Roadmap

A rolling engineering roadmap in thematic workstreams across Now / Next / Later. Priorities, not dates.

The GitHub milestones mirror the Now tier and are the source of truth for what's actively in flight; everything below Now is directional and will churn. Canonical copy lives in ROADMAP.md.

Now

The open GitHub milestones — the source of truth for what’s in flight.

Agent-driven Tracker — next up

Let an agent (Claude Code first) install Tracker, run workflows for you and relay their human gates — no TTY needed.

Pause at a human gate: at a gate the run checkpoints and exits as a resumable paused terminal; tracker -r <run> --answer … resumes it, bound to the gate it answers. For agents, CI and scripts, and the base for an attention queue of waiting runs.
A Claude Code skill + install.md, shipped from this repo as a plugin in the 2389 marketplace: onboarding (install, then explain / quickfix), driving (run built-ins, relay gates, diagnose), authoring (.dip workflows to grade A).

1 · Trust & verification

#655 — converge the built-in build_product with the tracker-runner fork; the tracker side is done, the switch is runner-side.
#624 / #625 — adopt adversarial review (typed verdicts, deterministic false-positive gate) in the review loop.
#490 / #353 — verification costs about as much as implementation; dedup and cap the review fan-out.
#627 — Meta Muse models priced and reachable. #280 / #281 — writable_paths follow-ups. #714 — tool commands trust context a resumed checkpoint restores.

Parallel-first resilience

#420 — branch-scoped retry, context and fix-attempt counters, so branches retry and resume independently.

Transport boundary

#634 — human-gate artifacts as named attachments, gate status tokens, structured gate payloads.

2 · `.dip` language & engine expressiveness

#641 — a workflow-level progress narrator. #721 — route an unmatched freeform gate reply explicitly, not by lexical order.
#717 / #718 — subgraph token totals and run IDs. #726 — verify.sh cargo scoping. #722 — Gemini prepaid-credit exhaustion should pause.

3 · Library, CLI & refactor quality

#463 run-flag presets · #450 root-package seams · #395 duplication · #672 Windows port.

4 · Product & 1.0 readiness

#465 / #589 — the first scored SWE-bench Verified run, published.
#460 / #583 / #585 / #586 — naming and discoverability. #458 / #459 / #581 — show the TUI, lead with trust, a /trust page. #461 / #464 — Dippin adoption; research tooling. #638 — local Hugo.

Recently shipped

Workstreams that landed across v0.46.0 → v0.81.0. See the changelog for detail.

First win in five minutes v0.81.0

With Claude Code installed and no API key, tracker explain --param question="…" answers a question about your repo (read-only), and tracker quickfix --param change="…" makes one change on its own branch for you to approve, revise or reject (details). Underneath: backend: auto, a keyless start, tool_access: read_only, and a tracker doctor that checks the backends a pipeline needs (#716). Next: a Claude Code skill + install.md so Claude Code can set Tracker up and run these for you.

Transport boundary v0.46.0

The core is now fully UI-agnostic: TUI, Slack (trackerbot), and a terminal REPL (trackerchat) are first-class transport peers on one tracker.Config → Engine path, with a transport/conformance suite a new transport runs to prove correctness. Plus mid-run steering (Config.SteeringChan) and per-run cost estimate. Contract: Transports.

Embedding surface completeness v0.47.0

The event surface an out-of-process control plane drives Tracker through is complete: NDJSON StreamEvent payload parity with activity.jsonl and a lossless ActivityEntry reader, gate lifecycle events (#509) and turn_metrics attribution (#508), paused_billing as a first-class resumable RunManager.RunPaused state, submit-time variable-availability validation (#505), and a bounded/async event-handler seam.

Policy, hygiene & coherence v0.48.0

A fail-closed pre-execution tool-call guardrail hook (#506), an injectable diagnostic sink (#449, tracker.SetDiagnosticLogger), and gate identity on the interviewer callback (GateAware).

