Sunstone Canvas

Feature roadmap & build status

Updated 20 August 2026 · app.sunstonekyg.com · database sunstone-app (Sunstone-owned)

Shipped

Before launch

Backlog

Open risk

Shipped & verified Before external users Backlog Requested by Brittany, 19 Aug

One open risk — concurrent editing

All chains, milestones and tasks for a project are stored as a single JSON document, and a save replaces the whole thing. With one user that was fine. With three, whoever saves last silently overwrites the others — no error, no warning. Needs a version check before more than one person works a board at the same time.

Shipped — built and verified

Foundation Migrated off Lovable Cloud · 20 Aug

✓
Sunstone-owned databaseSupabase project sunstone-app. Keys held by Sunstone, so anything can connect to it — the prerequisite for one login across products.
✓
Role modelsuper_admin · staff · client · steptoe. Matches the reports platform exactly so the two databases can merge later without redesign.
✓
Row-level security19 assertions passing, including 4 positive ones. Verified with a real external client token, not by inspection.
✓
Two independent access axesBoard role decides what you can do; organisation membership decides what you can see. A client can be a full board admin and remain blind to internal material.
✓
AuthenticationEmail and password, magic link, gated routes, automatic profile creation.
✓
Custom domainapp.sunstonekyg.com, live with TLS.
✓
Wrong-database guardThe app refuses to start if it is ever pointed at the wrong project — checked against both the URL and the key's own payload.

The canvas Core product

✓
Infinite zooming canvasProjects as bubbles on a priority × time-sensitivity grid. Drag anywhere; position carries meaning.
✓
Four levels of depthBubble → groups and subgroups → milestone chains → Kanban board → task detail.
✓
Team on the bubbleLead and contributors as orbiting moons; internal and external distinguished at a glance.
✓
BLUF overlayHover or pin the bottom line. On outreach chains it becomes a rich-text email editor with autosave.
✓
Timelines, KPIs, countdownsStart and end dates, measurable outcomes, live countdown per project.
✓
Project shelfIce Box, Completed and Inactive, out of the way but one click back.
✓
Client boardsOne board per client, its own URL, its own isolated data.
✓
Board settings & invitationsRename, manage members, invite by email. External admins can invite editors and viewers but never another admin.

Requested by Brittany · 19 August Her list, complete

✓
Comments & @mentionsThreads at project, chain, milestone and task level. Mentions limited to board members.
Brittany
✓
Change logInsert-only audit trail — who, what, before, after, when. Writes only via controlled procedures, so it cannot be bypassed.
Brittany
✓
Live notificationsReal-time alerts on mentions and on changes made by others.
Brittany
✓
Deadline alertsFires at 7 days, 48 hours, 24 hours and overdue. Once each, re-arming if the date moves.
Brittany
✓
Mandatory no-bid justificationRetiring an opportunity requires a reason and a written note of at least 20 characters. No skip, no dismiss. Includes "expired — no action" so lapses are counted separately from deliberate passes.
Brittany
✓
Deadline pressure on the bubbleCountdown turns amber, orange then red as the date closes; pulses when overdue. Suppressed at 100% complete.
Brittany
✓
Staleness indicatorGreen through red by days since anyone touched the file. Moving a bubble does not count as activity, so it cannot be gamed.
Brittany
✓
Portfolio viewEvery client board as one circle — active count, worst staleness, nearest deadline — without drilling in. "Mine only" toggle.
Brittany
✓
Submit-by, separate from deadlineThe government's date and ours are different dates. Defaults to 24 hours before, and the countdown tracks ours.
Brittany

Files & data

✓
Attachments at every levelBoard, project, group, chain, milestone or task. Private object storage, 1-hour signed links, 25MB per file.
✓
Fail-closed importBrings legacy browser data across as internal-only, and reports every assignment it refused to guess rather than inventing links.
✓
Client-view test accountA standing account for checking exactly what an external user sees after any change.

Before external users — blocking a client login

!
Concurrent-edit guardVersion check on save, with reload-and-retry, so two people working one board cannot silently overwrite each other.
Risk
·
Verify the invitation pathConfirm inviting someone who has no account yet actually reaches them, rather than failing quietly. This is the exact path the first client takes.
Now
·
Import the live canvas dataBring the existing Huffmaster work in, landing internal by default.
Now
·
Decide what the client seesReview every project and share deliberately. Nothing is visible until it is marked shared.
Now
·
Create the client accountClient role, board admin on their own board only.
Now
·
Final walkthrough as the clientConfirm with her own credentials that she can do her job and cannot see ours.
Now

Backlog — sequenced by value

·
Email notifications when you are awayAlerts currently only reach you with the app open. The preference already exists; nothing sends yet. Brittany's stated need is to be told at 48 and 24 hours out — which only works if it reaches an inbox.
High
·
Mobile portfolioA zooming canvas is poor on a phone, but the portfolio view is exactly what someone checks between meetings.
High
·
Outbound email captureCopy sent mail into the file automatically and log replies against the contact. The sending engine already exists on the reports platform — this is a connection, not a build.
High
·
SearchFind a project, contact or task across every board. Comfortable at four projects; painful at forty.
Medium
·
Export & printStatus out as a document or spreadsheet, for the first time a client asks for one.
Medium
·
Engagement templatesA standard set of projects and milestones for a new client, instead of rebuilding each time.
Medium
·
Research reports inside projectsSurface the market-intelligence reports on the project they belong to, rather than as separate files.
Medium
·
One login across both productsMove the reports platform onto this database so a single account works for both. Requires a data migration and a maintenance window on a live site.
Strategic
·
Client self-serviceLet a client organisation manage its own people and, eventually, its own subscription.
Strategic