

• Finish the FSC interop layerFSCL · a quartersovereign

  The cryptography is right and the request path works: mTLS inway and outway, certificate-bound tokens, SHA3-512 grant hashes over RFC 8785 canonical JSON, detached JWS signatures, and a self-test that drives a token end to end and rejects a tampered one. What is wrong is the shape of the front door. The token endpoint takes JSON where the standard requires an OAuth2 client-credentials form naming a grant hash; the peer-facing Manager API is mostly admin CRUD rather than the paths the standard names; the signing keys are not published at the well-known location; and eleven of our fifteen error codes appear nowhere in the standard. See the assessment of 1 October 2026.

• One vault access layer for all four channelsBastionL · a quartersovereignQ4 2026

  The gate is live for every vault, the platform bridge calls it for chat, MCP and agents, and the document store runs the same layer over files: it checks who is asking and why, masks by field class and writes the protocol and lineage rows. Still open: remote vault nodes behind the same layer.

Planned work sized in days or weeks, smallest first.

• Audit reading roomObservabilityS · dayssovereignQ1 2027

  One page for audit exports with days, row counts, verdicts and downloads, lineage verification per day, evidence verification per id, AI Act dossiers per module and attestations. Today all of these are API only.

• Cascade and hub handoff recordObservabilityS · dayssovereignQ4 2026

  When the hub asks for a cascade it passes the transaction ids and gets the run id back, which it writes on the run and the message; when a cascade sends through the hub the message carries the cascade run id. A cascade that consumed a message can be found from the message and the other way round.

• Conformance evidence packRobeeflowS · days

  Run the loopback harness and the interoperability suite and produce the evidence bundle Logius or a partner asks for during connection tests, as a PDF with the envelopes attached.

• Fix the domain identityMailS · days

  Make the server domain, the AI address default and the environment agree, and accept both spellings during the cutover.

• Grafana-compatible metrics endpointObservabilityS · days2027

  Both binaries expose a metrics endpoint in Prometheus text with runs, messages, ack latency, dead letters, AI calls, tokens and cost, spool sizes and dropped log entries, plus a shipped dashboard definition, so a customer's Grafana sees the hub.

• Hub run detail as an interactionObservabilityS · dayssovereignQ4 2026

  The hub run page renders the same waterfall as Interactions, with nodes as steps, AI calls nested, sends and acks as steps, and the message, parent run and children in the header. The flow designer's messages panel uses the same component.

• Masked test data generatorBastionS · days2027

  Synthetic BRP, BAG, KVK and WOZ records that pass elfproef and IBAN checks and keep the structure of real messages, labelled as test in every record and protocol row, so integrators and demos never touch real citizens.

• Observability health pageObservabilityS · daysQ1 2027

  One page for both binaries shows the logging pipeline queue, dropped and failed counts, span write failures, spool sizes, chain heads and last roots, export state, retention state per class, collector delivery and bridge round trip, each with what to do about it.

• Passkeys and device sessionsPlatformS · days

  WebAuthn sign-in with hardware keys for admins, a list of active devices and one-click revoke, next to the existing two-factor flow.

• Saved viewsObservabilityS · daysQ1 2027

  Save filters, columns, sort and time window on any observability table, per user or shared with the team, with a link and a pin to the dashboard home.

• Single status vocabulary and badge setObservabilityS · daysQ4 2026

  One canonical set of states with a mapping table per source and one StatusBadge replaces eight status vocabularies and five badge implementations. Every list endpoint returns the canonical state beside the native one.

• What did the AI do todayObservabilityS · dayssovereignQ1 2027

  The daily digest grows from counts into a narrative with numbers, covering model calls by module and model, cost, active agents, decisions taken and held, hub messages processed with AI, failures, replays, denials and the spool and chain state. It is delivered on the bus and kept as a page with history.

• Academy certification tracksAcademyM · weeks

  Hands-on tracks where the exercises are real Robeeflow flows and Layer 7 policies run in a sandbox tenant, graded automatically.

• Access model for observabilityObservabilityM · weekssovereignQ1 2027

  One role matrix decides who sees spans, lineage, usage, hub logs, message payloads, exports and bundles; payloads are masked by default with the existing masking profiles and a break-glass reveal is protocolled. Collection rules derive from the matrix instead of being set per collection.

• AI bridge for documents that never leaveDocument StoreM · weekssovereign2027

  Ask the local models to summarise a document, extract its metadata and entities, classify it or answer a question over a set of documents with citations to page and hash, always on a local lane and refused by code on a hosted one, with class-based redaction before the prompt.

• AI-assisted field mappingRobeeflowM · weekssovereign

  Given a sample source and a target message definition, the local model proposes the mapping and the operator confirms field by field.

• Approval and release workflows with second approverDocument StoreM · weeks2027

  Require a release step before a document may be shared or sent, with a second approver for bsn and special-category material and for registered deliveries, time-boxed grants and a rejection path with reasons; the approval is itself a signed, chained event.

• Attachment handlingMailM · weeks

  Persist attachments with size and type limits, block executables and macros, scan when a scanner is installed, show them read-only and never feed them to a model.

