Roadmap: 0.9

README.md

@@ -418,6 +418,53 @@ Shipped:
 
 Planned, in order:
 
+- **0.9.0 — Coverage, stated rather than assumed.** Flowlight says it sees every connection, and then the honest
+  paragraphs elsewhere explain the exceptions: traffic from before the filter started, system services exempt
+  from content filters, a Mac where another content filter owns the slot, apps that pin their certificates, QUIC
+  the proxy never sees, and an agent's local MCP server talking over a pipe. Today you have to know all of that
+  to read the screens correctly. A coverage view would say it per app: watched by the extension, decrypted by
+  the proxy, named only by DNS or SNI, or not covered at all — and *why*, with the fix where there is one. It is
+  the difference between a tool that claims completeness and one that can be trusted about its own limits.
+- **0.9.1 — A threat model, written down.** What Flowlight defends against, and what it does not, on one page:
+  software on this Mac behaving badly in the open; not software with root, which can switch the filter off.
+  A signed update from someone who is not us — which 0.8.2 closed. A VPN or security agent holding the content
+  filter slot. Certificate pinning, QUIC, and anything routed around the proxy. The product language should say
+  **monitoring, not prevention** beside every mention of blocking, because "block" invites a guarantee the
+  design cannot make. Alongside it, a security contact address and key for people who can't or won't use
+  GitHub's private reporting, and the web fonts served from this domain rather than Google's — a local-first
+  tool shouldn't make a third-party request to render its own privacy page.
+- **0.9.2 — A budget for inspection.** HTTPS inspection records request and response bodies for three days, and
+  that is the most sensitive thing Flowlight ever holds. The redaction that protects it is a guess at which
+  headers carry credentials — improved in 0.8.2, still a guess. This turns it into something with limits you
+  set: a header allowlist rather than a denylist, patterns of your own, an option to keep no headers at all,
+  per-app byte ceilings, bodies deleted on a schedule you choose, and an inspection session that expires by
+  itself instead of running until someone remembers.
+- **0.9.3 — Show me what this rule would have done.** A rule that refuses connections is easy to write and
+  frightening to switch on, because the first thing you learn about it is what it breaks. Simulation replays the
+  last day of recorded traffic against a rule and lists what it would have refused, before it refuses anything.
+  The data is already there; it has only ever been used to explain the past.
+- **0.9.4 — What leaves the Mac, before it leaves.** The OpenTelemetry export sends recorded traffic to a
+  collector someone typed in. Before the first row goes, it should show the destination, whether the connection
+  is encrypted, exactly which fields travel and whether any of them are headers — the same disclosure Flowlight
+  demands of everything else it watches, applied to itself.
+
+- **1.0 — What an agent did besides the network.** Flowlight can say that Claude Code uploaded 40 MB to an
+  unfamiliar host. It cannot say that it read `~/.ssh/id_rsa` first, and that second half is the exfiltration
+  story: a file leaving is a read followed by a send, and only the send is visible today. This would record
+  what an agent's tools opened, wrote and spawned, and line it up against the connections that followed —
+  *read the private key, then talked to paste.example* as one finding rather than two screens.
+
+  It is not a resource monitor. CPU, memory and energy per process are Activity Monitor's job, done well and
+  built into the Mac already; the only number of that kind worth having here is "this agent was busy while you
+  were away", which belongs beside the away-activity alert rather than in a tab of its own.
+
+  **Two things gate it, both stated here rather than discovered later.** Per-process file attribution on macOS
+  needs the EndpointSecurity framework, whose entitlement Apple grants on request and review — not a
+  checkbox — and which only works from a system extension. And it would put far more sensitive material in
+  Flowlight's hands than network metadata ever did, so the inspection budget in 0.9.2 stops being a nicety and
+  becomes the thing that has to exist first. A tool that asks you not to monitor it has to deserve that twice
+  over when it can see every file you open.
+
 Later, no version yet:
 
 - **Linux (Ubuntu).** A daemon plus a local web UI, sharing the Swift core (storage, protocol classification, agent

docs/index.html

@@ -402,6 +402,12 @@ <h2>What's coming</h2>
         <p class="lede">Flowlight watches, explains and refuses today. This is the order the rest is being built in.</p>
       </div>
       <div class="privacy">
+        <div><strong>Coverage, stated rather than assumed <span class="tag">0.9.0</span></strong><p>Per app: watched by the extension, decrypted by the proxy, named only by DNS or SNI, or not covered at all — and why, with the fix where there is one. A tool that claims completeness is worth less than one you can trust about its own limits.</p></div>
+        <div><strong>A threat model, written down <span class="tag">0.9.1</span></strong><p>What Flowlight defends against and what it doesn't, on one page: software misbehaving in the open, not software with root. Monitoring, not prevention, said beside every mention of blocking. Plus a security contact, and fonts served from here rather than from Google.</p></div>
+        <div><strong>A budget for inspection <span class="tag">0.9.2</span></strong><p>Recorded bodies are the most sensitive thing Flowlight holds. A header allowlist instead of a denylist, patterns of your own, an option to keep no headers at all, per-app ceilings, and a session that expires by itself.</p></div>
+        <div><strong>Show me what this rule would have done <span class="tag">0.9.3</span></strong><p>Replay the last day against a rule and list what it would have refused, before it refuses anything. The data is already there; it has only ever explained the past.</p></div>
+        <div><strong>What leaves the Mac, before it leaves <span class="tag">0.9.4</span></strong><p>Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself.</p></div>
+        <div><strong>What an agent did besides the network <span class="tag">1.0</span></strong><p>A file leaving is a read and then a send, and only the send is visible today. Recording what an agent's tools opened, wrote and spawned would make <em>read the private key, then talked to paste.example</em> one finding instead of two screens. Not a resource monitor: CPU and memory are Activity Monitor's job. Needs Apple's EndpointSecurity entitlement, and needs the inspection budget above to exist first.</p></div>
         <div><strong>Linux, then Windows</strong><p>The analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs.</p></div>
       </div>
     </div>

