meta: roadmap

[somethingwithproof]

Order

Each step is chosen so the next one is easier or cheaper to build.

	Work	Issue	Why here
1	CSP detection with a visible message	#96	Closes the actual user pain now. Three reports (#12, #15, #16) are the same blank page with no explanation.
2	Poller logging and an excluded-devices view	#97	Makes everything after it diagnosable. Today a missing device has five possible causes and none of them are visible.
3	OSM/Leaflet as a map provider	#8	Removes the API key barrier and most of the CSP problem in one move. Requested since 2018.
4	Sites integration	#2, #4	Cacti already knows where a site is. Reusing that makes setup close to automatic.
5	Geocoding, then marker and icon work	#98, #5	Fills in coordinates without hand entry; marker styling follows once devices actually appear.

Why this order

3 partially obsoletes 1. A Leaflet build serving its own tiles needs no third-party script host, so the CSP problem mostly disappears. That is not a reason to defer 1: the Google path stays supported, existing installs keep using it, and the people hitting the blank page today should not wait for a provider rewrite.

4 depends on 2. Sites integration changes which devices land on the map, and reviewing that change without the excluded-devices view means reading the poller by hand.

5 depends on 3 in practice. Nominatim needs no API key but requires caching and a real User-Agent, which fits the OSM work rather than the Google work.

Current state

Cacti core is on 1.2.31 with 1.3 in development. The plugin last released v2.1 in 2019 and declared compat = 1.1.17. In flight:

• fix(setup): correct database include path in gpsmap_check_upgrade #93 repairs the upgrade path, which fatals on every version change
• docs: document the Content Security Policy settings the map requires #94 documents the CSP settings
• chore(info): raise compat to 1.2.15 #95 raises compat to 1.2.15
• hardening: output escaping, path validation, and auth guards #83 covers escaping, bound queries and auth guards

Anything here is a proposal, not a commitment. Comments on ordering are welcome, particularly from anyone running the plugin at scale.