A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:01:48Z by majordomus 0.29.0. Nothing on this page is read again. See it live

Roadmap

From intent to impact, in the order the plan's dependencies allow.

Every milestone of the plan with the issues it holds, and the intents the work serves.

NowM002plan.roadmap /now
NextM003plan.roadmap /next
Milestones41plan.roadmap /milestones
Intents5intents.list /intents

What it is for

The milestone's own record: why it exists, what it promises, and what would prove it.

The problem

Several invariants are enforced well: no shadow operation inventory (projection-check, command-graph, mcp-tool-run, shell-inventory, mesh-check), generated drift (generate --check), skipped shell cases (test/run.sh --no-skips). Others are not. The full scheduled CI plan, the only one that selects every gate, has not produced a green verdict in its last 10 runs while push runs on master stay green, and nothing alarms; rule project.never-reported-is-not-green is review-only. rule-proof calls a rule satisfied when its proof is named and present: of 163 rules, 133 are 'not run'. No guard keeps a credential out of HTTP responses, MCP results, logs or mesh frames (apps/majordomus-cli/src/generate.rs:1364,1398 guards generated documents only), and redaction::public_text has no production caller (apps/majordomus-cli/src/redaction.rs:223). Nothing starts a shared server from an installed release in a foreign repository, and the release smoke swallows the launcher's failure (.github/workflows/release.yml:452). Measured in the runtime baseline audit of 2026-10-09 at master 1fb8d6be44 (plan/RUNTIME_BASELINE.md).

The outcome

A deliberate architectural violation fails a named gate; a red or cancelled full run is raised the day it happens; a rule is reported proven only when its proof ran; a credential shape never leaves through a response, log or frame; an installed release is proven to serve a repository that is not this one.

Where it stands

Gated: projections, generation, docs commands, release-follows-CI (scripts/ci/release-verdict). Partial: false green (push subset green over a red full plan), rule proof, secrets (prompt-privacy and no-machine-paths cover tracked text only), wire versions (version-surface covers the public surface only, see I2164), dogfood (install-check runs --standalone against this repository, scripts/ci/install-check:176). Remote unauthenticated mutation is I2123.

Where it should stand

Each row of the audit's enforcement table (plan/RUNTIME_BASELINE.md) is gated in CI with a fixture that makes the gate fail, and the session briefing shows the last full-plan verdict.

In scope

scripts/ci
.github/workflows/validate.yml
.github/workflows/release.yml
.ai/repo/ci/gates.yaml
.ai/repo/rules/project
apps/majordomus-cli/src/redaction.rs
apps/majordomus-cli/src/logging.rs
apps/majordomus-cli/src/http
apps/majordomus-cli/src/execution/redact.rs
apps/majordomus-cli/tests/executions.rs
apps/majordomus-cli/tests/redaction.rs
site/static/install.sh
test/cases
docs/DISTRIBUTION.md

Out of scope

Shortening the slowest case, which is I2115 (milestone ci-critical-path).
The evidence publication's use of public_text, which is I1955 (test-evidence).
A second CI pipeline; checks join the existing gates.yaml plan.

Proven when

A scheduled run that ends red or cancelled produces a visible record naming the failing jobs
rule-proof reports each rule from recorded runs, and the not-run count of blocking rules is printed
A credential-shaped value sent to the server never appears in a response, an MCP error or server.log
CI installs a release archive, starts its shared server in a fresh foreign repository and reads its readiness

objects.get0 msAPI/api/v1/objectMCPmajordomus_gettechnical view

Milestone

One milestone of the plan: what it holds, what can start, and what it waits for.

architecture-is-enforced · order 143 · p1

A violated invariant fails a gate, and green means every required check ran

activeClose

Done: 2 of 3
Ready now: I2708
Blocked: 0
Waits for: none
Blocked by: none
Unblocks: none
Serves: none

Critical path

I2708

Issues

Issue	Status	Priority	Wave	Blocked by
I2161No answer, log line or mesh frame carries a credential the redactor knows	done	p1	0	none
I2162A released archive, installed, serves a foreign repository over the shared server in CI	done	p1	0	none
I2708A mesh event field nobody listed fails the mesh check, and no log field or review body carries a credential the redactor knows	ready	p1	1	none

plan.roadmap0 msAPI/api/v1/plan/roadmapMCPmajordomus_plan_roadmaptechnical view

plan.issues0 msAPI/api/v1/plan/issuesMCPmajordomus_plan_issuestechnical view

Milestones

Every milestone, in the plan's order; the plan declares no dates, so none are drawn.

