Project
Roadmap
A plan, not a promise: phases advance only when every exit criterion has evidence, and stages change when a decision is recorded. No dates are promised and no progress percentage is shown.
Phases and gates
| Phase | Exit gate | Status |
|---|---|---|
| 0 · Stop lying Canonical hashes; honest tx states + JSON error envelope; confirmations vs node tip; lag disclosure; real mempool data; /health + /ready; metrics + lag alert; OpenAPI skeleton; differential harness v0; ADR-0001/0002 | All P0 closed with regression tests; harness green; ADRs approved | Closed 2026-09-07 — status |
| 1 · Catch up & vigia parity vigia adoption (ADR-0001) as btcintel's chain index; public wallet-compatible /api/* served by vigia; legacy indexer retirement; SSR migration (ADR-0002); cursor pagination; cache headers; block/tx/address pages at parity; design system v1; a11y; i18n scaffolding; docs site v1 | vigia serving /v1 and /api at the node tip (the 7-day lag observation was waived by decision, 2026-09-07 — no users yet); harness on full 1,300-object corpus with 0 mismatches; a wallet (Sparrow/BDK) syncs against /api unchanged; performance budgets met | Closed 2026-09-22 by the owner's declaration: vigia at the tip serving /api/* and /v1 chain reads, the legacy indexer retired, the SSR explorer live, the nightly differential harness green on the corpus and a 1,300-object sweep with budgets met (status, S0 status) |
| 2 · Mempool & fees parity ZMQ mempool mirror (ADR-0003); projected blocks; fee histogram + recommendations; RBF/CPFP with effective fee rate; WebSocket/SSE; "where is my tx"; stale-block tracking; coinbase observations and pool attributions per ADR-0004 | Projections within ±1 block of mempool.space over 24 h; live updates ≤ 1 s; no memory growth over a 72 h soak | Engine live in prod since 2026-09-10 (btcintel-api#9); web surfaces merged (btcintel-web#9, redesign btcintel-web#11). Remaining: WebSocket/SSE, "where is my tx", stale-block tracking, attributions, 24 h accuracy + 72 h soak evidence |
| 3 · The intel layer Everything ADR-0004 accepts: the three bands, sources with fetch citations and legal sign-off (starting set P19), observations and attributions, entities and relations, addressable claims, contradictions and disputes, tiers T0–T4 with quotas, MCP server and local signer, Community on Nostr with the embedded relay, third-party labelers, feedback channel and the improvement loop, STIX 2.1 and TagPack exports, backups before the first live source | ≥ 4 live sources with every claim citing a fetch; bulk lookup of 1,000 subjects ≤ 1 s p95; dispute process published; legal review before the first Community write; restore drill passed for the intel stores | Built and deployed between 2026-09-22 and 2026-10-03: stages S0–S7 of phase-3-plan.md, CP1–CP3 closed. Writes are on (P60), accounts on (P64), quotas enforced (P71); custodied signing is built and off until CP4 (P72). The gate, S8.1, is in progress |
| 4 · Distribution & polish es locale; PWA; Tor onion; sitemaps + structured data; llms.txt and .well-known discovery; verified-crawler exemptions and edge caching; docs + SDK snippets; testnet4/signet; public status page; off-box backups + restore drill; launch checklist and the launch slice S9 of the Phase 3 plan (press kit, profiles, announcements, agent and CTI directories) | Lighthouse ≥ 95 everywhere; onion reachable; docs cover 100 % of endpoints; restore drill passed off-box; launch checklist signed | — |
| 5+ · Options (own decisions each) Lightning classification or explorer; heuristic claims (exposure > hop 0, clusters, fingerprints); webhooks; OpenTimestamps anchoring of fetch hashes; TAXII transport; paid plans as extended quotas on T4; passkey unlock of key backups; OAuth 2.1 host binding | — | — |
Stages of the intel layer (Phase 3)
Each stage links its public issue; the state is what its spec records.
