Roadmap

• ✓ Go placeholder site with live server stats, Lighthouse 98–100 (done)
• ✓ Box hardened: key-only SSH, fail2ban, ufw with Cloudflare-only 80/443 (done)
• ✓ Caddy in front, Cloudflare Full (strict), www redirect (done)
• ✓ Isolated Incus container for Ravindra (done)
• ✓ Repo-scoped deploy key; account-wide GitHub token removed from the box (done)
• ✓ Build plan v2 with sessions, vault design, freshness engine, versioning (done)

• ✓ cmd/ + internal/ layout, embedded templates and static files (done)
• ✓ SQLite (modernc) with numbered embedded migrations, WAL, StateDirectory (done)
• ✓ Nonce CSP, real-IP, rate limiters, request log (done)
• ✓ Passkeys with discoverable credentials, DB sessions, ordered roles (done)
• ✓ kinkong admin invite one-time superadmin link (done)
• ✓ Admin shell: dashboard, users, audit log, Ctrl-K palette (done)
• ✓ Gates: admin-guard, routes table, roles scan, migrations, CSP nonce (done)
• ✓ Justfile with check, gates, ship, lighthouse, headers, release (done)
• ✓ Jack's passkey registered, /admin reachable (done)
• ✓ End-to-end passkey test in headless Chromium (register, login, step-up, roles, disable) (done)

• ✓ Encrypted vault (AES-256-GCM, master key via LoadCredential), kinkong vault init|rekey|status (done)
• ✓ /admin/vault write-only UI with step-up passkey assertion and live probes (done)
• ✓ Postmark mailer with console fallback and send governor (done)
• ✓ Passkey recovery by email (adds a passkey, never signs in) (done)
• ✓ Passkey management page (done)
• ✓ /updates, /updates.atom, /roadmap, /api/version, /admin/changelog (done)
• ✓ Legal page skeletons (done)

• ✓ Categories tree, tools, attributes, links, relations, models, hardware profiles, metrics (done)
• ✓ Public tool, category, model and search pages; FTS5 (done)
• ✓ "What can I run on…" hardware filter (done)
• ✓ 44 seeded tools with sources, and kinkong seed to load them (done)
• ✓ Permanent slugs: a renamed page's old URL redirects for ever (done)
• ✓ Sitemap generated from the database (done)
• ✓ Admin CRUD with markdown bodies (done)
• Per-tool OG cards — deferred to Session 6, which has the rasteriser (most crawlers refuse an SVG) (not started)

The catalog is edited at /admin/tools; data/seed/*.json and kinkong seed still load it from cold.

• ✓ Job scheduler with wall-clock due checks and /admin/jobs (done)
• ✓ Single outbound fetch client with UA, caps and per-host limits — and an address guard, so a URL (done)
• ✓ alive, github_sync, hf_sync, release_watch, wayback, housekeeping jobs (done)
• ✓ Tool pages show liveness, metrics sparkline, latest release, archive links (done)
• ✓ Admin notices for dead tools, archived repos, new releases and failing jobs, at /admin/notices (done)
• ✓ Systemd egress change rehearsed (deploy/rehearse-sandbox.sh) and deployed (done)

No sitemap job: /sitemap.xml renders from the database on request, so there is nothing to

• ✓ Feeds table and admin at /admin/feeds, seeded with ten verified sources (done)
• ✓ Inbox → draft → approve → publish flow, with two separate human decisions and no way past either (done)
• ✓ OpenRouter summaries with a shared AI ledger and budget cap, enforced by summing the ledger (done)
• ✓ /news, /news/{slug}, /news.atom, home page cards, and the AI-assisted label on all four (done)
• ✓ feeds (2 h) and summarize (30 min) jobs; release_watch now also drafts an inbox item (done)

Nothing published yet: the first post is a person's to write, and the inbox is where it starts.

• ✓ The AI ledger moved to internal/ledger, so art and news spend from one table and one cap (done)
• ✓ Tokens, type scale, effects kit within the JS/CSS budgets — and just budget to keep them there (done)
• ✓ Final legal copy and the 18+ interstitial at /go/{slug} (done)
• ✓ kinkong artgen with $9 cap, ledger, style guide, ratings, approval queue, derivatives (done)
• ✓ /art/{file} serves approved rows only, so an unreviewed image has no public URL at all (done)
• ✓ Home hero and category cards render approved artwork, and are unchanged where there is none (done)
• First art batch: logo, favicons, heroes, category cards, OG cards — **generated and in the queue; (not started)

• ✓ Provider balances read on a schedule (balances, 6 h) and shown on the vault card — never fetched (done)
• ✓ Inbound mail at *@kink.ong: Postmark webhook → /admin/mail, plain text only, nothing answered (done)
• ✓ Probe fixes: ImageRouter's 78 KB model list no longer truncated; no provider's name for a key ever (done)

• Public passkey sign-up with verified email (not started)
• Nested comments on tool pages, votes, reports (not started)
• Mod queue, scoped moderators, bans, rate limits, held links, removal log (not started)
• Notification emails (not started)

• /graph canvas force layout with relation perspectives (not started)
• /explorer desktop metaphor with shareable URL state (not started)

• Skin engine with lazy-loaded skins and flash-free bootstrap (not started)
• After Dark opt-in skin with its gate and asset variants (not started)
• Matrix, Cupertino Aqua, Redmond Luna, Win95, Y2K Chrome, Synthwave, Paper, High Contrast (not started)
• Video loops (≤ 4), mirrors, model hashes (not started)
• Launch checklist, HSTS preload, v1.0.0 (not started)