Skip to content

Roadmap

What comes next, in the order the milestone graph derives, each milestone gated by the ones it depends on being accepted rather than by anyone's intention.

A milestone here is an outcome, not a bucket of tickets. Its status comes from its own issues and from whether the milestones it depends on have been accepted — so finishing every issue inside a blocked milestone does not release it. That is why the sequence below is derived rather than written down. Each milestone's bar counts its accepted issues against the ones it requires; a full bar on a blocked milestone still does not release it.

Every milestone the plan holds is listed, in the graph's order, and none is left out for a field a person did or did not fill in. A milestone that has shipped shows the release that carried it and that release's date: the first release record containing its last accepted issue, inferred from the records and never typed. One no release has carried yet reads unreleased and shows the date of its last delivered issue, read from the history. Under it are its issues, grouped by their declared status, each linking to its own page. A milestone that names a claim shows the claim it would move out of planned. Naming it is not promoting it: a claim becomes guaranteed when an implementation, a behavioural test and a blocking CI job exist for it, and the guarantees matrix will keep saying planned until they do.

Observed at
22a914d002a, committed
Milestones
111, every one the plan holds, in the order the graph derives
Issues
280 ready441 blocked3 verify292 done18 cancelled
Delivery
inferred from the history at a31215b957d: merged and released, each linked to the commit or release that proves it and naming its pull request
  1. v0.3.1 M000 — Milestone and DAG driven development DONE

    released

    done
    15 of 15
    DONE 15 issues
    • I0001 Audit what actually plans work in this repository none
    • I0002 Define the canonical milestone and issue schema none
    • I0003 Implement the model loader and the status derivation engine none
    • I0004 Implement DAG validation and execution waves none
    • I0005 Implement the plan command surface none
    • I0006 Generate the Mermaid DAG from the graph none
    • I0007 Enforce the canonical model as doctrine none
    • I0008 Project the model to GitHub milestones and issues none
    • I0009 Project the model into the website none
    • I0010 Behavioural tests for schema, status, graph and command none
    • I0011 Cross-surface consistency and mutation tests none
    • I0012 Make CI refuse an invalid model or a stale projection none
    • I0013 Document the semantics and the dogfooding rule none
    • I0014 Make the worker instructions require the model none
    • I0015 Open the first real milestone and execute one issue through it none
  2. v0.3.1 M001 — A blocking question survives a handover DONE

    released

    done
    4 of 4
    DONE 4 issues
    • I0101 Reproduce the escaped blocker as an executable case none
    • I0102 Decide whether a question transfers or the gate widens releasedv0.3.17bcce2d
    • I0103 Implement the decision and prove it holds none
    • I0104 Move the claim from planned to guaranteed none
  3. unreleased M002 — A durable record names the worker that wrote it ACTIVE

    last delivery

    done
    2 of 4
    blocked
    1
    ready
    1
    READY 1 issue
    • I0703 Implement the decision and prove it holds none
    BLOCKED 1 issue
    • I0704 Publish what attribution guarantees, and what it still cannot none
    DONE 2 issues
  4. unreleased M003 — A session is a durable envelope, and knowledge is compiled from what is already canonical ACTIVE

    last delivery

    done
    13 of 17
    blocked
    2
    cancelled
    1
    ready
    2
    READY 2 issues
    • I0813 A closed session becomes a node that points at its episode none
    • I3061 A headless or nested provider session is not the worker: its end never hands over the task or writes a tracked record releasedv1.0.0-alpha.88bf9978
    BLOCKED 2 issues
    • I0815 Say what is now true in the claims, the documentation and the worker instructions none
    • I0816 Prove the loop on a real issue, without a transcript none
    DONE 13 issues
    • I0801 Narrow the Clean Extraction Boundary and record what was adopted none
    • I0802 Specify the session record before writing one none
    • I0803 Open a session and report its status none
    • I0804 Close a session into an envelope derived from the ledger none
    • I0805 Read sessions back with a divergence label none
    • I0806 Make the session rules doctrines, with retention and archiving releasedv0.27.0289cbbe
    • I0807 Discover knowledge sources from git, not from the filesystem none
    • I0808 Extract nodes with identities that survive a rebuild none
    • I0809 Record only edges that a file states, each with where it was observed none
    • I0811 Read-only knowledge lookup with an ordering that can be explained none
    • I0812 Validate the graph, and let doctor and watch ask the same validator releasedv0.28.0c5aec68
    • I0814 Give the worker a bounded slice of knowledge, not the knowledge base none
    • I3060 A provider hook declares its timeout, and the session end closes its episode inside the budget releasedv1.0.0-alpha.88bf9978
    CANCELLED 1 issue
    • I0810 A content-hash manifest that makes a second sync cheap none
  5. unreleased M004 — Performance is executable evidence, and the hot path does no canonical work twice ACTIVE

    last delivery

    done
    19 of 45
    blocked
    11
    ready
    14
    verify
    1
    READY 14 issues
    • I0820 Catalogue, DAG, context and command-surface validators read their inputs once none
    • I0838 bench compare and the top regressions report none
    • I2660 The site is published as an artifact by the job that built it, so a ready site waits for no second workflow none
    • I2661 A publication that did not arrive is a finding the next reader meets, never a green step releasedv0.30.0194e207
    • I2662 Validation leaves the deployment a runner: a branch's checks never hold the pool a publication or a release record needs none
    • I2663 The published UI is not read from nothing on every deployment none
    • I2709 A red on the trunk has one named carrier, and nobody else may land until it is paid none
    • I2717 A release record pull request gets a verdict that can pass none
    • I2846 A hand-pinned budget in a case is reported unless it states its margin none
    • I3018 The intent workspace borrows the plan instead of copying it on every request releasedv1.0.0-alpha.29129c66
    • I3448 A deploy of master keeps every pre-release's metadata the site already serves none
    • I3799 The Pages publication budgets are re-derived from the runs that publish the language copies none
    • I4200 A warm UI screen borrows what its sources answered and writes its page once, so a plan of any size is not copied per request releasedv1.0.0-alpha.843f1ace
    • I4223 The pre-commit generation gate answers inside its bound, and a failed case's reason reaches an artifact releasedv1.0.0-alpha.8f6d61eb
    BLOCKED 11 issues
    • I0822 Every canonical file is flattened at most once per command none
    • I0828 doctor under a declared budget, and the hook inherits it none
    • I0831 Performance claims at their proven status none
    • I0834 The test runner reports per-case time and the suite budget none
    • I0835 CI runs the structural performance checks none
    • I0839 watch inherits every doctor fix and its own budget none
    • I0840 context and its subcommands under a second none
    • I0841 Cache equivalence proved by property-shaped cases none
    • I0842 Before and after evidence for every optimisation none
    • I0843 The performance workflow is discoverable and complete none
    • I3761 The Pages run of a release head publishes with fresh evidence, or publishes the site with the evidence lag stated, and never fails on a missing snapshot artifact none
    VERIFY 1 issue
    DONE 19 issues
    • I0817 Phase timing and work counters behind MJ_TIMING none
    • I0818 The command registry is read in one pass none
    • I0819 The project model is loaded with one flatten per file and no per-file lookups none
    • I0823 majordomus bench: targets derived from the command registry none
    • I0824 Bench persists local runs and keeps a latest projection none
    • I0825 An explicit committed baseline none
    • I0826 bench --check refuses a regression by policy none
    • I0827 The benchmark policy block none
    • I0829 Performance doctrine as project rules none
    • I0830 docs/PERFORMANCE.md, README, CONTRIBUTING and CLI reference none
    • I0832 generate-site-data instrumented and its hot spots removed releasedv1.0.0-alpha.457c1a9d
    • I0833 knowledge nodes and edges read each source once none
    • I0836 A synthetic repository generator for scaling cases releasedv0.28.0c081c0b
    • I0837 Timing report as JSON none
    • I2068 A verdict that depends on the runner says so, and one cold sample is not a regression releasedv0.29.0507e38c
    • I2664 A run that has already failed is cancelled by itself, and a red on the trunk is fixed before anything else is prepared none
    • I2710 A release run never waits behind pull-request validates for a job slot none
    • I2711 The pages job judges production only after the deployment of its own commit has arrived none
    • I2716 A case derives its budgets and lists from what it tests, never pins them none
  6. v0.3.1 foundation — A supervisory control layer that is real rather than described DONE

    released

    delivered — accepted before its work was written as issues, so no issue records it

  7. unreleased execution-telemetry — Execution telemetry, only from providers that expose it honestly ACTIVE

    last delivery

    done
    1 of 4
    blocked
    3
    cancelled
    1
    BLOCKED 3 issues
    • I0303 Prove a silent provider produces an explicit absence, never a guess none
    • I0304 Read the measurements back through the history surface, under a bound none
    • I0305 Publish the telemetry claim and record what remains unmeasured none
    DONE 1 issue
    CANCELLED 1 issue
    • I0302 Record telemetry a provider reports, and refuse anything it did not none

    what this would make guaranteed

  8. unreleased fly-deployment — The container image is a projection of the repository model, and its smoke is its evidence ACTIVE

    last delivery

    done
    5 of 29
    blocked
    15
    cancelled
    9
    ready
    9
    READY 9 issues
    • I0906 Termination is graceful and proved against the real container none
    • I0907 The running process says what it is, from an allowlist none
    • I0908 A hosted process has no repository, and says so instead of failing none
    • I0909 The production image is a generated projection of the build specification none
    • I0927 The cockpit shows the deployment from the same data none
    • I3244 The generated Dockerfile copies every path crate cargo metadata names, so a new workspace crate needs no edit of the image none
    • I3245 The image build's cold and warm durations and its context size are read from docker-image runs, and the deployment records say what is built today none
    • I3315 The image smoke completes an MCP initialize on /mcp and a WebSocket upgrade on /events, not only a ready probe none
    • I3820 A deployment names the provider that hosts it, and the provider's files are generated from it releasedv1.0.0-alpha.827d017e
    BLOCKED 15 issues
    • I0910 The release profile is chosen by measurement, not by folklore none
    • I0911 A source change does not rebuild the world, and the context stays small none
    • I0912 The image serves the site the canonical pipeline produced releasedv1.0.0-alpha.89c9b115
    • I0916 The smoke suite is derived from the route registry, never written twice none
    • I0919 Nothing secret and nothing local leaves in the image none
    • I0920 The image's dependencies are known and its advisories are policy none
    • I0921 Size is measured first and budgeted second none
    • I0923 Cold start and endpoint cost are benchmark targets like everything else none
    • I0925 Every deployment rule is a check that runs none
    • I0926 The deployment documentation is generated and reachable none
    • I0928 A pull request cannot merge a deployment that would not work none
    • I0930 The real image runs under the real limits before anything is deployed none
    • I0932 The milestone is accepted on its evidence none
    • I3821 The tree a provider receives is assembled from the deployment object, and master publishes it after green ci releasedv1.0.0-alpha.8fdeee1a
    • I3822 A deployment that names a provider is observed at its own URL, and is active only while it serves master releasedv1.0.0-alpha.8e2c9675
    DONE 5 issues
    • I0901 The deployment description is a kind of the layer, not a provider file none
    • I0902 The deployment object becomes typed Rust that refuses nonsense none
    • I0903 Deployment reads are declared once and projected everywhere none
    • I0904 The listen address is one fact with two projections none
    • I0905 Liveness and readiness are registered capabilities, not router hacks releasedv1.0.0-alpha.8e714307
    CANCELLED 9 issues
    • I0913 The provider configuration is generated, and the cheap profile is declared none
    • I0914 One deployment core, one command, and a dry run that mutates nothing none
    • I0915 Deployment joins the diagnostics that already exist none
    • I0917 A bad deployment can be undone deterministically none
    • I0918 The bootstrap credential is used once and belongs to nothing none
    • I0922 The memory hypothesis is tested, not asserted none
    • I0924 The decision is recorded where architecture decisions are recorded releasedv0.25.0#1125e28dacc
    • I0929 Production deploys from CI with a token scoped to one application none
    • I0931 The application exists, one machine runs it, and the URL answers none
  9. unreleased web-sign-in — The deployed surfaces know who is asking, and the identity providers are data PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 8
    blocked
    7
    ready
    1
    READY 1 issue
    • I1201 An identity provider is a declarative object, and Google and Facebook are two of them none
    BLOCKED 7 issues
    • I1202 One typed provider model reads the objects, and no code names a provider none
    • I1203 One flow serves every provider, and it refuses everything it did not start none
    • I1204 The session is signed, short, and revocable from the server none
    • I1205 Identity is resolved once, in the router, and every surface reads it from there none
    • I1206 What an anonymous reader may do is derived from the effect classification, not from a list none
    • I1207 No credential reaches any output, and hostile provider metadata renders safely none
    • I1208 Adding a provider is one file, removing one is one deletion, and both are executed rather than described none
  10. unreleased capability-graph — One capability graph, two projections, and no second inventory of what this repository can do ACTIVE

    last delivery

    done
    11 of 34
    blocked
    15
    ready
    8
    READY 8 issues
    • I1007 The site renders the same graph, generated once none
    • I1009 Every menu in this repository comes from one derivation none
    • I1010 The overview is what exists, counted rather than claimed none
    • I1011 The coverage matrix reports evidence, and never a green cell without one none
    • I1012 One detail view, assembled from what a node actually has none
    • I1017 Live state is an overlay that degrades to nothing none
    • I2732 The MCP reference repeats no registry entry: no hand-written document lists tools releasedv1.0.0-alpha.85b2c281
    • I3314 An object's read names the commit that last changed its file, and its page lists the commits that changed it none
    BLOCKED 15 issues
    • I1008 The two projections are proved to be the same model none
    • I1013 Search over the graph, generated, with nothing to run none
    • I1014 The relation view reads the graph and holds no data of its own none
    • I1016 The Cockpit works on a phone and before JavaScript runs none
    • I1018 The surface rules exist as checks, proved by making them fail none
    • I1019 One skill runs the whole loop, and is itself in the graph none
    • I1020 The graph's health is answered by the doctor that already answers everything else none
    • I1021 A browser proves the interface, at the widths people use none
    • I1022 Drift in any derived surface fails the build none
    • I1024 The interface has a weight, and it is measured none
    • I1026 The architecture explains itself, from inside itself none
    • I1027 A synthetic capability proves the architecture instead of describing it none
    • I1028 The inventories this replaces are removed, not left running beside it none
    • I1029 The gate refuses what would silently break the interface none
    • I1030 The milestone is accepted on its evidence none
    DONE 11 issues
    • I1001 One typed graph composes the registries that already own their facts releasedv0.3.1a4979a0
    • I1002 Relations are typed, inferred from stable identities, and never dangle releasedv0.3.146da808
    • I1003 Skills, rules, decisions, documents, use cases and benchmarks enter the graph as themselves releasedv0.3.1701d378
    • I1004 Availability and visibility are metadata, not conditions in a template releasedv0.3.15b817c2
    • I1005 The graph is a generated artifact with a schema and no unsafe field releasedv0.5.02766249
    • I1006 The runtime reads the graph through the registry, like every other read none
    • I1015 A surface with no server behind it is not offered as if it had one none
    • I1023 Nothing private reaches a published page releasedv0.28.0bdc75e2
    • I1025 The federated model and its two projections are an architecture decision releasedv0.3.1a1fc8d8
    • I1031 A served surface says which checkout it is serving releasedv0.29.0159db73
    • I1966 The composed graph is whole or its generation refuses none
  11. unreleased external-workspaces — An external workspace is read the way this repository reads anything else, and its content never becomes public by accident ACTIVE

    last delivery

    done
    2 of 12
    blocked
    9
    ready
    1
    READY 1 issue
    • I1302 Identity, provenance and support level are typed fields, not prose releasedv0.5.0012fed6
    BLOCKED 9 issues
    • I1303 The store is bounded, measured and invisible to every published projection none
    • I1304 The browser transport is the one this repository already drives none
    • I1305 An observed contract has a fingerprint, a compatibility state and a fixture releasedv0.5.0d52f433
    • I1306 A sync resumes, repeats itself without harm, and says how fresh it is none
    • I1307 The ChatGPT shape is mapped from evidence and never becomes the canonical model none
    • I1308 The executable's share is one capability, shaped like continuity none
    • I1309 The boundaries this milestone asserts are gates, not sentences none
    • I1310 The subsystem is documented where a person looks, and the plan is closed against the repository none
    • I3173 A synced workspace conversation proposes candidate records that cite their conversation and message, and nothing becomes canonical without an act none
    DONE 2 issues
    • I1301 A workspace is a declared object of the layer; only its content is local releasedv0.5.0012fed6
    • I3100 What the ChatGPT project decided is promoted into the layer, each record naming the conversation and message it came from none
  12. unreleased two-folder-integration — A repository that adopts Majordomus gains two directories and two lines, and can give them back ACTIVE

