What's Shipped vs. Roadmap
A candid, line-by-line table of what is generally available in Nexus today, what is rolling out, and what is on the roadmap — so you never have to guess whether a capability actually exists.
This page exists because a common and fair criticism of vendor documentation is that you cannot tell what is actually shipped versus what is aspirational. This page removes the guesswork. Every significant capability is listed with a status of GA (generally available and running in production today), Rolling out (built and live on at least one production tenant, expanding), or Roadmap (not in the shipped server — do not design around it existing yet). Where something is Roadmap, we also state the pattern you use today to cover the gap. Candor here is the point: it is easier to trust a platform that tells you where its edges are.
How to read the status column
- GA — in the shipped server, running in production, safe to build on. Some GA controls have per-tenant configuration; that does not change their GA status.
- Rolling out — the capability is built and live on a production tenant (the commercial tenant), and is being extended. Treat it as real but not yet a universal guarantee on every tenant.
- Roadmap — not in the shipped server. Do not assume it exists. Read the "what you do today" note for the supported interim pattern.
Connectors & data access
| Capability |
Status |
Notes |
| PostgreSQL, MySQL, SQL Server connectors (full pushdown, incl. merge) |
GA |
Full where/order/group/aggregation pushdown. See Capability Matrix. |
| NetSuite connector (dual-surface) |
GA |
SuiteQL surface = full pushdown; REST record surface = no pushdown. Backs the nightly production sync. |
| QuickBooks Online connector |
GA |
Filter + order pushdown only; aggregation runs in-engine. |
| Monday.com connector |
GA |
Filter + order pushdown only; aggregation runs in-engine. |
| Internal Postgres workspace |
GA |
Baked per-tenant scratch DB, own managed identity, structurally isolated from op tables. |
| Generic HTTP/REST connector substrate |
GA |
Author build_request/parse_response, OAuth2/auth-header via the bridge, SSRF-checked. The answer for any REST API without a native adapter. |
| Generic JDBC connector |
GA |
Configurable driver/URL, JAR upload. The answer for any JDBC-reachable SQL source. |
| Stripe connector |
Rolling out |
Preview / pre-1.0 (0.1.x). Read/write per-collection; engine filters in-memory (no pushdown). Do not treat as production-hardened. |
| Container-aware pushdown wiring |
Roadmap |
The per-container pushdown override model is designed but not fully wired. Today, pushdown follows each adapter's declared capabilities. |
| Additional native connectors |
Roadmap |
The catalog is deliberately curated. Today, use the generic HTTP/REST or JDBC substrates, or Stingray can build a native adapter. |
Query, pipelines & authoring
| Capability |
Status |
Notes |
| UQL query engine + capability/pushdown model |
GA |
Typed per-adapter capabilities; clean in-engine fallback (not silent-wrong), bounded by a post-process row budget. |
discover_schema on all adapters |
GA |
Schema + sample discovery across every connector. |
| RBAC-gated, per-adapter-gated writes |
GA |
Views, formula/lookup columns, and read-only collections are blocked from writes. |
| Pipelines as sandboxed Python modules |
GA |
async def run(ctx), import allowlist, AST-level stripping of exec/eval/file-I/O/unrestricted-network. |
| Reports & dashboards |
GA |
Saved reports (row + scalar/aggregation shapes), dashboards, AI-assisted reporting. |
| Data sync |
GA |
Two-tier scheduled sync into the workspace; backs the production NetSuite workload. |
| Version control (git per tenant) |
GA |
Pipelines/reports/sites/skills; history/diff/restore via REST + MCP; multi-replica-safe writes. |
| Sites (hosted per-tenant pages) |
GA |
Sites set a strict CSP. See below for cross-origin isolation. |
| MCP server (embedded) |
GA |
Same RBAC + audit as REST; agents act within the connecting identity's permissions. |
Reliability & operations
| Capability |
Status |
Notes |
| Durable run queue (Postgres) |
GA |
run_queue, FOR UPDATE SKIP LOCKED claim + LISTEN/NOTIFY dispatch; survives replica restart. |
| Persisted run state, history & full traceback |
GA |
Every run in pipeline_runs with status, counters, logs, and the complete traceback on failure. |