• Audit exports and evidence bundles for documentsDocument StoreM · weekssovereign2027

  Hand an auditor or a court one self-contained bundle per period, customer, counterparty or case with the documents or their hashes, chain segments, signed and timestamped day roots, protocol rows, delivery receipts, scan verdicts and an offline verifier. Uses the exporter of the audit-chain daily export and the spectre-evidence archive.

• Auditor exports on every viewObservabilityM · weeksQ1 2027

  JSON and CSV on every list and detail view, PDF on every report, one export shape that carries the same ids and hashes the screen shows, and a record of who exported what.

• Both products on one notification busObservabilityM · weeks2027

  Puts the hub's announcements, delivery and certificate alerts and the platform's bell, mail and Discord digest on notification-bus, with both binaries publishing to it and every notification opening the timeline it refers to.

• Certified flow libraryRobeeflowM · weeks

  Tested flows for Digikoppeling ebMS2, WUS, REST-API, Peppol invoicing and SFTP exchange as configuration bundles that install in one click.

• Chunked resumable transfer and Grote Berichten both waysDocument StoreM · weeksQ4 2026

  Uploads and downloads run in hashed chunks that resume after a broken connection and stream to disk, so a 1.5 GB file is normal, and the hub offers Digikoppeling Grote Berichten in pull and push variants with checksum verification before a file counts as received.

• Cited answers onlyPlatformM · weekssovereign

  Retrieval answers must cite indexed documents; a sentence the verifier cannot ground in a citation is shown as unverified.

• Connector as a two-way MFT edge agentDocument StoreM · weekssovereignQ4 2026

  The connector on the customer's network grows from inbound pickup into a two-way edge agent with outbound drops to partner folders and SFTP, hashed chunked transfer to the hub, files beyond 16 MB, schedules and quiet hours, an on-agent pre-scan and a status page, while holding no data at rest beyond its queue.

• Connector fleet operationsRobeeflowM · weeks

  Bulk upgrade with canary rollout, remote configuration diff and a fleet health map for the on-premise connectors.

• Continuous model evaluationPlatformM · weeks

  The benchmark harness as a product page: golden sets per module, nightly regression runs and a promotion button that only unlocks when a candidate beats the incumbent.

• Cost per outcomeObservabilityM · weekssovereign2027

  See what the AI cost per message processed, per cascade report, per approved work output, per mail sent, per partner and per customer, and where spend does not turn into outcomes. The report inference-scheduler promises, built on the joined records.

• Customer-held key optionBastionM · weekssovereign2027

  A municipality or company supplies the key that wraps its vault from its own KMS, HSM or a split-knowledge ceremony, so the operator can never decrypt that vault alone. The vault stays sealed at boot until the customer unseals it.

• Data classification labels with enforcementPlatformM · weeks

  Tag every collection field as public, internal, personal, BSN or secret, so the vault, masking, export and retention all key off one label instead of three separate lists.

• Data loss prevention on the classes before anything leavesDocument StoreM · weekssovereignQ4 2026

  Before a share, a delivery, a transfer or a prompt, the PII scanner and the local NER lane check the content against the document's declared class and the purpose and counterparty, and refuse, redact or log a mismatch, so a BSN in a file marked internal never leaves the server.

• Data-subject requests for documents about a personDocument StoreM · weeksQ4 2026

  Access, rectification, erasure, restriction and portability find every document linked to a person or containing their identifiers, export them with provenance and protocol history, correct as new versions, delete with tombstones and show the one-month clock, in the same flow as the vault records.

• Directory federation and peer discoveryFSCM · weeks

  List in and read from the public FSC directory, discover peers and their services, and propose contracts from the discovered catalogue.

• Evidence attestationsObservabilityM · weekssovereignQ1 2027

  A signed statement per message, run or day names the rows, hashes and chain heads it covers and the key and time that signed it; the lineage, audit and evidence roots of a day combine into one platform root, with a verify endpoint and a page.

• Exposure graphSentinelM · weeks

  Link Spectre CVE findings to Sentinel projects and assets, score exposure, and raise tickets automatically.

• FSC Logging on the audit chain we already haveFSCM · weeks

  Twenty-two mandatory provisions covering what each role records, the record format, correlation across peers, retention and disclosure to a supervisor. Required rather than optional inside the Digikoppeling REST profile. Built by extending the hash-chained evidence files the platform already writes, not by growing a fourth audit system beside them.

• Inference scheduler and budgetsPlatformM · weeks

  Priority lanes, queueing and per-module token budgets on the single GPU, with a cost-per-outcome report, so a background job and a live chat no longer compete without rules.

• Live tailObservabilityM · weeks2027

  A live stream of timeline events filtered by id, flow, partner or model, so a run detail and a transaction page update while the run is in progress. The same stream feeds the alert rules.

• MCP and chat tool set for documents with scoped bridge keysDocument StoreM · weeks2027

  External agents and the chat model search, get, put, share, verify and send documents through one tool set, where each MCP key names the tenant, the document set or class ceiling, the purpose, the rate and the term, and restricted classes open only after the unlock ceremony.

• Mobile app shell with offline approvalsDesign systemM · weeks

  A progressive web app for approvals, alerts and work review that queues actions while offline and syncs when back.

• Model comparison over real trafficObservabilityM · weekssovereign2027

  Compare two models on the same lane over a period on latency, tokens, cost, error and fallback rate and outcome signals such as review approvals, mail verdicts and hub node success, side by side with the bench scores. The traffic-side counterpart of continuous-model-evaluation.