    last delivery

    done
    1 of 31
    blocked
    28
    ready
    2
    READY 2 issues
    • I2870 The layer's layout is declared as typed data: what each half holds, excludes, and the lifecycle of its contents none
    • I3014 The repository is found once per process, and a counter proves it none
    BLOCKED 28 issues
    • I1102 The two namespaces are a typed contract, not a habit none
    • I1103 Whether a file is authored or derived is a field, not a naming convention none
    • I1104 Both namespaces carry their contracts, all the way down none
    • I1105 The repository is discovered once, into one model none
    • I1106 The registries are views of the model, not separate discoveries none
    • I1107 Discovery is deterministic, cached, and its cost is known none
    • I1108 The desired integration is a value, and the plan is a diff none
    • I1109 Everything placed outside the two namespaces is recorded, with what it was none
    • I1110 The second run changes nothing, and a test says so none
    • I1111 Uninstall gives back exactly what was taken none
    • I1112 What touches the root is two small blocks, and they never change again none
    • I1113 Entering a directory is local, bounded and silent about the network none
    • I1114 A provider is an adapter over the model, and adding one is an implementation none
    • I1115 Completion comes from the command model, not from a second list none
    • I1116 This repository's own footprint moves, through the reconciler none
    • I1117 The hand-maintained lists are removed, not left running beside the derivation none
    • I1118 Every invariant of this milestone is a rule with a check that runs none
    • I1119 The budgets are measured, and a regression fails rather than being noticed none
    • I1120 A refusal says what to do about it none
    • I1121 Every surface shows the integration from the one model none
    • I1122 A foreign repository, adopted, upgraded and given back none
    • I1123 The milestone is accepted on its evidence none
    • I2871 A file in the half whose contract excludes it is refused, naming the path and the contract none
    • I2872 The skeleton a new repository receives is derived from the layout declaration none
    • I2873 The manifest schema is generated from typed sections none
    • I3015 serve and mcp discover the repository once, through the shared model none
    • I3016 A capability reads the repository from its context, never by opening it again none
    • I3017 Discovering the repository outside the model is refused none
    DONE 1 issue
    • I1101 What this tool leaves behind, established by inspection rather than by memory releasedv0.29.0b006442
  13. unreleased derived-data-integrity — A committed derivation describes something it can be a projection of ACTIVE

    last delivery

    done
    1 of 3
    cancelled
    1
    ready
    2
    READY 2 issues
    • I2863 A derive does not run while a merge is uncommitted none
    • I3775 A page written by hand is never resolved as derived: the merge=derived globs name only what a generator writes none
    DONE 1 issue
    CANCELLED 1 issue
    • I2864 The site generator reads no output of a later derive stage none
  14. unreleased work-graph-github — The projection to GitHub is gated, identified and traversable, and a merged pull request leads back to the outcome it served ACTIVE

    last delivery

    done
    10 of 12
    ready
    2
    READY 2 issues
    • I2844 plan validate refuses a milestone whose GitHub title would be over 255 characters none
    • I3920 The GitHub projection reads every issue, and a listing shorter than the repository refuses rather than reads as missing releasedv1.0.0-alpha.8080a40a
    DONE 10 issues
    • I1401 The identity of a projected record is what the record carries, not what its title says none
    • I1402 A finding says which of six states it found, and the state that could hide a person's edit is no longer one of them none
    • I1403 Backfill the projection once, deliberately, and record what it created releasedv0.27.0fa04902
    • I1404 The drift check is a gate, so a projection that stops being applied cannot stay silent none
    • I1405 A pull request names the issue it realises, and the edge is derived rather than remembered none
    • I1406 The plan's derivations are capabilities, so every surface reads the readiness the terminal reads none
    • I1407 One issue travels the whole path and back, as an executable case none
    • I1408 The documents stop claiming a projection nobody runs none
    • I1516 The adapter composes a projected body in one place none
    • I2300 A head is judged against what it changes, not against GitHub's live state releasedv0.21.0#9447377fe6
  15. unreleased intent-lifecycle — Work is traceable to the intent it serves, and an intent is satisfied only by evidence PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 3
    blocked
    1
    ready
    2
    READY 2 issues
    • I1900 An intent is a typed record whose stage and satisfaction are derived releasedv0.25.0#1128ac203c3
    • I3258 Evidence for and against one criterion is kept and named, and the criterion reads unknown until it is settled none
    BLOCKED 1 issue
    • I1903 The work realising an intent is joined across episodes, providers and handovers none
  16. unreleased development-runtime — The runtime has a development surface ACTIVE

    last delivery

    done
    59 of 93
    blocked
    13
    ready
    21
    READY 21 issues
    • I1504 One development transition is a capability, end to end none
    • I1997 The peer board can be read from the command line none
    • I2059 A rebuild never replaces the executable a live lease names releasedv0.19.0#8181fb8d6b
    • I2114 A task's scope admits what its derive writes releasedv0.20.0192ace8
    • I2484 majordomus ui ensures the shared server and opens the UI's dashboard mergeda31215b
    • I2485 The bench measures the first request after the repository moved, and a budget bounds it none
    • I2487 A screen is streamed, and one stream tells an open page which readings changed none
    • I2488 The HTTP stack is chosen by measurement: the same routes and several hundred open streams on tiny_http and on axum none
    • I2670 A build-cache offer is a typed model and its selection is a pure, explained function none
    • I2690 A session reads whether it is current, attached, announced and useful, from one capability none
    • I2694 A promoted note resolves in every checkout, not only where it was promoted none
    • I2698 The new scenes have screenshot evidence at 1080p and 4K on a named revision none
    • I2714 One build directory never serves two worktrees' jobs at once none
    • I2761 A branch that renumbered its decision away claims nothing at the old number none
    • I3172 The compiled context names the small set of capabilities the work needs none
    • I3312 An ADR may name the paths it governs, and the compiled context for those paths includes it none
    • I3316 The rescue command a stranded worktree is offered is proved by a drill that restores its work byte-identical none
    • I3317 An execution records the commit it started at, and a writing execution the paths it changed none
    • I3836 An offload derive observes the bundle's base commit, not its throwaway snapshot, so what it derives passes CI's check none
    • I3959 The shared build directory stays under its bound while builds run: between builds, under cargo's lock, its stale units are evicted oldest first until it is under the bound releasedv1.0.0-alpha.8b3ace7b
    • I4229 The image's build stage carries every file the crate embeds none
    BLOCKED 13 issues
    • I1505 A mutating capability leaves a durable event, and the ledger can be read back none
    • I1506 The lifecycle commands become non-interactive capabilities none
    • I1507 Issues, milestones, sessions and peers reach the Cockpit as projections none
    • I2671 A provider offers its cache as a signed, expiring mesh record, and a stopped provider goes stale none
    • I2672 The offers and the selection are one read, projected to CLI, MCP, HTTP and OpenAPI none
    • I2673 The sccache client configuration is derived from the selected offer, local disk first releasedv0.28.07a74935
    • I2674 A node is provisioned as an S3 cache provider, idempotently, with no secret in the repository releasedv0.28.07a74935
    • I2675 Build-cache health, headroom and hit statistics are visible where the mesh is none
    • I2676 The build cache is verified and validated: failure paths, security and a real second-node hit none
    • I2677 The build cache is documented, governed by a rule and described on the site and the Pages none
    • I2691 start, check, finish and the commit and push hooks refuse a change from a session that has not joined none
    • I2692 The join state is projected to the briefing, the Cockpit, the UI, the handbook, the site and GitHub Pages none
    • I2693 A session whose MCP server did not connect says so on the board, and a worker with nothing to do takes an open ask none
    DONE 59 issues
    • I1501 An execution a person starts is an execution the server can see none
    • I1502 A server serving code that no longer exists stops calling itself ready none
    • I1503 A closed session is not closed a second time under the same identity none
    • I1508 The navigation is derived from the dispatcher, not kept beside it none
    • I1509 A detail page that pages nothing has outgrown the reason it pages nothing none
    • I1510 A gap the audit calls planned names a plan object that exists none
    • I1511 The documentation surface answers in a checkout that has not built the site none
    • I1512 Gate state is something the runtime can answer releasedv1.0.0-alpha.8e46cb5d
    • I1520 A step that runs out of time says so itself none
    • I1967 A reporter that sets a flag is a reporter releasedv0.16.0195efb3
    • I1992 A rebuild that fails consumes no change: the next request retries it releasedv0.23.032d5b48
    • I1995 Work a session left uncommitted in a worktree is named, not found by luck releasedv0.19.0#8181fb8d6b
    • I2054 A tag does not turn every other pull request red until its record lands none
    • I2301 Whether the work is done is answered by measurement: the done invariant asks about debt, what was left behind and the backlog releasedv0.21.02841459
    • I2398 A derive offloaded to another machine waits its turn in a declared queue none
    • I2399 Every session briefs itself on an interval, without being asked releasedv0.21.0dd5a633
    • I2460 The overview asks its sources at once, so it costs its slowest source and not their sum releasedv0.21.051b8def
    • I2461 majordomus ui is served at /ui as its own product, with screens composed from capabilities releasedv0.21.0d5580ae
    • I2462 The UI has every screen, and its mesh is a graph whose nodes open an inspector releasedv0.21.0d5580ae
    • I2463 A train of stacked pull requests is a typed object, served everywhere and drawn as a graph none
    • I2470 The pull requests drain in the UI: a queue a reader narrows, inspects and follows to what each depends on releasedv0.21.02df014b
    • I2471 The roadmap opens a milestone: what it holds, what can start, its critical path, and what it waits for releasedv0.21.008333dc
    • I2472 How long CI takes is measured, from when each run started to when it completed, and the CI/CD screen draws it releasedv0.21.0306cf3b
    • I2473 A pull request shows its trail: what the executor did to it, and the drain what the lane did lately releasedv0.21.041008d5
    • I2474 The drain draws its merge throughput: each day's merges over the fortnight its trail ends on releasedv0.21.06a69100
    • I2475 The issues are browsed: every issue of the plan by status, milestone, priority or text, each a link onward releasedv0.21.0bc8ee34
    • I2476 An intent opens what serves it: its statement, its criteria and their evidence, and the milestones and issues that serve it releasedv0.21.05ba4b92
    • I2477 A claim opens its proof: what settles it, its last run, what changed since, how to see it again none
    • I2478 A rule opens its proof: what it states, the tests that prove it, what is missing, and the rules around it releasedv0.21.0ae556b8
    • I2481 The UI links every entity it names, and says none where a source has no value releasedv0.22.0995496f
    • I2482 Every screen of the UI has a case, and no link on the UI is dead releasedv0.22.0995496f
    • I2483 The UI is published as a snapshot: read once at the published commit and carried by the site at /ui releasedv0.22.041cc4dd
    • I2486 No screen waits for a source: a page shows the latest reading with its age, read again behind the reader releasedv0.22.0#1041f8611d4
    • I2489 A screen over its budget fails the build: the UI's latency budgets are benchmark policy, and bench --check holds them releasedv0.23.0#106573d3c8c
    • I2495 The Cockpit is published as a snapshot at /cockpit, and the UI's evidence links lead to it releasedv0.24.1#10843442ce6
    • I2652 The UI shows what the knowledge base holds: the candidates awaiting review and whether the deriver still writes, read and never acted on releasedv0.24.1#1090f0696ec
    • I2678 The public Observatory replays events that were recorded, and says it is a replay none
    • I2679 The Observatory follows a stream with a cursor instead of asking for its page again none
    • I2680 The Observatory's gates are closed with evidence: screenshots, measured frame rates, a soak, the recovery drills releasedv0.26.0#11292ca25bb
    • I2695 The Observatory draws the proof, claim, surface, wave and release scenes from the capabilities that already answer them none
    • I2696 p5 is a built, optional asset of the UI and the page says where it is none
    • I2697 The public snapshot carries the p5 library, or says which scenes it cannot draw releasedv0.27.0f4cda10
    • I2712 release-check treats a tag whose release run is still going as pending, not as a missing record none
    • I2713 A build never lets idle incremental sessions fill the disk releasedv0.30.036de9d1
    • I2715 New public Rust code meets rust-quality before the structure job does none
    • I2718 A linked worktree runs its own hooks, never the primary checkout's releasedv0.27.051faa7a
    • I2760 A scope entry is one path, and a path context would refuse is refused at start releasedv0.29.0e81e622
    • I2787 A build never lets the shared build directory's crate artifacts fill the disk releasedv0.29.0cc53629
    • I2813 A published page that answers 503, or does not answer, is asked again before it is called missing releasedv0.30.03f36b5b
    • I2882 A remote derive builds only inside its own run directory releasedv0.30.1a4c19d6
    • I2962 What the served surfaces change is said as the registry says it releasedv0.30.11b9b93d
    • I2963 The README's exit codes are the commands' contract releasedv0.30.1ae2a2a3
    • I2964 Every step that reads a surface into the published snapshot can ask the forge none
    • I2965 The site says a test proves a guarantee only as far as recorded evidence supports it releasedv0.30.1c90d10c
    • I2966 A forge setting that could not be read is unknown, never \"allows nothing\" none
    • I2967 The site's own pages name the layout in force releasedv0.30.1886cd9a
    • I3098 Waiting derives take the machine's derive lock in the order they arrived releasedv1.0.0-alpha.44b36890
    • I3099 The serve-lifecycle test tells a stopped server from another server answering its freed port none
    • I3171 The compiled context names source ranges with their reason and confidence, not only whole objects of the layer mergede75d3c3
  17. unreleased test-evidence — Every verifiable claim and widget resolves to revision-bound test evidence, on every surface ACTIVE

    last delivery

    done
    19 of 32
    blocked
    10
    ready
    3
    READY 3 issues
    • I1953 Evidence answers by subject, on every surface none
    • I1954 Every runner reaches the ledger, through the recording branch none
    • I1965 The entry preflight reads the one verdict none
    BLOCKED 10 issues
    • I1955 The evidence publication is an allow-listed projection none
    • I1956 The Cockpit shows evidence by subject none
    • I1957 Every test line is read, and a local run stays local none
    • I1958 Evidence has one route per subject, and every panel is joined to its subject none
    • I1959 The evidence publication is typed, bound to its build, and kept on gh-pages none
    • I1960 Every widget names its proof none
    • I1961 A deploy verifies the evidence routes it publishes none
    • I1962 The evidence gates read subject findings and widgets releasedv0.12.042a5715
    • I1963 Evidence is tested end to end none
    • I1964 The evidence reference is documented and held to the tree none
    DONE 19 issues
    • I1945 The test-evidence decision and its plan are recorded none
    • I1946 The verdict words are status words of the design system none
    • I1947 Every feature reaches a test, and every use case has a feature none
    • I1948 Evidence is judged at the presented revision, by one freshness function releasedv0.12.06d3973a
    • I1949 CI evidence is recorded clean, and its report is the tracked ledger's verdict releasedv0.16.05288706
    • I1950 Text a run printed is redacted by one rule set none
    • I1951 Evidence runs are typed, and a recording carries what its run measured none
    • I1952 Evidence subjects are derived once, in Rust none
    • I2282 The record pull request's dispatched verdict does not satisfy branch protection releasedv1.0.0-alpha.435a559f
    • I2296 The executor reopens a record pull request no run was started for releasedv0.21.07e4c594
    • I2298 A pull request stacked on one that landed merges on the verdict its head already has none
    • I2303 A release publishes its metadata to the site before its record lands, and the site never goes back a release none
    • I2396 The CI critical path of 2026-10-10 is measured, recorded, and explained before anything is changed none
    • I2416 The ci verdict asks every selected gate for a receipt, and a gate whose step never ran is red none
    • I2786 The published UI reads the evidence CI recorded, and a publication that would show tests as not run is refused releasedv0.29.0302adff
    • I2795 The trunk's recorded run reaches the tracked evidence ledger, and the baseline is tightened to it none
    • I2845 a run cancelled midway is not the publication's evidence while a complete one is near none
    • I2853 a Pages deploy on a fresh master is not refused for claims newer than the ledger it reads releasedv0.30.229acb77
    • I3013 The evidence job runs only when a planned lane ran tests, so a records-only pull request is not red releasedv1.0.0-alpha.499727f4
  18. unreleased public-proof — A visitor sees the product prove itself, and can check every claim it makes ACTIVE

    last delivery

    done
    14 of 26
    blocked
    6
    ready
    6
    READY 6 issues
    • I3084 An article explains the mesh in both languages: many machines, one journal none
    • I3753 The Czech copy says what the English says, in one vocabulary, with no segment of the homepage or the roadmap left in English none
    • I3759 Every language's homepage is held to the declared weight budget, and the capability list is fetched rather than inlined none
    • I3760 Each evidence-chain node says its own thing, and every homepage figure links to a page that counts the same number none
    • I3765 The homepage's provider figure says what it counts, and every provider it names is a name a visitor can recognise none
    • I3766 The install section links each page once, and the recorded refusals are grouped by the use case they prove none
    BLOCKED 6 issues
    • I3085 An article explains how a doubt is settled in both languages: by an experiment, not a count none
    • I3086 An article explains in both languages why silence is not a verdict none
    • I3088 An article explains in both languages why automation is a capability, not a shell script none
    • I3758 A number in a segment is a placeholder, so a changed count keeps its translation, and site-check reports each copy's untranslated share none
    • I3777 site-check refuses a translation-memory entry the build can no longer reach because it is keyed the old way none
    • I3860 An article explains in both languages why a saving is measured, not claimed none
    DONE 14 issues
    • I1600 The challenge is one recorded run, and every public surface replays it releasedv0.27.0#946c0e3585
    • I2417 The landing page is a click-through story: an editorial hero and an evidence chain a visitor steps through none
    • I3074 Every article ends with the articles related to it, in its reader's language, and each answers it back none
    • I3075 An article explains the cooperation model in both languages: seats are claims, tops are judged once, stale work is brought current none
    • I3077 An article explains the plan critique in both languages: a plan is attacked before it is built none
    • I3078 An article explains derivation in both languages: written once, derived everywhere none
    • I3080 An article explains claiming in both languages: claimed before it is built none
    • I3081 An article explains continuity in both languages: a session ends, the work does not none
    • I3082 An article explains the worktree topology in both languages: one branch, one place none
    • I3092 A translation-memory edit says which pages each changed key reaches, and refuses one that reaches none releasedv1.0.0-alpha.537205d4
    • I3095 A count inside a translated sentence is a slot, so a changed number never drops the translation releasedv1.0.0-alpha.5d296bf2
    • I3436 Every article reads in every language the site declares, and its counterparts are reciprocal none
    • I3437 An article names every language version in one translations table, and every member names the same group none
    • I3438 A translation records the digest of its source, and site-check refuses one its source has moved past none
  19. unreleased adopter-upgrades — An adopting repository survives a Majordomus upgrade, and what the tool vendors into it is adopter-neutral ACTIVE