S0
- CLAUDE.md and AGENTS.md in api, web, codexBuilt 2026-09-22 — status note.
- CI hardening: vet, lint, race, OpenAPI lint, typecheck, link checkBuilt 2026-09-22 — status note.
- Regtest: first application of the ADR-0004 DDL, roles per schemaBuilt 2026-09-22 — status note.
- Makefile targets, .env.example, PR templates, fixturesBuilt 2026-09-22 — status note.
- Reserve brand handles and profiles; mailboxes; D22 (brand npub)
S1
- Migration 003_intel.sql, roles, fixture copy, drop 002Built 2026-09-22 — status note.
- Subjects, claim ids/versions/hashes/citations, change feed, audit logBuilt 2026-09-22 — status note.
- Fetch and import pipeline (metadata-only fetches, diff to valid_to, push)Built 2026-09-22 — status note.
- Importers: OFAC SDN, RansomwhereBuilt 2026-09-22 — status note.
- Importers: pool catalogs, ATT&CK, MISP, exchange PoRBuilt 2026-09-22 — status note.
- Read model and REST v1 intel routes, OpenAPIBuilt 2026-09-22, deployed 2026-09-23 — status note.
- Coinbase extractor, matcher, attributions without a winnerBuilt and deployed 2026-09-23 — status note.
- Transaction extractor (OP_RETURN, meta-protocols, CoinJoin, Patoshi)Built and deployed 2026-09-23 — status note.
- Block template diff at block connect, /auditBuilt and deployed 2026-09-23 — status note.
- Backups before the first live source, import alertsBuilt 2026-09-23 — status note.
- Checkpoint 1: review of the Curated coreClosed 2026-09-23 — status note.
S2
- Design: three-band pages (owner approval)Taken in code 2026-09-23 (P51); the owner reviews the deployed pages — status note.
- Implement bands, claim rows, disputed attributions, feedback button, docsBuilt and deployed 2026-09-23 — status note.
- Entity, source and claim permalink pages, sitemapBuilt and deployed 2026-09-23 — status note.
- The entities explorer as the owner designed it (API sort, filters, total, abuse summary; web as drawn)Built 2026-10-02
S3
- Tiers T0/T1/T4, quotas at the origin, btci_anon_ minting, keysBuilt and deployed 2026-09-23; quotas enforced in production since 2026-10-04 (P71: btcintel-api #124 and #125) — status note.
- MCP server from OpenAPI; .well-known, llms.txtBuilt and deployed 2026-09-23 — status note.
- Ops surface: operators, drafts and approval, agent_may_publish gateBuilt and deployed 2026-09-23 — status note.
- Feedback channel (web, MCP, auto)Built and deployed 2026-09-23 — status note.
- Documentation site: API reference from OpenAPI, MCP guide, citing, tiers, coverage checkBuilt and deployed 2026-09-24 — status note.
- Checkpoint 2: security review of tiers, keys, MCP, opsClosed 2026-09-24 — status note.
- Third-party scripts under an allowlist (P58, P59)Built 2026-09-29 (phase A of the identity plan): btcintel-web PR #52, web deploy 62, production check 33
S4
- Embedded relay, ingester, verification, moderation lens, labelersBuilt and deployed 2026-09-24 (api#55 store and door rules, api#56 relay, api#57 status fix, api#58 ingester, api#59 ops routes and vhost). Relay live in read-only mode at wss://api.btcintel.io/relay; wss://relay.btcintel.io follows the owner's DNS record. T-6 soak runs 2026-09-24 → 2026-09-27.
- Community read API/MCP, labelers=, ordering with safeguardsBuilt and deployed 2026-09-24 (api#60 read model and zap validation, api#61 API, contract and MCP tools). Docs "Community" page appears with S4.4; the web's docs generator gains a community group with the next contract refresh.
- Design + build: the Community band (owner approval)Built in code 2026-09-24 (web#34) under P53: Part A's canvas is superseded; the states matrix and the component list below are the design record; the owner's review of the deployed pages is T-5. Deviations in the Definition of done.
