A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:01:48Z by majordomus 0.29.0. Nothing on this page is read again. See it live

Roadmap

From intent to impact, in the order the plan's dependencies allow.

Every milestone of the plan with the issues it holds, and the intents the work serves.

NowM002plan.roadmap /now
NextM003plan.roadmap /next
Milestones41plan.roadmap /milestones
Intents5intents.list /intents

What it is for

The milestone's own record: why it exists, what it promises, and what would prove it.

The problem

The pack assumes a self-updater and signed releases. Both premises are refuted. majordomus update regenerates provider projections from policy (lib/update.sh:4); there is no self-update command, and docs/DISTRIBUTION.md:416-439 says so; to upgrade, a person reruns install.sh with --version. Artifacts are checksummed, not signed: sha256 and size in releases/<tag>.json are checked by site/static/install.sh:478 (called at :706), and docs/DISTRIBUTION.md:151-153 defers signing on purpose. What exists is compatibility risk: the superseded check covers only a binary replaced at the same path (apps/majordomus-cli/src/lease.rs:695-709), while the installer uses one directory per version, so a new client attaches to an older server and only an Outdated warning records it (apps/majordomus-cli/src/capability/builtin/server.rs:410-424). version-surface prices the public surface only; mesh discovery and link versions (apps/majordomus-cli/src/mesh/protocol.rs:36-40, apps/majordomus-cli/src/mesh/link.rs:50-53), the lease schema and journal events are outside it. Measured in the runtime baseline audit of 2026-10-09 at master 1fb8d6be44 (plan/RUNTIME_BASELINE.md).

The outcome

An enrolled mesh node follows the stable release by itself through the one installer, forward only, activating in order and rolling back a failed activation (ADR 0161); a newer client replaces an older server in an ordered hand-off and an older client is told it is older; a change to any wire or on-disk schema needs a version bump; a released archive carries a provenance attestation the installer checks.

Where it stands

Implemented: install.sh verifies checksum and size, refuses traversal and non-HTTPS; release-verdict gates the release on CI; version-surface covers capabilities, routes, tools, commands and schemas; MCP protocol negotiation. Absent: a reader of the stable pointer on any node (every node is upgraded by hand), cross-path version hand-off, wire-schema pricing, a v1 advertisement fixture, provenance.

Where it should stand

The compatibility matrix in plan/RUNTIME_BASELINE.md lists adjacent client/server and mesh versions with a test for each pair, and docs/DISTRIBUTION.md states what each install path verifies. The owner decided on 2026-10-14 that a background update check is wanted (ADR 0161): every enrolled node follows releases/latest.json through self update, which re-runs install.sh, and the mesh shows each node's version (I2720-I2724).

In scope

apps/majordomus-cli/src/lease.rs
apps/majordomus-cli/src/capability/builtin/server.rs
apps/majordomus-cli/src/mcp/protocol.rs
apps/majordomus-cli/src/release
apps/majordomus-cli/src/mesh/protocol.rs
apps/majordomus-cli/src/mesh/link.rs
scripts/ci/version-matches-surface
.github/workflows/release.yml
site/static/install.sh
test/fixtures
test/cases
docs/DISTRIBUTION.md
docs/MCP.md
docs/MESH.md
apps/majordomus-cli/src/mesh
.ai/repo/mesh/majordomus.yaml

Out of scope

A second installer or updater; install.sh stays the one path (pack M11), and self update re-runs it (ADR 0161).
A network fetch on entering a repository.
Restarting a client's server while it has work in flight; hand-off goes through I2127's session move.

Proven when

An enrolled, following node is on the version releases/latest.json names within one check interval of a release, with no person on it
A failed activation rolls back to the previous version by itself and the board names node, version and failed check
A client of version N+1 beside a server of version N at another path ends with one server of N+1 and no lost session
A wire or lease or journal schema change without a version bump fails version-surface
Each release archive carries an attestation that verifies for this repository

objects.get0 msAPI/api/v1/objectMCPmajordomus_gettechnical view

Milestone

One milestone of the plan: what it holds, what can start, and what it waits for.

safe-self-update · order 144 · p0

Every mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked

activeClose

Done: 2 of 7
Ready now: I2720I2723
Blocked: 3
Waits for: none
Blocked by: none
Unblocks: none
Serves: none

Critical path

Issues

Issue	Status	Priority	Wave	Blocked by
I2163A client never attaches to a server of another version without saying so, and a newer client replaces an older server	done	p1	1	none
I2165A released archive carries a provenance attestation the installer can check	done	p1	0	none
I2720majordomus self update re-runs the published installer, and never reimplements it	ready	p0	0	none
I2721An enrolled mesh node follows the stable pointer by itself	blocked	p0	1	`I2720`
I2722A hub activates a new version under its service manager, checks its health and rolls back by itself	blocked	p0	1	`I2720`
I2723The mesh shows each node's version and how far a release has rolled out	ready	p1	0	none
I2724A node without a route to the site takes the archive from a peer and still verifies it itself	blocked	p1	1	`I2720`

plan.roadmap0 msAPI/api/v1/plan/roadmapMCPmajordomus_plan_roadmaptechnical view

plan.issues0 msAPI/api/v1/plan/issuesMCPmajordomus_plan_issuestechnical view

Milestones

Every milestone, in the plan's order; the plan declares no dates, so none are drawn.

