🚀 EU Parliament Monitor — Future CI/CD Workflows

🔮 Planned Workflow Enhancements & Roadmap (2026-2037)
🎯 Evolution towards Advanced Automation, AI-Driven Operations & AGI-Ready Pipelines

📋 Document Owner: CEO | 📄 Version: 4.1 | 📅 Last Updated: 2026-05-31 (UTC)
🔄 Review Cycle: Quarterly | ⏰ Next Review: 2026-08-31
🏷️ Classification: Public (Open Source European Parliament Monitoring Platform)

📚 Architecture Documentation Map

Document	Focus	Description	Documentation Link
Architecture	🏛️ Architecture	C4 model showing current system structure	View Source
Future Architecture	🏛️ Architecture	C4 model showing future system structure	View Source
Mindmaps	🧠 Concept	Current system component relationships	View Source
Future Mindmaps	🧠 Concept	Future capability evolution	View Source
SWOT Analysis	💼 Business	Current strategic assessment	View Source
Future SWOT Analysis	💼 Business	Future strategic opportunities	View Source
Data Model	📊 Data	Current data structures and relationships	View Source
Future Data Model	📊 Data	Enhanced European Parliament data architecture	View Source
Flowcharts	🔄 Process	Current data processing workflows	View Source
Future Flowcharts	🔄 Process	Enhanced AI-driven workflows	View Source
State Diagrams	🔄 Behavior	Current system state transitions	View Source
Future State Diagrams	🔄 Behavior	Enhanced adaptive state transitions	View Source
Security Architecture	🛡️ Security	Current security implementation	View Source
Future Security Architecture	🛡️ Security	Security enhancement roadmap	View Source
Threat Model	🎯 Security	Political Threat Landscape analysis	View Source
Classification	🏷️ Governance	CIA classification & BCP	View Source
CRA Assessment	🛡️ Compliance	Cyber Resilience Act	View Source
Workflows	⚙️ DevOps	CI/CD documentation	View Source
Future Workflows	🚀 DevOps	Planned CI/CD enhancements	This Document
Business Continuity Plan	🔄 Resilience	Recovery planning	View Source
Financial Security Plan	💰 Financial	Cost & security analysis	View Source
End-of-Life Strategy	📦 Lifecycle	Technology EOL planning	View Source
Unit Test Plan	🧪 Testing	Unit testing strategy	View Source
E2E Test Plan	🔍 Testing	End-to-end testing	View Source
Performance Testing	⚡ Performance	Performance benchmarks	View Source
Security Policy	🔒 Security	Vulnerability reporting & security policy	View Source

🔐 ISMS Policy Alignment

This future workflows document is designed to implement all controls from Hack23 AB's ISMS framework as the EU Parliament Monitor platform evolves.

Related ISMS Policies

Policy Domain	Policy	Planned Implementation
🔐 Core Security	Information Security Policy	Overall security governance framework for enhanced monitoring
🛠️ Development	Secure Development Policy	Security-integrated development lifecycle enhancements
🌐 Network	Network Security Policy	CDN architecture, WAF, DDoS protection
🔒 Cryptography	Cryptography Policy	Content signing, TLS 1.3, integrity verification
🔑 Access Control	Access Control Policy	MCP authentication, request authorization
🏷️ Data Classification	Data Classification Policy	European Parliament data classification
🔍 Vulnerability	Vulnerability Management	Enhanced automated scanning and monitoring
🚨 Incident Response	Incident Response Plan	Automated incident detection and response
💾 Backup & Recovery	Backup Recovery Policy	Content backup, version control, recovery
🔄 Business Continuity	Business Continuity Plan	Multi-CDN deployment, disaster recovery
🤝 Third-Party	Third Party Management	CDN provider security assessment
🏷️ Classification	Classification Framework	Business impact analysis for platform

Compliance Framework Mapping

Framework	Version	Relevant Controls
ISO 27001	2022	A.5.1, A.8.25, A.8.26, A.8.27
NIST CSF	2.0	GV.OC, GV.RM, ID.AM, PR.AT
CIS Controls	v8.1	Control 1-5, 14, 16

📋 Executive Summary

This document outlines planned enhancements to the EU Parliament Monitor CI/CD workflows, aligned with the Future Security Architecture and Hack23 ISMS continuous improvement principles.

Enhancement Principles

Security First: Every enhancement increases security posture
Automation Everywhere: Reduce manual intervention
Evidence-Based: All changes backed by metrics
ISMS Aligned: Compliance with Hack23 ISMS policies
Performance Optimized: Faster feedback cycles

Roadmap Overview

Phase	Timeline	Focus	Key Deliverables	Status
Phase 0	✅ Completed	Agentic Workflows	18 gh-aw news workflows (8 split-pair + generator + translator), Copilot agent setup, 100% SHA-pinning	✅ Done
Phase 1	Q2 2026	Security Hardening	FOSSA, knip, advanced scanning	🔄 In Progress
Phase 2	Q3 2026	Performance & Quality	Load testing, mutation testing, E2E expansion	📋 Planned
Phase 3	Q4 2026	Advanced Automation	Multi-environment, canary deployments	📋 Planned

Pipeline Evolution Architecture

flowchart TD
    subgraph Phase0["✅ Phase 0: Current State (Completed)"]
        P0A[🤖 10 Agentic Workflows] --> P0B[🔐 100% SHA Pinning]
        P0B --> P0C[🛡️ Harden Runner]
        P0C --> P0D[📜 SLSA L3 Provenance]
    end

    subgraph Phase1["🔐 Phase 1: Security Hardening (Q2 2026)"]
        P1A[📋 FOSSA License Compliance] --> P1B[🧹 Knip Dead Code]
        P1B --> P1C[🔍 Enhanced SAST/DAST]
        P1C --> P1D[🕵️ Secret Scanning]
    end

    subgraph Phase2["⚡ Phase 2: Performance & Quality (Q3 2026)"]
        P2A[📊 k6 Load Testing] --> P2B[🧬 Stryker Mutation Testing]
        P2B --> P2C[🌐 Expanded E2E Coverage]
        P2C --> P2D[📈 Performance Budgets]
    end

    subgraph Phase3["🚀 Phase 3: Advanced Automation (Q4 2026)"]
        P3A[🔄 Multi-Environment Deploy] --> P3B[🐦 Canary Deployments]
        P3B --> P3C[⏪ Automated Rollback]
        P3C --> P3D[📊 Progressive Delivery]
    end

    Phase0 --> Phase1 --> Phase2 --> Phase3

    classDef completed fill:#27ae60,stroke:#1e8449,stroke-width:2px,color:white
    classDef security fill:#e74c3c,stroke:#c0392b,stroke-width:1.5px,color:white
    classDef performance fill:#f39c12,stroke:#e67e22,stroke-width:1.5px,color:black
    classDef automation fill:#3498db,stroke:#2980b9,stroke-width:1.5px,color:white

    class P0A,P0B,P0C,P0D completed
    class P1A,P1B,P1C,P1D security
    class P2A,P2B,P2C,P2D performance
    class P3A,P3B,P3C,P3D automation