• One notification busPlatformM · weeks

  Replace the separate toast stacks and ad-hoc mails with one event bus that fans out to in-app, mail, Teams and Signal, with per-user preferences.

• OpenTelemetry export to a customer's collectorObservabilityM · weeks2027

  Traces, logs and metrics from both binaries go to the customer's own collector in OTLP with W3C propagation and shared resource attributes, per tenant, with a page that shows delivery status.

• Organisation-wide search with class-aware resultsDocument StoreM · weekssovereign2027

  Full-text and semantic search over document content and metadata on the local embedding fleet, filtered by your purpose and class ceiling before ranking, with restricted hits shown as citations without snippets and every search recorded as a read.

• Partner SLAs and scorecardsRobeeflowM · weeks

  Delivery and acknowledgement targets per agreement, alerts on breach, and a monthly partner report from the tracking data that already exists.

• Pass the official conformance suiteFSCM · weekssovereign

  A local certificate authority and a two-node federation on one machine, the Logius compliance tester run from a script rather than a pipeline, and a stored report saying which of the standard's mandatory provisions pass, which fail and what changed since the last run. No PKIoverheid certificate is needed for this; a test authority is enough.

• Peppol document exchangeDocument StoreM · weeks2027

  Send and receive Peppol BIS Billing 3.0 invoices and other Peppol document types over AS4 to any participant using the hub's SML and SMP discovery, file each exchanged document with its receipt and validate against the Dutch rule sets. The Peppol invoicing flow of certified-flow-library becomes the packaged starting point.

• Per-agent reportObservabilityM · weekssovereignQ1 2027

  For any agent and manifest, see calls, tools used, denials, work outputs and XP, decisions taken, cost, hub messages processed and incidents, with the manifest's permitted scope beside what the agent actually did.

• Per-flow and per-cascade reportObservabilityM · weeksQ1 2027

  For a flow or cascade and period, see runs, success rate, p50 and p95 duration, the failing nodes or steps ranked, AI cost per run, alerts and replays, with a partner breakdown for flows and report and XP history for cascades.

• Per-message reportObservabilityM · weekssovereignQ1 2027

  One document per message id with parties and agreement, envelope facts, delivery attempts, the acknowledgement with proof, flow runs and nodes, AI calls with model, manifest and hashes, alerts, replays, cascade follow-ups, archive location, audit rows and chain verification. Export it as JSON or PDF.

• Per-model reportObservabilityM · weeksQ1 2027

  For any model and period, see calls, latency percentiles, tokens, cost, error and fallback rate, the lanes, agents and hub flows that used it, and the bench results for the same model next to real traffic, with the trend against the previous period. Complements the golden sets of continuous-model-evaluation.

• PGP and S/MIME payload protectionDocument StoreM · weeks2027

  Encrypt and sign a file end to end with OpenPGP or S/MIME keys from the partner profile, independent of the transport, so a file handed to a partner's SFTP server stays unreadable there and an inbound PGP file is verified and decrypted only inside the store.

• PII-aware storageMailM · weekssovereign

  Scan at ingest, redact before any model call, and encrypt stored bodies.

• Policy-as-code syncLayer 7M · weeks

  Import and export policies as files with a diff view and the existing lint and security analysis as the gate, so policies live in version control and are reviewed like code.

• Portable sealed vault bundlesBastionM · weekssovereignQ4 2026

  Export a whole vault as one sealed bundle, with the ciphertext, the key envelopes wrapped for the destination, the classification schema, the registered purposes, the protocol history and a signed manifest, so a vault can move to another host or an air-gapped machine without ever being decrypted in transit. The export is itself a protocolled event and a moved vault keeps its identity and its protocol chain.

• Prompt-injection hardeningMailM · weekssovereign

  Mail inside an untrusted frame, tools disabled during understanding and drafting, recipients fixed before the model runs, and a regression test with known injection payloads against the verifier.

• Queryable OTel log storeObservabilityM · weeksQ1 2027

  OTel records land in a collection with the trace id and attributes indexed, and the OTel Logs page gains search by id, attribute and severity beside the day file download, so hub events and cascade steps become findable.

• Replay against recorded trafficLayer 7M · weeks

  Record real request corpora and simulate a policy change against them before it goes live, with a before-and-after report.

• Scenario forecasting and deal coachingSentinelM · weeks

  Sentinel forecasts with what-if scenarios, and MEDDPICC coaching notes generated per deal by the local model.

• Secure mail and NEN 7516-conformant deliveryDocument StoreM · weeks2027

  When the recipient is only an e-mail address, send a notification with a link into a share or the portal, never the file, with recipient authentication, expiry, revocation and read receipts that meet the 7516 requirements for health and other sensitive information.

• SLA breach reports per partnerObservabilityM · weekssovereign2027

  Bind service levels to agreements and customers, measure acknowledgement latency, delivery success, availability and incidents from the outbox and inbox, and get a monthly report per partner with each breach linked to its messages.

• Sovereign speechPlatformM · weekssovereign

  Local speech-to-text and text-to-speech for Buddy and chat, so meetings and dictation stay on the machine like everything else.