- Legal package before writesAdopted 2026-09-24 (P54): texts in codex#99/#101, api#62 (vocabulary, retention), web#35 (pages). Facts fixed by the owner: the operator is Satsboard LLC, 1021 E Lincolnway 10076, Cheyenne, WY 82001, USA; governing law Wyoming, venue Laramie County; the legal-notice channel is [email protected] (Cloudflare Email Routing, live) plus the feedback channel; Spain's LSSI does not apply. write_enabled switched on 2026-09-24; the UI publish path waits for CP3.
S5
- NIP-98, sessions, NIP-49 backup, T2 keys, publish path, PoWBuilt and deployed 2026-09-28 (api#64 identity, api#66 backup, api#67 publish path, api#68 proposals; web#37 docs sync and the Identity page). Sessions and backups are live; publish, delete and propose answer 501 until CP3 flips WRITES_ENABLED.
- Design + build: key onboarding and publishing UI (owner approval)Built 2026-09-28 (web#39). Part A taken in code (P51, P53): the states matrix below is the design contract and every row is a rendered state; the owner reviews the deployed pages (T-6 pending).
- Disputes end to endBuilt 2026-09-28 (api#69; the web dispute sheet with S5.2, web#39).
- Watchlists and change feed consumptionBuilt 2026-09-28 (api#70).
- Checkpoint 3: security review before writes openClosed 2026-09-29 (P60) — the review was posted 2026-09-28 (status note), the findings codex#106–#122 are closed except #122 (a later spec), the owner acknowledged the checkpoint on 2026-09-29 and switched WRITES_ENABLED=true on the box by hand; production check 35 reads features.writes: true — status note.
- Accounts (t4): email and password, passkeys, second factor, organisations, sign-in methods (P55, P57)Built: phase B on 2026-09-29, switched on by the owner on 2026-10-01 (P64; production check 63 reads features.accounts: true): API in btcintel-api #90–#101 (deploys 104–113, production checks 36–42 green); web in btcintel-web #53–#59, all merged, deploys 63, 64, 66–69, production check 44 green on 2026-09-30 with /auth/sign-in, /account/security, /docs/identity and /docs/privacy among the pages. Phase D (the providers) built 2026-09-30 and off: btcintel-api #110 (deploy 122, production check 57 green), btcintel-web #66 (deploy 76); every provider stays off until its OAUTH_* values are set; §12 lists phase B's deviations, §13 phase D as built.
- Custodied signing keys: the NIP-46 signer service, export, own-signer linking, Remote Login (P56)Built 2026-09-30 and deployed switched off (profile signer off, SIGNER_URL unset, SIGNING_ENABLED=false); FR-12 deferred (P62); the first real key waits for CP4. See §12
- NIP-55: the Android signer (Amber) for own keys, the follow-up of S5.6 FR-12 (P62)Built 2026-09-30 (btcintel-web #64, deploy 74); T-4 waived by the owner the same day (no Android device to run it on), so the first Android user's report is the device test; see §9
- The NIP-98 login bound to a browser nonce, the follow-up of CP3 finding 17 (P63)Built 2026-09-30 and deployed with LOGIN_NONCE_REQUIRED=false: btcintel-api #111 (deploy 123, production check 59 green), btcintel-web #67 (deploy 77); the window closes when the owner flips the flag (§10). Mirror issue #122
- The account's Nostr key generated at sign-up, replaceable by the person's own (P65)Built 2026-10-01 (btcintel-api#113 and #114, btcintel-web#72) and deployed; it acts from the day custodied signing is switched on after CP4, and changes nothing before. Mirror issue #167. See §10
- Agents write: the Community write tools over MCP and a t2 key an agent issues itself (P70)Built and deployed 2026-10-03 (btcintel-api #121, #122; btcintel-web #86). Production check run 89 is T-5 — status note. The owner confirmed P70 on 2026-10-04. Mirror issue #185
- Checkpoint 4: security review before the first custodied keyIn progress: round 1 of the review posted 2026-10-04 on #145 (P72): seven findings, four blocking (CP4-1 to CP4-4), fixed by btcintel-api #126–#129. Still open: the staging run with the signer on, the scripted abuse session, the second reviewer and the owner's items
S6
- STIX 2.1 bundles, TagPack in/out, redistribution enforcementBuilt 2026-09-28 (api#74 STIX, api#75 TagPack; web#41 docs). The mapping as built lives in docs/stix-mapping.md of btcintel-api.
