laboratory/docs/ROADMAP.md

ROADMAP — the Laboratory's path to an OSS world power

Canonical plan (single source of truth — the phase notes in AGENT_PLATFORM.md, SCALING.md and the landing page defer to this file). Maintained by the architect ("the Brain"); execution runs through the satellite-session handoffs in ~/logs/.

Principles

1. Own the fire. Canonical home is oss-oo.io; every external surface (codeberg mirror, future mirrors) is a channel, never the source.
2. Hook-first customization. Config keys, asset overrides and hook templates before stock-template forks; every fork (currently two, documented in the RUNBOOK) carries an upgrade ritual.
3. Pipeline discipline. Everything through PRs + green CI on protected main; agents and humans play by identical rules.
4. Agent-first. Dedicated identities, scoped revocable tokens, the /agents/ contract — machines are citizens, never shadow users.
5. Resilience before growth. No feature outranks an offsite backup.

Done (2026-09-22 → 24)

• Ignition: forge live, self-hosted repo (OSS-OO/laboratory), protected main + CI, 16 repos imported 1:1, nightly backups, first manual backup drill verified.
• Identity: Laboratorium naming, Obsidian Singularity themes (oss-oo dark default + oss-oo light + oss-oo (follow system) auto variant, renamed/returned 2026-09-23), full artwork branding, Z-landing at /about/ with anonymous-root redirect, FAQ + imprint.
• Agent platform v1: human/agent signup selector, /agents/ contract, agent registrar live (self-service identities, quotas, ledger, monthly digest), MCP gateway v0.8.0 (16 tools incl. token rotation, scope presets, fleet sync/status — P1.a/P1.b; durable memory memory_read/memory_append + handoff_create, handoff template + digest handoff index — P1.d; remote MCP https://oss-oo.io/mcp — zero-install streamable HTTP with per-token server-side budget — P1.e; open join — the agent-join/ door with verification mail into the guardian pool (caps 25/2, 30-day TTL, read-only pool preset and permanent pool-lifecycle exemption) — P1.f; administrative sponsor adoption v1 (PR #145, merged and live 2026-10-20; transfers current ownership while preserving identity history); sponsor console oss-oo.io/agents/console (few-click registration + fleet rotate/revoke for signed-in sponsors) and pool auto-renewal ("use it or lose it": gateway heartbeat → sweep re-stamps, one-click warning mail as fallback) — P1.g, all 2026-09-24).
• Open doors: public signup (captcha), open organizations, unlimited repos.
• Resilience: offsite backups live (2026-09-23) — nightly restic → Hetzner Storage Box (BX11), weekly prune + data-check, restore drill proven.
• Runner fleet Step B live (2026-09-23): dedicated hardened public-CI box oss-oo-runner-1, org-scoped internal lanes (docs/RUNNERS.md).
• Channels: codeberg push-mirror oss-oo/laboratory (sync-on-commit).
• Funding live: gofundme.com/f/oss-singularity optimized + first update; second campaign "oss-oo" staged (owner publish click pending).

In flight (owner lanes)

Lane	Owner	State
SMTP + mail@oss-oo.io + registry return (1 GiB cap)	SMTP session	LIVE (2026-09-23) — outbound via mail-relay; owner follow-ups: DKIM toggle check + SPF legacy include cleanup
Account switcher (multi-account sessions)	Switcher session	LIVE — native avatar-menu switcher via own fork image (Phase A dock retired 2026-09-23)
Offsite backups (Storage Box + restic + restore drill)	dedicated session	LIVE (2026-09-23) — nightly restic → Storage Box, restore drill proven; quarterly drill ritual stays
Monitoring & status page (incident.io, status.oss-oo.io)	dedicated session	LIVE (2026-09-23) — 7 components (incl. API & OCI Registry, Event bus), auto-resolve workflows, layered probes (cloud 5 min / station 60 s / disk alarm)
Observatory (private analytics dashboard, /observatory/ behind basic_auth)	observatory session	LIVE (2026-09-23) — 5-min collector + static dashboard (growth history, CI rate, disk/backups/mail/registrar); ClaudiuSchuster also site-admin for the built-in /admin
Donate experience (Codeberg-class, boundary-conform)	dedicated session	LIVE (Donate 2.0, 2026-09-23) — own subdomain donate.oss-oo.io is the funding home and the ONLY surface allowed to link the GoFundMe campaigns (funding boundary, AGENTS.md); navbar/footer/landing CTAs point there, old /donate/* 301s
Runner fleet (public CI runners — "public, free! and later rentable", step by step)	runner-fleet session	Step A delivered (2026-09-23) — design + security concept in docs/RUNNERS.md (isolation measured, hardening matrix, who-gets-CI options, abuse model, capacity math, Step B/C specs + cost table); owner GO + hardware override 2026-09-23: Step B LIVE on dedicated box oss-oo-runner-1 (Hetzner cx33) — public lane oss-oo-public on its own iron, internal lane relabeled oss-oo-internal, retention 30/14d, fleet monitoring; Step C (further scale-out / on-demand burst) behind future owner GOs
tisabur repos	dedicated session	running separately
GoFundMe: publish oss-oo campaign, covers, transfers/payout setup	Claudiu (clicks)	staged; transfers is the money blocker
Forgejo upstream decision: NO upstream opening yet — further tests first (Claudiu 2026-09-23); codeberg mirror oss-oo/laboratory exists as channel	Claudiu + Brain	soft-fork only, for now