| Per-run wall-clock timeouts |
GA |
Default 3600s, hard ceiling 6h, per-pipeline # nexus:timeout override. |
| Pipeline row-count constraints (blast-radius caps) |
GA |
Max rows read/created/updated/deleted. |
| Concurrency controls (global/worker/per-tenant) |
GA |
A queue that delays work, not a rejecting limiter. Plus the bridge connection governor. |
| Cron scheduling with exactly-once firing |
GA |
Compare-and-swap claim + cross-replica advisory locks. Applies to firing, not end-to-end execution. |
| Heartbeat + orphan reaper |
GA |
Detects runs whose worker died and marks them terminal. |
| Approval workflow (resumable dispatch) |
GA |
Human-in-the-loop approval steps with before/after audit snapshots. |
| Audit & cost telemetry |
GA |
Before/after audit snapshots on writes; telemetry per tenant. |
| Azure-native disaster recovery pattern |
GA |
DR is an extension of your Azure services' DR (Postgres backups, Azure Files, Key Vault). You set your own targets. |
| Run cancellation |
GA (best-effort) |
Requests cancellation. Cooperatively cancels an in-memory task or marks the run cancelled; the isolated worker can terminate the process. Not a guaranteed kill. |
| Automatic run-level retry / exponential backoff |
Roadmap |
Backoff exists only for adapter HTTP 429s and child-run polling. Today: design idempotent pipelines and re-invoke from an external scheduler. See Retries & Idempotency. |
| Dead-letter queue |
Roadmap |
Failed runs are recorded, not requeued. Today: query run history for failures and re-dispatch. |
| Durable step-level orchestration / checkpointed resume |
Roadmap |
Today: checkpoint yourself via the internal workspace between idempotent stages. |
| End-to-end exactly-once execution |
Roadmap / not planned as a guarantee |
Exactly-once applies to cron firing only; queue dispatch is at-least-once at the claim boundary. Design for at-least-once. |
Security & isolation
| Capability |
Status |
Notes |
| Tenant-owned deployment (managed app in your subscription) |
GA |
Per-tenant Container App, Postgres (MI auth, passwords disabled), Key Vault, VNet + NSG egress allowlist + private endpoint to the DB. |
| RBAC (roles + per-resource grants, users + apps) |
GA |
Execution roles / assume-role; admin edit-locks; service-bridge vs. user-bridge credential isolation. |
| Signed + dual-attested adapter bundles (fail-closed) |
GA |
Dual ES256 signatures from two Key Vaults; verified before load. |
| Signing-key management (Key Vault, TTL cache, rotation) |
GA |
5-min TTL cache + circuit breaker; NIST 90-day rotation. |
| SSRF checks on all outbound HTTP; app-layer egress allowlist + NSG |
GA |
Applies to ctx.http and the HTTP/REST connector substrate. |
| Sites strict CSP |
GA |
Sites set a strict Content-Security-Policy. This is Sites-specific, not a platform-wide server-enforced CSP. |
| Process isolation (env-scrubbed worker, brokered secrets over data-only IPC) |
Rolling out |
Live on the commercial tenant. An architectural control being rolled out — not yet a universal GA guarantee on every tenant. |
| Sites cross-origin isolation (per-tenant host separation) |
Roadmap |
Proposed, not deployed. Do not assume Sites are origin-isolated from the app today. |
| Government-cloud (GCC-High) deployment path |
GA (proven) |
Live on an Azure Government tenant, including a proven cross-cloud image pull. |
Identity & access
| Capability |
Status |
Notes |
| Microsoft Entra ID identity |
GA |
Users via OAuth2 + PKCE; desktop stores tokens in the OS keyring. |
| Scoped app tokens / API keys for automation |
GA |
Service-level bridge scope only; MCP access off by default; human-only content writes reject app tokens. |
| B2B external-user invites |
Rolling out |
Invite flow + "Allow External Users" deployment option; live-enabled on the commercial tenant. |
What we deliberately do not publish
No uptime percentage, latency, throughput, SLA, or RPO/RTO number appears anywhere in this documentation. Those are not backed by a public measurement program, so we do not print them. Because Nexus runs on Azure services inside your subscription, those services carry their own certifications and posture, and Nexus inherits that underlying posture — but we do not claim a third-party penetration test or a certification we do not hold. See Compliance & Shared Responsibility.
See also
Nexus