# SRS v1.1 implementation gap matrix

The SRS remains the product target. This release is a first implementation slice, not full delivery.

| SRS family | Current slice | Remaining |
|---|---|---|
| FR-ORG | Company/group creation, router ownership, company memberships and filters | Lifecycle, archive/transfer, inherited policies, overlapping-IP collectors, group/device scopes |
| FR-INT | REST HTTPS, pinned IPv4, credential encryption, test/poll and replacement credential test | Native API-SSL, collectors, bulk import, version/capability discovery, full lifecycle |
| FR-FULL | Fixed read-only menu workspace | Structured writes, advanced console, full RouterOS coverage, staged execution |
| FR-IAM | Fixed roles, company scope, session timeout, single maker-checker | Custom RBAC, MFA/SSO, group/device/risk scopes, multi-level approval |
| FR-MON | Latest resource poll, integration and CPU incidents | History, interface alarms, correlation, topology, advanced active tests |
| FR-RTG/QUE/VPN | Selected live read menus | Configuration editing, policy analysis, service-specific incidents and validation |
| FR-INC | Incidents, acknowledgement, optional single-chat notifications | Escalation, assignment, delivery retries, company Telegram destinations and callbacks |
| FR-DSH | Summary-card preferences, filters, responsive shell | Drag/drop, charts, templates, sharing, AI-generated dashboards |
| FR-AI | Limited deterministic diagnosis, optional model explanation | Evidence retrieval across services, robust RCA, design generation, model governance |
| FR-CHG | Text proposal, Web review, no self-approval | Risk engine, exact action plans, Telegram approval, scheduling, executor, checks and rollback |
| FR-BKP/CFG | Encrypted diagnostic JSON snapshots, download, interval schedule and retention | Binary backup/RSC, upload/import/restore, Golden Config, drift, diff, recovery |
| Security/standards | Basic app controls and company checks | Standards/control engine, external vault, immutable audit, penetration test |
| NFR | Bounded reads and locks | Fleet-scale load tests, HA/DR, numeric SLOs, accessibility/localization acceptance |

A diagnostic snapshot is deliberately NOT labeled a backup. An approved review record is deliberately NOT labeled an executed change. These distinctions prevent unsafe assumptions on a production ISP network.