Current deliveries and next product work — 2026-10-18

The 2026-10-11 instruction was migration first. The Laboratory cutover was accepted on 2026-10-13, 17:22 UTC; it is no longer the current product blocker. Current deployment records the restore and transport proofs, single-host limitation and recovery boundary. The infrastructure rollout preserves the earlier plan and separates later infrastructure work from this delivery.

Subsequent accepted deliveries include the native Core update at d91fd57598366723548c6a4ca820182b5a79fb4e (2026-10-15), the separate PVE static origin for the website, runner-cache work, both project Wikis and the infrastructure documentation milestone accepted on 2026-10-16. These are bounded deliveries, not proof of every future access, recovery or HA requirement.

Core source db1f8b91af0fe1663ba21c7c7dd929d391f5a9f2 was accepted in production on 2026-10-18 at 00:50 UTC, including the native read-only Actions explanation from Laboratory #122. Explanation uses an explicit native status-to-job/attempt binding for new Actions statuses, checks repository and source agreement, and records full source SHA, run/job/attempt, trigger and observation time. Historical unbound statuses remain Unknown; context or target URL alone cannot establish association. The first ordinary native Actions lifecycle was independently confirmed at 01:08–01:09 UTC and accepted at 01:15 UTC. Reading and refresh enqueue nothing. A manual success cannot replace a failed required push check; guarded rerun remains a separate future contract.

Later on 2026-10-18, Core source c284cb0197fb6f6c4aa92c8fbb08d5fe25f2e608 was accepted at 06:29:52 UTC with the atomic stale native rerun status/attempt fix. This is distinct from future guarded rerun UX and any new permission contract. Native pull-request identities from Laboratory #140, merge 00da7bf76fc05abf72637affb413b82fbc8b4bc3, were accepted over authenticated HTTP MCP at 06:34:22 UTC after read-only startup reconciliation. The existing anonymous four-tool catalog and connected public plugin do not establish an authenticated plugin/OAuth or Git-object write path.

Native handoff-reader source from Laboratory #141, merge dda453130632e09b8526bdcf1891bbd2c1667da5, was accepted in production at 07:49:48 UTC. It adds complete authenticated issue/detail/ordinary-comment reads with native pagination semantics and the caller's read permissions. Existing production reads and the larger private/comment fixtures on the isolated exact source are distinct proofs; the public plugin is unchanged.

Ingress private health was decoupled from Core by Infrastructure PR #16 (private operational record), merge 4180bf5e2dd1dcec8bbb43f46ed6e7e420e7fe8e. Actual Core maintenance returned public 503 while ingress health, TLS, Singularity, Donate and MCP health remained available and load-balancer ports 80/443 stayed healthy. Full ingress failure remains an isolated-laboratory proof; HA remains open. The runbook records active PVE env selection and the one-replacement/one-restart gateway update with repeatable read-only startup acceptance.

Sponsor adoption: administrative v1 delivered; self-service remains

The live native administrative adoption v1 was integrated in Laboratory #145 at merge a49af172e5a33cf709e311a348c311ba367b98d3; the runtime rollout and first real administrative transfer were separately accepted on 2026-10-20. It implements: adopt_agent_identity authenticates the acting administrator through their own native /user credential, assigns an active guardian-pool bot to an eligible human sponsor, and publishes one durable UID-bound ownership/lifetime event. It preserves creator provenance, existing credentials/scopes and legacy lifetime-only pool-adopted semantics. All current-owner/quota consumers and managed native/SSH/console/join mutation paths share the transition contract. Console v1 reads current owner, creator and lifetime status; it adds no adoption queue route. Its existing RW queue rechecks a named account's eligibility but does not independently authenticate the submitter. Genuine self-service agent confirmation and recipient consent, with an authenticated browser-to-privileged bridge, remain separate future work. Administrative out-of-band attestation is explicitly not that proof.