✅ Phase 0: Completed Enhancements (Pre-Q2 2026)

The following capabilities have already been delivered and are documented in WORKFLOWS.md:

0.1 Complete SHA-Pinning Migration — ✅ COMPLETED

Status: All 12 standard workflows now use 100% SHA-pinned actions.
Evidence: Verified in WORKFLOWS.md §Workflow Permissions Matrix

0.2 Agentic News Workflows — ✅ COMPLETED

Status: 15 agentic news workflows compiled via gh-aw (GitHub Agentic Workflows ≥ v0.69.3, engine.mcp.session-timeout: 65m) are in production.
Engine: GitHub Copilot CLI with claude-sonnet-4.6 model
Data Source: european-parliament-mcp-server@1.4.0+ via MCP protocol Coverage: 14 languages (EN, SV, DA, NO, FI, DE, FR, ES, NL, AR, HE, JA, KO, ZH)
Horizon registry: src/config/article-horizons.ts is the single source of truth for every horizon's data window, cadence, mandatory artifacts, stage budgets and electoral overlay.

Workflow	Schedule	Purpose
`news-breaking.lock.yml`	Every 4 hours (`0 /4 * *`)	Breaking news
`news-week-ahead.lock.yml`	Friday 07:00 UTC	Parliamentary week preview
`news-month-ahead.lock.yml`	1st of month 08:00 UTC	Monthly outlook
`news-quarter-ahead.lock.yml`	1st of month 06:00 UTC	90-day pipeline forecast + presidency-trio overlay (shipped 2026-Q2)
`news-year-ahead.lock.yml`	Quarterly — 2nd of Jan/Apr/Jul/Oct 08:00 UTC	12-month outlook + Commission Work Programme alignment (shipped 2026-Q2)
`news-term-outlook.lock.yml`	Semi-annual — 1 Jan & 1 Jul 08:00 UTC	Full EP-term outlook anchored to next-EP-election (shipped 2026-Q2)
`news-election-cycle.lock.yml`	Annual — 1 Dec 08:00 UTC + T-180/T-90/T-30 imminent triggers	EP-election span (±6 mo) — mandate scorecard, seat projection, Spitzenkandidaten arithmetic (shipped 2026-Q2)
`news-week-in-review.lock.yml`	Saturday 09:00 UTC	Week retrospective (D-8 → D-36 reporting window)
`news-month-in-review.lock.yml`	28th of month 10:00 UTC	Monthly retrospective
`news-quarter-in-review.lock.yml`	5th of month 08:00 UTC	Quarterly retrospective with pipeline transit overlay (shipped 2026-Q2)
`news-year-in-review.lock.yml`	Annual — 15 Jan 08:00 UTC	Annual retrospective with mandate-fulfilment + term-arc + historical parallels (shipped 2026-Q2)
`news-motions.lock.yml`	Weekdays 06:00 UTC	Plenary votes & resolutions
`news-propositions.lock.yml`	Weekdays 05:00 UTC	Legislative procedures
`news-committee-reports.lock.yml`	Weekdays 04:00 UTC	Committee activity
`news-translate.lock.yml`	After content PRs merged + scheduled flushes	Translate EN articles → 13 languages

Recently shipped — long-horizon & election-cycle expansion (2026-Q2)

The 6 new workflows above (news-quarter-ahead, news-year-ahead, news-term-outlook, news-election-cycle, news-quarter-in-review, news-year-in-review) were graduated from the original "future" backlog by PR #1561 / Look-Ahead epic #1562. They introduce 8 new analysis artifacts (forward-projection, legislative-pipeline-forecast, parliamentary-calendar-projection, term-arc, seat-projection, mandate-fulfilment-scorecard, presidency-trio-context, commission-wp-alignment) with depth floors keyed per article type in analysis/methodologies/reference-quality-thresholds.json and full methodology coverage in forward-projection-methodology.md + electoral-cycle-methodology.md. The original "Article Generator" manual dispatch workflow (news-article-generator.lock.yml) was retired in the April-2026 aggregator-pipeline migration.

0.3 Copilot Agent Setup — ✅ COMPLETED

Status: copilot-setup-steps.yml configures the environment for 8 specialized Copilot agents with MCP server integrations.
Compile Workflow: compile-agentic-workflows.yml compiles .md source → .lock.yml via gh aw compile.

0.4 Lighthouse CI Performance Testing — ✅ COMPLETED

Status: Lighthouse CI (@lhci/cli@0.15.1) is integrated into the performance job of test-and-report.yml.
Metrics: Performance budgets, accessibility scores, SEO audits, best practices validation.

0.5 Article Generation Benchmarks — ✅ COMPLETED

Status: The performance job in test-and-report.yml includes article generation benchmarks with a 30-second budget (GENERATION_BUDGET_MS=30000).

🔬 Phase 0b: Political Intelligence Quality Enhancement (Q2 2026 — In Progress)

Priority: PRIO 1 — All agentic workflows must download data and produce great analytics unique for every article type.

This enhancement phase ensures every agentic workflow produces unique, high-quality political intelligence tailored to its specific article type, with per-document deep analysis for important EP items.

flowchart TD
    subgraph "🔬 Intelligence Quality Enhancement"
        direction TB
        IQ1["📡 Mandatory Data Download\nALL feeds queried before analysis"]
        IQ2["🔍 Per-Document Deep Analysis\nEvery MCP file gets {id}.analysis.md"]
        IQ3["🎯 Unique Analytics Per Workflow\nTailored tools per article type"]
        IQ4["✅ Quality Gate ≥7.0/10\n5-dimension weighted scoring"]
        IQ5["📊 Evidence-Based Output\nCitations + confidence levels"]
    end

    IQ1 --> IQ2 --> IQ3 --> IQ4 --> IQ5

    style IQ1 fill:#dc3545,stroke:#b02a37,color:#fff
    style IQ2 fill:#fd7e14,stroke:#ca6510,color:#fff
    style IQ3 fill:#ffc107,stroke:#cc9a06,color:#000
    style IQ4 fill:#198754,stroke:#146c43,color:#fff
    style IQ5 fill:#0d6efd,stroke:#0a58ca,color:#fff

0b.1 Mandatory Data Download Enforcement — ✅ IMPLEMENTED

Status: All 9 content workflows now enforce mandatory data download before the newsworthiness gate.

timeframe: "today" first, "one-week" fallback for empty/error/timeout feeds
Advisory feeds (documents, plenary docs, committee docs, questions) are MANDATORY, not optional
safeoutputs___noop only permitted AFTER all data collection and analysis completes

0b.2 Workflow-Specific Analytical Tools — ✅ IMPLEMENTED

Status: Each workflow now has unique MCP analytical tools tailored to its article type:

Workflow	Unique Analytical Tools
Breaking	`detect_voting_anomalies`, `early_warning_system`, `generate_political_landscape`
Motions	`get_voting_records`, `compare_political_groups`, `analyze_coalition_dynamics`
Propositions	`search_documents`, `monitor_legislative_pipeline`, `track_legislation`
Committee	`get_committee_info`, `analyze_legislative_effectiveness`
Week Ahead	`get_plenary_sessions` (future dates), `generate_political_landscape`
Weekly Review	`get_voting_records`, `detect_voting_anomalies`
Month Ahead	`compare_political_groups`, `analyze_country_delegation`
Monthly Review	`analyze_legislative_effectiveness`, `compare_political_groups`

0b.3 Per-Document Intelligence Analysis — 🔄 IN PROGRESS

Goal: Every downloaded MCP data file receives individual deep analysis following analysis/templates/per-file-political-intelligence.md.

