Roadmap

Summary page

This page summarises ROADMAP.md in the platform repository, which is the source of truth and is tracked as GitHub milestones and issues. It is shorter and can lag behind; if the two differ, the platform repository wins.

0.1 – Core (tagged v0.1.0 on 2026-10-04; built from source, release images follow with 0.2)

Version 0.1.0 is a Git tag. There is no GitHub release object and no published release image yet; build and run it from source with Docker Compose.

• Control node: API (Fastify, OpenAPI 3.1), PostgreSQL, run queue, console (React), OIDC/LDAP sign-in, RBAC with six roles, API tokens.
• Agents as code: agents.md parser and validator, immutable published versions, pipelines of 1..n agents.
• Events: signed webhooks, Kafka, cron, mail-in via webhook; Teams and Slack through generic webhooks.
• Guardrails: per-agent audit gate, global control agent, approvals, data classification.
• Audit: append-only SHA-256 hash chain with Ed25519-signed checkpoints and verification.
• Costs: per step and run, price table, budgets with hard stop.
• Providers: OpenAI-compatible (for example Azure OpenAI, OpenRouter, vLLM; not yet verified with real accounts), Ollama, AWS Bedrock (VPC endpoint, proxy, IRSA), Anthropic, simulated.
• MCP: client with per-agent allowlists, timeouts and result limits; the policy gate as an MCP proxy.
• Runners: in-process and local (oax CLI), with the interfaces for all later runners.
• Observability: Prometheus metrics, OpenTelemetry traces, JSON logs, health endpoints.
• Cost attribution: per agent, use case and run, with CSV/JSON export.
• Delivery: Docker Compose (built from source), a Helm chart for Kubernetes and EKS (images not yet published), this website and docs.

Also in 0.1, with full docs

• Change-gated schedules with HTTP and file probes (details).
• Development guidelines with deterministic hardening review (details).
• Dark software factory mode, opt-in, with a fixed notice (details).

0.2 – Next release

Merged on main, not released yet:

• Tenants and access: tenants as the isolation boundary, roles per tenant and optionally per agent (details).
• Bring your own: provider keys by reference and a model catalog from a pinned models.dev snapshot (details); MCP servers per tenant.
• Budgets and air gap: monthly budgets per tenant and use case with hard stop and alerts as events; a fail-closed air-gapped switch.
• Typed handovers and conditional steps: schema-validated outputs and when expressions.
• Tool profiles: named read/write profiles per MCP server.
• Agent Check and Agent Plan: advisory, least-privilege decomposition with linting.
• Harnesses: Claude Code behind the policy gate, verified with real runs (in-process, 2026-10-04). Harness steps in an isolated run node go through the model proxy (off by default); that path is implemented, but its real-run verification is pending. The OpenCode adapter is implemented and tested against a fake CLI; verification with the real binary is pending.
• Kubernetes Job runner (building block): one Job per step with a NetworkPolicy. It is not wired into the platform yet.
• Container runner and credential broker: one short-lived, hardened container per isolated step that receives only its own credentials, revoked when the step ends. On main, opt-in (OAX_CONTAINER_*), ships with 0.2. Hardening follow-ups are tracked in the platform repository.
• Guided demo tour for the public demo at demo.openagentix.si (fake data, simulated model).

Still planned for 0.2 (not built):

• More change-gate probes: API responses with secrets, SQL queries, MCP reads. Today only HTTP and file probes exist.
• Toolbox images from a catalogue: minimal, non-root, read-only, pinned by digest, signed (cosign), with SBOM (syft) and vulnerability scans (trivy); egress allowlisted per toolbox.
• Publishing the API image on GHCR and a GitHub release, then the Helm install test.

0.3 – Enterprise integration

• AWS Lambda, GitHub Actions and GitLab CI runners with signed callbacks.
• Optional external harnesses Hermes and OpenClaw (Claude Code and OpenCode: see 0.2), all routed through the policy gate.
• Dedicated Slack and Teams event adapters, IMAP polling for mail.
• SCIM provisioning, per-tenant identity providers.
• Secret managers (Vault, AWS Secrets Manager).
• MCP catalog with review states and per-server egress rules.

0.4 – Agent lifecycle

• Agent Build: from plans to scaffolded agents with tests.
• Evaluations v2: golden datasets and promotion gates.
• Version approval bound to model and eval set.
• Automatic hardening review of development agents’ pull requests.
• Agent lifecycle governance (planned, not built; design in ADR 0017, tracked as W14 in the platform repository): see Planned: lifecycle governance. Four-eyes publish approval with review comments (an agent is in development until another person approves publishing it), personal, team and tenant secrets stored encrypted and never readable, and HashiCorp Vault and AWS Secrets Manager as secret backends.
• MCP catalog governance and container-run MCP servers.

1.0 – Enterprise readiness

• Stable v1 API and agents.md schema.
• Per-tenant audit chains and Merkle proofs.
• Multi-step approval workflows.
• Data residency and region pinning.
• Scale-out run queue (Valkey/Kafka).
• Red-teaming campaigns.
• Air-gapped offline bundle.
• Private model hosting (vLLM/Ollama with GPU).
• Demo on release images (a demo with fake data already runs at demo.openagentix.si).

The order within this list is not fixed; the platform repository tracks the current plan.

Towards 1.0

• Stable v1 APIs and agents.md schema (openagentix.io/v1).
• Signed releases and images, documented upgrade paths.
• Chart repository and OCI publishing, demo on release images.

Have an idea? Open an issue in the platform repository; larger changes start as an ADR.