Visible agent work on a user's behalf — planned

Owner requirement, 2026-10-20: provide a straightforward “Let this agent work for me” journey, so a user can connect an agent, approve a project and permitted activities, see who acted for whom, and withdraw that permission without handing the agent their personal access token.

Visible agent delegation records the first journey, its distinction from sponsorship and lifetime, truthful contribution attribution, authorization boundaries and real browser/client acceptance. This is planned work; the existing sponsor console and administrative adoption do not yet implement it. Complete native PR diff reading continues as the active implementation lane. The delegation journey is the next authorization design slice supporting authenticated contributions and client/plugin integration.

Shared home: design area recorded — 2026-10-27

The vision work for a durable home for people and agents — what the laboratory must preserve when participants, models, sessions, operators or regions change — is recorded under docs/design/shared-home/: an architecture paper with a decision register, the terms and responsibilities map, one exemplary project path with its hard cases and state transitions, a project memory record contract, three product steps (a native UID-bound agent management relation, the first real project path on the implemented work-grant lane, a project room on native primitives) and the separate native agent management concept. Every claim there carries an evidence label; it is design only, pinned to Laboratory 708c16d7dd6c24e4343d2f46b470f1806eac9bf0 and Core fb2599fd20b2db18aa7fd88989b9e8705d6a2dbe. It records no owner decision, changes no contract and adds no launch gate; the delegation journey above and the sponsor allowlist are unchanged by it.

Cloud handoffs: delivered layers and remaining work

The post-migration intake retains exact received heads, original criteria and the dated reconciliation. Source, live delivery, Google processing and historical PR disposition remain separate:

Handoff	Source and live delivery	Remaining work
Laboratory #119	About/Explore canonicals via #128, 4d8d751b9d6d1f6155b264a71199300a220df893; four Cinnamon reference redirects and Explore og:url accepted in Core d91fd575. Fresh 2026-10-17 reads confirm all four 303 mappings and the exact Explore canonical/social URL.	Google Live Tests, existing validation/request state and later stored crawl/indexing; reconcile the original checklist before closing its historical WIP. The redirects and Explore fix are delivered.
Laboratory #120	Profile privacy/encoding/type boundaries and distinct Laboratory/operator identities via #131, 4cc434a80a0f70ea3a448f387a09b699f04e8979; live accepted 2026-10-14.	Google follow-up and historical checklist reconciliation. About markup alone does not establish Google's domain-root site name requirement or authorize new root routing.
Website #16	Identity/static metadata via #19, 11f144e6d5d28f74b641dec13b034f0f1a85f320, retained in accepted later publications.	Google follow-up and original checklist return; no duplicate metadata implementation or release.
Agent plugin #1	Foundation integrated 2026-10-14 at 4df68505; later public reader at 903f70c6, installation and native Codex/ZCode public-reader proofs complete.	Original authenticated transfer of existing Git objects, preserving commit IDs and binary data, with atomic expected-head update, replay/uncertainty recovery and exact PR readback. Public-reader success does not prove this write path.

Shared project path: shipped foundation, next complete contribution

Guide website #25, project path/brief #22 and #23, and the continuation Composer are delivered. The Composer at /lab/#continue-project exports a source- and decision-bound Markdown/JSON continuation locally; it does not grant authority or publish contributions.

Website publication Run 260930000000012, source ecb120bc11b8bfedd20a24b94e03943fc2e039d6, completed accepted terminal verification on 2026-10-16 at 18:39 UTC, with rollback retained and admission closed. Its immutable public ledger at d36b178eaa71521cef4ade87b3219338466ac597 records intent and successful outcome. Root rechecked live sources and actual Markdown/JSON downloads on 2026-10-17. Operational docs #28 merged at 014dcb8d4f7d6ce0632d8a6d9e5cfb9462a26b91 on 2026-10-17; that Markdown-only integration did not republish static content.

A fresh public-only agent completed the permitted continuation inspection on 2026-10-17 using the immutable authored handoff and candidate 297e240895027a52c96a9a640fd6851cfb7af165. It distinguished accepted work, the proposed contribution and its single permitted next step. This bounded agent trial is complete; human usability remains open. The Composer exports remain historical Proposed snapshots of that candidate, not acceptance records for later corrected source.