    last delivery

    done
    14 of 20
    blocked
    2
    ready
    4
    READY 4 issues
    • I1980 A layer names the tool version it was written for, and doctor tells version skew from defects releasedv0.13.21aaf9f8
    • I1988 A use case's setup scripts live where the adopter declares, and its scenarios may run the adopter's own commands none
    • I1990 The pre-push check judges the refs being pushed, or says why the checkout's task binds them none
    • I1999 A tracked file a hook regenerates does not refuse a task that never touched it none
    BLOCKED 2 issues
    • I1982 Plan stamps written before seals existed are re-sealed by a command that keeps their original times none
    • I1983 Upgrading the vendored rules reports or applies the policy and source keys those rules depend on none
    DONE 14 issues
    • I1981 A command's effect class is declared per subcommand and flag, and live scenarios judge the whole argv releasedv0.21.0#95300496ba
    • I1984 Knowledge candidates never leave untracked files on a trunk that only pull requests change releasedv0.28.0b1a0bff
    • I1985 A knowledge candidate relates to its own decision and commit, not to the whole episode releasedv1.0.0-alpha.435a559f
    • I1986 The vendored rule package says nothing that is only true of this repository none
    • I1987 A knowledge record's file provenance survives the file's deletion none
    • I1989 init seeds a scope for the stack it finds, not for this repository's none
    • I1991 A comment-only edit of the policy regenerates no bootstrap releasedv0.13.21aaf9f8
    • I1996 doctor does not fail an adopter on a check written for this repository none
    • I1998 A health command in an unsupervised repository does not exit 0 none
    • I2464 A path that holds a space is one path to the scope doctrine releasedv0.22.0ac1c709
    • I2491 A personal layer changes nothing shared: init --personal and install.sh --personal keep the layer one person's own, verify it, and --shared hands it to the team releasedv0.22.0#104923c5c31
    • I2849 release next raises from the trunk the repository names, never from a branch name written in the tool releasedv0.30.06dceb97
    • I2941 A fresh init leaves doctor clean: a README that does not name AGENTS.md gains one paragraph that does releasedv0.30.065220a9
    • I2942 An installer dry run changes nothing, and the install guide says only what is true releasedv0.30.02b383cf
  20. unreleased a-second-adopter-is-served — A second adopter is served: what a foreign repository met on its first day is fixed in the tool ACTIVE

    last delivery

    done
    4 of 5
    verify
    1
    VERIFY 1 issue
    DONE 4 issues
    • I2601 majordomus evidence reaches record, stamp and show releasedv0.30.058d522c
    • I2987 server.status and peers.list ask every checkout at once, a bounded number at a time none
    • I2993 doctor counts the work no remote holds in one walk, whatever the number of branches none
    • I2995 doctor does no work whose answer cannot change a finding: the roadmap lookups and the board's wide status none
  21. unreleased ci-critical-path — The critical path from a change to its verdict, and from a merge to its verified deploy, runs under a minute warm ACTIVE

    last delivery

    done
    4 of 34
    blocked
    8
    ready
    22
    READY 22 issues
    • I2115 The slowest case costs a fraction of its budget, and its budget is never raised to follow runner load again releasedv1.0.0-alpha.82937c95
    • I2350 One gate model names what a local check, a pull request, an integration and a release must run, and no second inventory exists releasedv1.0.0-alpha.82937c95
    • I3825 A build refuses to start beside five others or below 35 GiB free none
    • I3830 A local gate reports and CI decides: pre-commit and pre-push refuse only on integrity none
    • I3919 The coverage gate finds the end of a test module across multi-line and raw string literals releasedv1.0.0-alpha.8#2348355a0ce
    • I3930 The suite is dealt from the seconds it costs now, and the record that deals it says when it falls behind none
    • I3931 A stale UI bar is told in a minute, before the browser audit, and a branch does not spend the audit to learn it none
    • I3936 The pages gate judges master's deploy after the run's heavy jobs, not on a clock that expires while the deploy queues behind them none
    • I3937 A gate whose cases the planned suite runs is not planned beside it none
    • I3938 The rustdoc composition case proves its composition on a small site, not on the whole one none
    • I3939 The executable and the rustdoc surface are built once per run and downloaded by the jobs that drive them releasedv1.0.0-alpha.8643f9e2
    • I3942 Linux's per-argument cap is measured on every host, so an oversized jq argument fails where it is written none
    • I3943 A second list of gates outside the model is found when it is put back none
    • I3945 The site generator's input list reaches jq through a file, not as one command-line argument none
    • I3949 A printf piped into grep -q under pipefail is refused, and a here-string replaces it none
    • I3963 A merge of master derives in one go: scripts/derive derives the staged merge with both parents as history none
    • I3999 A fixture holds the skills the site generator reads releasedv1.0.0-alpha.833c1948
    • I4154 The follow backlog test waits on the follower's cursor, not on fifty milliseconds none
    • I4199 A case that compiles the crate runs alone or caps cargo, so the cases beside it are never starved past their bounds releasedv1.0.0-alpha.84b9aa6e
    • I4203 The ci verdict judges each gate by the receipt of the attempt that ran it, so a rerun that passes is not judged by the attempt that failed none
    • I4221 CI's Rust cache carries the shared build directory, where cargo actually compiles mergede9e7ba9
    • I4222 A forge reply cut off on its way is asked again none
    BLOCKED 8 issues
    • I2348 A gate's result is reused only for the exact inputs it judged, and a skipped gate carries the proof that nothing it reads changed none
    • I3832 majordomus worktree sweep removes merged, clean, idle worktrees, never with force, and announces each on the mesh none
    • I3833 majordomus disk prune reclaims by name what nobody is using: idle build directories under their cargo locks, and the container runtime's cache none
    • I3940 The UI audit runs as four shards side by side, and the long pole of a full run is a quarter as long none
    • I3944 The two readers of the CI model give every gate, and the plan, the same reason in the same words none
    • I3946 Every gate of the CI model declares its lane, and both readers refuse a lane they cannot read none
    • I3947 A plan asked at a tier selects only the lanes that tier runs, and both readers of the CI model agree on it none
    • I4155 The follower's shared board and page caches are keyed by the repository they read none
    DONE 4 issues
    • I3824 The cooperation rule says a worker lands its own green head, and every bootstrap says the same releasedv1.0.0-alpha.48d394f3
    • I3831 A hook never starts a cold cargo build: a stale executable is the installed release, or the check is skipped and says so none
    • I3834 A case run removes its own scratch dir however it ends: passed, failed, timed out or interrupted releasedv1.0.0-alpha.442a1ce3
    • I3839 A build that cannot take its build directory's lock never falls back to a cold private directory below the free-disk bound: it waits, bounded, or refuses naming the bound and the holder none
  22. unreleased measurements-are-tracked-over-time — Coverage and CI cost are kept, exported and drawn over time, from the one measurement each has PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 7
    blocked
    3
    ready
    4
    READY 4 issues
    • I3934 A CI run is emitted as an OpenTelemetry trace when an endpoint is configured, and nothing is sent when none is none
    • I3941 The UI draws the trends the pages publication records: coverage and CI time per run, and the slowest jobs none
    • I4207 Only a trends series of the shape the publication writes decides a run link none
    • I4220 A run that /trends/ draws is a link the site check decides by provenance releasedv1.0.0-alpha.8#25006af2d09
    BLOCKED 3 issues
    • I3932 Coverage is exported as LCOV and Cobertura from its one measurement, and uploaded to Coveralls and Codecov when their secrets exist none
    • I3933 Every master run's coverage and CI cost join a derived series that the site and the Cockpit draw none
    • I3935 An agent session's telemetry reaches the same OpenTelemetry endpoint, configured once and projected to every provider none
  23. unreleased automation — Repository automation is scripted capabilities over typed Rust, not shell ACTIVE

    last delivery

    done
    3 of 6
    blocked
    1
    ready
    2
    READY 2 issues
    • I1801 A scripted capability is a kind, discovered and registered, runnable and projected like any capability none
    • I3160 A behavioural case can be written as a Rust integration test over a disposable repository, and the continuity cases are the first ported none
    BLOCKED 1 issue
    • I1804 The first shell scripts become scripted capabilities over typed Rust none
    DONE 3 issues
    • I1800 The sandboxed engine a scripted capability runs in releasedv0.27.07ac2fde
    • I1802 Nothing runs Perl none
    • I1803 New shell is refused without a declared exemption, and the migration inventory is tracked none
  24. v0.28.0 a-session-leaves-what-it-observed — A session leaves what it observed, and the repository routes it DONE

    released

    done
    3 of 3
    DONE 3 issues
    • I2073 A worker records an observation in one command none
    • I2074 An observation becomes a candidate that says what it is about, and reading groups recurrence none
    • I2075 A candidate is routed by what it is about none
  25. unreleased runtime-trust — A runtime is safe to reach from another machine, and joining the mesh trusts nobody by accident ACTIVE

    last delivery

    done
    6 of 10
    ready
    4
    READY 4 issues
    • I2703 The mesh cooperation rule lists the hello checks in the order the code runs them, and a test names that order none
    • I2704 A dialer reads no reply beyond the link bound and no more candidates than the bound, and a refusing peer is retried at a measured, jittered rate none
    • I2705 A node key can be rotated, peers follow the new key, and the old key is refused none
    • I3175 Two hosts presenting one node key are named as a duplicate, never folded into one flapping node none
    DONE 6 issues
    • I2123 A caller beyond loopback reads, and changes nothing it cannot authenticate releasedv0.28.0dc3c365
    • I2124 An event reloaded from disk meets the trust policy in force, and no stamp outruns the clock releasedv0.28.04393314
    • I2132 A hello names the runtime it is meant for, and no other runtime accepts it releasedv1.0.0-alpha.8e5d2a83
    • I2133 Every mesh input and answer has a bound, and a refused registration learns nothing none
    • I2134 A key removed from the trust list loses its links without a restart, and a node key can be rotated releasedv0.28.0db2d2d3
    • I2135 The trust root is read from the default branch, not from whatever the checkout holds releasedv0.28.070e203f
  26. unreleased runtime-lifecycle — One usable server per checkout starts, attaches, stops and reports its state without races or hidden kills ACTIVE

    last delivery

    done
    7 of 10
    cancelled
    1
    ready
    3
    READY 3 issues
    • I2700 A lease probe asks a cheap liveness route, and a server holding another lease token is not taken for the leaseholder none
    • I3179 The runtime reports one typed state, with how it got there, and every surface shows it none
    • I3606 Two live instances of one runtime slot keep their links, and the mesh names them instead of flapping none
    DONE 7 issues
    • I2126 A server busy with tool calls is never taken over as if it were dead none
    • I2127 A server that lost its lease hands its sessions on and ends releasedv0.27.0540b3ca
    • I2128 A lease is removed only by the process that holds it, and serve stop stops the server in order releasedv0.28.02caa75b
    • I2129 The lease timings the policy declares are the ones the mcp and serve elections use none
    • I2131 A server in use through the Cockpit or HTTP is not stopped as idle, and a checkout keeps one address none
    • I2701 The idle timeout is declared beside the other server timings, and serve --idle overrides the declaration none
    • I2702 A checkout keeps one address across restarts, because its server binds a port derived from the checkout none
    CANCELLED 1 issue
    • I3180 Entering a checkout whose executable is missing or stale starts one background build and says building releasedv1.0.0-alpha.86d4e350
  27. unreleased mesh-journal-converges — The cooperation journal is durable, converges under any delivery order, and never lets a stale claim win ACTIVE

    last delivery

    done
    4 of 14
    blocked
    1
    ready
    9
    READY 9 issues
    • I2733 A resumed mesh.events walk returns every event exactly once, across partitions releasedv0.28.0a64fdc1
    • I2825 A claim released on one runtime is released on every runtime that holds it, and a link to a restarted peer recovers releasedv0.30.091ed1da
    • I2874 A replicated mesh notice carries what a seat did, so a removal or a prune is seen on every machine none
    • I3174 An exclusive claim carries a fencing epoch, and a holder returning under an old epoch is refused none
    • I3444 A claim released on a runtime that is not replicating reaches every linked runtime, or the release is refused none
    • I3608 An open review says how old it is, and lapses when nobody can answer it any more none
    • I3771 A claim scope that is not a repository path is refused, or mapped to the record file it names, so a milestone claim excludes what it says none
    • I3772 Every mesh link counts its failed sync rounds, and a link whose rounds fail does not read plainly connected none
    • I3810 A mesh session whose client process has ended is closed by the runtime that holds it none
    BLOCKED 1 issue
    • I3798 A session's mesh claims outlive a lease takeover of the server it made them on none
    DONE 4 issues
    • I2137 An accepted mesh event is on disk before it counts, and a damaged journal line is reported, never fused or dropped silently releasedv0.26.0#1130990853c
    • I2139 A sync message stays under the link bound whatever the marks weigh none
    • I2140 Paging mesh.events returns every event exactly once none
    • I2706 An own event whose append failed is never acknowledged as durable, and a journal reload is bounded in size releasedv0.30.090bf65b
  28. unreleased mcp-transports-are-reliable — Every MCP transport delivers each request at most once, bounds what it carries, and honours cancellation ACTIVE

    last delivery

    done
    2 of 9
    ready
    7
    READY 7 issues
    • I2148 Every provider's MCP launch configuration is a projection of one declaration, and a drifted one fails a gate releasedv1.0.0-alpha.85e3cc2d
    • I2840 A cancelled MCP call stops, and the client is told it stopped releasedv0.30.033b6821
    • I3960 The initialize instructions tell the caller about itself before the board, and the board line is bounded none
    • I3961 peers.list answers a summary by default: checkouts that hold no board are counted, not listed none
    • I3962 The codex advisor's final message is held to the answer schema and read from its file alone none
    • I3990 An exclusive mesh claim lives by its holder's progress: a session stuck on a dialog, hung or crashed stops refusing others while its server beats on merged38b6d05
    • I4227 A client that re-attaches and repeats its named claim keeps one departed row, not one per reconnect merged8c48014
    DONE 2 issues
    • I2145 A tool call that may have run is never sent a second time none
    • I2147 The MCP transports bound what they read and follow the Streamable HTTP rules they claim none
  29. unreleased surfaces-never-disagree — Every surface projects the same state, says when it was observed, and keeps no list of its own ACTIVE

    last delivery

    done
    8 of 18
    ready
    10
    READY 10 issues
    • I2654 A chart is held to its table by a gate, and the tables that are measured series are drawn none
    • I2655 The homepage decides whether it carries a derived figure, within its declared story and budget none
    • I2656 The diagram viewer serves the Cockpit and majordomus ui, and a node that is a repository file links to its source none
    • I2842 The live site is verified on a schedule, and its last verification is evidence releasedv0.30.070b5804
    • I3318 Every decision and curated note is read on /ui, with the records it names and the records that name it none
    • I3447 No two published paths differ only in case, and a publication that holds two is refused before it is built none
    • I3607 mesh state answers in JSON on the command line, and its view is chosen the same way on every surface none
    • I3609 A claim replayed after a re-attach keeps the time it was made, and an announce answers with the claim it made none
    • I3752 The UI is one of the product's surfaces, so every count of the interfaces agrees none
    • I3767 The language switch of a UI or Cockpit page keeps the reader on that page, and says so when the surface has no copy in the language chosen none
    DONE 8 issues
    • I2151 A page served beside the write routes runs only script it shipped, and a rebinding host reads nothing releasedv0.28.0d5f1289
    • I2653 Every diagram on the site is one interactive, linkable viewer whose node links are inferred, and a derived table can be drawn as a chart none
    • I2770 majordomus ui and the Cockpit wear the site's navbar: one renderer, the same styles and scripts, and a browser comparison that refuses a difference releasedv0.29.03a8ca85
    • I2943 A mesh this process is not on is said as not observed, never as zero or no releasedv0.30.081d1fb3
    • I3007 A commit that a record or the site's data names is a commit the history holds releasedv0.30.17a20e31
    • I3008 A homepage link with a fragment resolves to an element its page carries none
    • I3009 No record's prose and no board announcement holds a template delimiter releasedv1.0.0-alpha.2ce424b8
    • I3010 The mesh manual says the edit guard is not wired, and how to wire it by hand none
  30. unreleased failure-is-visible — Every failure the runtime can suffer is bounded, tested or stated, and changes the health it reports ACTIVE

    last delivery

    done
    5 of 6
    ready
    1
    READY 1 issue
    • I3310 majordomus start refuses a task, owner or reason that the task record cannot hold, and writes nothing none
    DONE 5 issues
    • I2156 A slow or silent HTTP client cannot hold a server worker none
    • I2157 Ready means ready: a lost lease, a degraded layer or a failing mesh is not reported ready none
    • I2707 majordomus doctor reports a stale server, or says plainly that it checks governance only none
    • I2731 Every failure class in the published failure table names its test or its stated limitation none
    • I2827 A tool written a moment ago is run once its writer lets go releasedv0.30.08a82388
  31. unreleased architecture-is-enforced — A violated invariant fails a gate, and green means every required check ran ACTIVE