• Steward dashboards for documents and transfersDocument StoreM · weeks2027

  One page shows sealed and unsealed tenants with key versions, chain and root health per day, documents past retention or under hold, quarantined files, expiring shares, transfers by partner with success rates and the dead queue, delivery receipts outstanding and certificates about to expire.

• Templates and document generation into the storeDocument StoreM · weeks2027

  Reports, decisions, tender answers, invoices and letters the platform generates are born inside the store with metadata, class, subject link, hash and an optional seal, as PDF/A or DOCX, instead of landing in a text field or a loose file.

• Tender bid copilotTendersM · weekssovereign

  Draft questionnaire answers from past bids and the qualification library with citations to the source bid, on the local model, inside the Tenders pipeline.

• Token issuance the way the standard asksFSCM · weekssovereign

  Access tokens obtained through the OAuth2 client-credentials flow, carrying the grant hash in the scope field and the peer id as the client, authorised against that specific grant on that specific contract rather than by service name, with the error responses RFC 6749 requires. This is the first request of any conformance run.

• Transaction searchRobeeflowM · weeks

  One search box over outbox, inbox, runs and logs by correlation id, partner or content, with saved searches and a single timeline per transaction.

• Transaction search across both productsObservabilityM · weeksQ1 2027

  Extends transaction-search from the hub's four collections to spans, lineage, audit rows and events on the platform, by any id, partner, service, customer, flow, model, agent or free text, with typed results that jump to the timeline.

• Work log integrationObservabilityM · weekssovereignQ1 2027

  Every operator action that changes a transaction and every agent completion writes a work entry with the trace id, and the work report links each entry to its timeline. The work log gains its API, MCP tool and chat tool.

Planned work the size of a quarter. These need a design before a date.

• Air-gapped installerOperationsL · a quartersovereign

  One bundle with binaries, models, PocketBase and licence that installs on a machine with no internet. The sovereignty claim made literal.

• Alert rules on the unified streamObservabilityL · a quarter2027

  Write alert rules as data over timeline events, such as dead letters per agreement, failed runs of a flow, AI error rate, lineage spool growth, dropped log entries, certificate expiry, SLA breach or cost above budget, with severity, routing and cool-down. Every alert carries the transaction id that opens its timeline.

• Distribution via FSC and Digikoppeling under contractsBastionL · a quartersovereign2027

  Vault data leaves the hub only under an FSC contract or Digikoppeling agreement that names the counterparty, the vault, the purpose, the field list and the term, enforced by the Inway and Outway or the message profile and protocolled on every delivery.

• Drift and error clusteringObservabilityL · a quarter2027

  Errors from spans, hub runs, outbox failures and log messages are grouped by fingerprint into incidents with first seen, last seen, count and affected transactions, and drift in latency, tokens, ack rate and error rate per model, flow and partner surfaces as an incident before a customer notices.

• E-signature and sealing with PAdES, wallet QES and organisation sealsDocument StoreL · a quartersovereign2027

  Ask one or several people to sign in order or in parallel, with advanced signatures in the portal, qualified signatures through a Dutch trust service or the signer's EUDI wallet, and organisation seals with the customer's PKIoverheid certificate, all as PAdES or XAdES with a timestamp that keeps the signature valid after the certificate expires.

• EDIFACT and Peppol BIS validation nodesRobeeflowL · a quarter

  Parse and serialise EDIFACT and X12, and validate Peppol BIS 3 documents, next to the existing Validate and Transform nodes.

• Enforcement adaptersLayer 7L · a quarter

  Export a policy to Envoy, OPA or the FSC inway configuration, so Layer 7 is where policy is designed and the runtimes follow.

• EUDI wallet relying party and attestation issuanceBastionL · a quarter2027

  Citizens and companies prove attributes from their wallet to the hub over OpenID4VP, the hub registers as relying party with its access certificate, and a vault can issue attestations over OpenID4VCI for facts the customer is the authentic source of.

• Evidence bundleObservabilityL · a quartersovereignQ1 2027

  A signed zip per message, run or period with the rows, archive documents, spans, lineage rows, audit rows, day roots and a chain verification report, laid out with a hashed manifest so an auditor can verify it offline with a small tool.

• FSC Regulated AreaFSCL · a quarter

  The extension that binds participants inside a regulated area. who regulates, who takes part, the obligations that attach, and onboarding, revocation and supervision. Twenty-eight mandatory provisions, none of which bind us until we join an area, which is why it comes last.

• Hub federationRobeeflowL · a quarter

  Two hubs exchanging configuration bundles and forwarding outboxes, so acceptance and production, or two agencies, can share agreements without sharing a database.

• MFT protocols with partner profiles and checkpoint restartDocument StoreL · a quartersovereignQ4 2026

  The hub becomes a managed-file-transfer server and client for SFTP, AS2, AS4, OFTP2 and HTTPS, with a partner profile that bundles identity, certificates, endpoints, allowed document types, schedules, retry and DLP policy; transfers restart from the last acknowledged chunk and a dead transfer lands in an operator queue. The tested SFTP and Peppol flows of certified-flow-library install against these profiles.

• OOTS evidence provider and requesterBastionL · a quartersovereign2027

  The hub joins the Once-Only Technical System through its AS4 access point, answering evidence queries from a vault behind a Preview Space where the citizen approves before anything is sent, and requesting evidence through the Evidence Broker.

