diff --git a/docs/PLAN.md b/docs/PLAN.md index 9c432ad..ce63682 100644 --- a/docs/PLAN.md +++ b/docs/PLAN.md @@ -171,3 +171,37 @@ OWASP LLM Top-10 2025: LLM01, LLM02, LLM04, LLM05, LLM06 (strongest coverage), L evasion (2504.11168), EchoLeak (CVE-2025-32711), RAGShield (2604.00387), CaMeL (2503.18813), Dual-LLM (Willison), and the litellm supply-chain compromise (corroborates the minimal-dependency thesis). + +## v0.2+ stream sequencing (post-v0.1.0, decided 2026-07-06) + +v0.1.0 is tagged — the format-agnostic text core (modules 1–11, hardened at +`5397ba1`, released at `df30c7b`). Three forward streams, **all to be built**; +the order is dependency-driven, not preference: + +1. **OKF v0.2 hardening** — the OKF adapter + the 8 tasks in + `docs/OKF-INGESTION-BRIEF.md` §8 (internal order T8 → T1–T4+T6 → T7 → T5). +2. **Wire consumers** — `claude-code-llm-wiki`, `ms-ai-architect`, + `portfolio-optimiser` (its OKF-upload-inbox is the flagship). +3. **Node/polyglot port** — one polyglot repo over the shared JSON lexicon + (BRIEF §13.5/§8); driver = `ms-ai-architect` convergence. + +**Why this order (dependencies, not taste):** + +- The flagship consumer (`portfolio-optimiser`'s OKF-upload-inbox) *is* an OKF + surface. Wiring it before OKF hardening ships a knowingly-incomplete guard + into the exact case that needs it → **stream 2 depends on stream 1**. +- The Node port must port a *settled* public surface. OKF v0.2 adds the + OKF-adapter surface; porting before it = porting a moving target and exactly + the §13.3 split-drift the polyglot rule exists to forbid → **stream 3 after 1**. +- Within stream 1: **T8** (residual-risk docs, brief §7.2/§7.4) is the cheap, + decision-free first step — it lands independently and makes the live README + honest about uncovered OKF surfaces before anything else is built. **T3/T4/T5 + are blocked on an OKF-spec confirmation pass** (brief §9 "operator premise": + concept-ID=path-minus-`.md`, reserved `index.md`/`log.md`, the `resource` + field, `description`→`index.md` were taken from the brief, not checked against + `SPEC.md`). + +**Splittable early win (optional):** text-only consumers can be wired at v0.1.0 +today — for them the guard is already complete. Folded behind stream 1 by +default (editing other repos = context switch + weaker feedback than the +flagship). Pull forward only on explicit request.