# backlog.md

> Anything not on the active roadmap (`build-plan.md`). Add freely; promote to a phase when ready.

---

## Ideas (raw, ungroomed)

- Email-bound report delivery: adviser clicks "Send to client" → CostusWorx emails the PDF directly with adviser branding.
- Two-factor authentication (TOTP) for Plus+ tiers.
- "Compare two scenarios" view: side-by-side success rate, paths, recommendations for the SAME client across two scenarios.
- Adviser-firm-level analytics dashboard: "average success rate across all clients this quarter."
- Heatmap of asset-class performance across simulation years.
- Anonymised industry benchmark: "your firm's median success rate vs. UK industry."
- Sensitivity slider: "what if inflation is +1% / -1%?"
- Educational tooltip mode: explains each metric in plain language for client-facing meetings.
- Glossary section in the PDF appendix (FCA, SIPP, ISA, IA sectors, NI qualifying years, etc.).
- NI qualifying year gap analysis — "you need 8 more qualifying years to receive the full State Pension."

---

## Enhancements (to existing features)

### Engine
- **TER drag** — subtract per-asset TER from each year's return. Already noted in `risks.md` and Phase 6.
- **Forward-looking parametric returns** — opt-in: μ=7% σ=16% for UK equity instead of bootstrapping history. Phase 6.
- **HMRC tax brackets inflate per year** — currently static for 25-year simulation. Phase 5.
- **SIPP minimum access age guard** — enforce age 57 (from 2028) at simulation start. Phase 5.
- **Lump Sum Allowance check** — flag if PCLS exceeds £268,275 across all SIPP/pension assets. Phase 5.
- **Per-asset year-sampling correlation lock** — when assets have own `fundReturns`, lock the year to the market's drawn year.
- **Sequence-of-returns dashboard chart** — visualise the bad-early-returns risk explicitly.
- **ISA annual allowance tracking** — £20,000/yr; flag contributions exceeding the limit in accumulation phase.

### Reporting
- **Email-the-report** button from dashboard.
- **PDF watermark** for Free tier (Pro tier removes it).
- **CSV export** of asset-by-asset annual values (currently only top-level paths).
- **Excel export** with native cell formatting (probably PhpSpreadsheet if Composer ever lands).
- **Custom branding** per-tenant: upload logo + 2 brand colours, applied to PDFs.

### Admin
- **HMRC tax bracket admin UI** — controller stub written, view pending.
- ~~**Fund import via UI**~~ — done: Export/Import CSV on `/admin/platform/funds`.
- ~~**User & Tenant CRUD (superadmin)**~~ — done: full add/edit/delete for users and tenants.
- **Bulk client import** for new tenant onboarding.
- **Engine version selector** — "rerun this saved run under engine v2026.05.07.3 for comparison."

### Fund data
- ~~**OpenFIGI lookup button on fund forms**~~ — done: `🔍 Lookup via OpenFIGI` on both edit and create forms; auto-fills name, SEDOL, fund type from ISIN or ticker.
- **Morningstar UK data integration** — possibly via Python service.
- **Daily NAV update** for active funds (not just annual returns).
- **IA category drift detection** — alert if a fund's IA sector changes between ingests.
- **Vanguard UK / iShares feed ingestion** — CSV ingest of UK fund performance data.

### Performance
- **Async simulation queue** — for runs >1000 iterations, queue and email when done.
- **Database query indexes audit** — pending until fund universe grows beyond 1000.
- **Static page caching** for dashboard landing.

---

## Future Modules

- **Strategy Comparator** — Phase 2, in plan.
- **Lifestyle planner** — model expense changes by age band (children leave, mortgage paid, downsize home).
- **Estate planning module** — Inheritance Tax (IHT), executor costs, nil-rate band calculations.
- **Annuity shop integration** — quote a guaranteed annuity from a UK insurer panel at retirement date.
- **DB pension comparator** — defined benefit vs DC comparison (commutation vs fund value).
- **Tax-efficient withdrawal sequencer** — when to draw from ISA vs SIPP vs GIA to minimise lifetime tax.
- **Beneficiary modelling** — what does this leave to spouse / children at p10/p50/p90?
- **Client portal (read-only)** — clients log in to see THEIR scenarios (gated by adviser).
- **NI record lookup integration** — link to HMRC NI record (future: GOV.UK API when available).

---

## Bugs / debt to clear

- ~~**Monte Carlo fund-specific annual return applied as monthly rate**~~ — fixed: `Asset::applyReturn()` now converts annual → monthly with `(1+r)^(1/12)-1`.
- `simulation_runs.app_version` column exists but isn't populated by `SimulationRunRepository::save()`. Add it.
- Audit log purge cron — table grows forever without one (6-year FCA retention applies).
- `async_funds_agent.php` legacy file in webroot exposes DB creds (per `risks.md`). **Delete from production.**
- Stripe webhook signature validation end-to-end audit pending.
- `simulation_runs` schema has individual columns plus `*_json` columns — clean up.
- `runs_count` not currently captured on `SimulationResult` — `PdfReport::runCount` hardcodes 500. Pass it through.
- ESLint rules absent on `app.js` — minor style drift over time.
- `.htaccess` containing `STRIPE_SECRET_KEY` and `OPENFIGI_API_KEY` must be excluded from git — add a `.htaccess.example` placeholder.

---

## Operations

- **UptimeRobot monitor** — 5-min ping on production URL (retireuk.costusworx.co.za).
- **Sentry-equivalent error reporting** — currently rely on cPanel error log. Add lightweight error-to-email if traffic grows.
- **Documented restore drill** — practice the full DB+files restore from backup once per quarter.
- **UK GDPR compliance review** — annual review with an external DPO / compliance officer.
- **Stripe webhook event replay** — use Stripe Dashboard to replay failed webhook events after outages.

---

## Marketing / growth

- **CISI / PIMFA partnership** — speak at CISI Annual Conference or PIMFA Forum.
- **Free FCA suitability template pack** as lead magnet for IFAs.
- **YouTube series** — "Building a UK retirement engine without Composer" (developer marketing).
- **Case study** — partner with one paying IFA firm to produce a public success story.
- **Referral program** — 20% recurring commission for advisers who refer.

---

## Stretch goals (Y2+)

- **Republic of Ireland rollout** — similar product set, similar regulatory environment.
- **EU rollout** — UK GDPR already compliant by design; EU GDPR alignment minimal delta.
- **Open Banking integration** (Plaid UK / TrueLayer) to auto-pull client portfolio balances.
- **AI-assist** — natural-language scenario entry ("retire at 62, need £3,000/month net, SIPP + State Pension") parses into a scenario.
- **Mobile apps** (iOS + Android) — view-only for clients, full for advisers.
- **Multi-currency support** — for clients with offshore assets in USD/EUR.

---

## How to use this file

- Anything goes. Don't filter at intake.
- Promote to `build-plan.md` only when scoped + estimated.
- Demote from `build-plan.md` here if the phase is cut.
- Review monthly; archive completed items to `changelog.md`.