• Per-tenant envelope encryptionPlatformL · a quarter

  One data key per customer, wrapped by the platform key, so deleting a customer is deleting a key and several agencies can share one server.

• Qualified timestamps and long-term preservationDocument StoreL · a quartersovereign2027

  Daily roots and signatures are anchored with RFC 3161 timestamps and re-stamped before algorithms weaken, every version keeps a write-once copy, and a file can be migrated to PDF/A with the original and both hashes linked, so proof survives for decades under the customer's own control.

• Recipient portal for citizens and companiesDocument StoreL · a quartersovereign2027

  A Doccle-style inbox on your own server where an organisation delivers invoices, decisions and letters, and the recipient logs in with DigiD, eHerkenning or the EUDI wallet, reads, signs, pays and decides with a consent record who else may see a document.

• Registered delivery with evidence (ERDS)Document StoreL · a quartersovereign2027

  For a decision, a summons or a contract the store produces the registered-delivery evidence set, from submission acceptance to content handover with the recipient's identification, each signed, timestamped and chained, so the sender holds a receipt bundle a court accepts. The hub's AS4 receipts become the relay evidence.

• Remote vault nodes that connect backBastionL · a quartersovereign2027

  Install a vault on a customer's own server or a second hub as a vault node that registers with the main platform over FSC or Digikoppeling with mutual authentication. The platform then reaches it through the same access layer and the same four channels, the data stays on the node, and the node keeps its own keys and protocol chain.

• Retention aligned with the seven-year termObservabilityL · a quartersovereignQ4 2026

  One retention registry by data class, so an ebMS exchange and everything it touched keeps for 2555 days by default in hot, warm and archive tiers, every janitor reads the same registry, every deletion is an audit event and any record shows what applies to it and when it leaves. The registry and defaults land first; tiering and protocolled deletion follow in Q1 2027.

• Sealed document bundles and remote document nodesDocument StoreL · a quartersovereign2027

  Export a case, a customer or a citizen's inbox as one sealed bundle with ciphertext, re-wrapped key envelopes, metadata, purposes, protocol history and a signed manifest, and install it on another host as a document node that keeps its chain and registers back with the platform over FSC or Digikoppeling. The documents part of the vault-26 bundle format.

• The peer-facing Manager APIFSCL · a quartersovereign

  The paths FSC Core requires a Manager to expose to other peers over mTLS, separate from the operator's management plane. announce, the contract lifecycle of accept, reject and revoke, peer and service listings, and the signing keys at the well-known JWKS location so a counterparty can verify our contract signatures.

• ZGW Documenten API facadeDocument StoreL · a quarter2027

  A municipality's case system, Open Zaak or a ZDS 1.2 bridge uses the store as its document management system through the VNG Documenten API, with versions, lock and unlock, chunked upload, links to cases and the confidentiality marking mapped onto the six classes.

Roadmap items that have landed, newest first. Each one is also described under Features.

• BAG connectorBastionM · weeks

  Address and building lookups through the BAG API within Kadaster's published limits, honoured before the call rather than after a refusal, caching only for freshness and never as a second register. Addresses link to vault records by BAG identifier instead of free text.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Breach detection and alertingBastionM · weeks

  Seven rules over the access record, from bulk reads and off-hours reveals to failed decrypts, break-glass and a broken chain, raise an alert and a notification, and the serious ones open an incident that carries the 72-hour clock from the moment awareness began. A rule counts rows and hashes and never names a person.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Content-addressed document store with a signed daily rootDocument StoreM · weekssovereign

  Every file you put in the store is hashed on arrival, kept once by that hash and sealed into a per-day chain whose root is signed with a public key beside the platform HMAC, so an auditor verifies documents, audit rows and vault reads with one verifier. Reuses the evidence chain of spectre-evidence.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• DPIA generatorBastionM · weeks

  From the vault configuration the product drafts the data protection impact assessment, with the three mandatory triggers read from the configuration rather than asked of anyone, the mitigations in force listed with links to their evidence, and the whole versioned and signed beside the register of processing activities. It stays a draft until a person signs it.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Field-level classification schema per vaultBastionM · weeks

  Every field of every vault carries a class (public, internal, personal, BSN, special category, secret) that decides masking, prompt access and export, and a field the schema does not name fails the read closed instead of passing as harmless.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Governed share links with recipients, expiry, limits, view-only and watermarkDocument StoreM · weekssovereign

  Share a document with a named recipient under a purpose, an expiry, a download limit and an optional view-only mode with a watermark. The store keeps only a keyed hash of the token, so a lost link is reissued and never recovered, revocation is immediate, and every open and every refusal writes a row instead of bumping a counter.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Haal Centraal BRP connectorBastionL · a quarter

  A live connector to the BRP API with the field list derived from the registered purpose and the authorisation, PKIoverheid and Diginetwerk transport, a short freshness cache with provenance, and protocollering of both the acquisition and the provision. The published test persons load as a labelled test vault.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Hub run recorder joined to the platform trace storeObservabilityL · a quartersovereign

  A hub flow run shows up on the Interactions page as one waterfall beside chat turns and cascades, with each node, send and acknowledgement as a step. The hub keeps its own run row and the platform gets the tree.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• KVK connectorBastionM · weeks

