Roadmap
Milestones are sequenced by dependency and risk. The rule: nothing ships to the public until the agent is trustworthy; a fleet agent that has to be recalled is a project-ending event. Estimates assume a small, part-time effort with AI assistance.
Done
M0: Foundation
The design corpus: vision, feature-parity analysis against every Landscape feature, architecture, data model, API design, agent design, security model, and the decision records.
M1: Skeleton
The thinnest end-to-end path: a Windows VM registers, appears in the database, survives
a server restart without losing messages, and survives its own reboot without losing its
spool. PostgreSQL schema and migrations, the FastAPI app with JWT auth and RBAC, the
register / exchange / ping
protocol with signed-body auth, the .NET agent with its SQLite spool, and MSI packaging.
M2: Inventory & activities
All collectors; software identity and cross-provider dedup; the activity and activity-group model with dispatch, aggregation and cancellation; tags, annotations and the query language; TPM-bound identity; the first usable web screens (host list, host detail, search). Exit: a real fleet is inventoried and searchable.
M3: Execution & monitoring
The script library with versions and attachments, ad-hoc and scheduled execution, the
isolated portrait-exec host; metrics with rollups and a host-detail graph;
processes, services, local-accounts and security-posture collectors; alert rules with
SMTP and signed-webhook sinks; the audit log and CEF/NDJSON SIEM export; a security
assessment of the execution path. Exit: the tool is genuinely useful. Internal alpha.
M4: Patching & profiles (the value milestone)
WUA-driven patch inventory with real classification and severity; the profile
evaluation model and all five profile types with evaluators and web UI;
install / upgrade / remove dispatch for Windows Update and WinGet; maintenance windows;
reboot orchestration with a user-deferral prompt; the portraitctl CLI with
a generated client; backup and restore; agent self-update with staged rollout and
rollback, the roadmap’s own number-one fleet risk. Exit: feature-complete
against Portrait’s value proposition.
In progress
M5: Security & scale
Self-service enrollment and the pending-approval hold zone; permanent host removal; duplicate-host detection and clone recovery (a full quarantine-and-recovery chain, once testing showed a lighter approach was not enough); BitLocker recovery key escrow with audited reveal, and LAPS escrow; OIDC authentication; MSIX/Store app management; optional WebSocket dispatch; load testing to the 5,000-host design point; and dropping Redis in favor of PostgreSQL primitives. Exit: v1.0.
After v1.0
- M6: Compliance & provisioning. CIS/STIG audit reporting;
WSL inventory and Landscape hand-off; feature-update orchestration;
unattend.xml/.ppkgprovisioning generation; Windows Server as a co-equal platform for the server tier. - M7: Enforcement. Compliance remediation (audit → enforce); WDAC/AppLocker policy deployment; configuration-drift management.
- M8: Scale-out, as demanded. Multi-tenancy activation; horizontal app tier; read replicas; a minimal package-deploy capability if software delivery turns out to be the dominant request.
Known risks
| Risk | Mitigation |
|---|---|
| An agent bug bricks the management path fleet-wide | Staged rollout, health-check rollback, an independent local Event Log, and an offline agent that stays manageable by never depending on the server to survive |
| Scope creep toward Intune parity | The non-goals are load-bearing: not an MDM, not an EDR, not an imaging server, not a software distribution point, not AD-aware |
| Maintainer bandwidth after release | Quiet release by design, no promotion, real docs, an explicit support statement |
This is a summary. The authoritative status lives in the project’s roadmap and shakedown documents, which are verified against the code rather than assembled from notes.