Record Phase 4 and Phase 5 on the roadmap

[om986]

Summary

• Phase 4 is workload package inventory from persistent storage: root volumes, boot images, container layers, function bundles, and shared filesystems. It ends when a package found there is a CVE finding on the workload the graph already stores.
• Phase 5 is secret and malware findings on storage that scan already opened. The graph stores the kind and the path.
• Object-body and database-row classification stays on the commercial side of the split. Issue Add a rule pack beyond CIS AWS #10 stays a side task.

Test plan

• Read docs/ROADMAP.md and confirm the ordered issues match EC2 root volumes are not inventoried for packages #102–Malware on inventoried workload storage is not a finding #108
• Confirm om scan aws, om scan azure, and om scan gcp are still described as read-only
• Confirm the README phase table lists Phase 4 and Phase 5 as open

Made with Cursor

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: OpenSourceOM/core/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: c2b984ee-54e0-4398-82f9-eb32a36b961d

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}