  Company profiles through the KVK search, basic profile and establishment profile APIs. Public company data is kept apart from the personal data of a sole trader or a partnership, whose whole registration is stored under a class the gate treats as personal.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Lineage rows for hub AI nodesObservabilityM · weekssovereign

  The hub's AI node calls the platform's governed model API under the hub's manifest, so every hub inference gets a lineage row, a span and a usage entry with the execution, node and message ids attached. Per message you see which model was asked what, at what cost and under which manifest, and can verify the chain.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Managed file transferRobeeflowL · a quarter

  Partner profiles with a pinned host key and sealed credentials, transfers over secure file transfer in both directions, over HTTPS and from watched folders, payload-level encryption, checksums that travel with the file, retries with backoff and restart from the byte a transfer stopped at.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Metadata schema aligned with MDTO and the six classesDocument StoreM · weeks

  Every document carries the MDTO elements a Dutch archive expects, from archive creator and retention term to checksum and format, plus exactly one classification class that decides masking, sharing and export. A document without a class does not save.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• OIN register upgradeBastionS · days

  The existing mirror loads into a vault of its own through the access layer, refreshed daily from the Logius export, with parent and sub-OIN relations, the KVK cross-link and a freshness stamp and provenance on every lookup.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• One access layer for documents on all four channelsDocument StoreM · weeks

  Every list, get, put, share, deliver, sign and delete passes one on-server layer that resolves who is asking, checks the purpose, applies the class rules, decrypts, writes the row and attests egress, and the API, the Document Keeper flow node, the MCP tools and the chat tools are adapters over it. This extends the vault access layer of vault-01 with a document resource type.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Per-document envelope encryption on the vault key hierarchyDocument StoreM · weekssovereign

  Each document gets its own data key, wrapped by its tenant key, wrapped in turn by the platform master key, so rotation re-wraps keys without touching a single document and a sealed tenant cannot be read by the operator. Every record names the data key and the tenant key version that sealed it.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Protocollering per open, download, share and deliveryDocument StoreM · weekssovereign

  Every read of a document on any channel writes a tamper-evident protocol row with actor, purpose, channel, document hash and version, pages returned with their class, counterparty and outcome, kept append-only for its legal term, so a steward answers who saw what and a data subject lists the rows about their documents. Extends vault-07 from records to documents.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Purpose binding per vault with a generated verwerkingsregisterBastionM · weeks

  Purposes and lawful bases are registered per vault and per consumer, the gate refuses free text and any purpose it does not know, a Guardian approves purposes with a BSN scope, and the article 30 register of processing activities is rendered from that configuration alone, versioned by content hash, signed and regenerated whenever a purpose or a retention term changes.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Records belong to a customer and an authorisation covers a populationBastionM · weekssovereign

  A record names the customer it belongs to and a purpose names the people it covers rather than the whole register, the way a Dutch autorisatiebesluit does. A read is answered for the caller's own customer, an authorisation narrows further by any field of the record, and reaching across customers is a declared, operator-only act recorded on every row.

  Shipped 28 Sept 2026 in 1.21.0 · see it under Features
• Replay lineageObservabilityM · weekssovereign

  Replays, reruns, sandbox runs and dry runs become recorded runs with a kind and a parent, and the original message and run list their children with outcome. A sandbox run keeps only masked facts and counts.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Retention and archival per vaultBastionM · weeks

  Each vault and protocol store gets a retention rule tied to the Archiefwet selection list or the customer's own term, with a legal hold and an archival step before deletion, and a daily sweep that respects both. The retention page shows what is past its term and what the sweep would do.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Retention per class and legal hold for documentsDocument StoreM · weeks

  Each document inherits a retention term from its information category and class, records past term are sealed into the archive and deleted with tombstones, and a legal hold for litigation, a Woo request or an investigation freezes deletion until a recorded decision lifts it.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Transaction id contractObservabilityM · weeks

  Every record about a message, run, chat turn or cascade carries the same trace id, and the ids that already exist keep their meaning with one parent word each. The same id chip appears on every page, copies, pastes into search and lands on the same transaction from either product.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Unified transaction timelineObservabilityL · a quartersovereign

  Paste any id and get one ordered list of everything that happened because of it, on both sides of the bridge, from message received through nodes, AI calls, deliveries, acks, alerts, replays, cascade steps, reports, notifications, audit rows, archive documents and evidence. Each event carries its source, status, duration, links and hashes.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Vault console with break-glass and no direct database accessBastionM · weeks

  The console shows masked records with a reveal that needs a reason and is protocolled, and a BSN-class or special-category reveal first needs a second administrator to approve a request that is valid for fifteen minutes and for one reveal. Break-glass without a second person takes an explicit flag and raises an alert somebody has to answer for.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Versions, immutability and tombstonesDocument StoreM · weeks

  A new upload of a known document becomes a new version linked to the old one, and a deletion leaves a tombstone with actor, reason and legal basis, so the same bytes cannot quietly come back and content only disappears once retention and holds allow it.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• Withholding a record from disclosureBastionM · weekssovereign

  A person can ask for their record to be withheld, which the population register calls a verstrekkingsbeperking. It disappears from every read, search and count, a single time-boxed look needs a second administrator, and out of scope, withheld and absent all answer in the same words so the answer itself reveals nothing.