docs/llms-full.txt

@@ -1034,6 +1034,18 @@ e.g. Wireshark
 
  Flowlight watches, explains and refuses today. This is the order the rest is being built in.
 
+ Coverage, stated rather than assumed 0.9.0Per app: watched by the extension, decrypted by the proxy, named only by DNS or SNI, or not covered at all — and why, with the fix where there is one. A tool that claims completeness is worth less than one you can trust about its own limits.
+
+ A threat model, written down 0.9.1What Flowlight defends against and what it doesn't, on one page: software misbehaving in the open, not software with root. Monitoring, not prevention, said beside every mention of blocking. Plus a security contact, and fonts served from here rather than from Google.
+
+ A budget for inspection 0.9.2Recorded bodies are the most sensitive thing Flowlight holds. A header allowlist instead of a denylist, patterns of your own, an option to keep no headers at all, per-app ceilings, and a session that expires by itself.
+
+ Show me what this rule would have done 0.9.3Replay the last day against a rule and list what it would have refused, before it refuses anything. The data is already there; it has only ever explained the past.
+
+ What leaves the Mac, before it leaves 0.9.4Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself.
+
+ What an agent did besides the network 1.0A file leaving is a read and then a send, and only the send is visible today. Recording what an agent's tools opened, wrote and spawned would make read the private key, then talked to paste.example one finding instead of two screens. Not a resource monitor: CPU and memory are Activity Monitor's job. Needs Apple's EndpointSecurity entitlement, and needs the inspection budget above to exist first.
+
  Linux, then WindowsThe analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs.
 
  Privacy

docs/sitemap.xml

@@ -2,7 +2,7 @@
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
   <url><loc>https://flowlight.xinbetween.com/about/</loc><lastmod>2026-09-25</lastmod></url>
   <url><loc>https://flowlight.xinbetween.com/docs/</loc><lastmod>2026-09-26</lastmod></url>
-  <url><loc>https://flowlight.xinbetween.com/</loc><lastmod>2026-09-26</lastmod></url>
+  <url><loc>https://flowlight.xinbetween.com/</loc><lastmod>2026-09-27</lastmod></url>
   <url><loc>https://flowlight.xinbetween.com/privacy/</loc><lastmod>2026-09-25</lastmod></url>
   <url><loc>https://flowlight.xinbetween.com/releases/</loc><lastmod>2026-09-27</lastmod></url>
   <url><loc>https://flowlight.xinbetween.com/de/about/</loc><lastmod>2026-09-26</lastmod></url>

site/pages/index.html

@@ -348,6 +348,12 @@ <h2>What's coming</h2>
         <p class="lede">Flowlight watches, explains and refuses today. This is the order the rest is being built in.</p>
       </div>
       <div class="privacy">
+        <div><strong>Coverage, stated rather than assumed <span class="tag">0.9.0</span></strong><p>Per app: watched by the extension, decrypted by the proxy, named only by DNS or SNI, or not covered at all — and why, with the fix where there is one. A tool that claims completeness is worth less than one you can trust about its own limits.</p></div>
+        <div><strong>A threat model, written down <span class="tag">0.9.1</span></strong><p>What Flowlight defends against and what it doesn't, on one page: software misbehaving in the open, not software with root. Monitoring, not prevention, said beside every mention of blocking. Plus a security contact, and fonts served from here rather than from Google.</p></div>
+        <div><strong>A budget for inspection <span class="tag">0.9.2</span></strong><p>Recorded bodies are the most sensitive thing Flowlight holds. A header allowlist instead of a denylist, patterns of your own, an option to keep no headers at all, per-app ceilings, and a session that expires by itself.</p></div>
+        <div><strong>Show me what this rule would have done <span class="tag">0.9.3</span></strong><p>Replay the last day against a rule and list what it would have refused, before it refuses anything. The data is already there; it has only ever explained the past.</p></div>
+        <div><strong>What leaves the Mac, before it leaves <span class="tag">0.9.4</span></strong><p>Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself.</p></div>
+        <div><strong>What an agent did besides the network <span class="tag">1.0</span></strong><p>A file leaving is a read and then a send, and only the send is visible today. Recording what an agent's tools opened, wrote and spawned would make <em>read the private key, then talked to paste.example</em> one finding instead of two screens. Not a resource monitor: CPU and memory are Activity Monitor's job. Needs Apple's EndpointSecurity entitlement, and needs the inspection budget above to exist first.</p></div>
         <div><strong>Linux, then Windows</strong><p>The analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs.</p></div>
       </div>
     </div>