    last delivery

    done
    6 of 8
    ready
    2
    READY 2 issues
    DONE 6 issues
    • I2161 No answer, log line or mesh frame carries a credential the redactor knows none
    • I2162 A released archive, installed, serves a foreign repository over the shared server in CI releasedv0.21.05f654ca
    • I2708 A mesh event field nobody listed fails the mesh check, and no log field or review body carries a credential the redactor knows none
    • I2841 The site's browser probe is split, so the site job runs well inside its timeout releasedv1.0.0-alpha.47def409
    • I3091 A translated bar keeps the headroom of its English bar, whatever fonts the machine has releasedv1.0.0-alpha.50ada953
    • I3094 The Pages build and check hold a site built in every language releasedv1.0.0-alpha.5eef2f1c
  32. unreleased safe-self-update — Every mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked ACTIVE

    last delivery

    done
    4 of 12
    blocked
    5
    ready
    3
    READY 3 issues
    • I2720 majordomus self update re-runs the published installer, and never reimplements it none
    • I2723 The mesh shows each node's version and how far a release has rolled out none
    • I2826 A GitHub release carries the tool's own changelog for its tag, never GitHub's generated notes releasedv0.30.04960fa3
    BLOCKED 5 issues
    • I2721 An enrolled mesh node follows the stable pointer by itself none
    • I2722 A hub activates a new version under its service manager, checks its health and rolls back by itself none
    • I2724 A node without a route to the site takes the archive from a peer and still verifies it itself none
    • I3177 Two nodes one release apart keep linking, and what the older cannot answer is shown unavailable none
    • I3178 A self update killed at any stage leaves a usable installation none
    DONE 4 issues
    • I2163 A client never attaches to a server of another version without saying so, and a newer client replaces an older server releasedv0.27.0540b3ca
    • I2165 A released archive carries a provenance attestation the installer can check releasedv0.20.0#874a804ae2
    • I2829 An alpha is published as a pre-release end to end, and never becomes the latest release anywhere releasedv0.30.19f8baaf
    • I3097 An older executable never takes the shared-server lease from a newer one because the newer one's file was rebuilt none
  33. unreleased every-session-joins-the-mesh — Every LLM session joins the Majordomus mesh at start, told the mesh as work ACTIVE

    last delivery

    done
    3 of 5
    ready
    2
    READY 2 issues
    • I2289 A task built off the mesh is refused none
    • I3774 Every completed step of a session is announced on the mesh by the step itself, and the board, the monitor and the UI show it none
    DONE 3 issues
  34. unreleased truthful-plan-surfaces — The plan's surfaces are inferred from delivery, and nothing they show is typed beside the repository ACTIVE

    last delivery

    done
    16 of 44
    blocked
    6
    ready
    22
    READY 22 issues
    • I2747 Every code block on every surface is highlighted by one engine with one palette none
    • I2749 A commit that only plans an issue is not its delivery none
    • I2750 The trunk's drift gate reads the forge before it judges none
    • I3079 The links of the Deployments table on /ui/delivery meet the target size at every audited width releasedv1.0.0-alpha.2ea81bca
    • I3271 plan.drift reports a source it could not observe as unknown, never as a drift finding none
    • I3319 No record names a repository a design was studied in none
    • I3440 A milestone's meter counts the issues it requires, and a milestone with none says so none
    • I3441 The roadmap's tables show the order they are in, say none for nothing, and link every milestone none
    • I3442 Where the work is is cached by what it reads, and a warm roadmap does not walk the trunk none
    • I3443 Each roadmap milestone names the product features its issues deliver, derived from the feature declarations none
    • I3449 Every surface names its versions from one derived release model, says which version each one is, and a gate refuses a version that disagrees or is written by hand releasedv1.0.0-alpha.8784a372
    • I3750 The milestone graph reads each edge in the direction it means, in its text and in its detail panel none
    • I3751 The roadmap says only what the plan holds, with a bar and a date on every milestone none
    • I3756 A published UI snapshot says once why it reads no mesh and no deployed commit, and shows no unread notice for either none
    • I3757 A BLOCKED milestone names what holds it: the milestones it waits on, or the issues outside it that hold every open issue inside it none
    • I3762 plan validate warns on an open issue that declares no parallel_safe none
    • I3763 A cancelled dependency that names its replacement is satisfied by that replacement, and one that names none is reported none
    • I3764 The homepage's plan card says what each status means, links each to its issues, draws progress, and invites the roadmap none
    • I3769 A published page reads delivery at the commit it was built from, and names one commit none
    • I3916 The homepage counts supported claims from the run the evidence page reads, and names the revision it was recorded at releasedv1.0.0-alpha.83071f0f
    • I3917 The plan's status counts leave the homepage hero and stay on the roadmap releasedv1.0.0-alpha.83071f0f
    • I3918 README, CONTRIBUTING and the homepage say truthfully how big the tool is and what its registry counts are releasedv1.0.0-alpha.80cb26dd
    BLOCKED 6 issues
    • I2748 The drift already on the trunk is settled before the gate is made blocking releasedv0.30.0c34a3c0
    • I3439 Now and next are derived once, and every plan surface names the same two none
    • I3754 plan.next never names an issue whose delivery is merged or released, and plan.roadmap names that issue with its drift none
    • I3755 /roadmap/ opens with now, next and a status summary, shows each milestone's priority, and keeps its issue groups collapsed none
    • I3768 Every plan surface answers 'when' from the records: a release's date beside its version, and the last delivery date of each open milestone none
    • I3773 Every plan surface draws a milestone's progress as a bar of the issues it requires, a blocked milestone's bar says the gate is closed, and the roadmap no longer says a bar would be a lie none
    DONE 16 issues
    • I2740 An issue's delivery is inferred from branches, pull requests, merges, tags and the published site releasedv0.30.0ee02079
    • I2741 Merged work the plan has not recorded is drift, and on the trunk past a window it is red releasedv0.30.08d74440
    • I2742 A milestone's version is inferred from the release that carried it, never typed releasedv0.30.083b25a6
    • I2743 The public roadmap draws every milestone in the graph's order, each issue with its inferred delivery releasedv0.30.05485fee
    • I2744 The UI roadmap reads delivery and the releases themselves, and its now is where work is releasedv0.30.0b4247f3
    • I2745 The landing page states no present it does not read releasedv0.30.058d522c
    • I2746 Every published tree draws its diagrams, and every diagram is the interactive viewer releasedv0.30.058d522c
    • I2850 the published PR Drain carries its pull requests, and counts pull requests rather than plan issues releasedv0.30.038f2e9b
    • I2851 the homepage's product view counts the delivery the history proves beside the statuses the records declare, each count a link releasedv0.30.0ca277ce
    • I2852 every class a UI screen gives an element is one the UI's stylesheet defines releasedv0.30.0500f0d4
    • I3020 The Knowledge screen states nothing about the repository that its checkout could not observe releasedv0.30.06afb124
    • I3021 The Knowledge screen shows each review command as code with what it does as a sentence releasedv0.30.16f54b41
    • I3022 An empty knowledge queue is one sentence that says how a record arrives, not two empty tables releasedv0.30.19904000
    • I3023 The Knowledge screen reads in review order, in plain labels, and leads to the knowledge manual releasedv0.30.19904000
    • I3024 The Knowledge screen's manual link names a page the site has, on the server and on Pages releasedv1.0.0-alpha.119d5dda
    • I3025 Every Knowledge tile reads whole at a phone's width releasedv1.0.0-alpha.1b9b6dbf
  35. unreleased browser-compute — A browser computes for the project with the server's own code, and the server verifies every result PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 1
    ready
    1
    READY 1 issue
  36. unreleased idd-workspace — The UI is where the owner directs the work, from an intent to its next move DONE

    last delivery

    done
    6 of 6
    DONE 6 issues
    • I2780 The UI has an intent workspace: an intent, its milestones, issues, waves and graph on one screen releasedv0.29.08def887
    • I2781 An issue is started, verified and finished from the intent workspace releasedv0.30.06811d1e
    • I2783 The intent workspace reads itself again when a move ends on its server releasedv0.30.0afaecfe
    • I2789 The intent workspace shows why an intent stands where it stands and every move made on its issues releasedv0.30.09bcbc98
    • I2812 The IDD loop is accepted end to end in a real browser on one commit releasedv0.30.0627eae8
    • I2900 Every issue id on the intent workspace is a link, the shared-scope pairs are one folded line, and no missing library is asked for releasedv0.30.0a119ab2
  37. unreleased a-test-fails-when-the-code-is-wrong — The suites that guard critical predicates are shown to fail when those predicates are wrong PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 3
    ready
    3
    READY 3 issues
    • I3120 A scheduled mutation run over the declared critical predicates records its survivors as evidence none
    • I3121 The release compatibility analyzer's invariants hold under property tests none
    • I3309 A fix finishes completed only with a named regression case that fails on the task's base and passes on its head none
  38. unreleased a-claim-stands-only-on-its-evidence — A claim that something is enforced, tested or delivered stands only on recorded evidence that would have caught it being false PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 20
    blocked
    4
    ready
    16
    READY 16 issues
    • I3083 Six records say something the code or another record no longer says none
    • I3087 Seven statements about silence disagree with the record they cite, or name what does not exist none
    • I3089 Five statements about the shell migration disagree with the code, the plan or the proof they name none
    • I3110 A blocking rule reads proven only when one of its cases shows its violation refused none
    • I3113 github-check refuses when master's protection no longer requires the verdict check gates.yaml names none
    • I3115 A rule or guarantee that cites a proposed decision as its authority is listed, and the owner's acceptance queue is derived from it none
    • I3116 The debt every ratchet baseline holds is one derived table, with its rule and its trend none
    • I3117 The README and the launch page say only what master does about model invocation, doctrine dispatch and overrides none
    • I3118 The edit guard's contract names every case it lets through, and each row has a test none
    • I3119 The delivery report computes required_tests_current, test_evidence_published and ui_linked instead of citing a merged pull request none
    • I3122 A coverage figure on every surface names its dimension, its commit and what it does not measure none
    • I3123 finish refuses a verify command the profile does not admit for the change, and keeps its output none
    • I3124 A JUnit XML report a repository already produces is imported into the evidence ledger, and nothing in that repository changes none
    • I3126 check and finish count the refusals later overridden and the completions later reverted, per rule and per release none
    • I3861 The economics methodology names an interval the calculator does not compute, and ADR 0082 reads a finding it has no run for none
    • I3862 The shell floor is held by a case that reads what the rule forbids none
    BLOCKED 4 issues
    • I3111 Every dispatched blocking validator is run against a declared violation, and one that accepts it fails the case none
    • I3112 rule-proof-check prints the blocking rules no recorded run proves, and that count only falls none
    • I3114 A merge past the required check is observed from the forge and matched to the owner's recorded authorisation none
    • I3125 Coverage from LCOV or Cobertura is linked line by line to the source at the measured revision none
  39. unreleased the-product-shows-what-it-caught — What finish caught is counted from the ledger and compared on the benchmark, never asserted BLOCKED

    nothing delivered yet

    done
    0 of 4
    blocked
    4
    BLOCKED 4 issues
    • I3130 The ledger answers how many false dones finish caught, by doctrine, with the tasks it counted none
    • I3131 A refusal answered by no change to the tree is not counted as a caught false done none
    • I3132 /ui shows what finish caught beside what being caught cost, and says not observed where there is no ledger none
    • I3133 The economics benchmark measures acceptance: how many sessions declared done while the task's hidden tests fail, with and without the finish contract none
  40. unreleased prismatic-lumen — Prismatic Lumen: the owner oversees and moves the whole mesh from one page, which owns nothing PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 4
    blocked
    3
    ready
    1
    READY 1 issue
    • I3137 Lumen is a declared term of the vocabulary, defined by the capabilities it composes none
    BLOCKED 3 issues
    • I3138 One page shows the whole mesh from the blackboard, peers and monitor with each figure's freshness, and recovers after a reconnect none
    • I3139 The mesh page offers one authorised action through an existing capability, and shows its result from the journal none
    • I3140 The mesh page's latency is measured against a recorded baseline before any target is claimed none
  41. unreleased the-session-domain-is-written-once — The session lifecycle is written by the typed domain, and the shell only parses and renders PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 9
    blocked
    8
    ready
    1
    READY 1 issue
    • I3320 A lifecycle command run against an absent or stale executable fails loudly and never falls back to a shell writer none
    BLOCKED 8 issues
    • I3141 majordomus session close writes its record through the typed domain's closer, and the shell closer is deleted none
    • I3142 An episode opens through the typed domain and records the task and issue it began on none
    • I3143 Each provider lifecycle event leaves a typed receipt written by the domain before any guard can return early none
    • I3144 Checkpoints and handovers are recorded against the episode, and the shell only parses and renders them none
    • I3145 Continuity is resolved and judged fresh by one function, and the shell's copies are deleted none
    • I3146 A closed session record says whether it is complete, and one that changed the tree without saying what it served is not none
    • I3311 Generated sequences of episode events never move an episode in a way its transition table forbids none
    • I3313 A failing verification in a closed session record says whether the ledger already held it failing at the task's base none
  42. unreleased knowledge-acts-on-what-it-learns — The repository decides when to evolve its layer, and a session carries it out PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 5
    blocked
    2
    ready
    3
    READY 3 issues
    • I3162 Which task.refused lines are friction is measured across every checkout, and then each repeated refused rule becomes one observation candidate none
    • I3163 Each episode boundary derives whether evolve is due — skip, defer or run — and the next session is told why none
    • I3166 A curated note whose cited file changed since its last review is reported for review, not served as current none
    BLOCKED 2 issues
    • I3164 A change an evolve run makes yields no candidate about itself, and a rejected subject is not proposed again without new evidence none
    • I3165 What evolution changed is measured: recurrence of a subject after its lesson landed, per window, with its denominator none
  43. unreleased campaigns-are-read-as-provenance — A prompt pack is a campaign the index serves and the plan cites PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 4
    blocked
    3
    ready
    1
    READY 1 issue
    • I3167 A campaign is a kind of the index: every pack under campaigns/ is an object with its manifest digest, served read-only none
    BLOCKED 3 issues
    • I3168 An intent, milestone or issue cites the campaign that drove it, and a campaign answers which records cite it none
    • I3169 A new pack enters campaigns/ through one command that checks the archive before writing a byte none
    • I3170 An execution of a record that cites a campaign pins the revision it ran, and a later revision changes nothing about it none
  44. unreleased repository-automation-is-typed — Repository automation is typed capabilities that Rhai orchestrates, and domain-logic shell only shrinks PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 8
    blocked
    5
    ready
    3
    READY 3 issues
    • I3154 Every just recipe is generated from the command graph or names the exemption that keeps it hand-written none
    • I3155 The shell check reports shell by disposition, and the count of domain-logic shell never rises against the merge base none
    • I3156 Every command path is implemented by one executable, and the other only delegates none
    BLOCKED 5 issues
    • I3157 A scripted capability declared in an adopting repository's layer reaches its surfaces with no change to the tool, and says where it came from and what it may do none
    • I3159 A shell unit is deleted only after a parity case shows its replacement gives the same verdict on the same fixture none
    • I3161 The commit hook is one call of the executable that runs the commit subset of doctor, the worktree guard and pages current under a declared budget none
    • I3305 A scripted capability installed from outside the repository registers like one inside it none
    • I3306 An external scripted capability runs under default-deny grants, bounded, and leaves an audit record none
  45. unreleased an-authorised-node-connects-from-anywhere — An authorised node reaches another across LAN, tailnet or NAT, and says how ACTIVE

    last delivery

    done
    1 of 5
    blocked
    4
    BLOCKED 4 issues
    • I3176 The committed mesh declaration names its hubs by node, and no private address is tracked or published none
    • I3826 A hosted hub keeps one key from a secret, advertises its URL, and shows the mesh only to those it trusts releasedv1.0.0-alpha.875c0222
    • I3827 The hosted hub is this repository's default rendezvous, and every node shows it as the path from anywhere releasedv1.0.0-alpha.89b6bc43
    • I3842 A caller on another host never sees this process's executions, live or recorded none
    DONE 1 issue
    • I3823 The mesh client reaches an https endpoint over TLS and refuses cleartext to a public address releasedv1.0.0-alpha.8c6eda57
  46. unreleased the-mesh-is-operated-from-any-device — The owner understands and operates the whole mesh from one page, on any device BLOCKED

    nothing delivered yet

    done
    0 of 1
    blocked
    1
    BLOCKED 1 issue
    • I3181 A change made on another node reaches every open page by push, and a gap is refetched none
  47. unreleased finished-work-reaches-a-verified-release — Finished work reaches a verified release at the pace it is finished BLOCKED

    nothing delivered yet

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3200 The trunk's protection is compared with the CI model, and a drift is a finding that names the change none
    • I3212 Two open pull requests that realise the same issue are reported as duplicates, with the survivor named none
  48. unreleased ordinary-commands-never-build — No ordinary command builds: every entry path fails fast or answers through a release of the same generation PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 1
    ready
    1
    READY 1 issue
    • I3957 No entry path or gate builds: the launcher, the gates, the test harness and the just bridge call the tree's executable and fail fast or use a release of the same generation none
  49. unreleased every-surface-follows-what-changed — Every surface follows what changed in the repository by push, and a surface that does not says so PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 8
    blocked
    3
    ready
    5
    READY 5 issues
    • I3218 The execution ledger is a source of the monitor, so a run started anywhere is followed everywhere none
    • I3219 The Observatory is told what happened over the live channel, and asks only when it cannot be told none
    • I3220 An intent proposed or an issue moved by any client reaches an open intent workspace without a reload none
    • I3222 A follower whose frames are lost, delayed or reordered, or whose peer is partitioned, ends equal to a fresh snapshot none
    • I3232 A kiosk left running for days shifts its marks against burn-in and recovers from a lost drawing context none
    BLOCKED 3 issues
    • I3221 Every live surface says in ADR 0158's words whether it is live, reconnecting, stale, polling, a snapshot or a replay none
    • I3231 The Observatory shows its own stream health: lag, dropped frames, resyncs and frame rate none
    • I3431 A record a process outside the server writes (a knowledge record reaching the index, a ledger line or a captured prompt) reaches an open view within one heartbeat, without a reload none
  50. unreleased a-visitor-understands-and-checks-majordomus — A first-time visitor of majordomus.dev understands what Majordomus does and can check every claim it makes ACTIVE

