SnowOps — Gap Register¶
Asset codes (e.g.
F1,E0) map to human-readable names indocs/context/00-asset-glossary.md. (TheG#gap IDs in the table below are gap identifiers, not assets.)
Identified gaps in the original plan and their resolutions.
| # | Gap | Impact | Resolution | Closed In |
|---|---|---|---|---|
| G1 | No brownfield / terraform import strategy — all F-modules were greenfield-only |
Blocks Day-30/90 clients; modules only useful for new environments | Brownfield Import Library (F12); F-modules must ship with import blocks; Brownfield-Safe principle added to §2 |
M3 |
| G2 | CI/CD is 100% GitHub Actions — no Azure DevOps path | Blocks enterprise Azure-centric clients running ADO | Azure DevOps Pipeline Templates (C5) (ADO equivalent of the Terraform Plan/Apply Pipeline C1); M2 scoped as "GitHub Actions only" with explicit constraint |
M3 |
| G3 | Cloud-Agnostic Module Contracts (F0) unbuilt but F1–F6 already shipped — modules don't implement the cloud-agnostic interface |
Violates "Cloud-Agnostic by Construction" principle; AWS parity impossible without contracts | F0 sequenced as first item in M2a; F1+F6 tech debt tracked; no new F-module before F0 | M2a |
| G4 | No module versioning or client upgrade path | Every patch requires manual coordination; no way to pin a module version | Module Registry & Versioning (F11) (private registry); semver per module; consumer pin strategy |
M3 |
| G5 | No maturity-tiered entry points — both packages assume greenfield | Day-30/90 clients forced into full engagement even when they only need 3 assets | Maturity entry point table in §3.6; Quick-Win [QW] tier; D-series and C-series explicitly portable onto existing repos |
M1 (QW) / M3 (brownfield) |
| G6 | K8s / AKS assumption baked into Baseline — no path for Container Apps / App Service clients | Non-K8s clients can't adopt D4/F3/F8 and have no container security layer | D4/F3/F8 scoped as "AKS clients" with explicit note; non-K8s clients get the Container Image Scan (I1) + Container Registry Module (F4, ACR) as container security baseline |
M2a |
| G7 | Evidence collection is entirely Advanced-tier — Baseline clients get zero automated evidence | Baseline clients can't satisfy a single auditor question with machine-generated evidence | Compliance Snapshot Collector (E0) created as new Baseline-tier asset; emitted on every Terraform Plan/Apply Pipeline (C1) apply |
M2b |
| G8 | Ticketing is hardcoded (Linear/Jira) across E6, I5, K4, P3 | Different implementation for every client ticketing platform | Ticket Platform Library (E7) TicketPlatform interface + adapters (Jira, GitHub Issues, Linear, Azure DevOps Boards); E6/I5/K4/P3 updated to use E7 |
M3 |
| G9 | Architecture diagrams (Diagram Generator, V2) and the Runbook Generator (V3) are Advanced-only |
Baseline clients receive no documentation of what was built for them | V2 and V3 promoted to Baseline [B]; assigned to M2b |
M2b |
| G10 | No "SnowOps-operated" vs "client-owned" distinction — unclear what happens to client infra if engagement ends | Client adoption and offboarding unclear; hidden dependency on SnowOps repo | Ownership taxonomy added (§3.7): [SO/CO/CA/SH] tags on every asset; docs/client-guides/ with handover guides per milestone |
M1 (taxonomy); ongoing per asset |
| G11 | G (discovery) findings not linked to F (remediation modules) | Discovery report creates urgency but no clear remediation path | G2 rule pack extended to include remediation_asset_id per finding; G3 roadmap links to specific §4 catalog entries |
M1 |
| G12 | No waiver/exception mechanism for OPA policy rules | D3 blocks every brownfield adoption at first terraform plan; no incremental migration path |
D5 (policy waiver engine): time-boxed exceptions with PR-linked audit trail and CI expiry enforcement | M2b |
| G13 | AWS-first prospects can't use the discovery tool (G) | Free audit offer doesn't work for ~30–40% of ICP | G7 (AWS discovery mode); M1/M2/M3 scoped as Azure-only with explicit constraint; G7 in M4 | M4 |
| G14 | No client self-service capability — all onboarding requires SnowOps to run it | Slows engagement start; clients can't self-validate prerequisites | B6 (self-service bootstrap script); clients run it pre-engagement to validate permissions and prerequisites | M3 |
Gaps — Identified in v0.55 Repo Review (2026-06-04)¶
Surfaced by a full-repo review. G15–G17, G19, G20 closed in the same pass; G18 seeded (see Status column).
