Feature status & roadmap

Cushy ships in rounds. Most major surfaces are now real (implemented and covered by the end-to-end suite); a few remain on the roadmap. This page states the honest status of each so you never mistake a roadmap item for a shipping feature.

Terraform

Real. The full execution engine ships: blueprints compose to native HCL, plan → policy/cost gates → approval (with per-workspace separation of duties) → apply-the-saved-plan, encrypted state versions with rollback, drift refresh, import/adopt of discovered resources, workspace folders, and the GitOps hydrated-repo commit. By default an apply is recorded-only (modeled in inventory and state); once you enable Terraform provisioning on a cloud account, the apply runs real OpenTofu against your live cloud with short-lived credentials. See the Terraform guide.

Pipelines

Pipelines are the deploy control plane for both applications and infrastructure. An application pipeline builds a connected application Git repo and deploys it to an optional infrastructure Terraform workspace (source → build → deploy — real with an enrolled deploy agent). An infrastructure pipeline drives a Terraform workspace's real lifecycle (plan → policy/cost → approve → apply through the same engine, honoring the account's provisioning opt-in) and is auto-created with every workspace. A production workspace still requires a second operator to approve before apply — the plan author cannot self-approve. Application build/deploy against live infrastructure and Kargo-style freight/promotion are still on the roadmap.

Git connections

The Git-connections screen connects real GitHub, GitLab and Bitbucket repositories with a personal access token (stored encrypted, never echoed). Until you connect a repository the screen shows an empty state — there is no demo data.

AI assistant

The assistant overlay is wired to a real OpenAI-compatible model (Gemini, Ollama, vLLM or a hosted endpoint by configuration) and grounds each answer on a compact, read-only, org-scoped summary of your real infrastructure plus a retrieval of your prior questions (RAG). When no backend is configured it says so honestly — it never fabricates an answer.

Image attachments. Attach up to 4 images (PNG, JPEG, WebP or GIF, ≤5MB each) to a question — click the 📎 button in the assistant composer. The images are validated and forwarded server-side to the model as multimodal content, so you can ask about a screenshot, an architecture diagram or an error dialog. Attachments are transient (sent with the turn, never stored); a turn may be image-only with no text.

Monitoring & incidents

For a connected organization the Incidents screen shows real correlated incident timelines (alerts plus change events) from the monitoring engine; a never-connected organization sees an empty state — there is no demo timeline.

SAML & SCIM

Real. SAML 2.0 single sign-on (SP-initiated and IdP-initiated), SCIM 2.0 provisioning with deactivate-based deprovisioning, and IdP group-to-role mapping (highest privilege wins) all ship — see SAML & SCIM. SAML Single Logout and encrypted assertions are not yet supported.

Azure & Alibaba connections

Real now. All four cloud connection adapters — AWS, GCP, Azure and Alibaba — are live. Azure uses OIDC workload-identity federation to an Entra app/service principal (no client secret); Alibaba uses RAM AssumeRoleWithOIDC via a customer RAM OIDC provider and role (no AccessKeySecret). Each connects, syncs inventory + network topology, reports cost, and can deploy (bucket / compute / VPC blueprints). Cross-cloud connectivity is real — a site-to-site IPsec VPN across all six cloud pairs (see the *Cross-cloud connections* guide); self-service account vending remains on the roadmap.

Marketplace

On the roadmap. Not started.