  Shipped 28 Sept 2026 in 1.21.0 · see it under Features
• WOZ connectorBastionM · weeks

  LV WOZ queries over Digikoppeling WUS limited to the fields the Waarderingskamer authorisation matrix gives the customer's role, which narrows the answer a fourth time after the purpose, its field list and the authorisation. Every value is stored with its reference date and the authority it was obtained under.

  Shipped 28 Sept 2026 in 1.20.0 · see it under Features
• A real MCP server for SpectreSpectreM · weeks

  scrape, crawl, map, search, extract and watch over MCP with streamable HTTP and stdio, backed by the existing bridge and API keys, so outside agent runtimes call Spectre natively.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Agent permission manifestsPlatformM · weekssovereign

  Each agent declares the tools, collections and hosts it may touch; anything outside the manifest lands in an approval queue.

  Shipped 27 Sept 2026 · see it under Features
• AI Act dossier generatorPlatformM · weekssovereign

  From the ledger, the model registry and the routing file, produce the Annex IV technical documentation and a risk classification per AI use, as a versioned document per module.

  Shipped 27 Sept 2026 · see it under Features
• AI bridge keys stored as hashesBastionM · weekssovereign

  Every AI-side caller, whether a chat tool, an MCP key, an agent manifest or a flow node, holds a scoped bridge key that names the vault, the purpose, the field classes and the rate. The key exists on the server only as a keyed hash, the bridge resolves records on the server and hands the local model only class-filtered fields or citations, and a hosted model lane is refused by code.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• AI call lineage ledgerPlatformM · weekssovereign

  Each inference records prompt hash, model, parameters, output hash, user and module, hash-chained. The logging the EU AI Act asks for on high-risk use.

  Shipped 27 Sept 2026 · see it under Features
• AI chat bridge with vault tools for local modelsBastionL · a quartersovereign

  Ask Buddy about a person, building or company and the local model calls a server-side vault tool whose result is redacted by class before it enters the prompt, pinned to a local lane by code, and cited back to the record and its protocol row. An unlock ceremony precedes the first read of a session.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• AI-to-AI autonomous vault accessBastionM · weekssovereign

  A flow or cascade step queries a vault for another agent under that agent's permission manifest, decrypts only the allowed fields, writes a lineage row linking both agents to the record, and refuses to hand BSN-class fields to steps that send outward.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Allow, deny and suppression listsMailM · weeks

  Sender and domain policy per mailbox plus a global suppression list, enforced before any draft is written.

  Shipped 27 Sept 2026 · see it under Features
• Autonomous responder with a held queueMailL · a quartersovereign

  Guard, understand, draft, verify, decide, send and record, shipped with draft as the default and an Approve, Edit, Reject queue in the mail page.

  Shipped 27 Sept 2026 · see it under Features
• Backup rehearsalOperationsS · days

  Scheduled PocketBase snapshots restored into a scratch instance with a report of what came back.

  Shipped 27 Sept 2026 · see it under Features
• Batch improvementsSpectreS · days

  URL dedupe, per-batch formats and schema, concurrency honoured against the browser pool, paginated results.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Caller-controlled cachingSpectreS · days

  maxAge, minAge and storeInCache per request, with cachedAt in the answer.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Crawl-wide schema extractSpectreM · weeks

  One schema over every page of an extraction or a URL list, chunked and merged, validated with one retry.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Data-never-leaves attestation per queryBastionM · weekssovereign

  Every vault read through any channel produces a signed row stating the local lane and model used, that no outbound connection was made during the query, the fields and classes returned, and the protocol and lineage identifiers, exportable for auditors.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Data-subject rights toolingBastionM · weeks

  Look a person up by BSN under a registered purpose and produce an access export with protocol history, record a rectification with before and after, and delete with a tombstone so a later import cannot bring the person back.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Decision audit trailMailS · dayssovereign

  One record per stage with model, lane and prompt hash, shown as a timeline on the mail and counted in the usage tables.

  Shipped 27 Sept 2026 · see it under Features
• Declarative page actionsSpectreM · weeks

  wait, click, write, press, scroll, executeJavascript, screenshot and scrape steps in the existing Chrome session, replacing the raw script string; unlocks login walls and infinite scroll.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Design-system compliance gateDesign systemS · days

  Extend the palette lint, add a raw-primitive rule and publish a component index page, so the compliance score becomes a number that only goes up.

  Shipped 27 Sept 2026 · see it under Features
• Dutch government source packsSpectreM · weekssovereign

  First-class packs for TenderNed, officielebekendmakingen.nl and the KVK register with seeds, a schema, a watch preset and legal notes.

  Shipped 27 Sept 2026 · see it under Features
• Envelope encryption with per-vault data keys and rotationBastionM · weeks

  Each vault gets its own data key wrapped by a platform key, every record carries its key version, and rotation re-wraps keys without re-encrypting every record. The readiness page shows key age and rotation status.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Evidence-grade archivingSpectreL · a quartersovereign

  Raw response, headers, rendered DOM and screenshot per fetch as WARC, hash-chained by day and signed, with a verify endpoint.

  Shipped 27 Sept 2026 · see it under Features
• Format selector on FetchSpectreS · days

  Ask for markdown, html, rawHtml, links, screenshot or json and get only that from the cached artifacts; screenshots become reachable from the API.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Generate and wire DKIM keys in deployMailS · days

  The deploy creates the key, sets the variables and prints the TXT record.

