fotospiel-app/docs/process/roadmap.md

Product & Ops Roadmap

Last updated: 2025-10-25

This high-level view connects the active epics in docs/process/todo/ so stakeholders can scan what is shipping now versus what is queued next. Detailed checklists live in the linked TODO files, and day-to-day notes go into docs/process/changes/.

-## Now (Q4 2025)

• Security Hardening Epic (docs/process/todo/security-hardening-epic.md)
  Rolling out dual-key auth, hashed join tokens, signed asset URLs, streaming uploads, and webhook hardening. Tracks six workstreams (identity, tokens, API resilience, media services, billing, frontend/CSP).
• Streaming Upload Refactor (docs/process/todo/media-streaming-upload-refactor.md)
  Designing the chunked upload/session pipeline (SEC-MS-02) to lift photo size caps and improve reliability before updating the guest PWA.
• Paddle Billing Migration & Catalog Sync
  • Platform migration plan tracked in docs/process/todo/paddle-migration.md (env/config, service layer, admin billing).
  • Catalog synchronization and Filament UX tracked in docs/process/todo/paddle-catalog-sync.md.

Next Up (Q1 2026)

• Localized SEO & Hreflang Strategy (docs/process/todo/localized-seo-hreflang-strategy.md)
  Route-prefix migration, hreflang/canonical cleanup, and sitemap realignment for the marketing site and checkout.
• Paddle Customer Success Metrics (spin-off from the migration tasks)
  Finalize tenant ↔ Paddle sync, sandbox catalog seeding, and rollout/rollback procedures before GA. Captured in the remaining unchecked items of the Paddle TODO files.

Recently Completed / Monitoring

• Tenant Admin Onboarding Fusion (docs/archive/process/todo/tenant-admin-onboarding-fusion.md) — Flow merged into the new PWA/TWA stack; keep monitoring localization coverage and checkout UX alignment.
• Event Join Token Hardening (docs/archive/process/todo/event-join-token-hardening.md) — All phases completed; continue monitoring default lifetime/rotation decisions.
• Package Limit Experience Overhaul (docs/archive/process/todo/package-limit-experience-overhaul.md) — Foundation live; alerts/reporting improvements now handled opportunistically.
• Checkout Refactor & Package Limits (docs/process/changes/2025-10-05-checkout-refactor-todo.md) — keep feature flags and alert thresholds under review but no net-new roadmap investment needed right now.

For historical roadmaps predating the split PRP, see docs/archive/implementation-roadmap.md. New initiatives should always start as a docs/process/todo/*.md file and be referenced here once prioritized.