Milestone	State	Issues done
M000Milestone and DAG driven development	done	15 of 15
M001A blocking question survives a handover	done	4 of 4
M002A durable record names the worker that wrote it	active	1 of 4
M003A session is a durable envelope, and knowledge is compiled from what is already canonical	active	11 of 16
M004Performance is executable evidence, and the hot path does no canonical work twice	active	16 of 38
foundationA supervisory control layer that is real rather than described	done	0 of 0
fly-deploymentThe container image is a projection of the repository model, and its smoke is its evidence	active	4 of 32
web-sign-inThe deployed surfaces know who is asking, and the identity providers are data	planned	0 of 8
capability-graphOne capability graph, two projections, and no second inventory of what this repository can do	active	9 of 32
external-workspacesAn external workspace is read the way this repository reads anything else, and its content never becomes public by accident	active	1 of 10
two-folder-integrationA repository that adopts Majordomus gains two directories and two lines, and can give them back	active	0 of 23
derived-data-integrityA committed derivation describes something it can be a projection of	verify	1 of 1
work-graph-githubThe projection to GitHub is gated, identified and traversable, and a merged pull request leads back to the outcome it served	verify	10 of 10
intent-lifecycleWork is traceable to the intent it serves, and an intent is satisfied only by evidence	planned	0 of 2
development-runtimeThe runtime has a development surface	active	38 of 70
test-evidenceEvery verifiable claim and widget resolves to revision-bound test evidence, on every surface	active	12 of 28
public-proofA visitor sees the product prove itself, and can check every claim it makes	active	1 of 2
adopter-upgradesAn adopting repository survives a Majordomus upgrade, and what the tool vendors into it is adopter-neutral	active	10 of 17
a-second-adopter-is-servedA second adopter is served: what a foreign repository met on its first day is fixed in the tool	active	0 of 1
a-session-leaves-what-it-observedA session leaves what it observed, and the repository routes it	done	3 of 3
automationRepository automation is scripted capabilities over typed Rust, not shell	active	2 of 5
runtime-trustA runtime is safe to reach from another machine, and joining the mesh trusts nobody by accident	active	5 of 9
runtime-lifecycleOne usable server per checkout starts, attaches, stops and reports its state without races or hidden kills	active	5 of 8
mesh-journal-convergesThe cooperation journal is durable, converges under any delivery order, and never lets a stale claim win	active	2 of 5
mcp-transports-are-reliableEvery MCP transport delivers each request at most once, bounds what it carries, and honours cancellation	verify	2 of 2
surfaces-never-disagreeEvery surface projects the same state, says when it was observed, and keeps no list of its own	active	1 of 6
failure-is-visibleEvery failure the runtime can suffer is bounded, tested or stated, and changes the health it reports	active	3 of 4
architecture-is-enforcedA violated invariant fails a gate, and green means every required check ran	active	2 of 3
safe-self-updateEvery mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked	active	2 of 7
every-session-joins-the-meshEvery LLM session joins the Majordomus mesh at start, told the mesh as work	planned	0 of 4
truthful-plan-surfacesThe plan's surfaces are inferred from delivery, and nothing they show is typed beside the repository	active	0 of 9
idd-workspaceThe UI is where the owner directs the work, from an intent to its next move	active	0 of 1
everything-is-followed-in-one-streamEverything that happens in the repository is followed in one stream	active	1 of 8
the-mesh-works-out-of-the-boxThe mesh works out of the box: trusted machines find each other by every means and their sessions cooperate from the first turn	planned	0 of 6
runtime-adaptersProfiles become runtime constraints rather than advice	planned	0 of 6
intent-planningThe plan of an intent is held to it before execution	blocked	0 of 2
execution-telemetryExecution telemetry, only from providers that expose it honestly	blocked	0 of 5
intent-bound-workA task is bound to the intent it serves	blocked	0 of 5
cost-per-accepted-outcomeCost per accepted outcome, only on measured data	blocked	0 of 4
routing-recommendationsRouting recommendations derived from measured cost	blocked	0 of 4
shared-policyShared policy across repositories and workers	blocked	0 of 5

plan.roadmap0 msAPI/api/v1/plan/roadmapMCPmajordomus_plan_roadmaptechnical view

Intents

What the work is for, and whether the evidence says it is met.

Intent	Stage	Verdict
a-session-leaves-what-it-observedEvery managed session leaves what it observed, and the repository groups and routes it without being asked	satisfied	satisfied
intent-bound-workWork starts bound to the intent it serves, and a worker resumes knowing whether that intent moved	planned	satisfied
intent-lifecycleEvery change can be traced to the intent it serves, and an intent reads satisfied only when evidence says so	planned	unknown
intent-planningThe plan of an intent is checked against it before execution, from a recorded gap and a recorded critique	planned	satisfied
the-owner-directs-work-from-the-uiThe owner directs the repository's development from the UI, from an intent to the move that starts its next issue	executing	satisfied

intents.list264 msAPI/api/v1/intentsCLImajordomus intent listMCPmajordomus_intentstechnical view

Issues by status

Every issue of the plan, counted by the plan.

View all

424issues

active1
blocked159
cancelled10
done161
ready86
verify7

plan.status0 msAPI/api/v1/plan/statusMCPmajordomus_plan_statustechnical view

Dependencies

Which milestone waits for which, as the plan records it.

Milestone	Depends on	Blocked by
runtime-adapters	foundation
intent-planning	intent-lifecycle	intent-lifecycle
execution-telemetry	runtime-adapters	runtime-adapters
intent-bound-work	intent-planning	intent-planning
cost-per-accepted-outcome	execution-telemetry	execution-telemetry
routing-recommendations	cost-per-accepted-outcome	cost-per-accepted-outcome
shared-policy	routing-recommendations	routing-recommendations

plan.roadmap0 msAPI/api/v1/plan/roadmapMCPmajordomus_plan_roadmaptechnical view