S7
- Ops agents (Grok): identity, budget, kill switch, playbooksBuilt 2026-09-28, not armed (api#76 the runner, api#77 the kill switch at the key and the end-to-end test; the playbooks and operations/agents.md in this repository). No operator, key or schedule exists in production; arming is the owner's (agents.md, "Arming").
- Design + build: changelog and roadmap page (owner approval)Built 2026-09-28 (web#42; the codex sources in codex#127) — Part A taken in code on P51/P53's route, the owner reviews the deployed pages.
S8
- Evidence pack, harness extension, restore drill, owner declarationIn progress (2026-09-28) — FR-1 and FR-2 built (api#81, api#84); the first run with the groups green (harness run 23: corpus pass 112, fail 0; intel p95 197 ms, community 189 ms, mcp 705 ms from a GitHub runner); the exit criteria's evidence inventoried below; FR-3, FR-4, FR-5 not started.
S9
- Launch checklist, press kit, launch metrics without trackingPrepared 2026-09-28: the checklist (FR-1), the launch-day template (FR-4) and the metrics document with its daily script (FR-3) exist; the press kit (FR-2) and the press page wait for the founder line and the design assets
- Accounts and profiles live (X, LinkedIn, Crunchbase, GitHub, Stacker News, Reddit; Nostr per D22)
- Announcements and launch posts: sequence, angles, drafts by ops agentsPrepared 2026-09-28: the sequence in the checklist, the angles, the FAQ and thirteen post drafts under launch/posts/ with their checker in CI; the posts wait for the owner's edit and the day
- Agent and CTI directories: MCP registries, awesome lists, TagPack, OpenCTI/MISPPrepared 2026-09-28: FR-1's document is served (api#86); every listing waits for the owner — launch/directories.md
What btcintel will not build
Changing any of these takes a recorded decision.
- No risk scores. The set of claims with source, method and confidence class is returned; nothing fuses them into a number, a taint or a sanctioned: true that collapses sources (P1).
- No stored winner. When methods or sources disagree, every row is kept and the response says disputed; the read policy is versioned in the API, not in a column (P7).
- No endorsement of Community claims. Curated stands on the brand's own sources; a Community event may be cited as the origin of a lead, never sealed, elevated or corroborated by a brand chip (P5).
- No accounts, passwords or emails. Reads are anonymous; writes are signed with a key; an nsec never lives on btcintel servers; the brand signs nothing on Nostr (P11–P16).
- No tracking. No third-party scripts, no fingerprinting, no cookies for reads, no per-request logs with IPs; feedback is explicit, never telemetry (P39, P43).
- No trading product. No candles, portfolios or price alerts.
- Bitcoin on-chain and mempool only. No Lightning explorer, no sidechain pegs, no cross-chain until a decision adds them (P2).
- No heuristic claims in this version. No exposure beyond hop 0, no address clusters, no wallet-software fingerprints (P18).
- No paid plans before Phase 5, and then only extended quotas. on the top tier (P10, P13).
- No placeholder content in production.
- No unrebuildable infrastructure without a backup. The chain index rebuilds from the node; the Curated, Community, access and feedback stores are dumped nightly with a restore drill (P36).
- No guessed Bitcoin semantics. If Core, the BIPs or a regtest experiment cannot settle a question, the answer does not ship.