Planned enhancements:

Opt-in --analysis-methods=document-analysis flag for per-document markdown + JSON output
Quality gate validation per document (minimum 7.0/10 across 5 dimensions)
Important documents flagged for extended analysis (committee opinions, legislative resolutions, plenary votes)

0b.4 Analysis Quality Metrics — 📋 PLANNED

Goal: Automated quality scoring for all analysis output.

Dimension	Weight	Target
Evidence density	30%	≥7/10 — citations per claim
Analytical depth	25%	≥7/10 — multi-framework insights
Structural completeness	20%	≥8/10 — Mermaid diagrams, tables
Political relevance	15%	≥7/10 — EP-specific stakeholder analysis
Writing quality	10%	≥8/10 — style guide compliance

🔐 Phase 1: Security Hardening (Q2 2026)

flowchart TD
    subgraph "🔐 Phase 1: Security Hardening Pipeline"
        FOSSA[📋 FOSSA License Compliance] --> KNIP[🧹 Knip Dead Code Detection]
        KNIP --> SAST[🔍 Enhanced SAST]
        SAST --> DAST[🕷️ ZAP DAST Scanning]
        DAST --> SECRET[🔑 Secret Scanning]
        SECRET --> GATE[🚦 Security Quality Gate]
    end

    GATE --> DEPLOY[🚀 Secure Deployment]

    classDef security fill:#e74c3c,stroke:#c0392b,stroke-width:1.5px,color:white
    classDef scanning fill:#9b59b6,stroke:#8e44ad,stroke-width:1.5px,color:white
    classDef gate fill:#f39c12,stroke:#e67e22,stroke-width:2px,color:black
    classDef deploy fill:#27ae60,stroke:#1e8449,stroke-width:1.5px,color:white

    class FOSSA,KNIP security
    class SAST,DAST,SECRET scanning
    class GATE gate
    class DEPLOY deploy

1.1 Complete SHA-Pinning Migration — ✅ COMPLETED

Current State: ✅ 100% of actions are SHA-pinned (achieved pre-Q2 2026)
Target: ~~100% SHA-pinned actions~~ Done
Timeline: ~~Q2 2026 Week 1-2~~ Completed

Implementation

All 13 standard workflows now use SHA-pinned actions:

# All workflows now use SHA-pinned actions (example from e2e.yml)
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0

Benefits:

✅ Protection against compromised action versions
✅ Reproducible builds
✅ Supply chain security

ISMS Evidence: Supply Chain Security Policy §4.4

1.2 Add FOSSA License Compliance

Purpose: Automated license compliance scanning
Timeline: Q2 2026 Week 3-4

New Workflow: `fossa.yml`

name: FOSSA License Compliance

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # Weekly Monday 06:00 UTC

permissions:
  contents: read
  pull-requests: write

jobs:
  fossa:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<SHA>
      
      - name: Run FOSSA Scan
        uses: fossas/fossa-action@<SHA>
        with:
          api-key: ${{ secrets.FOSSA_API_KEY }}
          
      - name: Check License Compliance
        run: fossa test --timeout 600

Benefits:

✅ Automated license compliance
✅ Block GPL/AGPL licenses
✅ Supply chain transparency

Badge:

1.3 Add Knip Validation

Purpose: Detect unused dependencies and exports
Timeline: Q2 2026 Week 3-4

Integration into test-and-report.yml

- name: Run knip
  run: npx knip --production --strict

Benefits:

✅ Reduce bundle size
✅ Faster builds
✅ Less attack surface

ISMS Evidence: Code quality standards

1.4 Enhanced Security Scanning

Purpose: Multi-tool SAST/DAST coverage
Timeline: Q2 2026 Week 5-8

Additional Security Tools

Tool	Purpose	Integration
Semgrep	Additional SAST rules	New workflow
Snyk	Vulnerability database	PR checks
OWASP ZAP	DAST scanning	Weekly
GitLeaks	Secret scanning	Pre-commit + CI

New Workflow: `advanced-security.yml`

name: Advanced Security Scanning

on:
  pull_request:
  schedule:
    - cron: '0 2 * * 0'  # Weekly Sunday 02:00 UTC

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<SHA>
      - uses: returntocorp/semgrep-action@<SHA>
        with:
          config: p/security-audit p/javascript

  snyk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<SHA>
      - uses: snyk/actions/node@<SHA>
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

Benefits:

✅ Multiple security perspectives
✅ Higher vulnerability detection rate
✅ Industry best practices

⚡ Phase 2: Performance & Quality (Q3 2026)

flowchart TD
    subgraph "⚡ Phase 2: Performance & Quality Pipeline"
        K6[📊 k6 Load Testing] --> STRYKER[🧬 Stryker Mutation Testing]
        STRYKER --> E2E[🌐 Expanded E2E Tests]
        E2E --> PERF[📈 Performance Budgets]
        PERF --> REPORT[📋 Quality Report]
    end

    REPORT --> QUALITY[✅ Quality Gate Pass]

    classDef perf fill:#f39c12,stroke:#e67e22,stroke-width:1.5px,color:black
    classDef test fill:#27ae60,stroke:#1e8449,stroke-width:1.5px,color:white
    classDef report fill:#9b59b6,stroke:#8e44ad,stroke-width:1.5px,color:white
    classDef gate fill:#3498db,stroke:#2980b9,stroke-width:2px,color:white

    class K6,PERF perf
    class STRYKER,E2E test
    class REPORT report
    class QUALITY gate

2.1 Load Testing & Performance — ⚡ PARTIALLY COMPLETED

Purpose: Validate performance under load
Timeline: Q3 2026 Week 1-4
Status: Lighthouse CI is already integrated. k6 load testing remains planned.

