CADENCE — Time to Market
Honest estimate of the engineering and non-engineering work between today and a real, paid launch. Effort sizes are rough (S ≈ ≤1 day, M ≈ 2—4 days, L ≈ 1—2 weeks of focused solo work). "Done" = shipped on
gnhf/cadence, tested, gated.
Where we are (after run #3)
The entire engineering MVP loop is built, tested offline (192 tests), and e2e-verified over real HTTP + a real SMTP wire. Concretely, the appliance is now a continuously-refreshing daemon: it pulls a vendor-signed feed over HTTP on a timer (CADENCE_REFRESH_INTERVAL), verifies it fail-closed (sig-before-parse + per-file SHA-256, into a re-verifiable air-gap mirror dir), reads inventory from a live adapter (Proxmox/NetBox/Nextcloud/apt) or a file, analyzes (conditional + cross-product verdicts, CVE highlighting, reminders), serves a read-only Leptos dashboard with optional Basic auth + a freshness/audit status bar, and delivers notifications on change (no re-spam, with retry) over both real channels — webhook and SMTP email (multi-channel). The Feed Builder CLI signs/validates the feed and now lints it for authoring mistakes. A tamper-evident, hash-chained decision audit trail (dashboard badge + GET /decisions.json export) is the concrete compliance artifact. Four feed modules ship illustrative content, including a PostgreSQL module proving the architecture is product-agnostic.
What that does not yet mean: no real (vs illustrative) advisory content, no docker build verified (the Dockerfile + compose are drafted + runtime-verified but unbuilt — no Docker in CI), no real email/SMTP account (the transport is built), no billing, no landing page, no paying pilot. Those are the road to market below — and notably, what remains is now almost entirely not code.
Milestones
| # | Milestone | Effort | Status |
|---|---|---|---|
M1 |
Feed schema + ed25519 sign/verify + fail-closed loader |
M |
DONE (run 1) |
M2 |
Analysis engine (conditional, cross-product, reminders) |
M |
DONE (run 1) |
M3 |
Feed Builder CLI + sample feed + e2e test |
M |
DONE (run 1) |
M4 |
Inventory adapters behind the trait, offline-testable |
M |
DONE (run 2 — all four: Proxmox, Nextcloud, NetBox, apt) |
M5 |
|
S—M |
DONE (run 2) |
M6 |
Leptos read-only client UI: verdicts per asset + reminders + feed status |
L |
DONE (run 2; SSR, + optional Basic auth) |
M7 |
Notifications: |
M |
DONE (run 3 — both transports REAL: |
M8 |
Client wiring: pull feed (HTTP) → verify → adapter inventory → analyze → notify |
M |
DONE (run 2, S18/S18c; e2e-verified) |
M8b |
Scheduled re-pull + re-evaluate on a timer + notify-on-change (+ retry, + due-reminder alerts) |
S—M |
DONE (run 3; e2e-verified over a live pulled feed) |
M8c |
|
M |
DONE (run 3) |
M9 |
Packaging: Dockerfile + compose that actually builds & serves |
M |
drafted + runtime-verified (run 3); needs a Docker-capable env to verify |
M10 |
Real curated advisory content for 2 modules (ongoing, not one-shot) |
L + ongoing |
todo — the actual product |
M11 |
Feed hosting/CDN + signing-key custody (hardware) + a real SMTP/mail account |
M |
todo (transports built; needs infra accounts) |
M12 |
Billing seam → real provider (Stripe/Paddle); plans/subscriptions |
M |
todo |
M13 |
Landing page + 3 cornerstone content posts + trust page |
M |
todo (copy drafted — |
M14 |
First design-partner MSP + first regulated pilot |
L |
todo |
What’s left for a usable free launch (Community tier) is now almost entirely NOT engineering: the loop, UI, live wiring, auth, the notify-on-change daemon, both real notification transports, the linter, and the compliance audit trail are all done (M4—M8c). The only remaining code task is verifying the M9 Docker build in a Docker-capable env (the artifacts are drafted + runtime- verified — a few hours, not a feature). The dominant remaining work is non-code: M10 (real curated content), M11 (feed hosting + infra accounts), M13 (landing page). Critical path to first revenue: add M11 (feed hosting + a real mail account) + M12 (billing) + M14 on top — another ~3—5 weeks of work plus the sales cycle (MSP/regulated deals are weeks-to-months). The audit trail built in run #3 is the concrete asset for the regulated pitch.
Honest total: the engineering that used to dominate this estimate is largely done and tested; a credible free launch is now gated on the M10 content discipline + a few infra accounts, not on building features — realistically ~1 month to a free launch once content authoring starts in earnest, first paying pilots in ~3—4 months. The research’s €1.5—6k MRR band remains a 12-month target, weighted to MSP/Compliance, contingent entirely on M10 cadence and 2—3 design partners. (No traction exists yet — this is a build/plan, not a result.)
The ongoing human cost (the real operating expense)
The product is a human authoring accurate, timely advisories — research risk #1. This is not a one-off; it is the recurring cost and the bottleneck:
-
Monitoring: track Proxmox/Ceph/Nextcloud release channels, changelogs, forums, and security advisories continuously — to publish a hold before customers upgrade, not after.
-
Authoring cadence: estimate 3—8 hours/week to keep two modules genuinely current (more around major releases like a PVE 8→9 wave). That cadence is the product; if the feed lags reality, the value evaporates and churn follows.
-
Implication for sequencing: do two modules excellently before adding a third. A wide, stale feed is worse than a narrow, current one. Tooling that lowers authoring cost (a good Feed Builder authoring UX, changelog-diff assists) is high-leverage and pays back every week.
Biggest risks to the timeline
-
M10 (content cadence) is unbounded and is the actual product — under-resourcing it sinks the whole thing regardless of code quality.
-
M6 (Leptos UI) is the largest single engineering lump and gates the free launch.
-
Sales cycle for the paying tiers (M14) is slow; start design-partner conversations early, in parallel with M4—M9, not after.