| # | Gap | Impact | Resolution | Status |
|---|---|---|---|---|
| G15 | GitHub Onboarder App (B1) automated test failed. apps/github-onboarder/src/load-template.test.ts asserted an exact file list for templates/client-repo/.github/workflows/, but 3 workflows were added since (aks-deploy.yml, container-build-sign.yml, sp-inventory-rotation.yml). B1 is marked code_complete. |
Violated DoD #2 (automated test passes). A "code-complete" asset had a red test. | Test rewritten to compute the expected tree from an independent on-disk walk + assert anchor files; resilient to future template additions. 38/38 pass. | ✅ Closed (v0.55 review) |
| G16 | No CI gate ran apps/* unit tests on PR. Per-app deploy workflows existed, but nothing ran npm test across all apps; the GitHub Onboarder App (B1) (github-onboarder) had no workflow at all. |
Regressions landed silently — G15 went unnoticed; DoD #2 unverifiable in CI. | Added .github/workflows/app-tests.yml — dynamically discovers every apps/* with a test script (scaffolds auto-skipped), runs npm ci + typecheck --if-present + npm test in a matrix on PRs touching apps/**. |
✅ Closed (v0.55 review) |
| G17 | CLAUDE.md §2 repo layout was stale. Missing: apps/github-onboarder/ (GitHub Onboarder App B1), apps/cost-cleanup/ (Idle Resource Cleanup U3), apps/soar-playbooks/ (Sentinel SOAR Playbooks K3), modules/aws/, modules/gcp/, trust-center/, waivers/, docs/adr/, docs/packages/, policy/azure-policy/, policy/checkov/, tests/pipeline-integration/. |
Index unreliable; B1's real implementation was invisible in the layout. | §2 refreshed with all missing dirs. | ✅ Closed (v0.55 review) |
| G18 | Zero ADRs despite 50 logged decisions. docs/adr/ was .gitkeep only, but DoD #5 and §3 PR conventions both require "ADR if architectural". |
Architectural rationale not captured per the repo's own convention. | Seeded docs/adr/: README (convention + index), 0000-template.md, and ADRs 0001 (cloud-agnostic contracts), 0002 (Kyverno), 0003 (OIDC federation), 0004 (TF state on Blob). Remaining: backfill ADRs for other architectural D-rows as they're touched. |
🟧 Seeded; ongoing |
| G19 | Terragrunt Live-Infra Reference (F7) live/ "failed" its own format gate. live/validate.sh reported unformatted HCL, yet F7 is code_complete. Root cause: the script used deprecated terragrunt hclfmt/--terragrunt-* flags that current terragrunt rejects — a false positive. HCL was already clean. |
A code-complete asset appeared to ship unformatted HCL on every validate run. | validate.sh updated to the modern terragrunt hcl fmt --check (with legacy fallback) and promoted from a warning to a hard failure. Now passes. |
✅ Closed (v0.55 review) |
| G20 | Idle Resource Cleanup (U3, apps/cost-cleanup/) and Sentinel SOAR Playbooks (K3, apps/soar-playbooks/) are README-only scaffolds whose READMEs described asset behavior as if present, while both are postponed. |
Implied a capability that does not exist. | Both READMEs now carry a "⚠️ SCAFFOLD — postponed (not yet implemented)" banner; layout (§2) tags them as scaffolds too. | ✅ Closed (v0.55 review) |
Gaps — Identified in Compliance Control-Mapping Review (2026-06-07)¶
Surfaced while reading compliance/{soc2,iso27001,hipaa,cis-azure}/control-mapping.md
end to end. The mapping docs are hand-maintained markdown with no link back to
the asset glossary or shipped status, so they drift silently as assets ship or
get renumbered. G21 fixed the found instances in the same pass; G22 is the
underlying systemic fix and is too large for this pass — queued for later.