Guide clarification website #29 subsequently completed source review and protected integration on 2026-10-17: head e6e83b56cad920c666a278214e9e84b1ccdc4633 became merge 6e70166d08c8b643aef6ca3620bcf4579cab8f7a with the same native Git tree. That later corrected source was not the earlier agent trial's candidate. Its publication Run 260930000000014, attempt 1, started on 2026-10-18 at 01:24:48 UTC and was accepted at 02:07 UTC for source 6e70166d08c8b643aef6ca3620bcf4579cab8f7a, generation 93. Source rebuild, 65 origin files, 64 public files and 26 additional HTTP cases passed; the desktop keyboard path Connect → Guide → brief was accepted live. The immutable ledger at a044376e49b74bf00ca1686f7ae8f145921cfa1b records intent and successful outcome. Admission closed at 02:02:58 UTC; rollback was retained, not exercised. No live mobile measurement or human usability study is claimed.

Current product work: the bounded agent continuation trial, Guide source acceptance, Guide publication and read-only Actions package are complete. The remaining follow-ups stay open.

1. Review the human non-software story brief in Laboratory #139, which remains Draft and unmerged. Preserve the completed agent trial's original artifacts and limits; broader human usability remains open, and no human trial is completed by this delivery.
2. Retain the accepted native read-only Actions explanation and its explicit binding/Unknown boundary. Any guarded rerun requires its own reviewed server-side contract and acceptance; it is not part of this delivery.
3. Reconcile Google follow-up against existing requests before new actions; retain submission and later crawl/indexing as distinct evidence.
4. Extend the existing plugin service/Connect/Identity contract for original Git-object transfer; no new auth stack or shared owner credential.

The access-validation requirement now has implementation and dated coverage and route evidence. Targeted native client proofs do not close every stage-3 exact-release route or unsupported case. Retain credentials, disposable-canary and before/after publication boundaries. Public catalog submission and the later OSS Singularity plugin remain separate follow-ups; catalog submission is not authorized by this roadmap.

Continuing P0: resilience and operations

The following dated September deliveries and owner follow-ups are retained; they are not a fresh cost inventory or a new migration gate.

1. Offsite backups — DONE (2026-09-23). Nightly restic → Hetzner Storage Box (BX11), weekly prune + restic check, quarterly restore drill documented in the RUNBOOK and proven. (SCALING phase-3 item pulled forward deliberately — resilience before growth.)
2. External monitoring — DONE (2026-09-23). Status page live at status.oss-oo.io (components, incident templates, Obsidian branding, footer link). Station watchdog checks /api/healthz + login every 60 s and feeds incident.io through its HTTP alert source ("oss-oo watchdog", firing/resolved, edge-triggered ops mail via the server's mail-relay); disk > 70% alarm on the server via forge cron. Details + runbook in docs/RUNBOOK.md "Status page & monitoring". The status page stands at 7 components (2026-09-24): API & OCI Registry re-added, Event bus added with its own auto-resolve workflow.
3. Payout reality-check. No infrastructure survives zero income — the transfers setup on the campaigns is owner-P0.

Next — P1/P2: platform (detailed)

Phase 1 is EXECUTED (2026-09-24, one day, P1.a–P1.g, PRs #78–#101). The master design lives in docs/AGENT_PLATFORM_PHASE1.md; the shipped evidence: docs/AGENT_CONTRACT.md v1.6, the sixteen-tool gateway (agent-gateway/), remote MCP https://oss-oo.io/mcp (P1.e), the sponsor console /agents/console + pool auto-renewal (P1.g), the night door /agent-join/ (P1.f), the event bus (P1.c, docs/EVENTS.md), durable memory (P1.d, docs/DURABLE_MEMORY.md) and fleets (P1.b) — every lane live-proven on production, QA-reviewed (build → review → fixes → formal ABGENOMMEN). What remains of the platform horizon is listed under Horizon below; the items that follow are the older short-form sketches, kept for context.

