Implementation Plan
This document outlines the roadmap to transform the current system into an enterprise-grade, procurement-ready platform.
Priority Matrix
| Priority | Timeframe | Focus | Outcome |
|---|---|---|---|
| P0 | This week | Blockers | System coherence |
| P1 | 2 sprints | Procurement-grade | Enterprise sales ready |
| P2 | 1-2 months | Full enterprise | Complete platform |
Dependency Graph
flowchart TD
P0_1[P0.1: QSA as IdP] --> P0_2[P0.2: QuantumLock Core]
P0_1 --> P0_3[P0.3: Evidence Skeleton]
P0_2 --> P0_3
P0_3 --> P1_1[P1.1: Observability]
P0_1 --> P1_4[P1.4: Security]
P1_1 --> P2_3[P2.3: DR/Backups]
P1_4 --> P2_2[P2.2: Supply Chain]
P0_1 --> P2_1[P2.1: SCIM/SAML UI]
P1_2[P1.2: Billing UI]
P1_3[P1.3: Entitlements CRUD]
P2_4[P2.4: Multi-Env]
P0 — Immediate Blockers (This Week)
P0.1 — QSA as Primary IdP
Current: Portal uses Zitadel, QSA exists separately
Target: QSA is single IdP for all services
| Task | File | Status |
|---|---|---|
| Configure Portal Frontend OIDC | portal-frontend/public/config.js | ⬜ |
| Configure Admin Frontend OIDC | admin-frontend/public/config.js | ⬜ |
| Update Portal Backend JWT validation | portal-backend/app/auth.py | ⬜ |
| Create Service Principals in QSA | QSA Admin | ⬜ |
| Deprecate Zitadel integration | portal-backend/app/zitadel_service.py | ⬜ |
Dependencies: QSA running with OIDC endpoints
Effort: 3-4 days
P0.2 — QuantumLock as Core
Current: Portal has some license logic
Target: Portal is gateway-only; QuantumLock is source of truth
| Task | File | Status |
|---|---|---|
| Implement M2M client | portal-backend/app/quantumlock_client.py | ✅ |
| Refactor license routes | portal-backend/app/quantumlock_routes.py | ⬜ |
| Add KMS endpoints to QuantumLock | quantumlock/quantumlock_api/main.py | ⬜ |
| Test license flow E2E | Tests | ⬜ |
Dependencies: P0.1 (Service Principal)
Effort: 3-4 days
P0.3 — Evidence Plane Skeleton
Current: QCOS Shim returns demo data
Target: Real storage, DB, and signing
| Task | File | Status |
|---|---|---|
| Set up Object Storage | MinIO/S3 | ⬜ |
| Create Evidence DB tables | migrations/004_evidence_tables.sql | ✅ |
| Implement Storage Service | portal-backend/app/storage_service.py | ✅ |
| Implement Evidence Service | portal-backend/app/evidence_service.py | ✅ |
| Create Evidence Models | portal-backend/app/evidence_models.py | ✅ |
Dependencies: P0.2 (QuantumLock for signing)
Effort: 5-7 days
P1 — Procurement-Grade (2 Sprints)
P1.1 — Observability Stack
| Task | Description |
|---|---|
| Structured Logging | JSON logs with correlation_id, tenant_id |
| Metrics (Prometheus) | Request latency, error rates, business metrics |
| Tracing (OpenTelemetry) | Distributed tracing across services |
| Alerting | SLOs, PagerDuty/Slack integration |
P1.2 — Billing Admin UI
| Task | Description |
|---|---|
| Billing resource | CRUD for invoices in Admin Frontend |
| Usage Dashboard | Charts, MRR, churn metrics |
| Billing Settings | Tax, payment methods, webhooks |
P1.3 — Entitlements CRUD
| Task | Description |
|---|---|
| Backend endpoints | POST/PUT/DELETE for entitlements |
| Frontend UI | Create/Edit forms with feature picker |
P1.4 — Security Hardening
| Task | Description |
|---|---|
| API Gateway | Traefik/Kong with rate limiting |
| Security Headers | CORS, CSP, HSTS |
| mTLS | For M2M communication |
| Secrets Management | Vault/Azure Key Vault |
P2 — Full Enterprise (1-2 Months)
P2.1 — SCIM/SAML UI
- SAML Configuration UI (metadata, attribute mapping)
- SCIM Configuration UI (endpoints, sync status)
- SSO Testing Tools (assertion viewer, diagnostics)
P2.2 — Supply Chain Security
- SBOM Generation (Syft/Trivy)
- Vulnerability Scanning (CI/CD)
- Image Signing (Cosign)
- Dependency Review (Dependabot)
P2.3 — DR and Backups
- Automated daily backups
- Point-in-time recovery
- Cross-region replication
- DR runbook and testing
P2.4 — Multi-Environment Setup
- DEV/STG/PROD parity
- CI/CD pipelines
- Feature flags
- Seed data automation
Success Criteria
P0 Complete
- All frontends authenticate via QSA
- All licenses generated via QuantumLock M2M
- Evidence bundles stored with DB metadata
- Evidence signatures verified via QuantumLock
P1 Complete
- Structured logs with correlation IDs
- Prometheus metrics exposed
- Billing manageable in Admin UI
- Entitlements CRUD working
- Rate limiting active
P2 Complete
- SCIM/SAML configurable via UI
- SBOM for all images
- Daily backups verified
- DR tested
- CI/CD to all environments
Risk Register
| Risk | Impact | Mitigation |
|---|---|---|
| QSA migration breaks auth | High | Feature flag, parallel auth |
| QuantumLock unavailable | High | Circuit breaker, cache validations |
| Storage costs spike | Medium | Retention policies, compression |
| Evidence signing latency | Medium | Async worker, queue |
| Breaking API changes | Medium | Versioning, deprecation policy |
Team Allocation
| Phase | Backend | Frontend | DevOps | QSA |
|---|---|---|---|---|
| P0 | 80% | 20% | 40% | 20% |
| P1 | 40% | 60% | 60% | 20% |
| P2 | 20% | 40% | 80% | 60% |