Roadmap¶
What runs, what is next, and what is research. Dated 25 August 2026; the further down the page, the less certain the timing.
Status vocabulary, used across these docs:
| Marker | Means |
|---|---|
| Plain prose | Runs today |
| Planned | Designed and specified, awaiting implementation |
| Research | Part of the Software Health Control Plane proposal: funded work with partners, uncommitted here |
Shipped¶
The closed loop, and the chassis under it.
| 0.1.0 | Beta: four forge adapters, dashboard, reports, AI summaries, trends, webhook machinery, OpenAPI, Docker |
| 0.2.0 | The loop closed: a sync now scores, evaluates rules and dispatches signed events. Codeberg in the UI. Migrations became the schema authority |
| 0.3.0 | Three extension points: evidence sources, scorers, rule evaluators. The evidence store |
| 0.4.0 | Reference plugins: CycloneDX SBOMs, OSV advisories, a dependency-exposure scorer, an actuation subscriber |
| 0.5.0 | Commits record when they landed as well as when they were written, so every activity window counts work in the week it arrived |
Next¶
Ordered by what unblocks the most.
Messaging destinations¶
Planned
Alerts and report notifications to Slack, Discord, Teams, Mattermost, Matrix, Telegram, XMPP and generic webhooks, through Apprise: one dispatcher, many sinks.
The shape follows from the architecture. A dispatcher subscribes to the signed webhook bus, which makes it a plugin like everything else domain-shaped. Per-account channels, encrypted at rest, with a send-test.
SourceHut and Codeberg in the UI¶
Planned
Codeberg is selectable today. SourceHut is API-only, because its adapter is user-centric and "add an organization" does not fit its model. Both want OAuth, and both are token and public-API only until then.
Per-account alert thresholds¶
Planned
The six rules use sensible compiled-in defaults. Making them configurable is a settings surface over an existing mechanism.
Onboarding¶
Planned
Signup, OAuth and first sync all work, and a new user stitches them together by hand. A guided flow (connect a platform, pick organizations, choose a digest) is the difference between working and usable.
The commercial half¶
Planned
Tier quota enforcement, billing, team invitations, an audit log, and an /api/v1/ prefix before anyone builds against the API in anger. None of it is hard, and all of it is unbuilt.
Research¶
The Software Health Control Plane is a proposal to build a supply-chain health control plane with a consortium of partners. Ospobox is offered as the running chassis it lands in: the layers below replace or extend what ships today, and each is owned by the partner best placed to build it.
None of this is committed work on this repository. The interfaces that would receive it already exist, and knowing where a system is headed changes how you read what it does now.
A verifiable evidence graph¶
Research
Relationships as first-class edges, signature chains over records, verification, and a post-quantum archival tier. The append-only table shipping today is the floor under this: it keeps facts and hashes them, and it cannot express that one fact is about another.
A seven-dimension health model¶
Research
Replacing the composite outright with dimensions that declare the evidence they need and abstain when it is absent. Today's composite scores a zero there, and calls every SourceHut repository unhealthy on that basis.
The chassis already requires what such a model needs: every component explains itself, in its own units, rendered verbatim.
Policy as code¶
Research
Verdicts (hold, quarantine, patch, roll back) evaluated against evidence and carrying their reasoning. Alerts remain the currency on the bus, so subscribers written today keep working.
Actuation across a fleet¶
Research
Subscribers that hold a deployment, decline to resolve a package, or open a remediation path, with the evidence trail behind each decision one click away.
Two spikes¶
Research
A retrospective run of the xz-utils compromise against the model, to see what would have been visible and when. And a cryptographic inventory of a real fleet, to see what the evidence store makes cheap that is expensive today.
Deliberately not doing¶
Four choices and the reasoning behind them:
- Fixing the SourceHut score cap by special-casing thresholds. The cap is instructive, and the answer to it is a model whose components abstain. A fudge factor would hide the argument.
- Copying activity into the evidence store. Commits, PRs and issues have tables, indexes and queries. Duplicating them as JSON would double every write for nothing.
- A policy language before there is policy. The rule evaluators carry the current need. A language would be a solution looking for its problem.
- Response caching. Unnecessary at current scale, and a cache is a correctness liability until it earns its place.