Coverage & API stability v0.49.0

Golden-trace fixtures pin the five previously-unverified handler/terminal contracts, and docs/api-stability.md plus an exported-surface golden snapshot (#462) guard the root tracker package against accidental signature change.

Run capture & cost correctness v0.50.0 – v0.52.0

A finished run is reconstructable from the executed spec + verbatim provider request bodies + per-call/turn/session identity + a run.json manifest (#519; tracker run-json backfills archived runs), with a batch of cost-accuracy fixes (provider-aware cache-write pricing, per-(provider,model) TokenTracker, failover pricing) and capture-file security hardening (0600 + O_NOFOLLOW, .tracker/ excluded from bundles). A library caller gets the same capture from the Config.Capture seam (#530). v0.52.0 shipped the unpriced/--max-cost signal (#518). The published-price provenance + drift guard that briefly lived in tracker has since moved to dippin as part of the pricing retirement below (#558) — tracker no longer maintains a price table.

Security-boundary docs & test-fidelity v0.53.0 – v0.54.0

The writable_paths jail gained its reference docs — Linux security primitives (#284), a 9-class reviewer audit checklist (#285), and the “freeze and prove” security-PR process pattern (#286), plus a Landlock ABI-v3 kernel-version correction. On the engine side, tracker verify-tests --race adds a Go race-detector fidelity gate (#489, partial; fuzzy heuristics split to #532), the no-progress detector now keys on workspace edits (#531), and the parallel fan-in join hint moved onto the typed Outcome.SuggestedNextNodes channel (#451).

Declared inputs, pricing source-of-truth & reliability hardening v0.55.0 – v0.60.1

Workflows can now declare a typed inputs signature (a dippin inputs block, dippin ≥ v0.51): the library introspects it (DescribeInputs), validates values with structured per-input errors (ValidateInputs), and binds them at run start (Config.Inputs) — a missing required input fails closed before any node runs instead of the agent inventing work (#553). File and secret inputs are staged to a 0600 file under .tracker/inputs/ and ${inputs.<name>} resolves to the path only, so a secret never enters a prompt, the provider wire, the trace, or the checkpoint (#555); build_product takes its spec this way, so a host can drive the flagship build headlessly. LLM prices are now sourced from dippin-lang/pricing — tracker retired its own price table (#558). Plus a batch of reliability fixes clients hit hardest: RunManager.Cancel unblocks a parked webhook gate and workdir isolation no longer collides on sanitized keys (#551/#552), server Retry-After is honored on 429 retries (#549), a pipe-to-shell denylist bypass was closed (#554), and the checkpoint temp write is O_NOFOLLOW-hardened (#559, partial).

Adversarial Review v0.73.0

A reusable read-only adversarial code-review subgraph (epic #625): three independent perspectives over a frozen diff in parallel, a typed-verdict critic audit, a bounded re-review loop over contested findings, and a deterministic false-positive gate emitting ctx.review_verdict (approve/rework) — fail-closed at the approval boundary.

build_product hardening & engine failure semantics v0.74.0

The three shipped pipelines are decomposed into prompt_file: / command_file: sidecars (#398) with fixture suites beside every script, and build_product converged with tracker-runner’s fork (epic #655, bug list #640, siblings #646): EnsureEnv seed bootstrap, a deny-by-default test oracle (verify.sh exit 3 not-yet-verifiable, positive executed-test count), advisory language-native lint, per-milestone contract tests, and fail-closed unattended paths (AbortRun, EscalateVerification, every abandon ends the run fail). The engine batch #642–#654 makes failure routing match dippin’s documented order: one-shot fallback latch, per-iteration restart budgets, routable tool timeouts, AST-serialized conditions, else ->, fail-routing provenance and a resume that rewinds past a fail-closed dead end. writable_paths_mode: prefer (#648) lets a hardened node degrade to a loud, recorded unjailed run where Landlock is absent.