    no delivery date: its done issues left no merge the history can name

    done
    6 of 7
    ready
    1
    READY 1 issue
    • I3843 The homepage title says the product sentence as declared, and in Czech on the Czech homepage none
    DONE 6 issues
    • I3134 The product sentence is declared once, and the homepage, README, page titles, Open Graph and launch kit read it none
    • I3135 The launch kit is held by the same promise check as the homepage, and the tool publishes none of it none
    • I3136 The copy refuses hype words that no recorded comparison permits none
    • I3223 The homepage hero lets a visitor switch between recorded scenarios, each ending in the refusal it proves none
    • I3224 Every problem and every step on the homepage leads to the feature and evidence behind it, with the maturity the product model derives none
    • I3324 After every deploy the published homepage's hero choices are probed and found reachable none
  51. unreleased the-plan-says-what-a-fix-unblocks — The plan says what finishing an issue unblocks, and why each blocked issue is blocked PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 4
    blocked
    2
    ready
    2
    READY 2 issues
    • I3267 One read-only evaluator says what accepting an issue would unblock, from plan.next's own readiness rules none
    • I3270 A blocked issue says which kind of block holds it: a dependency, contention, or a stale record none
    BLOCKED 2 issues
    • I3268 The published plan has an impact page whose graph and sortable table agree and name the commit they were read at none
    • I3269 Accepting several issues at once is previewed on the original graph, with shared unlocks counted once none
  52. unreleased a-promoted-record-opens-its-message — Every record promoted from a workspace cites the message it came from, and the UI opens it for the operator who holds it PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 5
    blocked
    4
    ready
    1
    READY 1 issue
    • I3280 An intent, a milestone and an issue carry provenance the way an ADR and a knowledge record do none
    BLOCKED 4 issues
    • I3281 A workspace message is a typed provenance reference that validates in every checkout without the store none
    • I3282 A workspace reference resolves to its message where the store holds it, and says 'not held here' where it does not none
    • I3283 The UI opens the message a record cites, and the published snapshot shows only the reference none
    • I3284 Every reference the 2026-10-18 import wrote is pinned to the upstream message it meant none
  53. unreleased a-provider-carries-the-contract-natively — Each agent client carries the contract through its own extension points, generated once and checked for drift PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 11
    blocked
    5
    ready
    6
    READY 6 issues
    • I3303 Codex's hooks draw its episodes and refuse an edit no claim covers, as Claude Code's do none
    • I3304 A prompt reaches the model within a declared capture budget, and no captured record is lost none
    • I3307 The default MCP tools/list stays within a declared byte budget, and a full schema is fetched per tool none
    • I3308 Zed validates and completes .ai files against the repository's own schemas none
    • I3322 capture install wires the edit guard into Claude Code's PreToolUse, first in an advisory mode, and doctor reports it unwired none
    • I3829 A provider declares whether its client drives a browser beside the server, and preflight says when this machine's bridge is missing releasedv1.0.0-alpha.8dc51400
    BLOCKED 5 issues
    • I3300 Majordomus installs into Claude Code as one generated plugin carrying its skills, hooks, mods and MCP server none
    • I3301 A Claude Code session that stops with an active task is told what the task still owes none
    • I3302 An installed plugin or mod that differs from what the repository generated is a doctor finding none
    • I3323 An unclaimed edit is refused in Claude Code once no live peer edits without a claim none
    • I3410 A Codex prompt is captured through Codex's own UserPromptSubmit hook, and capture status stops calling Codex prompts unadapted none
  54. unreleased a-change-is-judged-in-minutes — A change is derived in under a second and judged in minutes, and nothing that could have changed is skipped PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 11
    blocked
    8
    ready
    3
    READY 3 issues
    • I2848 A pre-push gate that runs the executable does not wait on another worktree's build none
    • I3838 The plan page renders within the audit budget at every width, because a finding is counted rather than printed once per pair releasedv1.0.0-alpha.40545642
    • I3841 The plan's graph is drawn by milestone, so /plan/dag/ answers the site probe within its budget however large the backlog grows none
    BLOCKED 8 issues
    • I3233 Stage C renders only the targets that read the index, and the manifest no longer renders every code-only artifact a second time none
    • I3234 A derive whose executable is current and whose inputs did not move answers before it waits for the machine's lock none
    • I3235 The site generator reads the use-case catalogue once per run none
    • I3238 A pull request runs the cases its change can affect, chosen from what each case declares it reads, and a change of unknown impact runs them all none
    • I3239 One job builds a run's executable and every other job of that run uses it none
    • I3240 A pull request's browser audit visits the pages its change can reach, and a shared-layout change sweeps them all none
    • I3241 Only a job that reads history fetches all of it none
    • I3242 The pull-request critical path has a committed GitHub baseline and a budget per required job, and a run's summary names its critical path and every cache state none
  55. unreleased what-a-workspace-decides-reaches-the-repository-with-its-source — What the owner decides in a vendor workspace reaches the repository, and every promoted record opens the message it came from BLOCKED

    nothing delivered yet

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3278 The 2026-10-18 import is the workspace store's first sync, not a scratchpad none
    • I3279 The vendor's own data export is a transport, and it carries the message identities an in-page read did not keep none
  56. unreleased every-sessions-usage-is-observed — What every AI session consumed is observed from the provider, attributed to the work it served, and never estimated into a fact ACTIVE

    last delivery

    done
    1 of 13
    blocked
    9
    ready
    3
    READY 3 issues
    • I3288 The shared server receives Claude Code's OpenTelemetry usage events over loopback and records them as reported releasedv1.0.0-alpha.8#23634cfa537
    • I3298 The benchmark declares one arm per mechanism and per agent topology, and a short-task hypothesis beside the long-work one none
    • I3299 Majordomus's own overhead in an adopting repository is measured per operation against declared budgets none
    BLOCKED 9 issues
    • I3289 Turning usage collection on is a dry-run plan the person consents to, never a committed repository setting none
    • I3290 Codex usage is read from app-server increments, and a cumulative total is never summed none
    • I3291 Gemini CLI usage events map onto the same record, thought tokens included none
    • I3292 Reported tokens, a price-list estimate and a billed amount are three fields, and the billing mode says which account paid none
    • I3293 Usage is attributed to the session, task and issue it was spent on, from records the repository already keeps none
    • I3294 /ui shows usage by provider, model, session, task and issue, and every figure opens its reported events none
    • I3295 A task declared over its token budget is told so, and refused only where policy says refuse none
    • I3296 Each compaction is measured: the context before and after, from the provider's report none
    • I3297 A waste finding names its evidence and confidence and is never presented as a saving none
    DONE 1 issue
  57. unreleased the-ui-runs-and-explains — The UI runs any capability and explains what needs the owner, whose version it shows and where its time went PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 6
    blocked
    4
    ready
    2
    READY 2 issues
    • I3226 Every UI and Cockpit response says where its time went none
    • I3229 Every version badge says whose version it is and how it stands to the latest release none
    BLOCKED 4 issues
    • I3225 A capability is run from /ui through the form its input schema generates, confirmed when its effect writes, and followed as an execution none
    • I3227 A UI link a reader is about to follow is fetched ahead when the route is cheap and the connection allows it none
    • I3228 The UI's search finds any entity the registry addresses and offers the moves its status admits none
    • I3230 The Dashboard opens on what needs the owner: what runs, what is blocked and why, what was verified, and the next safe move none
  58. unreleased the-proof-tests-are-registered-before-they-run — The six proof tests are registered as validated protocols, each frozen by its own digest, and every trial is a typed record that publishes only what its basis permits PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 3
    blocked
    2
    ready
    1
    READY 1 issue
    • I3351 A proof plan is a validated record in which each protocol is frozen by its own digest, so registering one test never stales another's records none
    BLOCKED 2 issues
    • I3352 The six proof tests are registered, each with the claim it settles and its instrument, and none carries a protocol yet none
    • I3353 A trial is a typed record that carries its protocol's digest, refuses what the protocol does not declare, and redacts what its publication basis does not permit none
  59. unreleased the-proof-scorecard-is-published — One derived scorecard publishes every proof test's computed status, losses included, on every surface, and no value claim stands without a passed test PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 6
    blocked
    5
    ready
    1
    READY 1 issue
    • I3350 The homepage copy may not use a word of delivered value until a claim permits it none
    BLOCKED 5 issues
    • I3354 A pure scorecard function computes each proof test's status, counted sample, effect and losses from committed records, and withholds a verdict until the registered sample is complete none
    • I3355 majordomus economics proof serves the scorecard on the command line, HTTP and MCP from one capability declaration none
    • I3356 The site's economics page publishes the scorecard from the generated summary, failed and inconclusive tests and every loss in the same rows as passed ones, each linking its records none
    • I3357 /ui/evidence shows the proof scorecard beside the claims it settles, read from economics.proof, with each row linking its records none
    • I3358 economics check refuses a guaranteed claim of value that no passed proof test backs, in the claims matrix only none
  60. unreleased a-foreign-repository-is-adopted-and-measured — A repository not built around Majordomus is adopted from the published installer to an accepted finish, and its overhead and friction are recorded without exposing what its basis does not permit PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 7
    blocked
    6
    ready
    1
    READY 1 issue
    • I3359 A workflow states which repository may be adopted as foreign, what each adoption records and publishes, and with whose consent none
    BLOCKED 6 issues
    • I3360 The T1 protocol and its selection floors are registered before any candidate is measured, and a record without an admitted candidate is refused none
    • I3361 install-check's first-run stage runs against a clone of an existing repository named on the command line and writes a T1 trial record none
    • I3362 Candidate repositories are measured against the registered floors and admitted or refused before any of them is installed into none
    • I3363 One admitted foreign repository is adopted from the published installer to an accepted finish by a real coding agent, and its record is committed whatever its outcome none
    • I3364 The adoption-overhead bench takes a target repository, and Majordomus's overhead and footprint are measured in the adopted foreign repository none
    • I3365 Every intervention, undocumented command and refused step of a foreign adoption carries a friction id or a reason, and every friction id is cited by an issue or a cancellation none
  61. unreleased the-corpus-is-registered-before-it-runs — A corpus of 20 tasks, stratified by a difficulty proxy measured and registered before the new tasks are written, is registered with its analysis, run order, stopping rule and a pinned release BLOCKED

    nothing delivered yet

    done
    0 of 6
    blocked
    6
    BLOCKED 6 issues
    • I3367 A suite can be registered: strata, outcomes, acceptance rule, analysis, MDE, a seeded interleaved run order and the stopping rule are declared data the load validates and the runner honours none
    • I3368 Six large tasks join the economics corpus, each failing on its start, passing on its reference and reviewed by someone other than its author none
    • I3369 Four medium and three small tasks join the economics corpus, each failing on its start, passing on its reference and reviewed by someone other than its author none
    • I3370 The corpus suite is registered and committed before its first run, and the T2 protocol names its registration digest none
    • I3374 Task difficulty is a proxy measured from each task's reference, and the stratum cut-offs are registered before any new task is written none
    • I3375 A registered suite pins its treatment to one released version, so landings on master during the runs leave them current none
  62. unreleased a-registered-corpus-judges-majordomus — The registered corpus judges the same agent with and without Majordomus, by an exact task-level test on accepted results, and the verdict is published with its losses PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 4
    blocked
    2
    ready
    2
    READY 2 issues
    • I3366 The economics calculator decides a binary paired outcome by an exact task-level test, intervals a continuous paired difference by task-clustered bootstrap, and turns either into one verdict none
    • I3373 The program's blocked dependencies are cut or re-scoped by recorded owner decisions, or recorded as refused with the criteria they leave outside the window none
    BLOCKED 2 issues
    • I3371 Economics summary decides a registered suite's primary outcome by its registered test, reports secondary differences without a verdict word, and refuses typed figures about them none
    • I3372 The registered corpus is run in both arms, its records are committed, and its verdict is published with its losses and its origin none
  63. unreleased every-task-states-its-delivery-economics — Every task states its delivery economics: wall time, typed human interventions, CI reruns, spend and acceptance, each from a named record or said not observed PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 6
    blocked
    5
    ready
    1
    READY 1 issue
    • I3376 One capability states each task's wall time and episodes from every checkout's ledger, and names every field it cannot yet fill as not observed none
    BLOCKED 5 issues
    • I3377 A task's prompt records, restarts and manual changes are counted by type from the records that already hold them, each with the ids behind it none
    • I3378 A permission request the provider reports leaves a receipt with its own elapsed time, and economics.tasks counts it as an approval none
    • I3379 Each issue's CI reruns and rounds are counted from the Actions run record, attributed through plan.delivery none
    • I3380 A task's spend is the usage attributed to it, as reported tokens with their class, and money stays not observed until it is a separate field none
    • I3381 A task counts as accepted only by the written definition of an accepted outcome, with the issue's furthest delivery stage shown beside it none
  64. unreleased delivery-economics-are-measured-over-declared-windows — Delivery economics are measured on corpus runs and on real work over a window registered before it opens, and published with their denominators and losses BLOCKED

    nothing delivered yet

    done
    0 of 3
    blocked
    3
    BLOCKED 3 issues
    • I3382 Every recorded benchmark run answers the same delivery-economics shape as a task none
    • I3383 The T3 delivery window is registered before it opens: its period, the work it admits, the definition of accepted and a bound on each field's not-observed share none
    • I3384 The first delivery window is measured at its close and published with its denominators, the work not accepted and the checkouts it could not read none
  65. unreleased the-mesh-is-measured-against-one-agent — Coordinated workers on the mesh are compared with a single agent on the same batch tasks, at quality held by a registered non-inferiority guard BLOCKED

    nothing delivered yet

    done
    0 of 5
    blocked
    5
    BLOCKED 5 issues
    • I3385 A registered suite's primary verdict can be held to a non-inferiority guard, so a speed-up counts only when accepted share is not worse by more than a registered margin none
    • I3386 The economics runner runs one job as several concurrent workers in worktrees of one workspace sharing the treatment's server, and records the job's wall time to an integrated, accepted tree none
    • I3387 Batch tasks compose existing corpus tasks into sets of issues several workers can share, with their dependencies and the union of their hidden tests none
    • I3388 The mesh suite is registered before its first run, and the T4 protocol names its registration digest none
    • I3389 The mesh suite is run in both arms and its guarded verdict is published with its losses none
  66. unreleased recovery-from-injected-faults-is-proven — A killed worker, a cut connection and a conflict are injected on purpose, and recovery is proven without lost work or duplicate completion BLOCKED

    nothing delivered yet

    done
    0 of 5
    blocked
    5
    BLOCKED 5 issues
    • I3390 One conservation reading counts completions per issue, unreachable task commits, stranded claims and multiply-consumed handovers, each violation with its records none
    • I3391 The T5 protocol registers three fault kinds, the trials each needs and what a trial must show, before any fault is injected none
    • I3392 The mesh lab injects the three faults into work in progress, and its evidence holds the conservation reading of each scenario none
    • I3393 Each fault is injected into real coding-agent sessions on one host, and each trial's recovery and conservation reading are committed none
    • I3394 The mesh lab's work-fault evidence from CI is committed as T5 trials and the T5 verdict is published with every failed trial none
  67. unreleased a-newcomer-reaches-a-first-verified-intent — A newcomer reaches an intent whose verdict is satisfied, in a repository of their own, using only what the getting-started page shows PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 5
    blocked
    4
    ready
    1
    READY 1 issue
    • I3395 An intent criterion can cite a verification the repository's profile declares, and a recorded passing run of it at the current tree makes the criterion current none
    BLOCKED 4 issues
    • I3396 A documented command adds a criterion to a proposed intent, and the getting-started page shows the path from a proposal to a satisfied verdict none
    • I3397 install-check's first-intent stage reaches a satisfied verdict in a named repository with only the getting-started commands, and counts the doctrine its output exposes none
    • I3398 The T6 protocol says who counts as a newcomer, what each trial records and how many must reach a satisfied verdict unaided, before any trial runs none
    • I3399 Newcomer trials are run as the protocol declares, recorded as they happened, and the T6 verdict is published with every trial none
  68. unreleased a-paste-is-decomposed-by-a-skill — A pasted brief is decomposed into the plan by a skill, and never kept verbatim as an intent statement PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 6
    blocked
    5
    ready
    1
    READY 1 issue
    • I3400 The decompose-a-brief skill exists, is invoked by the plan workflow, and is named by both skill tests, so skills verify holds it as a capability none
    BLOCKED 5 issues
    • I3401 intents.propose writes no record for a multi-paragraph, Markdown or over-length statement and answers invalid_input, naming the canonical digest and the skill that decomposes it none
    • I3402 The /intent alias follows the skill an unsuccessful answer names instead of stopping at it or retrying with altered text none
    • I3403 The Cockpit runner, the execution form and the intent workspace show an answer that names a skill as one link to that skill, proven in the existing browser case none
    • I3404 A decomposition of a synthetic brief in the skill's output shape is held valid by a test, its digest agrees with the refusal, and an unserved criterion in it is caught none
    • I3405 Every generated model-invocable domain skill follows the skill an unsuccessful answer names, so the MCP path does not end at a refused paste none
  69. unreleased an-outcome-becomes-a-reviewed-plan — A desired outcome becomes a draft plan that is checked before a record is written PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 4
    blocked
    3
    ready
    1
    READY 1 issue
    • I3251 A desired outcome is briefed with what the repository already holds about it none
    BLOCKED 3 issues
    • I3252 A draft plan is judged as if it were written, and only a checked draft is written, through one capability none
    • I3253 A proposal lists the values it left unresolved, and a draft that carries an invented threshold is refused none
    • I3254 A proposal names the existing intents and issues it duplicates or overlaps, and is merged into one rather than added beside it none
  70. unreleased the-intent-loop-is-proved-end-to-end — The intent loop is proved end to end, and the plan and the documents say what it does BLOCKED