✅ Completed: Lighthouse CI

Lighthouse CI (@lhci/cli@0.15.1) is integrated into the performance job of test-and-report.yml with:

Performance budgets (30-second article generation budget)
Accessibility audits
SEO validation
Best practices checks

Remaining: k6 Load Testing

name: Performance Testing

on:
  workflow_dispatch:
  schedule:
    - cron: '0 3 * * 0'  # Weekly Sunday 03:00 UTC

jobs:
  lighthouse:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<SHA>
      
      - name: Run Lighthouse CI
        uses: treosh/lighthouse-ci-action@<SHA>
        with:
          urls: |
            https://hack23.github.io/euparliamentmonitor/
            https://hack23.github.io/euparliamentmonitor/index.html
          uploadArtifacts: true
          temporaryPublicStorage: true

  k6-load-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<SHA>
      
      - name: Run k6 load test
        uses: grafana/k6-action@<SHA>
        with:
          filename: test/performance/load-test.js

Metrics:

Page load time: <1s
Lighthouse score: >95
Concurrent users: 1000+

Benefits:

✅ Performance regression detection
✅ User experience validation
✅ Capacity planning data

2.2 Mutation Testing

Purpose: Validate test quality
Timeline: Q3 2026 Week 5-8

Integration with Stryker

- name: Run mutation testing
  run: npx stryker run --concurrency 4
  
- name: Upload mutation report
  uses: actions/upload-artifact@<SHA>
  with:
    name: mutation-report
    path: reports/mutation/

Target: ≥80% mutation score

Benefits:

✅ Identify weak tests
✅ Improve test quality
✅ Higher confidence in coverage

2.3 Expanded E2E Testing

Purpose: Comprehensive cross-browser testing
Timeline: Q3 2026 Week 9-12

Enhanced E2E Configuration

// playwright.config.js
export default defineConfig({
  projects: [
    { name: 'chromium', use: { ...devices['Desktop Chrome'] } },
    { name: 'firefox', use: { ...devices['Desktop Firefox'] } },
    { name: 'webkit', use: { ...devices['Desktop Safari'] } },
    { name: 'mobile-chrome', use: { ...devices['Pixel 5'] } },
    { name: 'mobile-safari', use: { ...devices['iPhone 13'] } },
  ],
  reporter: [
    ['html'],
    ['junit', { outputFile: 'junit.xml' }],
    ['json', { outputFile: 'test-results.json' }],
  ],
});

Coverage:

5 browsers/devices
Visual regression testing
Network condition simulation
Geolocation testing

🚀 Phase 3: Advanced Automation (Q4 2026)

flowchart TD
    subgraph "🚀 Phase 3: Advanced Automation Pipeline"
        MULTI[🔄 Multi-Environment Deploy] --> CANARY[🐦 Canary Deployments]
        CANARY --> ROLLBACK[⏪ Automated Rollback]
        ROLLBACK --> MONITOR[📊 Progressive Delivery]
    end

    subgraph "🌐 Environments"
        PREVIEW[👁️ Preview] --> STAGING[🧪 Staging]
        STAGING --> PROD[🚀 Production]
    end

    MULTI --> PREVIEW
    MONITOR --> PROD

    classDef automation fill:#3498db,stroke:#2980b9,stroke-width:1.5px,color:white
    classDef env fill:#27ae60,stroke:#1e8449,stroke-width:1.5px,color:white
    classDef rollback fill:#e74c3c,stroke:#c0392b,stroke-width:1.5px,color:white
    classDef monitor fill:#9b59b6,stroke:#8e44ad,stroke-width:1.5px,color:white

    class MULTI,CANARY automation
    class ROLLBACK rollback
    class MONITOR monitor
    class PREVIEW,STAGING,PROD env

3.1 Multi-Environment Deployments

Purpose: Staging, production, and preview environments
Timeline: Q4 2026 Week 1-6

Environment Strategy

graph LR
    A[PR] --> B[Preview Environment]
    C[Main Branch] --> D[Staging]
    E[Release Tag] --> F[Production]
    
    B --> G[E2E Tests]
    D --> H[Smoke Tests]
    F --> I[Health Checks]

    classDef trigger fill:#3498db,stroke:#2980b9,stroke-width:2px,color:white
    classDef env fill:#9b59b6,stroke:#8e44ad,stroke-width:1.5px,color:white
    classDef test fill:#27ae60,stroke:#1e8449,stroke-width:1.5px,color:white

    class A,C,E trigger
    class B,D,F env
    class G,H,I test

New Workflow: `deploy-preview.yml`

name: Deploy Preview Environment

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  deploy-preview:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<SHA>
      
      - name: Deploy to Vercel Preview
        uses: amondnet/vercel-action@<SHA>
        with:
          vercel-token: ${{ secrets.VERCEL_TOKEN }}
          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
          
      - name: Comment PR with preview URL
        uses: actions/github-script@<SHA>
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '🚀 Preview deployed: ${{ steps.deploy.outputs.url }}'
            })

Environments:

Preview: Per-PR isolated environment
Staging: Main branch continuous deployment
Production: Release tag deployment

3.2 Canary Deployments

Purpose: Gradual rollout with automatic rollback
Timeline: Q4 2026 Week 7-10

Deployment Strategy

name: Canary Deployment

on:
  release:
    types: [published]

jobs:
  canary-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy 10% traffic
        run: ./scripts/deploy-canary.sh 10
        
      - name: Monitor metrics (5 min)
        run: ./scripts/monitor-health.sh --duration 300
        
      - name: Evaluate canary
        run: |
          if ./scripts/evaluate-metrics.sh; then
            echo "✅ Canary successful, proceeding"
          else
            echo "❌ Canary failed, rolling back"
            ./scripts/rollback.sh
            exit 1
          fi
          
      - name: Gradual rollout
        run: |
          ./scripts/deploy-canary.sh 25
          sleep 300
          ./scripts/deploy-canary.sh 50
          sleep 300
          ./scripts/deploy-canary.sh 100

Metrics Monitored:

Error rate
Response time (P95, P99)
CPU/Memory usage
User engagement

3.3 Automated Rollback

Purpose: Instant rollback on failure detection
Timeline: Q4 2026 Week 11-12

Health Check Integration

- name: Deployment health check
  run: |
    for i in {1..10}; do
      if curl -f https://euparliamentmonitor.com/health; then
        echo "✅ Health check $i passed"
      else
        echo "❌ Health check $i failed"
        ./scripts/rollback.sh
        exit 1
      fi
      sleep 30
    done

Rollback Triggers:

Health check failure
Error rate spike (>1%)
Response time degradation (>2x baseline)
Manual trigger

📊 Success Metrics

Phase 1 Metrics (Q2 2026)

Metric	Baseline	Target	Current	Status
SHA-Pinned Actions	~~90%~~	100%	100%	✅ Completed
License Compliance	Manual	Automated	Manual	📋 Planned
Unused Dependencies	Unknown	0	Unknown	📋 Planned
Security Tools	3 (CodeQL, npm audit, Dep Review)	5	3	📋 Planned

Phase 2 Metrics (Q3 2026)