Milestone	State	Issues done
M000Milestone and DAG driven development	done	15 of 15
M001A blocking question survives a handover	done	4 of 4
M002A durable record names the worker that wrote it	active	1 of 4
M003A session is a durable envelope, and knowledge is compiled from what is already canonical	active	11 of 16
M004Performance is executable evidence, and the hot path does no canonical work twice	active	16 of 38
foundationA supervisory control layer that is real rather than described	done	0 of 0
fly-deploymentThe container image is a projection of the repository model, and its smoke is its evidence	active	4 of 32
web-sign-inThe deployed surfaces know who is asking, and the identity providers are data	planned	0 of 8
capability-graphOne capability graph, two projections, and no second inventory of what this repository can do	active	9 of 32
external-workspacesAn external workspace is read the way this repository reads anything else, and its content never becomes public by accident	active	1 of 10
two-folder-integrationA repository that adopts Majordomus gains two directories and two lines, and can give them back	active	0 of 23
derived-data-integrityA committed derivation describes something it can be a projection of	verify	1 of 1
work-graph-githubThe projection to GitHub is gated, identified and traversable, and a merged pull request leads back to the outcome it served	verify	10 of 10
intent-lifecycleWork is traceable to the intent it serves, and an intent is satisfied only by evidence	planned	0 of 2
development-runtimeThe runtime has a development surface	active	38 of 70
test-evidenceEvery verifiable claim and widget resolves to revision-bound test evidence, on every surface	active	12 of 28
public-proofA visitor sees the product prove itself, and can check every claim it makes	active	1 of 2
adopter-upgradesAn adopting repository survives a Majordomus upgrade, and what the tool vendors into it is adopter-neutral	active	10 of 17
a-second-adopter-is-servedA second adopter is served: what a foreign repository met on its first day is fixed in the tool	active	0 of 1
a-session-leaves-what-it-observedA session leaves what it observed, and the repository routes it	done	3 of 3
automationRepository automation is scripted capabilities over typed Rust, not shell	active	2 of 5
runtime-trustA runtime is safe to reach from another machine, and joining the mesh trusts nobody by accident	active	5 of 9
runtime-lifecycleOne usable server per checkout starts, attaches, stops and reports its state without races or hidden kills	active	5 of 8
mesh-journal-convergesThe cooperation journal is durable, converges under any delivery order, and never lets a stale claim win	active	2 of 5
mcp-transports-are-reliableEvery MCP transport delivers each request at most once, bounds what it carries, and honours cancellation	verify	2 of 2
surfaces-never-disagreeEvery surface projects the same state, says when it was observed, and keeps no list of its own	active	1 of 6
failure-is-visibleEvery failure the runtime can suffer is bounded, tested or stated, and changes the health it reports	active	3 of 4
architecture-is-enforcedA violated invariant fails a gate, and green means every required check ran	active	2 of 3
safe-self-updateEvery mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked	active	2 of 7
every-session-joins-the-meshEvery LLM session joins the Majordomus mesh at start, told the mesh as work	planned	0 of 4
truthful-plan-surfacesThe plan's surfaces are inferred from delivery, and nothing they show is typed beside the repository	active	0 of 9
idd-workspaceThe UI is where the owner directs the work, from an intent to its next move	active	0 of 1
everything-is-followed-in-one-streamEverything that happens in the repository is followed in one stream	active	1 of 8
the-mesh-works-out-of-the-boxThe mesh works out of the box: trusted machines find each other by every means and their sessions cooperate from the first turn	planned	0 of 6
runtime-adaptersProfiles become runtime constraints rather than advice	planned	0 of 6
intent-planningThe plan of an intent is held to it before execution	blocked	0 of 2
execution-telemetryExecution telemetry, only from providers that expose it honestly	blocked	0 of 5
intent-bound-workA task is bound to the intent it serves	blocked	0 of 5
cost-per-accepted-outcomeCost per accepted outcome, only on measured data	blocked	0 of 4
routing-recommendationsRouting recommendations derived from measured cost	blocked	0 of 4
shared-policyShared policy across repositories and workers	blocked	0 of 5

plan.roadmap0 msAPI/api/v1/plan/roadmapMCPmajordomus_plan_roadmaptechnical view

Intents

What the work is for, and whether the evidence says it is met.

Intent	Stage	Verdict
a-session-leaves-what-it-observedEvery managed session leaves what it observed, and the repository groups and routes it without being asked	satisfied	satisfied
intent-bound-workWork starts bound to the intent it serves, and a worker resumes knowing whether that intent moved	planned	satisfied
intent-lifecycleEvery change can be traced to the intent it serves, and an intent reads satisfied only when evidence says so	planned	unknown
intent-planningThe plan of an intent is checked against it before execution, from a recorded gap and a recorded critique	planned	satisfied
the-owner-directs-work-from-the-uiThe owner directs the repository's development from the UI, from an intent to the move that starts its next issue	executing	satisfied

intents.list264 msAPI/api/v1/intentsCLImajordomus intent listMCPmajordomus_intentstechnical view

Issues by status

Every issue of the plan, counted by the plan.

View all

424issues

active1
blocked159
cancelled10
done161
ready86
verify7

plan.status0 msAPI/api/v1/plan/statusMCPmajordomus_plan_statustechnical view

Dependencies

Which milestone waits for which, as the plan records it.

Milestone	Depends on	Blocked by
runtime-adapters	foundation
intent-planning	intent-lifecycle	intent-lifecycle
execution-telemetry	runtime-adapters	runtime-adapters
intent-bound-work	intent-planning	intent-planning
cost-per-accepted-outcome	execution-telemetry	execution-telemetry
routing-recommendations	cost-per-accepted-outcome	cost-per-accepted-outcome
shared-policy	routing-recommendations	routing-recommendations

plan.roadmap0 msAPI/api/v1/plan/roadmapMCPmajordomus_plan_roadmaptechnical view