    nothing delivered yet

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3260 One intent is carried in a disposable repository from a sentence through a failing criterion to a satisfied verdict, across two providers and a handover none
    • I3261 Every bypass of the intent loop is tried by a test and is refused or exempted by policy, never passed none
  71. unreleased an-unmet-criterion-is-drafted-into-work — An unmet criterion is drafted into work from the evidence, and the draft is the same on every run PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 5
    blocked
    4
    ready
    1
    READY 1 issue
    • I3246 The evidence half of a gap is drafted from the ledger, and a second draft at one commit is the same none
    BLOCKED 4 issues
    • I3247 Work is drafted for each criterion nothing serves, under a key derived from the intent, the criterion and the gap, so a second draft drafts the same work none
    • I3248 A draft that drops or weakens a criterion of its intent is refused unless a recorded decision names the change none
    • I3249 A replan is bounded: past a declared budget of drafts without measurable progress it ends in a named state a person resolves none
    • I3250 Before drafting work the planner says whether a criterion is met, met but unproven, or unmet, and drafts proof-only work where only proof is missing none
  72. unreleased command-and-deployment-criteria-are-judged — A command or deployment criterion is met by a recorded run of exactly that command, or an observation of exactly that deployment, current at the presented revision PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 3
    blocked
    2
    ready
    1
    READY 1 issue
    • I3255 A command criterion is met only by a recorded passing run of exactly that command at the presented revision none
    BLOCKED 2 issues
    • I3256 A deployment criterion is met only by a recorded observation of that deployment serving a build that contains the criterion's newest change none
    • I3257 intent explain follows each served issue past its merge to the release and the observed deployment that carry it none
  73. unreleased the-mesh-works-out-of-the-box — The mesh works out of the box: trusted machines find each other by every means and their sessions cooperate from the first turn ACTIVE

    last delivery

    done
    3 of 9
    blocked
    1
    ready
    5
    READY 5 issues
    • I2410 A trusted machine on the tailnet is found through Tailscale, with no address written by hand releasedv1.0.0-alpha.835253fc
    • I2411 A server whose mesh is enabled is reachable on the tailnet and the LAN, and only by a trusted peer none
    • I2412 `majordomus init` declares the mesh and enrols this machine's key, so a fresh repository cooperates none
    • I3770 A server that lost its checkout lease answers every mesh read by naming the server that holds it, never with an empty mesh none
    • I3835 A node the mesh lists as trusted and present but cannot link is said so, with why, on every surface that names it releasedv1.0.0-alpha.412c702c
    BLOCKED 1 issue
    • I3837 A case that enables the mesh declares its tailnet provider off, so it stays hermetic on a machine that runs Tailscale none
    DONE 3 issues
    • I2413 A linked worktree cooperates through its repository's running server, and a start that cannot ensure one says why releasedv1.0.0-alpha.442291f9
    • I2414 mesh.state and mesh.peers answer a filtered summary that fits one tool answer releasedv0.30.08d0b36d
    • I2415 A mesh review request carries a body, can be withdrawn, and expires none
  74. unreleased everything-is-followed-in-one-stream — Everything that happens in the repository is followed in one stream ACTIVE

    no delivery date: its done issues left no merge the history can name

    done
    3 of 8
    blocked
    2
    ready
    3
    READY 3 issues
    • I2402 majordomus monitor follows the stream from a terminal and a script none
    • I2404 The Cockpit shows the stream live none
    • I2405 Every session is told what happened since its last look none
    BLOCKED 2 issues
    • I2406 The stream is documented where a reader looks none
    • I2407 The monitor is released and deployed none
    DONE 3 issues
    • I2400 A signal model and a fold join every source the server already records none
    • I2401 monitor is one read capability with three projections none
    • I2403 Pull requests, checks and deploys reach the stream when GitHub is reachable none
  75. unreleased a-version-follows-the-work — Landed work is released as a measured version, and how long it has waited is a finding PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 4
    blocked
    3
    ready
    1
    READY 1 issue
    • I3070 release.currency measures the landed work past the last release, and the brief and doctor say when it waits none
    BLOCKED 3 issues
    • I3071 /ui/delivery shows how much landed work waits for a release, and since when none
    • I3072 A task holding the release seat does not finish completed while landed work has waited past the threshold none
    • I3076 The landing clock's first source is measured, a fresh clone's wait is a labelled bound, and case 3470 shows a decided version none
  76. unreleased peer-blackboard — The peer blackboard is one projection, pushed live to every surface PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 9
    blocked
    8
    ready
    1
    READY 1 issue
    • I2980 The blackboard is one projection answered on every interface none
    BLOCKED 8 issues
    • I2981 A board or journal change is pushed over one WebSocket none
    • I2982 The monitor page is pushed over the live channel, and says when it polls none
    • I2983 /ui/peers shows the blackboard and is read again when it changes none
    • I2984 The published site shows a public-safe blackboard, labelled as the snapshot it is none
    • I2985 The Observatory's cooperation scene draws the blackboard, not a second join of the journal none
    • I2998 /cockpit/peers renders the blackboard and follows it live none
    • I2999 From /ui/peers an operator answers a review, takes a handover or releases a claim, through its capability none
    • I3073 The home page and the docs explain the peer blackboard: live on a runtime, a labelled snapshot on the published site none
  77. unreleased a-derive-does-only-the-work-its-inputs-changed — A derive does only the work its inputs changed, and can say why ACTIVE

    no delivery date: its done issues left no merge the history can name

    done
    1 of 12
    blocked
    9
    ready
    2
    READY 2 issues
    • I2521 What a derive costs is measured per stage and per kind of change, and every file a stage reads is listed none
    • I2867 A passing scenario's evidence is reused by every checkout of the repository whose tool is the same none
    BLOCKED 9 issues
    • I2522 The derivation is a typed graph in the crate: every producer is a node with declared inputs and outputs, answered by one capability none
    • I2523 A node's key is computed from the bytes its producer reads, the index membership it enumerates and the generation of the executable none
    • I2524 majordomus derive plan and derive explain say, without writing, which nodes would run and which input moved each one none
    • I2525 An incremental derive runs only the nodes its plan marks, a no-op derive runs no generator, and the full derive stays as it is none
    • I2526 The site generator's sections are nodes with inputs of their own, and the use-case scenarios run only when what they exercise changed none
    • I2527 An incremental derive equals a full derive byte for byte, and an omitted dependency turns a gate red none
    • I2528 The UI shows the derivation graph and its last plan, and one documentation page explains the model none
    • I2865 The eight kinds of derive are measured cold on a host of their own, each with its sample count none
    • I2866 Each node of a measured derive reports its fingerprint, cache status and times, and each run its critical path and peak memory none
    DONE 1 issue
    • I2847 every file the site generator reads by a literal path is one of its declared inputs none
  78. unreleased a-derivation-computed-once-is-reused — A derivation computed once is reused by every worktree and by CI, and the incremental path becomes the default on evidence BLOCKED

    nothing delivered yet

    done
    0 of 5
    blocked
    5
    BLOCKED 5 issues
    • I2529 A node's outputs are kept under its key and restored only after every digest is verified none
    • I2530 The derivation store is bounded and measured: its size and hit rate are read by a capability, and only an explicit command removes entries none
    • I2531 Two worktrees deriving the same key compute it once, and the machine lock covers the write into a tree, not the computation none
    • I2532 CI reuses derivation entries keyed by the graph, and still fails on a stale committed file whether or not the cache was restored none
    • I2533 The incremental derive becomes the default after a shadow period proves it equal, and one flag returns to the full derive none
  79. unreleased one-kit-on-every-surface — Code, charts, controls, embeds and shell blocks are one kit on every surface, declared in the design book and held there by a gate PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 8
    blocked
    6
    ready
    2
    READY 2 issues
    • I3793 One copy control and one tab control ship to every surface none
    • I3795 A surface links to another surface and never embeds it none
    BLOCKED 6 issues
    • I3790 The design book declares one mechanism, its tokens and its gate for code, charts, controls, embeds and shell blocks none
    • I3791 A code block on /ui and the Cockpit carries the one highlighter's classes, and the audit refuses one that does not none
    • I3792 Every chart on every surface is drawn from a table on its page none
    • I3794 The interaction probe drives the controls of /ui and the Cockpit as it drives the site's none
    • I3796 Every command and its output is one shell block, on every surface none
    • I3797 A command shown outside the shell block is refused by the audit none
  80. unreleased landing-survives-any-session — Landing green work survives any session, any restart and any machine PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 6
    blocked
    4
    ready
    2
    READY 2 issues
    • I3910 The integration executor fast-forwards master to every green head, a combined top included, and nothing else lands releasedv1.0.0-alpha.892946d3
    • I3911 The executor reads its audit trail, its halt and its lease from origin, so any clone continues it and a stale holder is refused none
    BLOCKED 4 issues
    • I3912 A seat whose holder stopped beating is reported vacant and offered to live sessions by capability none
    • I3913 The executor runs as a user service outside every agent session, restarted after a crash and never after a halt none
    • I3914 A standing approval is one owner-attributed record in the repository, each machine reports whether it carries it, and only the owner writes it none
    • I3915 A combined top is composed by a typed command from members declared in a tracked train manifest releasedv1.0.0-alpha.8b52038c
  81. unreleased merging-and-referencing-are-enforced — Merging and referencing are enforced: every pull request carries its metadata, every reference resolves, every number is taken once PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 10
    blocked
    7
    ready
    3
    READY 3 issues
    • I3973 A record is referenced only once it is on master: a pull request naming an unlanded id is refused, and convergence reports stranded records none
    • I3974 One allocator surveys every number (issue ids, ADR numbers, case numbers), and two branches adding one number under different names are refused none
    • I3979 Every label, branch prefix and commit type is declared once, projected to GitHub, described in CONTRIBUTING and checked releasedv1.0.0-alpha.8e6deaf9
    BLOCKED 7 issues
    • I3970 Every pull request carries its metadata, projected from the trunk's records: labels, milestone, assignee and Refs links, never a closing keyword releasedv1.0.0-alpha.89f231f2
    • I3971 Work in an open pull request or under a live branch claim is reported taken and is never the next issue none
    • I3972 plan validate names every issue held only by its milestone gate, and an issue may declare it needs nothing from the milestone's dependencies none
    • I3975 GitHub issues are created only by github-sync: an agent's raw create is refused, an issue nobody projected is reported on GitHub, and an unmarked issue is never adopted none
    • I3976 Every commit names the issue it serves, outside narrow machine-verifiable exemptions, with the earlier history as a baseline none
    • I3977 Every page a deployment serves names only versions of the release model, checked after the deploy none
    • I3978 Each train member is judged on its merged tree, and a fix member joins only with a test and its changed-code coverage none
  82. unreleased every-model-call-is-paid-from-a-declared-source — How a model call Majordomus starts can be paid is declared by the vendor with evidence, and each call names the source it was declared to draw on PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 3
    blocked
    1
    cancelled
    5
    ready
    2
    READY 2 issues
    • I3660 A vendor declares its funding sources in the model catalogue, each with dated, quoted vendor evidence releasedv1.0.0-alpha.8e9f5964
    • I3663 An Anthropic API advisor is declared, so a held Anthropic credit grant can pay for review releasedv1.0.0-alpha.8#175877ee6c3
    BLOCKED 1 issue
    • I3665 A benchmark run and an advisor consultation carry the funding kind the owner declared for them, or unknown none
    CANCELLED 5 issues
    • I3661 Which funding sources the owner holds, and their caps, are the owner's local declaration and never projected none
    • I3662 models.route names the funding source a route would draw on, as an inference with its basis, in the declared source order none
    • I3664 doctor and the brief tell the owner a held funding source no credential reaches, with the vendor's claim link none
    • I3666 Spend against a funding source is observed from a named vendor seam or recorded absent, and no balance is derived from a price none
    • I3667 A run that would fall through to metered billing while a grant is held, or cross a declared cap, is told before it starts none
  83. unreleased a-session-proceeds-through-the-mesh — A session proceeds through the mesh: it finds the work, claims it once, runs it watched and stops when the intent is met PLANNED

    last delivery

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 10
    blocked
    5
    ready
    5
    READY 5 issues
    • I4000 A repeated executions.start with the same key answers one execution releasedv1.0.0-alpha.8315af95
    • I4002 Worktree.create is a typed writing capability none
    • I4006 Machine.slot is a counting machine-wide slot for heavy work none
    • I4007 An idle serve exits by itself after a bound none
    • I4008 A push that only deletes refs runs no plan in the pre-push hook none
    BLOCKED 5 issues
    • I4001 The execution state machine has Authorizing, Claimed, Verifying, Refused and UnknownOutcome none
    • I4003 Devtask.implement runs readiness, preflight, claim, worktree and one execution none
    • I4004 The executor takes the issue's mesh claim in the handler and releases it when the run ends none
    • I4005 Proceed.step answers one idempotent work order none
    • I4009 /watchdog reads liveness and runs wake, handover, reap releasedv1.0.0-alpha.8315af95
  84. unreleased runtime-adapters — Profiles become runtime constraints rather than advice PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 6
    blocked
    5
    ready
    1
    READY 1 issue
    • I0201 Declare which profile axis may become which runtime limit none
    BLOCKED 5 issues
    • I0202 Resolve a task's effective limits and print them as data none
    • I0203 Make enforcement opt-in, and prove a repository that declines is unaffected none
    • I0204 Apply one derived limit for real and prove it changes what happens none
    • I0205 Declare the clamp as a doctrine so the mapping and the adapter cannot drift none
    • I0206 Publish the runtime-adapters claim with the test that proves it and the limits it does not cover none

    what this would make guaranteed

  85. unreleased cost-per-accepted-outcome — Cost per accepted outcome, only on measured data BLOCKED

    nothing delivered yet

    Blocked by execution-telemetry. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 4
    blocked
    4
    BLOCKED 4 issues
    • I0401 Define an accepted outcome, and join it to its measurements without storing the join none
    • I0402 Report cost only where measurement and acceptance both exist none
    • I0403 Make a thin denominator say so rather than average it away none
    • I0404 Publish the cost-per-outcome claim with its unit defined beside it none

    what this would make guaranteed

  86. unreleased intent-planning — The plan of an intent is held to it before execution BLOCKED

    nothing delivered yet

    Blocked by intent-lifecycle. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I1901 An issue names the intent criterion it serves, and coverage is derived none
    • I1902 The gap and the critique of an intent are typed records the plan is held to none
  87. unreleased idd-reads-at-a-glance — The intent workspace reads at a glance and leads everywhere it names ACTIVE

    last delivery

    done
    6 of 25
    ready
    18
    verify
    1
    READY 18 issues
    • I2901 One grammar names an issue id, and every surface reads it none
    • I2902 A status names the moves it admits, and every surface reads that none
    • I2903 The workspace prefers stages by IntentStage, not by strings none
    • I2904 An intent whose criteria are met while its milestones hold open issues says so none
    • I2906 Every id and chip on the workspace leads to its record none
    • I2908 Stage and verdict wear the kit's one badge none
    • I2909 A panel with nothing to show is one sentence none
    • I2910 A move on the published workspace reads \"live only\" none
    • I2911 The workspace is a list and its chosen intent side by side none
    • I2912 A screen's sources are one disclosure, not a footer per panel none
    • I2913 Each intent in the list shows its progress none
    • I2914 No /ui page shows an issue id that leads nowhere releasedv0.30.04b15b43
    • I2918 The issue list filters by status none
    • I2919 The graph and the intent list respond to a hand and a keyboard none
    • I3002 A command to reproduce is a code block a reader can copy none
    • I3003 The workspace's prose is set for reading none
    • I3004 No raw markdown reaches a /ui page none
    • I3005 Code on the UI has one highlighter none
    VERIFY 1 issue
    • I3840 The intent workspace answers within its 100 ms budget: its shared-scope fold holds the first pairs, not every pair releasedv1.0.0-alpha.8b83c6a0
    DONE 6 issues
  88. unreleased a-stranger-adopts-it-unaided — A stranger installs Majordomus and is stopped from a false done in ten minutes, and every outside first run teaches the tool BLOCKED

    last delivery

    Blocked by a-second-adopter-is-served. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 5
    blocked
    5
    BLOCKED 5 issues
    • I3127 A clean installation reaches its first refused finish in a foreign repository, and the time and the manual steps are recorded none
    • I3128 init ends with what it found in the repository it adopted, each finding naming its file none
    • I3129 An outside developer's first run is recorded as it happened, and each friction it met becomes an issue with a failing case none
    • I3321 In a foreign repository, the wired pre-push hook of the claude-code projection refuses what finish would refuse, through the installed release none
    • I3995 A task started before the first commit finishes: an unborn recorded head is an ancestor of every commit releasedv1.0.0-alpha.839f3711
  89. unreleased entry-proves-what-it-handed — An episode records the governance and briefing it was handed, and a change is told BLOCKED