Metric	Baseline	Target	Current	Status
Page Load Time	~1.5s	<1s	Monitored via Lighthouse CI	⚡ Partial
Lighthouse Score	85	>95	Monitored via test-and-report	⚡ Partial
Mutation Score	Unknown	≥80%	Unknown	📋 Planned
Browser Coverage	1	5	1 (Chromium)	📋 Planned

Phase 3 Metrics (Q4 2026)

Metric	Baseline	Target	Measurement
Deployment Frequency	Weekly	Daily	GitHub insights
Mean Time to Deploy	15 min	<5 min	Workflow duration
Failed Deployment Rate	0%	<1%	Success rate
Rollback Time	Manual	<2 min	Automated

🔒 ISMS Alignment

Policy Compliance

Phase	ISMS Policy	Implementation
Phase 1	🛠️ Secure Development Policy	SHA-pinning, FOSSA, license compliance
Phase 1	🔍 Vulnerability Management	Semgrep, Snyk, OWASP ZAP, GitLeaks
Phase 2	🛠️ Secure Development Policy	Mutation testing, expanded E2E
Phase 2	🛠️ Secure Development Policy	Load testing, Lighthouse, performance budgets
Phase 3	🛠️ Secure Development Policy	Multi-environment, canary deployment
Phase 3	🚨 Incident Response Plan	Automated rollback, incident classification
Phase 3	💾 Backup & Recovery Policy	Multi-environment disaster recovery

Compliance Frameworks

Framework	Version	Control	Phase	Implementation
ISO 27001	2022	A.8.25 Secure development lifecycle	Phase 1-3	All phases enhance SDLC
ISO 27001	2022	A.8.28 Secure coding	Phase 2	Mutation testing, code quality
ISO 27001	2022	A.12.1.2 Change management	Phase 3	Canary deployment, progressive delivery
NIST CSF	2.0	PR.IP-1 Baseline configuration	Phase 3	Multi-environment baselines
NIST CSF	2.0	DE.CM Continuous monitoring	Phase 2	Performance monitoring, load testing
CIS Controls	v8.1	16.6 Application testing	Phase 2	Mutation testing, performance testing
EU CRA	2024	Art. 10 Vulnerability handling	Phase 1	Enhanced scanning, auto-remediation

💰 Resource Requirements

Infrastructure Costs

Phase	Service	Monthly Cost	Annual Cost
Phase 1	FOSSA Pro	$299	$3,588
Phase 1	Snyk Team	$98	$1,176
Phase 2	Lighthouse CI	Free	$0
Phase 2	k6 Cloud	$49	$588
Phase 3	Vercel Pro	$20	$240
Total		$466/mo	$5,592/yr

Time Investment

Phase	Engineering Time	Timeline
Phase 1	40 hours	2 weeks
Phase 2	80 hours	4 weeks
Phase 3	120 hours	6 weeks
Total	240 hours	12 weeks

🎯 Implementation Plan

Phase 1: Security Hardening (Q2 2026)

Week 1-2:

Complete SHA-pinning migration for all workflows ✅ (achieved pre-Q2 2026)
Test all workflows with SHA-pinned actions ✅
Document action versions ✅ (in WORKFLOWS.md v3.0)

Week 3-4:

Set up FOSSA account and integration
Add knip to test-and-report workflow
Configure allowed license list

Week 5-8:

Integrate Semgrep security rules
Set up Snyk scanning
Add OWASP ZAP weekly scans
Configure GitLeaks pre-commit hooks

Phase 2: Performance & Quality (Q3 2026)

Week 1-4:

Set up Lighthouse CI ✅ (integrated in test-and-report.yml performance job)
Create k6 load test scripts
Configure performance budgets ✅ (GENERATION_BUDGET_MS=30000)
Automate performance reporting

Week 5-8:

Integrate Stryker mutation testing
Configure mutation testing thresholds
Add mutation reports to release docs

Week 9-12:

Enable multi-browser Playwright testing
Add visual regression testing
Expand E2E test coverage

Phase 3: Advanced Automation (Q4 2026)

Week 1-6:

Set up preview environments (Vercel)
Configure staging environment
Automate preview deployments per PR

Week 7-10:

Implement canary deployment scripts
Set up health monitoring
Configure gradual rollout

Week 11-12:

Implement automated rollback
Create runbooks for failure scenarios
Document deployment procedures

🕵️ Political Intelligence Capability Workflows (2026 → 2037)

The phases above harden and accelerate the current gh-aw newsroom pipeline. This section adds the missing intelligence-cycle workflows a high-level OSINT / INTOP operative would expect — the operational realisation of the capability roadmap in FUTURE_MINDMAP.md and the architecture in FUTURE_ARCHITECTURE.md. Today's pipeline does collection → analysis → production in a single session. The future workflow set closes the cycle: it adds direction (PIR) at the front, indications and warning as a continuous loop, adversarial review before production, and a calibration feedback arm at the end.

AI-Policy invariant for every workflow below: AI proposes evidence, hypotheses, gradings and forecasts; a human approves; there is no autonomous publication of an intelligence assessment and no collection outside the PUBLIC open-data boundary.

The Agentic Intelligence Cycle (v3.0+)

flowchart LR
    DIR["Direction\nPIR + Watchlist"]
    COL["Collection\nEP MCP + DOCEO + External + ASR"]
    PROC["Processing\nEntity Resolution + Knowledge Graph"]
    ANA["Analysis\nMulti-Agent ACH + Forecast + Counter-FIMI"]
    RT["Adversarial Review\nRed-Team + Devils Advocate"]
    PROD["Production\nGrading + WEP + Authenticity Signing"]
    HUM["Human Accountability Gate"]
    DIS["Dissemination\nStatic Edge + API + Alerts"]
    FB["Feedback\nForecast Calibration + Gap Re-Tasking"]

    DIR --> COL --> PROC --> ANA --> RT --> PROD --> HUM --> DIS --> FB
    FB -.re-task.-> DIR

    style DIR fill:#0d6efd,stroke:#0a58ca,color:#fff
    style COL fill:#0d6efd,stroke:#0a58ca,color:#fff
    style PROC fill:#6f42c1,stroke:#59359a,color:#fff
    style ANA fill:#6f42c1,stroke:#59359a,color:#fff
    style RT fill:#fd7e14,stroke:#ca6510,color:#fff
    style PROD fill:#198754,stroke:#146c43,color:#fff
    style HUM fill:#ffc107,stroke:#cc9a06,color:#000
    style DIS fill:#198754,stroke:#146c43,color:#fff
    style FB fill:#ffc107,stroke:#cc9a06,color:#000

