Roadmap

Open work, each item linking its proposal — nothing is in progress right now. Ideas parked behind a revisit trigger live in deferred instead. Rationale lives in Cost & Security Posture and packages/infra/docs/.

Blocked (app-side migration off key-based auth first)

• Keyless auth hardening — service-principal credentials in the app, then disable shared-key/local auth + network default-deny