Skip to main content

Roadmap

Phase 1 Hardening (Complete)​

  • Replace fixture drift with real filesystem reconciliation. (Implemented for ownership-state workspaces; legacy fixtures remain for regression coverage.)
  • Make restore ownership-safe. (Implemented through render-plan ownership baseline checks.)
  • Add interactive local approval prompts.
  • Move provider rendering into real provider adapter packages.
  • Expand trust gates for MCP servers, permission wildcards, sandbox weakening, inline secrets, and unknown settings. (Implemented locally; server workspace revisions also enforce hard denial for inline secrets and unknown settings.)

Phase 2 Hosted Registry and Object Service (Complete)​

  • Hono-based apps/api with @hono/zod-openapi for automatic OpenAPI 3.1 spec.
  • 26 REST endpoints: health, auth, packages, workspaces, approvals, objects, audit, telemetry.
  • Immutable package versions with draft/publish workflow.
  • HTTPS object upload/download with signed URLs, sha256 verification, ETags, and range downloads.
  • User and CI auth with Bearer tokens.
  • Device login flow for CLI authentication.
  • API-mediated Supabase OIDC (PKCE, ES256). (SAML and service accounts removed.)
  • Audit events.
  • Backend-selectable persistence: SQLite (WORKLOOM_API_DB_PATH) or Supabase.

Phase 3 Web Management (Complete)​

  • React SPA (apps/web) built with Vite, consuming generated React Query hooks.
  • API-mediated Supabase OIDC login with automatic Bearer token injection at the transport level.
  • Dashboard with org health summary via useDashboardModel composition hook.
  • Registry package browser via useRegistryModel.
  • Package detail pages.
  • Workspace listing and detail pages.
  • Editor, Telemetry, and Admin pages.
  • React Router v6 for client-side navigation.

Phase 3.5 API Client Generation Pipeline (Complete)​

  • @workloom/fetch-client: Native fetch() wrapper with auth injection.
  • @workloom/react-query: @tanstack/react-query v5 re-export with utilities.
  • @workloom/workloom-api: Kubb v4.37.8-generated typed client, hooks, types, and Zod schemas from the OpenAPI spec.
  • Generated code is committed and CI-validated via generate:check.

Phase 4 Telemetry (Complete)​

  • Privacy-safe ingestion.
  • Operational dashboards.
  • Rollout health.
  • CI compliance.
  • Renderer failure tracking.
  • Duration rollups.
  • Forbidden-field validation.

Phase 5 Provider and UX Expansion (Complete)​

  • Gemini install/link adapter.
  • Copilot expansion beyond committed projections.
  • GitHub REST automation for Copilot instruction sync and Copilot coding-agent repository access policy.
  • Desktop folder binder and drift resolver.
  • Local skill draft promotion preview.
  • Desktop distribution packaging plan with platform targets and signing gates.

Phase 6 Production Deployment (In Progress)​

  • Supabase Cloud backend (Postgres + Storage + Auth); local CLI stack for dev. Done.
  • Web on Vercel, API on Render; auto-deploy on push to main. Done.
  • API-mediated Supabase OIDC as the production identity path. Done.
  • Supabase migrations (supabase db push) for schema. Done.
  • Remaining: custom production domain + TLS, hardened CI/CD gating.

Phase 7 Enterprise Features (Planned)​

  • Full enterprise approval workflows (multi-stakeholder, policy-gated).
  • Richer CI policy gates with drift remediation.
  • Desktop native binary with platform signing and notarization.
  • Organization-scoped RBAC and team management.
  • Usage analytics and compliance reporting.