Roadmap and engineering log
This page is the project’s changelog for humans: a short list of engineering changes that matter, and what is planned next. The full, generated history is in CHANGELOG.md, which semantic-release maintains.
Planned
Section titled “Planned”In rough priority order. Each item links to where the gap is described.
| # | Item | Why | Status |
|---|---|---|---|
| 1 | Health checks and probes | Map /health/live and /health/ready (packages are already referenced), add Kubernetes liveness and readiness probes |
not started |
| 2 | JWT authentication | Validate the Azure AD B2C tokens the frontend already sends: Ocelot AuthenticationOptions plus AddAuthentication().AddJwtBearer() in services; replace the hard-coded "system" and "slowey" actors |
not started |
| 3 | Transactional outbox | Reliable publish for Basket checkout and Catalog activity (the checkout consumer is already idempotent) (Event bus) | in progress |
| 4 | Observability depth | Shared telemetry extension; MassTransit, EF Core, Mongo and Redis spans; OTel metrics that feed the business dashboards | not started |
| 5 | .NET Aspire for local orchestration | Replace the Compose-based inner loop with an Aspire AppHost (service discovery, dashboard with logs, traces and metrics) while keeping Compose and Helm for deployment | exploring |
| 6 | Payment data hygiene | Stop sending and storing card number and CVV; tokenize at the edge | not started |
| 7 | Infrastructure convergence | Pick one IaC path (Terraform), enable its remote state, align naming with CD, add an apply job with environment approvals |
not started |
| 8 | Strict mTLS and policies | PeerAuthentication STRICT, sidecars for Ordering, AuthorizationPolicy per service, working NetworkPolicies |
not started |
Engineering log
Section titled “Engineering log”Newest first.
| Date | Change | Reference |
|---|---|---|
| 2026-09 | Backend correctness + tests: mediator resolves handlers per scope (every Development request used to 500), shared RFC 7807 errors via Common.Api, 404/empty basket instead of 500, paging clamps, checkout validated before publishing, gRPC deadline, log-forging fix. 86 unit tests plus an end-to-end smoke test that drives checkout through the gateway, RabbitMQ and Ordering |
#564 |
| 2026-09 | Data integrity + fail-fast startup: Ordering migrations regenerated (fresh databases got no schema), Discount stops dropping coupons, Catalog seeds once with unique indexes, S3 delete after the DB write, idempotent checkout consumers with retry. 11 Testcontainers integration tests | #562 |
| 2026-09 | Documentation website (this site): Astro + Starlight, every page grounded in the code, with interactive architecture diagram | website/ |
| 2026-09 | Clearer frontend names: frontend/micro-frontends renamed to frontend/web (current), frontend/client to frontend/legacy-angular (deprecated) |
merged with #556 |
| 2026-09 | Standardized repository layout: src/Services, src/ApiGateways, src/BuildingBlocks, frontend/, deploy/, docs/, tests/load/k6. All workflows, Dependabot, Compose, scripts and docs updated. Dockerfiles now copy the full project graph and global.json before restore, so the restore layer caches |
#556 |
| 2026-09 | Nx 23.2.1 alignment: all 11 Nx packages migrated together with nx migrate (a Dependabot security bump had moved only 4), webpack pinned, @module-federation/runtime added; npm audit went from 31 to 3 findings |
#541 |
| 2026-06 | Green CI: lockfile re-sync, k6 install fix, redundant workflow dropped, Dependabot grouping; Nx excluded from Dependabot; dependency and CI policy documented | #468, #475, #477 |
| 2026-05 | Auto-merge for Dependabot patch and minor bumps | dependabot-auto-merge.yml |
| 2026-05 | MediatR replaced with in-house Common.Mediator (MediatR 13+ is commercially licensed) |
Mediator |
| 2026-05 | .NET 10 modernization: target framework net10.0, SDK pinned in global.json, central package management, AutoMapper replaced with Mapperly, MassTransit aligned on 8.x, Newtonsoft removed, known CVEs fixed |
Directory.Packages.props |
| 2026-05 | Docker build matrix restricted to linux/amd64 (protoc segfaults under QEMU arm64) |
docker.yml |
| 2026-03 | Terraform for AWS: 8 modules (VPC, security, EKS, ECR, databases, Amazon MQ, S3, OpenSearch) plus a Terraform CI workflow | deploy/terraform |