Mortar roadmap

Living document. Updated each session. The M-series aligns with Keel so the two infrastructure products ship in lockstep.

M = Milestone. Mortar/Keel use M numbering for launch maturity; distinct from Fabric’s V numbering (V = project type).

Status legend: [ ] not started, [~] in progress, [x] done.

M0 historical content was merged into M1 § Historical context; the external product numbering starts from M1.

M1 (public launch — ~3 months) — Mortar Cloud beta

Historical context — internal dogfood phase (pre-M1, 2025–2026.05)

Internal use only. 6 primitive (compute / database / cache / storage / network / function) × 5 feature (auth / data / files / realtime / usage) skeleton, backing Fabric’s AI bundle runtime. No public Mortar Cloud brand yet.

✅ 6 primitive interfaces + LocalDisk + Postgres + self-hosted Redis impls
✅ 5 feature CRUD endpoints
✅ Per-project JWT + admin API keys
✅ Usage credit ledger
✅ Plan gate (Tier 1-5)

M1 — first public release

M1 is the “first time anyone outside appunvs can use Mortar”. All launch-critical infrastructure + go-to-market surface. Most items already shipped this session; the remaining items are operational (ICP filing / merchant accounts / deploy runbooks).

Items already shipped this session are marked [x]; new items still [ ]:

Code

Operational (non-code, lawyer/operator-required)

ICP filing + public security filing + tax registration
WeChat Pay / Alipay merchant accounts (production credentials)
Production monitoring stack (Aliyun SLS + Aliyun monitoring + Grafana)
Phase 1–6 infrastructure (VPC / RDS / Tair / OSS / FC / ALB / domain)
Privacy policy (GB/T 35273 compliant)
Terms of Service
Data Processing Agreement (enterprise)
SLA published (99.9% target)
Documentation site (uses Fabric dogfood)

M2 (production hardening — ~3 months)

Post-launch polish — what customers complain about in the first 2 weeks of real traffic. Doesn’t block the M1 ship.

M3 (feature completeness — ~6 months)

Expand Mortar’s feature breadth to cover the standard capabilities a modern BaaS ships (cron / FTS / vector / queue). Each item is 1–2 sprints of work; they can run in parallel.

Edge function cron triggers (compute primitive extension)
Custom domains (user plugs their own domain into Mortar)
Full-text search (pg_search or Meilisearch sidecar)
Vector embeddings + RAG cookbook (pgvector helpers)
Queue / background jobs (pg-boss or sidekiq equivalent)
Realtime presence + broadcasts (separate channel from row change) — done: realtime.channel() (broadcast + presence) over SSE+POST, 4-SDK; completes the Supabase Realtime triad

M4 (scale + multi-region — ~12 months)

Customer-growth-driven; activated when the first big customer signs.

Database branches (git-like Postgres branching, PR-per-database)
Read replicas (config + connection pool routing)
Per-project dedicated RDS (Large+ tier; isolates noisy neighbors)
Multi-region (China-North + China-South + Singapore international)
BYOC (Bring-your-own-cloud — customer’s AWS hosts data; Mortar binary is a stateless control plane)
Cross-cloud failover (Aliyun ↔ AWS dual-deploy for enterprise)
AWS backends (backend/aws/{s3,lambda,stripe}.go — international expansion; managed Redis via MORTAR_CACHE_REDIS_URL pointed at ElastiCache, no separate backend needed)
Bug bounty program (HackerOne or in-house)

M5 (Enterprise — shared pack with appunvs + Keel)

⚠️ M5 is NOT Mortar-only. AppUnvs / Mortar / Keel ship a single enterprise pack — one Helm chart, one SSO gateway, one RBAC schema, one SLA contract, one audit log. See keel/docs/roadmap.md § M5 for the shared design.

Mortar-specific items inside the shared pack:

Per-customer SSO mapping to mortar_accounts (account_id ←→ SAML subject)
RBAC roles: mortar.project.owner / mortar.project.member / mortar.usage.viewer etc.
Audit log emit to shared SIEM stream (Splunk / SLS / Elastic)
Private deploy: Mortar Helm chart variant included in the appunvs-enterprise umbrella chart
SOC 2 / ISO 27001 controls (data encryption at rest, key rotation, retention policy)
Bring-your-own-encryption-key (KMS integration)
HIPAA / Level-3 cyber-security compliance documentation

For SSO / RBAC / audit / monitoring / SLA detail, see Keel M5 (same content).

Decisions still open

Mortar Center stack — Next.js (Vercel) vs Nuxt (Vue) vs SvelteKit? Recommendation: Next.js for ecosystem maturity + AI tool familiarity.
CLI distribution — pure npm vs single static binary vs both? Recommendation: both — npx @mortar/cli for try-it-once + mortar global binary for daily use.
OpenAPI hand-written vs auto-gen — hand-written is simpler today; auto-gen scales when the API grows past ~30 endpoints. Recommendation: hand-written for M0, switch when it hurts.
Native SDK release order — Swift first (iOS Mortar Cloud customers), then Kotlin, then Dart? Or all 3 in parallel? Depends on hiring.
Per-project OSS bucket vs shared bucket+prefix — buckets are easier for billing, prefix is easier for ops. Recommendation: shared bucket + prefix (one bucket, simple lifecycle policies).

Already done

See feat/mortar-init git log; high-level summary:

W1–W6: skeleton → auth → data → storage → realtime
Hexagonal refactor: 6 primitives + features + backend layout
W7.a–d: pricing model + credit ledger + plan.Gate + dashboard endpoint
Egress→Network rename
Network usage recording (event-time)
Hourly ticker (baseline + storage + cache_overage)
Payment package moved out of primitive/ to internal/payment/
50+ unit tests + 1 storage roundtrip + 2 RLS integration tests

14+ commits on feat/mortar-init (push blocked by a GitHub account suspension; will land when restored).