New Intelligence Workflows and Their Rollout

Workflow	What It Does	Anchoring Methodology	Feasibility / Horizon	Operative Benefit
PIR collection planner	Translates standing + ad-hoc requirements into tasked collection; tracks coverage vs gaps	source-triangulation	🟢 v2.0 pilot → 🔵 v3.0	Collect against requirements, not opportunistically
Indications and Warning monitor	Continuous indicator scoring against tripwires; promotes watch → warning	coalition-dynamics + political-risk	🔵 v3.0 (2028)	Early, calibrated warning of coalition / discipline breaks
Multi-agent ACH + red-team	Competing-hypotheses agents plus a devil's-advocate gate before any estimate ships	osint-tradecraft-standards §4	🔵 v3.0	Catches analytic overconfidence before publication
Counter-FIMI watch	Tags DISARM TTPs on coordinated narratives referencing EP activity	political-threat-framework	⚪ v3.2 (2031+)	Defensive narrative-integrity context for citizens
Integrity analytics	Correlates PUBLIC declarations, register meetings, and roll-calls into sourced questions	actor-mapping + stakeholder-map	🔵 v3.1 (2029)	Surfaces conflict-of-interest leads for journalists
Verbatim speech ingestion	ASR + stance/framing NLP over plenary and committee debate	per-document-methodology	🔵 v3.1 (2029)	Adds the spoken record as a first-class source
Forecast calibration loop	Records outcomes vs estimates; scores the analytic track record	forward-projection + confidence-calibration	🔵 v3.0	Makes "be early" honest and measurable

Indications-and-Warning Continuous Loop

The flagship new operating mode: an always-on EventBridge-scheduled loop that turns DOCEO live votes and committee activity into graded warnings — with a mandatory human-confirmation gate before any warning is disseminated.

flowchart TD
    T["EventBridge Tick\nplenary + committee cadence"]
    ING["Ingest Latest Votes + Activity"]
    SCORE["Score Indicators vs Baseline"]
    TRIP{"Tripwire Breached?"}
    SUPPRESS["Suppress + Log Baseline Drift"]
    DRAFT["Draft Warning\nWEP band + evidence chain"]
    GATE{"Human Confirms?"}
    EMIT["Emit Graded Warning\nbrief + alert + dashboard"]
    CAL["Record for Calibration"]

    T --> ING --> SCORE --> TRIP
    TRIP -- No --> SUPPRESS --> CAL
    TRIP -- Yes --> DRAFT --> GATE
    GATE -- No --> SUPPRESS
    GATE -- Yes --> EMIT --> CAL
    CAL -.feeds.-> SCORE

    style T fill:#0d6efd,stroke:#0a58ca,color:#fff
    style SCORE fill:#6f42c1,stroke:#59359a,color:#fff
    style TRIP fill:#fd7e14,stroke:#ca6510,color:#000
    style DRAFT fill:#fd7e14,stroke:#ca6510,color:#fff
    style GATE fill:#ffc107,stroke:#cc9a06,color:#000
    style EMIT fill:#198754,stroke:#146c43,color:#fff
    style SUPPRESS fill:#6c757d,stroke:#565e64,color:#fff
    style CAL fill:#ffc107,stroke:#cc9a06,color:#000

Governance and Phasing

v2.0 (2026–27, no servers): PIR planning and forecast-calibration logging are build-time additions to the existing gh-aw runs — a collection-plan.json and a forecast-ledger.json committed alongside manifest.json. No new infrastructure.
v3.0 (2028): the I&W monitor, multi-agent ACH/red-team, and NL query move behind the serverless core (Step Functions + Bedrock Agents + EventBridge).
v3.1–v3.2 (2029–31+): integrity analytics, verbatim speech, and counter-FIMI layer in once the knowledge graph and external-source registry are proven.
Throughout: the deterministic aggregator and the human-accountability gate are never bypassed; every workflow emits a methodology-reflection audit artifact.

🔮 Visionary Workflow Roadmap: 2027-2037

Political Intelligence Evolution — From Pipeline to Autonomous Observatory

As AI capabilities advance — from current LLMs (Opus 4.7) through multi-modal agents to potential AGI — the EU Parliament Monitor's workflow architecture will evolve from human-configured pipelines into an autonomous political intelligence observatory capable of real-time democratic transparency monitoring across all EU institutions.

flowchart TD
    subgraph "🤖 Phase 4: AI-Enhanced Intelligence (2027-2029)"
        direction TB
        P4A["🔍 Predictive Political<br/>Event Detection"] --> P4B["📊 Automated Source<br/>Triangulation"]
        P4B --> P4C["🎯 Contextual Analysis<br/>with Historical Memory"]
        P4C --> P4D["🛡️ Real-Time Threat<br/>Landscape Monitoring"]
    end

    subgraph "🧠 Phase 5: Autonomous OSINT (2029-2032)"
        direction TB
        P5A["🌐 Multi-Source<br/>Intelligence Fusion"] --> P5B["🔗 Cross-Institution<br/>Pattern Detection"]
        P5B --> P5C["📡 Continuous<br/>Democratic Monitoring"]
        P5C --> P5D["⚡ Automated Alert<br/>& Response System"]
    end

    subgraph "🔮 Phase 6: Cognitive Observatory (2032-2035)"
        direction TB
        P6A["🧪 Predictive<br/>Legislative Modeling"] --> P6B["🌍 Global Parliamentary<br/>Comparison Engine"]
        P6B --> P6C["📈 Democratic Health<br/>Index Computation"]
    end

    subgraph "🌐 Phase 7: AGI Democratic Guardian (2035-2037)"
        direction TB
        P7A["🏛️ Full Institutional<br/>Transparency Engine"] --> P7B["🤖 Self-Evolving<br/>Analysis Frameworks"]
        P7B --> P7C["⚖️ Universal Democratic<br/>Accountability System"]
    end

    P4D --> P5A
    P5D --> P6A
    P6C --> P7A

    classDef ai fill:#1565C0,stroke:#0D47A1,stroke-width:2px,color:#FFFFFF
    classDef autonomous fill:#6A1B9A,stroke:#4A148C,stroke-width:2px,color:#FFFFFF
    classDef cognitive fill:#E65100,stroke:#BF360C,stroke-width:2px,color:#FFFFFF
    classDef agi fill:#B71C1C,stroke:#880E4F,stroke-width:2px,color:#FFFFFF

    class P4A,P4B,P4C,P4D ai
    class P5A,P5B,P5C,P5D autonomous
    class P6A,P6B,P6C cognitive
    class P7A,P7B,P7C agi

Phase 4: AI-Enhanced Political Intelligence (2027-2029)

Vision: Transform from scheduled data processing to proactive intelligence detection — the system anticipates politically significant events before they unfold.

flowchart LR
    subgraph "📡 Enhanced Collection"
        EC1["Real-Time EP API<br/>WebSocket Feeds"]
        EC2["Council of EU<br/>Data Integration"]
        EC3["Commission<br/>Consultation Tracker"]
        EC4["CURIA Case Law<br/>Monitor"]
    end

    subgraph "🧠 AI-Enhanced Analysis"
        AE1["Historical Pattern<br/>Matching Engine"]
        AE2["Predictive Vote<br/>Outcome Model"]
        AE3["Coalition Shift<br/>Early Warning"]
        AE4["Legislative Impact<br/>Simulator"]
    end

    subgraph "📰 Smart Production"
        SP1["Adaptive Article<br/>Length & Depth"]
        SP2["Reader Interest<br/>Profiling"]
        SP3["Personalized<br/>Intelligence Briefs"]
    end