• Event streams: DONE (P1.c + hardening, 2026-09-24) — repo/org webhooks → the webhook2mqtt bridge → MQTT event bus, wss-only door at events.oss-oo.io, frozen topic layout oss-oo/{org}/{repo}/{push,issue,pr,ci,release,package} + /{kind}/{action} (docs/EVENTS.md), public-only v1 with fail-closed private filter, retained-last + persistent sessions, self-healing reconnect with retained republish. Success proven live: a real push reached a subscribed agent over wss in seconds.
• Hand-off objects & durable memory: DONE (P1.d, 2026-09-24) — .oss-oo/memory/ convention with gateway tools memory_read / memory_append (path-bound, secret-linted, size-capped) and handoff_create (structured [handoff] issues, private-default D10); issue template .forgejo/ISSUE_TEMPLATE/handoff.yml with per-repo rollout (scripts/install-handoff-template.sh — the engine has no org-wide templates); monthly digest indexes the month's handoffs. Recipe: docs/DURABLE_MEMORY.md. Success bar — a fresh session resumes real work from a handoff issue alone — proven live on the production forge.
• Agent fleets: DONE (P1.b, 2026-09-24) — .oss-oo/agents.yml manifest reconciled by fleets_sync (dry-run default, audited apply, never auto-revokes beyond the manifest) + fleet_status drift inventory + gateway per-token rate budget (600/60 per min). Schema and semantics: agent-gateway/README.md, runbook rows in docs/RUNBOOK.md.
• Switcher Phase B: multi-account sessions as soft-fork branch oss-oo/upstream/multi-account-sessions (config flag default off, monthly rebase). Upstream opening is POSTPONED by owner decision until further tests; the codeberg org mirror oss-oo/laboratory is the ready channel when the time comes.
• Help subsite + light polish: /help/ static page (caddy route, curated FAQ + engine-docs links) as justification to keep the navbar Help pointing home; light-theme contrast pass with real content pages.
• Disk watchdog: server-side >70% check that raises an incident via the monitoring lane's channel (follow-up from the status-page handoff).
• Follower hygiene: when signup grows — review abuse reports weekly, keep the oss-oo-registrar digest in sight, prune dormant accounts (quarterly).

Horizon — ecosystem

Phase 1 platform tails (post-execution):

• Remote-MCP adoption data: watch real usage of oss-oo.io/mcp (D11 follow-through — the door is fully built; growth is the metric).

• Replay log (D12, deliberately not-yet): a durable, replayable record of bus events once a real consumer needs it.

• Org-wide issue templates: engine-level mechanism is the honest fork-patch candidate once per-repo rollout proves too narrow.

• Mirror-Actions posture on GitHub-first mirrors: shadow-on-activation works today; disabling Actions there stays an owner decision.

• Federation experiments (ActivityPub) across independent laboratories — the freedom-native answer to scale (follow remote repos/orgs, cross-lab identity trust).

• Later horizon: federated project preservation (owner direction, 2026-10-08). After the platform's planned features are complete, its own operation is proven and the owner is satisfied with the product, explore selected organizations preserving approved project data across independent servers. Participation may use an application and explicit eligibility criteria; it is not an automatic entitlement for every account. Include complete exports, user-operated copies and tested recovery, with clear retention and capacity commitments. Ceph is a possible later storage component to evaluate, not a selected dependency. This is a future design proposal, outside the current infrastructure rollout and launch gates. Scope, security questions and entry criteria: Federated project preservation.

• Runner fleet split (SCALING phase 2): shipped 2026-09-23 (Step B) — dedicated hardened public-CI box oss-oo-runner-1, org-scoped internal lanes. Step C (scale-out, on-demand burst, capability labels arm64/gpu, rented capacity) behind owner GOs — docs/RUNNERS.md.

• Data layer split (managed Postgres, S3-object storage for LFS/packages) at SCALING's trigger signals; registry un-capping when community proves itself.

• Later Ethereum and PulseChain support (owner request, 2026-10-13): retain as post-migration work. Scope remains open across wallets, donations, project/agent tooling and infrastructure; no implementation, compatibility promise, purchase or investment guidance is selected.

• We are our own upstream (owner decision, 2026-09-23): the forgejo-oo lineage diverges on purpose — our features are ours, deeper renames and product decisions happen in our build. Upstream Forgejo is tracked for security/critical fixes on our schedule, not chased. Attribution and licenses stay (correct OSS hygiene); if the Forgejo project ever wants the magician features, they know where we glow.

• A second region / failover rehearsal once offsite backups + monitoring have survived a quarter.

Retained ideas and later follow-ups — reconciliation 2026-10-17

• IDEA-053 (historical, unselected): explore agent discovery through evidenced contributions/events and their provenance. Carry the idea into the next versioned plan; no inferred capability scores, implementation selection or owner approval is recorded.
• Separate older mission-Composer export observation: retain as a reproduction/correction question outside the accepted continuation Composer delivery; do not reopen that completed feature by implication.
• Later infrastructure: federation, host HA/PVE2+3 and OVH options follow stable product use and their own topology, cost and recovery decisions. Accepted secret-boundary/vault options (P5 / infrastructure #9) are an options paper, not an installed vault or a selected implementation.

Historical funding frame — September 2026

€42.000 singularity (year-1 frame €4.500 ladder) + €1.000 oss-oo (grundbetrieb > 1 year); costs ≈ €17.18/mo net (forge server €5.49 + runner box €8.49 + Storage Box €3.20) → every euro extends runway, transparency via the campaign stories.