What problem does it solve? When planning what to build next in the TinySocs SIEM codebase, it is easy to lose track of which subsystems are genuinely missing versus already shipped, or to accidentally claim deferred features exist. This Skill provides a verified catalogue of the seven open engineering gaps, ordered by leverage toward the first paying customer, so planning decisions rest on ground truth rather than stale strategy docs. ## Core Features & Use Cases - Gap catalogue with evidence: Each of the seven deferred subsystems (allowlist runtime, signed-pack activation, FP telemetry, Python KQL backend runner, baseline engine, premium-tier packs, AI-assisted triage) includes why it was deferred, with file paths and line numbers verified against the repository. - Actionable starting points: Every entry lists the concrete assets already in the repo, the first three implementation steps with real file paths, and a falsifiable milestone defining done. - Honesty guardrails: Explicit instructions prevent describing unbuilt features as shipped and route changes through the appropriate change-control and positioning skills. - Use Case: When asked "what should I work on next" or "is the allowlist feature built yet," load this Skill to get an accurate, source-cited answer instead of guessing from outdated roadmap documents. ## Quick Start Ask what is left to build in TinySocs before the first paying customer and which gap to tackle first.