    EC1 & EC2 & EC3 & EC4 --> AE1 & AE2 & AE3 & AE4 --> SP1 & SP2 & SP3

    style EC1 fill:#1565C0,stroke:#0D47A1,color:#FFFFFF
    style EC2 fill:#1565C0,stroke:#0D47A1,color:#FFFFFF
    style EC3 fill:#1565C0,stroke:#0D47A1,color:#FFFFFF
    style EC4 fill:#1565C0,stroke:#0D47A1,color:#FFFFFF
    style AE1 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style AE2 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style AE3 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style AE4 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style SP1 fill:#2E7D32,stroke:#1B5E20,color:#FFFFFF
    style SP2 fill:#2E7D32,stroke:#1B5E20,color:#FFFFFF
    style SP3 fill:#2E7D32,stroke:#1B5E20,color:#FFFFFF

Capability	Description	Political Intelligence Impact
Predictive Event Detection	ML models trained on EP parliamentary calendar predict significant events before official announcements	Earlier breaking news; advance analysis of upcoming votes
Source Triangulation	Cross-reference EP data with Council, Commission, and CURIA sources for comprehensive coverage	Higher confidence ratings; multi-institutional perspective
Historical Context Engine	Every analysis automatically enriched with relevant historical precedents from EP's legislative history	Deeper contextual intelligence; trend identification
Real-Time Threat Monitoring	Continuous Political Threat Landscape assessment with automated alert thresholds	Instant detection of coalition shifts, democratic erosion signals
Smart Caching	AI-optimised data caching based on parliamentary rhythm (plenary weeks vs. committee weeks)	Faster analysis cycles; reduced MCP server load

Phase 5: Autonomous OSINT Operations (2029-2032)

Vision: The platform evolves into a full OSINT (Open Source Intelligence) observatory — autonomously collecting, correlating, and publishing intelligence across the entire EU institutional landscape.

flowchart TD
    subgraph "🌐 Multi-Source Fusion"
        MS1["🏛️ EP Open Data"]
        MS2["🇪🇺 Council Press"]
        MS3["📋 Commission<br/>Regulatory Pipeline"]
        MS4["⚖️ CURIA Judgments"]
        MS5["📊 Eurostat<br/>Economic Data"]
        MS6["🗳️ National Parliament<br/>Coordination"]
    end

    subgraph "🔗 Intelligence Fusion Engine"
        FE1["Entity Resolution<br/>(MEPs across institutions)"]
        FE2["Topic Clustering<br/>(Cross-institutional)"]
        FE3["Influence Network<br/>Graph Analysis"]
        FE4["Anomaly Detection<br/>(Voting patterns)"]
    end

    subgraph "📡 Continuous Monitoring"
        CM1["Democratic Health<br/>Dashboard"]
        CM2["Legislative Pipeline<br/>Tracker"]
        CM3["Coalition Stability<br/>Monitor"]
        CM4["Transparency<br/>Scorecard"]
    end

    MS1 & MS2 & MS3 & MS4 & MS5 & MS6 --> FE1 & FE2 & FE3 & FE4
    FE1 & FE2 & FE3 & FE4 --> CM1 & CM2 & CM3 & CM4

    style MS1 fill:#003399,stroke:#002266,color:#FFFFFF
    style MS2 fill:#003399,stroke:#002266,color:#FFFFFF
    style MS3 fill:#003399,stroke:#002266,color:#FFFFFF
    style MS4 fill:#003399,stroke:#002266,color:#FFFFFF
    style MS5 fill:#003399,stroke:#002266,color:#FFFFFF
    style MS6 fill:#003399,stroke:#002266,color:#FFFFFF
    style FE1 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style FE2 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style FE3 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style FE4 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style CM1 fill:#C62828,stroke:#B71C1C,color:#FFFFFF
    style CM2 fill:#C62828,stroke:#B71C1C,color:#FFFFFF
    style CM3 fill:#C62828,stroke:#B71C1C,color:#FFFFFF
    style CM4 fill:#C62828,stroke:#B71C1C,color:#FFFFFF

Multi-Source Intelligence Fusion: Combine EP, Council, Commission, and court data into unified intelligence products — every article draws from all EU institutions, not just Parliament
Cross-Institution Pattern Detection: Identify when legislative proposals move between institutions, detect coordination patterns, track lobby influence across the trilogue process
Continuous Democratic Monitoring: Real-time dashboards that track democratic health indicators: participation rates, transparency scores, representation metrics, accountability measures
Automated Alert & Response: When threat landscape dimensions exceed thresholds (e.g., coalition cohesion drops below 60%), the system autonomously generates urgent intelligence briefings

Phase 6: Cognitive Parliamentary Observatory (2032-2035)

Vision: The system becomes a cognitive observatory that models legislative outcomes, compares democratic health across global parliaments, and computes verifiable democratic accountability indices.

Predictive Legislative Modeling: Simulate legislative outcomes with >80% accuracy by modeling MEP voting behaviour, committee dynamics, and political group strategies
Global Parliamentary Comparison Engine: Compare EP democratic practices against 50+ national parliaments worldwide, identifying best practices and areas for improvement
Democratic Health Index: A composite, evidence-based score combining transparency, participation, accountability, and representation metrics — updated daily, published monthly
Self-Healing Analysis Pipelines: Workflows that detect their own analytical blind spots, commission additional data collection, and refine their methodologies without human intervention

Phase 7: AGI Democratic Guardian (2035-2037)

Vision: With the emergence of AGI-level capabilities, the platform evolves into a universal democratic accountability system — monitoring, analysing, and reporting on democratic practices across all levels of European governance.

Full Institutional Transparency Engine: AGI-powered monitoring that covers every EU institution, agency, and body — from the European Central Bank to FRONTEX, from OLAF investigations to ECB monetary policy
Self-Evolving Analysis Frameworks: The 6 political threat dimensions automatically expand and refine based on emerging democratic challenges (cyber-democratic threats, AI governance risks, climate policy accountability)
Universal Democratic Accountability System: A platform that any citizen can query in natural language to understand the democratic implications of any EU legislative action, in any of the 24 EU official languages