| # | Gap | Impact | Resolution | Status |
|---|---|---|---|---|
| G21 | Control-mapping docs contained multiple stale asset-code references, found by cross-checking against 00-asset-glossary.md + 06-project-state.md: (1) CIS Azure 6.4/6.5 (WAF, DDoS Standard) were marked 🔧 Partial / "not yet a SnowOps module" — but N3 (WAF Policy Module) and N4 (DDoS Protection) shipped in v0.60; (2) COMPLIANCE-GUIDE.md attributed "Vanta sync" to D2 (PR Quality-Gate Workflow) instead of E2 (Vanta Adapter); (3) ~25 references across all four mapping docs + the guide cited O-series/P-series/Q-series (M4) for vendor risk / HR-training / policy-mgmt using a letter assignment that the asset glossary has since reassigned (vendor risk is now P1–P4, HR/training is Q1–Q5, policy mgmt is V1/Policy Repo Template — the docs had O↔P↔Q rotated one slot stale). |
Auditor-facing docs pointed at the wrong/non-existent assets — e.g. a reviewer following "Vanta sync (D2)" would land on the secret-scanning CI gate, not the evidence adapter; "O-series (M4) tracks vendor register" pointed at Endpoint & Workforce Security instead of Vendor & Third-Party Risk. | Updated CIS Azure 6.4/6.5 to ✅ with N3/N4 + evidence notes (and trimmed the now-resolved WAF/DDoS rows from "What SnowOps Does NOT Automate"); fixed the D2→E2 Vanta reference; remapped all O-series→P-series (vendor risk), P-series→Q-series (HR/training), Q-series→V-series (policy mgmt) across soc2, iso27001, hipaa mapping docs and COMPLIANCE-GUIDE.md (package-selection table + sequencing section too); added L5/S4/E6/E5 (shipped v0.61–v0.65, evidence-relevant) to the "Evidence Wiring" walkthrough and each framework's "key evidence artifacts" line, which previously only listed E0/S2/L4. |
✅ Closed (this pass) |
| G22 | No automated check ties compliance/*/control-mapping.md asset-code references to the asset glossary or shipped status — the same class of staleness that produced G21 (and structurally similar to G15: a hand-maintained list silently drifting from reality). Every new asset ship, rename, or M4→shipped transition requires someone to remember to grep four markdown files plus the engagement guide. |
Auditor-facing compliance evidence (the actual deliverable for SOC 2 / ISO 27001 / HIPAA engagements) silently degrades in accuracy over time; nothing fails CI when it does. | Closed: tests/compliance-lint/check_control_mappings.py — pure-stdlib Python script that (a) extracts every `[A-Z]\d+` backtick-wrapped asset-code token and *-series references from the four control-mapping docs + COMPLIANCE-GUIDE.md, (b) resolves each against docs/context/00-asset-glossary.md (ERROR on unknown codes), and (c) cross-references ⏳ Roadmap / "not yet a SnowOps module" markers against 04-asset-status.md 🟦/🟩 status (WARN when a roadmap row's named asset is now done). 24 unit tests (test_check_control_mappings.py). CI gate: .github/workflows/compliance-lint.yml. In the same pass found and fixed two real instances: five `D22` backtick-wrapped decision references (not an asset code — changed to plain-text decision D22) and one stale ⏳ Roadmap row referencing `H5` (which is 🟦 code-complete — removed the backtick code since H5 is only an analogue, not the actual unbuilt guest-review tool). |
✅ Closed |