    nothing delivered yet

    Blocked by the-session-domain-is-written-once. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 7
    blocked
    7
    BLOCKED 7 issues
    • I3147 The effective governance has one digest, computed by one function and shown by the preflight none
    • I3148 An episode records the governance digest and the briefing digest it was handed at start none
    • I3149 A governance change during a session is told at the session's next brief or check none
    • I3150 A handover carries the governance digest it was written under, and resolving it says when governance moved none
    • I3151 Every entry surface reports the same governance digest for one checkout none
    • I3152 Every known route around the preflight and the edit guard is a case or a stated limit none
    • I3153 Task start says how far its base is behind the remote's master as last fetched, and stops only on a diverged local master, with the next step none
  90. unreleased the-runtime-supervises-itself — The runtime says what is progressing, waiting or stalled, and repairs only what is safe BLOCKED

    last delivery

    Blocked by failure-is-visible, runtime-lifecycle. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 4
    blocked
    4
    BLOCKED 4 issues
    • I3182 One read says which work is progressing, waiting, stalled, failed or orphaned, and on what evidence none
    • I3183 A safe repair runs once per cause through ensure, recovery, leases and the reaper, and a repeated failure escalates none
    • I3902 A hung Pages build is replaced by a declared bound, and the right tree is rebuilt, never redeployed releasedv1.0.0-alpha.89daede4
    • I3903 A stuck or superseded CI run is found and stopped by a declared bound, by a typed capability on a schedule none
  91. unreleased the-host-knows-its-runtimes — A host knows every Majordomus runtime it runs, with no project open BLOCKED

    nothing delivered yet

    Blocked by runtime-lifecycle, safe-self-update. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3184 One command lists every Majordomus runtime of this user on this host, with no checkout open none
    • I3185 A request on a host with two Majordomus versions reaches the one whose protocol satisfies it, or is refused with a reason none
  92. unreleased mesh-connectivity — Trusted nodes connect across NAT through proven transports, and every surface says which path BLOCKED

    last delivery

    Blocked by runtime-trust, mesh-journal-converges. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 6
    blocked
    6
    BLOCKED 6 issues
    • I3187 A link names the endpoint candidates it tried, the one it chose and why none
    • I3188 A cold node finds the mesh from a signed manifest on Pages, and refuses a stale, rolled-back or unsigned one none
    • I3189 Two nodes with no direct path cooperate through a trusted hub that relays their authenticated frames none
    • I3190 The mesh lab proves links behind NAT, with the relay, a hub outage and an address change none
    • I4012 A remote node's loopback runtimes are not dialed, so its hub is none
    • I4013 A server bound to every interface advertises the addresses it has now releasedv1.0.0-alpha.825db775
  93. unreleased the-mesh-is-operated-from-one-page — The owner operates the mesh from one page: every runtime readable, one action authorised end to end BLOCKED

    nothing delivered yet

    Blocked by web-sign-in, prismatic-lumen. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3191 The UI reads any linked runtime the mesh names, and says which runtime every reading came from none
    • I3192 An operation started from /ui/mesh is authorised, executed, audited and its result streamed back none
  94. unreleased the-hub-is-reached-from-any-device — The hub is reached privately from any of the owner's devices, and a public ingress is configuration BLOCKED

    nothing delivered yet

    Blocked by safe-self-update. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3195 The lundra hub is a declared deployment target served over its tailnet name, and a second device reaches it none
    • I3196 A deployment's external URL, trusted hosts and forwarded headers are one typed fact read by every surface none
  95. unreleased delivery-flow-is-measured — The way from a pull request to a verified publication is measured per phase, and its bounds are read where work starts BLOCKED

    nothing delivered yet

    Blocked by development-runtime. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 6
    blocked
    6
    BLOCKED 6 issues
    • I3202 CI timings measure the wait before a run starts beside the run, and count what cancelled runs spent none
    • I3203 Delivery lead time is measured per phase, from a pull request's opening to its verified publication none
    • I3204 The backlog's bound is declared once in policy, and every session brief says when the landable backlog is past it none
    • I3205 A pull request's change is split into canonical, derived and incidental paths, and the drain shows each none
    • I3206 The delivery phases have budgets in benchmark policy, and a phase over its budget is a finding with its trend none
    • I3207 A finished task names the pull request that carries its branch and that pull request's disposition none
  96. unreleased a-release-is-proven-end-to-end — Whether a commit may be released, and whether its release arrived, is proved by one read and one case BLOCKED

    nothing delivered yet

    Blocked by safe-self-update, test-evidence. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 3
    blocked
    3
    BLOCKED 3 issues
    • I3201 A publication never replaces the site with a build of an older commit than the one gh-pages serves none
    • I3208 Whether a commit may be released is one read that names each condition and the evidence that settles it none
    • I3213 One case walks a fresh clone from init to published evidence on the release candidate none
  97. unreleased builds-reuse-the-mesh-cache — Builds reuse the mesh cache: compiled Rust, the cargo build directory, mix deps and npm packages, keyed by platform, toolchain and inputs BLOCKED

    last delivery

    Blocked by development-runtime. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 7
    blocked
    7
    BLOCKED 7 issues
    • I3950 A cache key is a versioned triplet of platform, toolchain and inputs, derived from the host and the repository none
    • I3951 The mesh store is spoken natively: signed S3 requests, bounded in time, with the credential read from a private file and never answered none
    • I3952 A dependency install is restored before and saved after, verified by its digest, local level first and a trusted store second none
    • I3953 Every local build path of the repository goes through the cache, and a gate refuses a new bypass none
    • I3955 Whether an archived cargo build directory is reused on a second node is measured before anything restores one none
    • I3956 Every worker, and every process it starts on any machine, is traced to its session, and the board names the address that reaches it none
    • I3996 A node's provisioning secret is read on mc's standard input, never from a command line merged7a71401
  98. unreleased the-ui-works-on-a-phone — Every first-party surface works on a phone, and the primary flow is accepted there PLANNED

    nothing delivered yet

    Nothing blocks it. Its dependencies are accepted, so it can begin.

    done
    0 of 4
    blocked
    2
    ready
    2
    READY 2 issues
    • I3214 The narrow-screen menu of /ui and /cockpit closes on Escape, on a choice and on its backdrop, and returns focus to its toggle none
    • I3215 The ui audit refuses a control a thumb cannot hit at the floor width none
    BLOCKED 2 issues
    • I3216 The IDD loop is accepted at a phone's width as it is at a desktop's none
    • I3217 A wide table on a UI screen is a stacked list below the narrow width, from the same rows none
  99. unreleased a-derive-answers-within-a-second — An ordinary derive answers in under a second, runs independent nodes in parallel, and a budget gate holds it BLOCKED

    nothing delivered yet

    Blocked by a-derive-does-only-the-work-its-inputs-changed. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3236 Independent derive nodes run in bounded parallel against one snapshot, and the bytes do not depend on the order none
    • I3237 A derive publishes its whole output set at once after validating it, and a killed derive leaves the previous set none
  100. unreleased intent-intake — A received brief is a campaign revision whose requirements are reconciled into the one plan BLOCKED

    nothing delivered yet

    Blocked by an-outcome-becomes-a-reviewed-plan. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 4
    blocked
    4
    BLOCKED 4 issues
    • I3272 A received brief is a campaign revision pinned by its manifest digest, and the same bytes again are the same revision none
    • I3273 Each requirement of a campaign revision has a content-derived identity and is reconciled into the existing intents and issues none
    • I3274 A new campaign revision reports only the criteria whose source requirement changed none
    • I3275 An intent's inspector shows the campaign segments it was derived from none
  101. unreleased a-workspace-reaches-the-repository — A vendor workspace reads the repository, and proposes to it only where the owner has decided it may BLOCKED

    nothing delivered yet

    Blocked by runtime-trust, a-promoted-record-opens-its-message. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3285 A vendor workspace reads the plan through the authenticated remote MCP surface, and a tunnel never makes it look local none
    • I3286 A proposal from a workspace arrives as intent.propose carrying the workspace reference it came from none
  102. unreleased an-entity-says-how-it-is-known-and-what-it-affects — One entity read names how its record says it is known and when it was observed, identically on every surface, and what a change affects is derived from the same index BLOCKED

    nothing delivered yet

    Blocked by capability-graph. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 5
    blocked
    5
    BLOCKED 5 issues
    • I3407 What a set of paths affects in the plan is derived from the index: the issues whose scope covers them, what those issues serve and their incoming edges, each with its relation, and nothing is rescanned none
    • I3412 entity.affected also answers the rules, claims and knowledge records whose declared references name an affected path or issue, and takes a revision range none
    • I3427 Every entity read names how its record says it is known, and never answers verified itself: proof stays the pointer it is none
    • I3428 An entity read carries the observation envelope repository.info already answers, plus the blob of its file, and a change to that file moves both none
    • I3429 One entity reads the same on the command line, REST, MCP and the Cockpit: identity, kind, class, evidence, observation envelope and edge order none
  103. unreleased an-inference-names-its-source-and-budget — Every inference a decision rests on names its model and source, stays inside a declared budget, counts independent sources rather than answers, and is never reached from a hook path BLOCKED

    nothing delivered yet

    Blocked by every-sessions-usage-is-observed. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 9
    blocked
    9
    BLOCKED 9 issues
    • I3418 Every advisor consultation records the model that answered, the source it came through and the session that asked none
    • I3419 A conclusion's independent review count counts distinct sources, defined as adapter plus recorded model, so two answers from one source are one review none
    • I3420 A mesh peer asked for critique receives the question and its evidence, and its answer is recorded with the session that gave it none
    • I3421 A reasoning plan over the task's declared token or time budget consults nobody and says that the budget decided none
    • I3422 Advisor consultations are economics usage with their measurement class, and a consultation over its plan's budget is a finding none
    • I3423 docs/REASONING.md maps the pack's routing levels onto the existing plan outcomes and modes, and a test fails when an outcome is missing from that mapping none
    • I3424 No inference transport is reachable from the shell closure of any declared hook command, and reasoning check refuses one that is none
    • I3425 A standing conclusion is reused only while the files it cites are unchanged since it was recorded none
    • I3426 An advisor answer carrying instructions or record-shaped fields is kept as bounded text and changes no record none
  104. unreleased routing-recommendations — Routing recommendations derived from measured cost BLOCKED

    nothing delivered yet

    Blocked by cost-per-accepted-outcome. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 4
    blocked
    4
    BLOCKED 4 issues
    • I0501 Group comparable work from what the records already carry none
    • I0502 Recommend a profile from measured cost, naming the measurements none
    • I0503 Return no recommendation where the data is too thin, and say why none
    • I0504 Prove the recommendation is advisory and publish it as such none

    what this would make guaranteed

  105. unreleased intent-bound-work — A task is bound to the intent it serves BLOCKED

    nothing delivered yet

    Blocked by intent-planning. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 5
    blocked
    5
    BLOCKED 5 issues
    • I2000 What a piece of work serves is one derivation, with a revision none
    • I2001 start asks what the task serves and refuses a refused binding where the policy requires it none
    • I2002 The context of a bound task says what the intent asks of this work none
    • I2003 A handover pins the binding it was written under, and resolving it reports drift none
    • I2004 plan start refuses an issue whose binding is refused, in both engines none
  106. unreleased mesh-peers-execute-assigned-work — Work is offered to a peer by capability under a fenced lease, and runs there as an execution BLOCKED

    nothing delivered yet

    Blocked by mesh-journal-converges, runtime-trust, runtime-adapters. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 2
    blocked
    2
    BLOCKED 2 issues
    • I3198 A peer is offered an assignment by capability under a fenced lease, and accepts or refuses it with a reason none
    • I3199 An assignment names the execution profile it needs, and a peer whose envelope does not satisfy it is refused none
  107. unreleased operation-convergence — After the alpha, the time from an intent to its verified satisfaction is measured from the records BLOCKED

    nothing delivered yet

    Blocked by cost-per-accepted-outcome. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 1
    blocked
    1
    BLOCKED 1 issue
    • I3276 The time from an intent's proposal to its verified satisfaction is derived from the records, with the interventions on the way none
  108. unreleased a-prompt-reaches-the-work-it-serves — A captured prompt is matched to its existing intent and recorded on the task that follows, joined to its outcome and evidence, shown on /ui and the Cockpit, read only on its own machine and never published BLOCKED

    nothing delivered yet

    Blocked by an-outcome-becomes-a-reviewed-plan, every-surface-follows-what-changed, an-entity-says-how-it-is-known-and-what-it-affects. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 9
    blocked
    9
    BLOCKED 9 issues
    • I3406 A prompt delivered again, concurrently, on the next day or after a resumed session is still one record, and capture status counts every identity that more than one record holds none
    • I3408 A captured prompt is answered, on this machine only, with the existing intents and issues it matches or with no match, and the answer carries identities and never the prompt's text none
    • I3409 An episode answers, for each prompt it captured, the intent it matched, the task that recorded it, that task's outcome and the evidence of the criterion it serves, with the same identities on every surface and after any replay none
    • I3411 A task records the captured prompt it followed, so the join from prompt to task is a recorded fact rather than a time adjacency none
    • I3430 The IDD standing panel and the Cockpit intent page show, under each criterion, the knowledge that bears on it, each with how it is known none
    • I3432 The UI and Cockpit snapshots pass both privacy gates after they are placed and before anything is published, on CI and from a terminal none
    • I3433 A UI snapshot page renders only the readings its subject declares publishable, and a page that reads any other reading, or a capability that refuses remote callers, is withheld with a link to the live page none
    • I3434 A capability declared as reading checkout-private records answers only this machine: a caller beyond loopback is refused on HTTP and MCP, and the refusal logs no input value none
    • I3435 A Cockpit snapshot withholds every page that reads a capability refusing remote callers, not only the continuity page it names none
  109. unreleased knowledge-is-reconciled-before-it-is-reviewed — What a session proposes as knowledge is reconciled with what the repository already knows before a person reviews it, and a promotion stands on evidence that resolves BLOCKED

    nothing delivered yet

    Blocked by knowledge-acts-on-what-it-learns, an-entity-says-how-it-is-known-and-what-it-affects. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 5
    blocked
    5
    BLOCKED 5 issues
    • I3413 A decision, resolved question or verified task fact already curated or pending from another episode of this checkout is not proposed again, and derive names the record it matched none
    • I3414 Every candidate group names the curated notes and the rule that already speak about its subject, read from entity.affected, so a possible duplicate or contradiction is in front of the reviewer with both sources none
    • I3415 knowledge promote refuses evidence that names no reference existing in this checkout, and knowledge.promoted records the references it stood on none
    • I3416 The episode boundary is proven to give one candidate for an observation recorded twice, none for a partial task, and one file per episode when two episodes close at once none
    • I3417 An observation can cite the mesh review that found what it records, and the reference stays in the candidate's body, never in its provenance none
  110. unreleased shared-policy — Shared policy across repositories and workers BLOCKED

    nothing delivered yet

    Blocked by routing-recommendations. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 5
    blocked
    5
    BLOCKED 5 issues
    • I0601 Let a policy name a shared source it does not copy none
    • I0602 Make a local override explicit and prove it survives an update of the shared source none
    • I0603 Report drift from the shared policy in one command none
    • I0604 Prove the offline guarantee survives sharing none
    • I0605 Publish the shared-policy claim and what sharing still cannot do none

    what this would make guaranteed

  111. unreleased a-finish-reads-the-criteria-its-work-serves — A finish reads what its work serves BLOCKED

    nothing delivered yet

    Blocked by intent-bound-work. Finishing every issue inside this milestone would not release it; the gate is the dependency, not the workload.

    done
    0 of 1
    blocked
    1
    BLOCKED 1 issue
    • I3259 Where the policy says completed means complete, finish refuses completed while a criterion the task serves is unmet, and writes no intent state none

The order, and why it is not a preference

28 of 111 milestones depend on another, and the dependency is enforced rather than intended: a milestone whose dependencies are not accepted is BLOCKED whatever its own issues say. Its bar can be full and it still waits: the bar counts its own issues, the graph says whether it may begin.

.ai/repo/project/milestones/

Select a node to see what it is and what it touches.