Workflow Evolution Gantt

gantt
    title EU Parliament Monitor Workflow Evolution (2026-2037)
    dateFormat YYYY-MM

    section Near-Term (2026)
    Phase 1 Security Hardening           :p1, 2026-04, 3M
    Phase 2 Performance & Quality        :p2, 2026-07, 3M
    Phase 3 Advanced Automation          :p3, 2026-10, 3M

    section Medium-Term (2027-2029)
    Phase 4 AI-Enhanced Intelligence     :p4, 2027-01, 24M
    Council/Commission Integration       :p4a, 2027-06, 12M
    Predictive Event Detection           :p4b, 2028-01, 12M

    section Autonomous (2029-2032)
    Phase 5 Autonomous OSINT             :p5, 2029-01, 36M
    Multi-Source Intelligence Fusion     :p5a, 2029-01, 18M
    Democratic Health Dashboard          :p5b, 2030-01, 24M

    section Cognitive (2032-2035)
    Phase 6 Cognitive Observatory        :p6, 2032-01, 36M
    Predictive Legislative Modeling      :p6a, 2032-06, 18M
    Global Parliamentary Comparison      :p6b, 2033-06, 18M

    section AGI (2035-2037)
    Phase 7 AGI Democratic Guardian      :p7, 2035-01, 24M
    Universal Accountability System      :p7a, 2036-01, 12M

Technology Evolution Map

flowchart LR
    subgraph "2026"
        T1["claude-sonnet-4.6<br/>GitHub Copilot<br/>EP MCP Server"]
    end

    subgraph "2027-2029"
        T2["Multi-Modal AI<br/>Real-Time APIs<br/>Cross-Institution MCP"]
    end

    subgraph "2029-2032"
        T3["Autonomous Agents<br/>Knowledge Graphs<br/>OSINT Fusion"]
    end

    subgraph "2032-2035"
        T4["Cognitive AI<br/>Predictive Models<br/>Global Comparison"]
    end

    subgraph "2035-2037"
        T5["AGI Systems<br/>Self-Evolving<br/>Universal Access"]
    end

    T1 --> T2 --> T3 --> T4 --> T5

    style T1 fill:#2E7D32,stroke:#1B5E20,color:#FFFFFF
    style T2 fill:#1565C0,stroke:#0D47A1,color:#FFFFFF
    style T3 fill:#6A1B9A,stroke:#4A148C,color:#FFFFFF
    style T4 fill:#E65100,stroke:#BF360C,color:#FFFFFF
    style T5 fill:#B71C1C,stroke:#880E4F,color:#FFFFFF

📚 Related Documentation

Document	Focus	Link
⚙️ Current Workflows	Present state documentation	WORKFLOWS.md
🔐 Security Architecture	Current security implementation	SECURITY_ARCHITECTURE.md
🚀 Future Security	Planned security enhancements	FUTURE_SECURITY_ARCHITECTURE.md
🔬 Analysis Framework	Political intelligence analysis	analysis/README.md
📐 Analysis Methodologies	6 analytical frameworks	analysis/methodologies/README.md
📋 Analysis Templates	8 structured templates	analysis/templates/README.md
📈 Security Flowcharts	Process flows	FLOWCHART.md
🛡️ ISMS Policy	Policy framework	Hack23 ISMS-PUBLIC

🔄 Review and Updates

This document will be reviewed quarterly to assess progress and adjust priorities based on:

Security threat landscape changes
Technology evolution (LLM capabilities, MCP protocol advances)
Business priorities and democratic transparency mission
Resource availability
Compliance requirements (GDPR, NIS2, EU CRA)
European Parliament institutional changes

Next Review: 2026-08-31

📞 Questions? Contact: DevOps Team
💡 Suggestions? Open an issue: GitHub Issues

Last updated: 2026-03-31 by Intelligence Operative

Uh oh!

Uh oh!

FilesExpand file tree

FUTURE_WORKFLOWS.md

Latest commit

History

FUTURE_WORKFLOWS.md

File metadata and controls

🚀 EU Parliament Monitor — Future CI/CD Workflows

📚 Architecture Documentation Map

🔐 ISMS Policy Alignment

Related ISMS Policies

Compliance Framework Mapping

📋 Executive Summary

Enhancement Principles

Roadmap Overview

Pipeline Evolution Architecture

✅ Phase 0: Completed Enhancements (Pre-Q2 2026)

0.1 Complete SHA-Pinning Migration — ✅ COMPLETED

0.2 Agentic News Workflows — ✅ COMPLETED

Recently shipped — long-horizon & election-cycle expansion (2026-Q2)

0.3 Copilot Agent Setup — ✅ COMPLETED

0.4 Lighthouse CI Performance Testing — ✅ COMPLETED

0.5 Article Generation Benchmarks — ✅ COMPLETED

🔬 Phase 0b: Political Intelligence Quality Enhancement (Q2 2026 — In Progress)

0b.1 Mandatory Data Download Enforcement — ✅ IMPLEMENTED

0b.2 Workflow-Specific Analytical Tools — ✅ IMPLEMENTED

0b.3 Per-Document Intelligence Analysis — 🔄 IN PROGRESS

0b.4 Analysis Quality Metrics — 📋 PLANNED

🔐 Phase 1: Security Hardening (Q2 2026)

1.1 Complete SHA-Pinning Migration — ✅ COMPLETED

Implementation

1.2 Add FOSSA License Compliance

New Workflow: fossa.yml

1.3 Add Knip Validation

Integration into test-and-report.yml

1.4 Enhanced Security Scanning

Additional Security Tools

New Workflow: advanced-security.yml

⚡ Phase 2: Performance & Quality (Q3 2026)

2.1 Load Testing & Performance — ⚡ PARTIALLY COMPLETED

✅ Completed: Lighthouse CI

Remaining: k6 Load Testing

2.2 Mutation Testing

Integration with Stryker

2.3 Expanded E2E Testing

Enhanced E2E Configuration

🚀 Phase 3: Advanced Automation (Q4 2026)

3.1 Multi-Environment Deployments

Environment Strategy

New Workflow: deploy-preview.yml

3.2 Canary Deployments

Deployment Strategy

3.3 Automated Rollback

Health Check Integration

📊 Success Metrics

Phase 1 Metrics (Q2 2026)

Phase 2 Metrics (Q3 2026)

Phase 3 Metrics (Q4 2026)

🔒 ISMS Alignment

Policy Compliance

Compliance Frameworks

💰 Resource Requirements

Infrastructure Costs

Time Investment

🎯 Implementation Plan

Phase 1: Security Hardening (Q2 2026)

Phase 2: Performance & Quality (Q3 2026)

Phase 3: Advanced Automation (Q4 2026)

🕵️ Political Intelligence Capability Workflows (2026 → 2037)

The Agentic Intelligence Cycle (v3.0+)

New Intelligence Workflows and Their Rollout

Indications-and-Warning Continuous Loop

Governance and Phasing

🔮 Visionary Workflow Roadmap: 2027-2037

Political Intelligence Evolution — From Pipeline to Autonomous Observatory

Phase 4: AI-Enhanced Political Intelligence (2027-2029)

Phase 5: Autonomous OSINT Operations (2029-2032)

Phase 6: Cognitive Parliamentary Observatory (2032-2035)

Phase 7: AGI Democratic Guardian (2035-2037)

New Workflow: `fossa.yml`

New Workflow: `advanced-security.yml`

New Workflow: `deploy-preview.yml`