Publish the CLI roadmap and seed a contributor-ready issue set

[malik111110]

Outcome

The public project communicates direction without promising uncommitted dates and gives
new contributors bounded ways to participate.

Acceptance criteria

• Publish Now/Next/Later roadmap themes tied to user outcomes.
• Label framework packs and rules by maturity and contribution need.
• Create at least five good first issue items with fixtures and acceptance criteria.
• Create at least three help wanted issues with maintainer guidance.
• Document triage labels, response targets, and stale/close policy.
• Link the roadmap and contribution entry points from the README.

Closure evidence

Link the roadmap and seeded issues; confirm a new contributor can identify a suitable
task without private context.

[malik111110]

Implementation is published in PR #20.

Contributor backlog seeded and added to the launch Project:

• good first issues: Add positive and safe fixtures for the FastAPI SSRF rule #14 FastAPI SSRF, Add command-injection fixtures for the Gin framework pack #15 Gin command injection, Add fixture coverage for the second Razor XSS rule #16 Razor XSS, Cover NestJS SSRF with vulnerable and safe fixtures #17 NestJS SSRF, Add safe SQL and redirect fixtures to the Echo pack #19 Echo safe cases
• help wanted: Make the strict GraphQL source regression reproducible #12 GraphQL strict regression, Make the strict Juice Shop Express taint regression reproducible #13 Express/Juice Shop strict regression, Make the strict Spring annotation-source regression portable #18 Spring annotation strict regression

Each issue names its files, fixture boundary, exact assertions, local commands, and maintainer review needs. The roadmap records Now/Next/Later outcomes and the current source-backed maturity count for all 18 registered packs. The triage policy defines labels, response targets, inactivity handling, and the contributor-ready definition.

Local links and public entry points are validated. Remote Windows/self-scan checks may remain dependent on the fully green functional fixes in PR #10.

[malik111110]

Completed on public main at 6d2745e.

• Roadmap: https://github.com/Patchflow-security/patchflow-cli/blob/main/ROADMAP.md
• Triage policy: https://github.com/Patchflow-security/patchflow-cli/blob/main/docs/TRIAGE.md
• Five good first issues: Add positive and safe fixtures for the FastAPI SSRF rule #14, Add command-injection fixtures for the Gin framework pack #15, Add fixture coverage for the second Razor XSS rule #16, Cover NestJS SSRF with vulnerable and safe fixtures #17, Add safe SQL and redirect fixtures to the Echo pack #19
• Three guided help-wanted issues: Make the strict GraphQL source regression reproducible #12, Make the strict Juice Shop Express taint regression reproducible #13, Make the strict Spring annotation-source regression portable #18
• README links the roadmap, triage policy, issue chooser, and filtered contributor queues.

Every seeded issue is public and names exact files, fixtures, assertions, commands, and maintainer boundaries, so a contributor can choose work without private context.