  Shipped 27 Sept 2026 · see it under Features
• Immutable audit exportPlatformS · days

  Hash-chain the audit history across platform and hub and export it to write-once storage on a schedule, with a verifier anyone can run.

  Shipped 27 Sept 2026 · see it under Features
• Intranet crawling under the hub's SSRF policySpectreM · weekssovereign

  The hub's URL policy adopted by Spectre so it can crawl internal wikis under an allow-list with redirect and DNS-rebind protection.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Job cancel, errors and paginationSpectreS · days

  Cancel endpoints for batch and extract, an errors listing, and a cursor for large results.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Keep the raw message and real headersMailM · weeks

  A proper MIME parser, the raw message kept as a file, the full header map and attachment list stored, and the truncation removed.

  Shipped 27 Sept 2026 · see it under Features
• Keyed hashing and tokenisation serviceBastionM · weeks

  A hashing key separate from the encryption key produces the lookup hashes for BSN, KVK and address keys, every BSN is elfproef-checked first, and per-purpose pseudonyms or format-preserving tokens stand in for the real number downstream.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Location and language emulationSpectreS · days

  Country and languages set Accept-Language, Chrome locale and timezone, and pick a matching proxy.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Loop protectionMailS · days

  Honour Auto-Submitted, Precedence, List headers and null senders, never auto-reply to them, and mark AI replies as auto-replied.

  Shipped 27 Sept 2026 · see it under Features
• Masked replay sandboxRobeeflowS · dayssovereign

  Replay a real received message into a dry run with personal data masked, so an integrator can debug production traffic without seeing it.

  Shipped 27 Sept 2026 · see it under Features
• MCP vault tools with scoped keysBastionM · weeks

  External agents call vault search, get and verify over MCP with a key scoped to one vault, purpose, field set and rate. The bridge applies the same manifest check as chat and writes the same protocol and lineage rows.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• On-demand change trackingSpectreM · weeks

  A changeTracking format on Fetch with previous capture time, status, a git-style diff and a schema-driven field diff, with tags for separate histories.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• PDF and Office auto-parseSpectreM · weeks

  Branch on content type: PDF with page markers, DOCX through the existing reader, and OCR fallback for scanned PDFs on local page images.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Per-request crawl controlsSpectreM · weeks

  limit, depth, include and exclude paths, subdomains, external links, sitemap modes, query-parameter handling, delay and concurrency on every crawl and extraction.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• PII-aware extraction with the vaultSpectreM · weekssovereign

  The PII detector runs over every page; findings are redacted or tokenised into the vault before results reach a model, disk or a webhook.

  Shipped 27 Sept 2026 · see it under Features
• Protocollering per readBastionM · weeks

  Every read of a personal-data vault writes a tamper-evident protocol row with who asked, under which purpose, which fields came back and a hash of the record, kept for its legal term and never showing a raw identifier. A citizen's protocol can be listed per person.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Public API and SDKsSpectreL · a quarter

  A versioned Spectre API with scoped keys, per-key limits and quotas, an OpenAPI description and thin TypeScript, Python and Go clients.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• robots.txt everywhereSpectreS · dayssovereign

  One shared robots cache consulted by fetch, extract, map, watch, batch and scout, with crawl-delay honoured and an explicit, recorded operator override.

  Shipped 27 Sept 2026 · see it under Features
• Route every Spectre inference through the spectre laneSpectreS · days

  Schema extract and search answers call the spectre lane, so routing edits and usage accounting see them.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Semantic change summaries in WatchSpectreS · days

  After a hash change a local model says what changed and whether it matters, and cosmetic diffs are suppressed by a threshold.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Semantic keywords and site searchSpectreM · weekssovereign

  Embed every fetched page locally, replace frequency ranking with hybrid search, and offer search over everything Spectre has ever crawled plus near-duplicate detection.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Signed lifecycle webhooksSpectreM · weeks

  started, page, completed and failed events for batch, extract and watch with an HMAC header and retries.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Signed model registryPlatformM · weekssovereign

  Every model in the fleet gets a manifest with weights hash, source, licence, benchmark scores and promotion date; health refuses a model whose hash drifted.

  Shipped 27 Sept 2026 · see it under Features
• Stealth tier and Chrome proxyingSpectreM · weeks

  Pass the proxy pool into Chrome, add basic, stealth and auto modes with retry on bot detection, and per-tenant pools.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Stop banning legitimate sendersMailS · days

  Return a plain refusal instead of a blacklist strike for unknown recipients and keep the reverse-DNS rule as a score.

  Shipped 27 Sept 2026 · see it under Features
• ThreadingMailS · days

  Persist and emit Message-ID, In-Reply-To and References, compute a thread id, show threads in the UI.

  Shipped 27 Sept 2026 · see it under Features
• Vision-assisted extractionSpectreM · weekssovereign

  Send local screenshots of charts, scanned notices and cookie-walled pages to the local vision model for captions, table transcription and page checks, and feed alt text back into image extraction.

  Shipped 27 Sept 2026 in 1.18.0 · see it under Features
• Zero-egress guarantee modeSpectreS · dayssovereign

  A tenant policy that disables every hosted lookup, pins captcha solving to a local model and stamps every result with an egress attestation.

  Shipped 27 Sept 2026 · see it under Features