Runner convergence closeout v0.75.0

The last tracker-side gaps for epic #655: tracker.ParseSource parses a built-in into a graph with its embedded sidecars resolved, so an embedder can mutate the graph before NewEngineFromGraph (runner #906), and verify.sh scopes cargo test to the crates a milestone changed (runner #901). The dippin v0.75.0 / v0.76.0 pins retire the four stopgaps filed in v0.74.0 and restore hint-severity diagnostics on the CLI load path.

Env-trust & credential-boundary hardening v0.77.0 – v0.79.0

Commands Tracker runs on the model’s behalf — tool nodes, the native bash tool, verify commands, ACP terminal commands and the engine’s git subprocesses — share one credential filter, exec.CommandEnv, which strips credential names and, since v0.79.0, credential-bearing values: a URL with a password, an http(s) URL with userinfo, a Docker auths blob (#679). A project .env may set provider *_API_KEYs only, with every env var registered in internal/envpolicy and tracker doctor reporting provenance (#659). The claude-code backend strips each provider key’s base URL with it (#677), and a claude-code node on the default bypassPermissions, with no tool_access or disallowed_tools, now fails when Claude Code refuses its tool calls instead of reporting success (#676). Still open: unifying the TRACKER_PASS_* / TRACKER_STRIP_ACP_KEYS switches and the full GOOS=windows build (#672).

ChatGPT-subscription auth v0.80.0 – v0.80.1

openai nodes can bill a signed-in ChatGPT plan instead of an API key, for one person’s own account on their own machine. tracker setup signs in through Codex’s OAuth device-code flow and sets TRACKER_OPENAI_AUTH=chatgpt; the native backend then sends openai requests to ChatGPT’s Codex backend as originator: tracker, labels the usage openai-subscription at $0, and pauses in the resumable paused_billing state at the plan’s usage limit. trackerbot refuses the mode. --autopilot-model (#699) points autopilot at a model the plan serves. v0.80.1 closed the follow-ups: #700, #701, #702.

Directional. Expected to promote to Now as the milestones above close.

Competitive-analysis sub-projects 3–5

An issue → PR built-in: take a GitHub issue to a reviewed branch and a pull request, building on quickfix’s worktree and gate.
An attention queue: the runs waiting on you (paused at a gate or on billing, or failed) in one list, with notifications; pause-at-gate (Now) is its base.
Runtime for_each fan-out: fan a node out over a list produced at run time.

Later

Backlog. Real, but not scheduled.

Sandbox breadth

#279 — rescope overrideAlreadyRecorded to checkpoint generation.
#280 — file-scoped Bash enforcement for writable_paths.
#281 — per-OS enforcement on macOS (Sandbox) / FreeBSD (Capsicum).

Security documentation & process

#284 — Linux security primitives reference doc.
#285 — 9-class audit checklist for writable_paths changes.
#286 — "freeze and prove" pattern for security PRs.

Structural & cosmetic refactors

#395 — collapse pervasive near-identical duplication (engine emits, llm adapters).
#398 — shipped (v0.74.0): every shipped built-in is decomposed into prompt_file: / command_file: sidecars with fixture suites; embedded built-ins resolve them from the binary’s embed FS.
#452 — write_enriched_sprint.go (1,250 lines) is a domain workflow embedded in agent/.
#453 — split the 1,687-line tracker_doctor.go into unit-testable checks.
#454 — group handler-specific Outcome fields into sub-structs.
#455 — repo hygiene sweep.

Product & positioning

#460 — naming & discoverability: "tracker" is ungoogleable.
#461 — Dippin adoption path: editor support, pipeline gallery.
#463 — run-flag surface (~36 flags) needs presets / progressive disclosure.
#464 — tracker-swebench + tracker-conformance in-repo read as research clutter.

The 1.0 question

#462 — API stability policy shipped (docs/api-stability.md + exported-surface golden snapshot). Remaining for v1.0: the actual no-breaking-changes commitment, benchmark cadence, and extending the surface snapshot to the supported sub-package types.