The milestone graph. An arrow means the target cannot begin until the source is accepted — not a preference, a gate the engine enforces. Select a milestone to see its neighbours; its name opens its page.
The same graph as text — 111 nodes, 39 edges

  • v0.3.1 M000 milestone · DONE

    Milestone and DAG driven development

  • v0.3.1 M001 milestone · DONE

    A blocking question survives a handover

  • M002 milestone · ACTIVE

    A durable record names the worker that wrote it

  • M003 milestone · ACTIVE

    A session is a durable envelope, and knowledge is compiled from what is already canonical

  • M004 milestone · ACTIVE

    Performance is executable evidence, and the hot path does no canonical work twice

  • v0.3.1 foundation milestone · DONE

    A supervisory control layer that is real rather than described

    • unblocks → runtime-adapters

  • execution-telemetry milestone · ACTIVE

    Execution telemetry, only from providers that expose it honestly

    • unblocks → cost-per-accepted-outcome

  • fly-deployment milestone · ACTIVE

    The container image is a projection of the repository model, and its smoke is its evidence

  • web-sign-in milestone · PLANNED

    The deployed surfaces know who is asking, and the identity providers are data

    • unblocks → the-mesh-is-operated-from-one-page

  • capability-graph milestone · ACTIVE

    One capability graph, two projections, and no second inventory of what this repository can do

    • unblocks → an-entity-says-how-it-is-known-and-what-it-affects

  • external-workspaces milestone · ACTIVE

    An external workspace is read the way this repository reads anything else, and its content never becomes public by accident

  • two-folder-integration milestone · ACTIVE

    A repository that adopts Majordomus gains two directories and two lines, and can give them back

  • derived-data-integrity milestone · ACTIVE

    A committed derivation describes something it can be a projection of

  • work-graph-github milestone · ACTIVE

    The projection to GitHub is gated, identified and traversable, and a merged pull request leads back to the outcome it served

  • intent-lifecycle milestone · PLANNED

    Work is traceable to the intent it serves, and an intent is satisfied only by evidence

    • unblocks → intent-planning

  • development-runtime milestone · ACTIVE

    The runtime has a development surface

    • unblocks → delivery-flow-is-measured
    • unblocks → builds-reuse-the-mesh-cache

  • test-evidence milestone · ACTIVE

    Every verifiable claim and widget resolves to revision-bound test evidence, on every surface

    • unblocks → a-release-is-proven-end-to-end

  • public-proof milestone · ACTIVE

    A visitor sees the product prove itself, and can check every claim it makes

  • adopter-upgrades milestone · ACTIVE

    An adopting repository survives a Majordomus upgrade, and what the tool vendors into it is adopter-neutral

  • a-second-adopter-is-served milestone · ACTIVE

    A second adopter is served: what a foreign repository met on its first day is fixed in the tool

    • unblocks → a-stranger-adopts-it-unaided

  • ci-critical-path milestone · ACTIVE

    The critical path from a change to its verdict, and from a merge to its verified deploy, runs under a minute warm

  • measurements-are-tracked-over-time milestone · PLANNED

    Coverage and CI cost are kept, exported and drawn over time, from the one measurement each has

  • automation milestone · ACTIVE

    Repository automation is scripted capabilities over typed Rust, not shell

  • v0.28.0 a-session-leaves-what-it-observed milestone · DONE

    A session leaves what it observed, and the repository routes it

  • runtime-trust milestone · ACTIVE

    A runtime is safe to reach from another machine, and joining the mesh trusts nobody by accident

    • unblocks → mesh-connectivity
    • unblocks → a-workspace-reaches-the-repository
    • unblocks → mesh-peers-execute-assigned-work

  • runtime-lifecycle milestone · ACTIVE

    One usable server per checkout starts, attaches, stops and reports its state without races or hidden kills

    • unblocks → the-runtime-supervises-itself
    • unblocks → the-host-knows-its-runtimes

  • mesh-journal-converges milestone · ACTIVE

    The cooperation journal is durable, converges under any delivery order, and never lets a stale claim win

    • unblocks → mesh-connectivity
    • unblocks → mesh-peers-execute-assigned-work

  • mcp-transports-are-reliable milestone · ACTIVE

    Every MCP transport delivers each request at most once, bounds what it carries, and honours cancellation

  • surfaces-never-disagree milestone · ACTIVE

    Every surface projects the same state, says when it was observed, and keeps no list of its own

  • failure-is-visible milestone · ACTIVE

    Every failure the runtime can suffer is bounded, tested or stated, and changes the health it reports

    • unblocks → the-runtime-supervises-itself

  • architecture-is-enforced milestone · ACTIVE

    A violated invariant fails a gate, and green means every required check ran

  • safe-self-update milestone · ACTIVE

    Every mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked

    • unblocks → the-host-knows-its-runtimes
    • unblocks → the-hub-is-reached-from-any-device
    • unblocks → a-release-is-proven-end-to-end

  • every-session-joins-the-mesh milestone · ACTIVE

    Every LLM session joins the Majordomus mesh at start, told the mesh as work

  • truthful-plan-surfaces milestone · ACTIVE

    The plan's surfaces are inferred from delivery, and nothing they show is typed beside the repository

  • browser-compute milestone · PLANNED

    A browser computes for the project with the server's own code, and the server verifies every result

  • idd-workspace milestone · DONE

    The UI is where the owner directs the work, from an intent to its next move

    • unblocks → idd-reads-at-a-glance
    • unblocks → the-ui-works-on-a-phone

  • a-test-fails-when-the-code-is-wrong milestone · PLANNED

    The suites that guard critical predicates are shown to fail when those predicates are wrong

  • a-claim-stands-only-on-its-evidence milestone · PLANNED

    A claim that something is enforced, tested or delivered stands only on recorded evidence that would have caught it being false

  • the-product-shows-what-it-caught milestone · BLOCKED

    What finish caught is counted from the ledger and compared on the benchmark, never asserted

  • prismatic-lumen milestone · PLANNED

    Prismatic Lumen: the owner oversees and moves the whole mesh from one page, which owns nothing

    • unblocks → the-mesh-is-operated-from-one-page

  • the-session-domain-is-written-once milestone · PLANNED

    The session lifecycle is written by the typed domain, and the shell only parses and renders

    • unblocks → entry-proves-what-it-handed

  • knowledge-acts-on-what-it-learns milestone · PLANNED

    The repository decides when to evolve its layer, and a session carries it out

    • unblocks → knowledge-is-reconciled-before-it-is-reviewed

  • campaigns-are-read-as-provenance milestone · PLANNED

    A prompt pack is a campaign the index serves and the plan cites

  • repository-automation-is-typed milestone · PLANNED

    Repository automation is typed capabilities that Rhai orchestrates, and domain-logic shell only shrinks

  • an-authorised-node-connects-from-anywhere milestone · ACTIVE

    An authorised node reaches another across LAN, tailnet or NAT, and says how

  • the-mesh-is-operated-from-any-device milestone · BLOCKED

    The owner understands and operates the whole mesh from one page, on any device

  • finished-work-reaches-a-verified-release milestone · BLOCKED

    Finished work reaches a verified release at the pace it is finished

  • ordinary-commands-never-build milestone · PLANNED

    No ordinary command builds: every entry path fails fast or answers through a release of the same generation

  • every-surface-follows-what-changed milestone · PLANNED

    Every surface follows what changed in the repository by push, and a surface that does not says so

    • unblocks → a-prompt-reaches-the-work-it-serves

  • a-visitor-understands-and-checks-majordomus milestone · ACTIVE

    A first-time visitor of majordomus.dev understands what Majordomus does and can check every claim it makes

  • the-plan-says-what-a-fix-unblocks milestone · PLANNED

    The plan says what finishing an issue unblocks, and why each blocked issue is blocked

  • a-promoted-record-opens-its-message milestone · PLANNED

    Every record promoted from a workspace cites the message it came from, and the UI opens it for the operator who holds it

    • unblocks → a-workspace-reaches-the-repository

  • a-provider-carries-the-contract-natively milestone · PLANNED

    Each agent client carries the contract through its own extension points, generated once and checked for drift

  • a-change-is-judged-in-minutes milestone · PLANNED

    A change is derived in under a second and judged in minutes, and nothing that could have changed is skipped

  • what-a-workspace-decides-reaches-the-repository-with-its-source milestone · BLOCKED

    What the owner decides in a vendor workspace reaches the repository, and every promoted record opens the message it came from

  • every-sessions-usage-is-observed milestone · ACTIVE

    What every AI session consumed is observed from the provider, attributed to the work it served, and never estimated into a fact

    • unblocks → an-inference-names-its-source-and-budget

  • the-ui-runs-and-explains milestone · PLANNED

    The UI runs any capability and explains what needs the owner, whose version it shows and where its time went

  • the-proof-tests-are-registered-before-they-run milestone · PLANNED

    The six proof tests are registered as validated protocols, each frozen by its own digest, and every trial is a typed record that publishes only what its basis permits

  • the-proof-scorecard-is-published milestone · PLANNED

    One derived scorecard publishes every proof test's computed status, losses included, on every surface, and no value claim stands without a passed test

  • a-foreign-repository-is-adopted-and-measured milestone · PLANNED

    A repository not built around Majordomus is adopted from the published installer to an accepted finish, and its overhead and friction are recorded without exposing what its basis does not permit

  • the-corpus-is-registered-before-it-runs milestone · BLOCKED

    A corpus of 20 tasks, stratified by a difficulty proxy measured and registered before the new tasks are written, is registered with its analysis, run order, stopping rule and a pinned release

  • a-registered-corpus-judges-majordomus milestone · PLANNED

    The registered corpus judges the same agent with and without Majordomus, by an exact task-level test on accepted results, and the verdict is published with its losses

  • every-task-states-its-delivery-economics milestone · PLANNED

    Every task states its delivery economics: wall time, typed human interventions, CI reruns, spend and acceptance, each from a named record or said not observed

  • delivery-economics-are-measured-over-declared-windows milestone · BLOCKED

    Delivery economics are measured on corpus runs and on real work over a window registered before it opens, and published with their denominators and losses

  • the-mesh-is-measured-against-one-agent milestone · BLOCKED

    Coordinated workers on the mesh are compared with a single agent on the same batch tasks, at quality held by a registered non-inferiority guard

  • recovery-from-injected-faults-is-proven milestone · BLOCKED

    A killed worker, a cut connection and a conflict are injected on purpose, and recovery is proven without lost work or duplicate completion

  • a-newcomer-reaches-a-first-verified-intent milestone · PLANNED

    A newcomer reaches an intent whose verdict is satisfied, in a repository of their own, using only what the getting-started page shows

  • a-paste-is-decomposed-by-a-skill milestone · PLANNED

    A pasted brief is decomposed into the plan by a skill, and never kept verbatim as an intent statement

  • an-outcome-becomes-a-reviewed-plan milestone · PLANNED

    A desired outcome becomes a draft plan that is checked before a record is written

    • unblocks → intent-intake
    • unblocks → a-prompt-reaches-the-work-it-serves

  • the-intent-loop-is-proved-end-to-end milestone · BLOCKED

    The intent loop is proved end to end, and the plan and the documents say what it does

  • an-unmet-criterion-is-drafted-into-work milestone · PLANNED

    An unmet criterion is drafted into work from the evidence, and the draft is the same on every run

  • command-and-deployment-criteria-are-judged milestone · PLANNED

    A command or deployment criterion is met by a recorded run of exactly that command, or an observation of exactly that deployment, current at the presented revision

  • the-mesh-works-out-of-the-box milestone · ACTIVE

    The mesh works out of the box: trusted machines find each other by every means and their sessions cooperate from the first turn

  • everything-is-followed-in-one-stream milestone · ACTIVE

    Everything that happens in the repository is followed in one stream

  • a-version-follows-the-work milestone · PLANNED

    Landed work is released as a measured version, and how long it has waited is a finding

  • peer-blackboard milestone · PLANNED

    The peer blackboard is one projection, pushed live to every surface

  • a-derive-does-only-the-work-its-inputs-changed milestone · ACTIVE

    A derive does only the work its inputs changed, and can say why

    • unblocks → a-derive-answers-within-a-second

  • a-derivation-computed-once-is-reused milestone · BLOCKED

    A derivation computed once is reused by every worktree and by CI, and the incremental path becomes the default on evidence

  • one-kit-on-every-surface milestone · PLANNED

    Code, charts, controls, embeds and shell blocks are one kit on every surface, declared in the design book and held there by a gate

  • landing-survives-any-session milestone · PLANNED

    Landing green work survives any session, any restart and any machine

  • merging-and-referencing-are-enforced milestone · PLANNED

    Merging and referencing are enforced: every pull request carries its metadata, every reference resolves, every number is taken once

  • every-model-call-is-paid-from-a-declared-source milestone · PLANNED

    How a model call Majordomus starts can be paid is declared by the vendor with evidence, and each call names the source it was declared to draw on

  • a-session-proceeds-through-the-mesh milestone · PLANNED

    A session proceeds through the mesh: it finds the work, claims it once, runs it watched and stops when the intent is met

  • runtime-adapters milestone · PLANNED

    Profiles become runtime constraints rather than advice

    • unblocks → mesh-peers-execute-assigned-work
    • foundation unblocks → this

  • cost-per-accepted-outcome milestone · BLOCKED

    Cost per accepted outcome, only on measured data

    • unblocks → routing-recommendations
    • unblocks → operation-convergence
    • execution-telemetry unblocks → this

  • intent-planning milestone · BLOCKED

    The plan of an intent is held to it before execution

    • unblocks → intent-bound-work
    • intent-lifecycle unblocks → this

  • idd-reads-at-a-glance milestone · ACTIVE

    The intent workspace reads at a glance and leads everywhere it names

    • idd-workspace unblocks → this

  • a-stranger-adopts-it-unaided milestone · BLOCKED

    A stranger installs Majordomus and is stopped from a false done in ten minutes, and every outside first run teaches the tool

    • a-second-adopter-is-served unblocks → this

  • entry-proves-what-it-handed milestone · BLOCKED

    An episode records the governance and briefing it was handed, and a change is told

    • the-session-domain-is-written-once unblocks → this

  • the-runtime-supervises-itself milestone · BLOCKED

    The runtime says what is progressing, waiting or stalled, and repairs only what is safe

    • failure-is-visible unblocks → this
    • runtime-lifecycle unblocks → this

  • the-host-knows-its-runtimes milestone · BLOCKED

    A host knows every Majordomus runtime it runs, with no project open

    • runtime-lifecycle unblocks → this
    • safe-self-update unblocks → this

  • mesh-connectivity milestone · BLOCKED

    Trusted nodes connect across NAT through proven transports, and every surface says which path

    • runtime-trust unblocks → this
    • mesh-journal-converges unblocks → this

  • the-mesh-is-operated-from-one-page milestone · BLOCKED

    The owner operates the mesh from one page: every runtime readable, one action authorised end to end

    • web-sign-in unblocks → this
    • prismatic-lumen unblocks → this

  • the-hub-is-reached-from-any-device milestone · BLOCKED

    The hub is reached privately from any of the owner's devices, and a public ingress is configuration

    • safe-self-update unblocks → this

  • delivery-flow-is-measured milestone · BLOCKED

    The way from a pull request to a verified publication is measured per phase, and its bounds are read where work starts

    • development-runtime unblocks → this

  • a-release-is-proven-end-to-end milestone · BLOCKED

    Whether a commit may be released, and whether its release arrived, is proved by one read and one case

    • safe-self-update unblocks → this
    • test-evidence unblocks → this

  • builds-reuse-the-mesh-cache milestone · BLOCKED

    Builds reuse the mesh cache: compiled Rust, the cargo build directory, mix deps and npm packages, keyed by platform, toolchain and inputs

    • development-runtime unblocks → this

  • the-ui-works-on-a-phone milestone · PLANNED

    Every first-party surface works on a phone, and the primary flow is accepted there

    • idd-workspace unblocks → this

  • a-derive-answers-within-a-second milestone · BLOCKED

    An ordinary derive answers in under a second, runs independent nodes in parallel, and a budget gate holds it

    • a-derive-does-only-the-work-its-inputs-changed unblocks → this

  • intent-intake milestone · BLOCKED

    A received brief is a campaign revision whose requirements are reconciled into the one plan

    • an-outcome-becomes-a-reviewed-plan unblocks → this

  • a-workspace-reaches-the-repository milestone · BLOCKED

    A vendor workspace reads the repository, and proposes to it only where the owner has decided it may

    • runtime-trust unblocks → this
    • a-promoted-record-opens-its-message unblocks → this

  • an-entity-says-how-it-is-known-and-what-it-affects milestone · BLOCKED

    One entity read names how its record says it is known and when it was observed, identically on every surface, and what a change affects is derived from the same index

    • unblocks → a-prompt-reaches-the-work-it-serves
    • unblocks → knowledge-is-reconciled-before-it-is-reviewed
    • capability-graph unblocks → this

  • an-inference-names-its-source-and-budget milestone · BLOCKED

    Every inference a decision rests on names its model and source, stays inside a declared budget, counts independent sources rather than answers, and is never reached from a hook path

    • every-sessions-usage-is-observed unblocks → this

  • routing-recommendations milestone · BLOCKED

    Routing recommendations derived from measured cost

    • unblocks → shared-policy
    • cost-per-accepted-outcome unblocks → this

  • intent-bound-work milestone · BLOCKED

    A task is bound to the intent it serves

    • unblocks → a-finish-reads-the-criteria-its-work-serves
    • intent-planning unblocks → this

  • mesh-peers-execute-assigned-work milestone · BLOCKED

    Work is offered to a peer by capability under a fenced lease, and runs there as an execution

    • mesh-journal-converges unblocks → this
    • runtime-trust unblocks → this
    • runtime-adapters unblocks → this

  • operation-convergence milestone · BLOCKED

    After the alpha, the time from an intent to its verified satisfaction is measured from the records

    • cost-per-accepted-outcome unblocks → this

  • a-prompt-reaches-the-work-it-serves milestone · BLOCKED

    A captured prompt is matched to its existing intent and recorded on the task that follows, joined to its outcome and evidence, shown on /ui and the Cockpit, read only on its own machine and never published

    • an-outcome-becomes-a-reviewed-plan unblocks → this
    • every-surface-follows-what-changed unblocks → this
    • an-entity-says-how-it-is-known-and-what-it-affects unblocks → this

  • knowledge-is-reconciled-before-it-is-reviewed milestone · BLOCKED

    What a session proposes as knowledge is reconciled with what the repository already knows before a person reviews it, and a promotion stands on evidence that resolves

    • knowledge-acts-on-what-it-learns unblocks → this
    • an-entity-says-how-it-is-known-and-what-it-affects unblocks → this

  • shared-policy milestone · BLOCKED

    Shared policy across repositories and workers

    • routing-recommendations unblocks → this

  • a-finish-reads-the-criteria-its-work-serves milestone · BLOCKED

    A finish reads what its work serves

    • intent-bound-work unblocks → this

Generated from .ai/repo/project/milestones/ and .ai/repo/project/issues/ through the same projection majordomus plan roadmap prints. The current state as a document is docs/PLAN_STATUS.md.

Searches the titles and descriptions of every page this site publishes.