Roadmap

Maintainer HQ is developed as a sequence of coherent release goals. Each goal ends with local release checks, a changelog entry, CI validation, and a versioned release before the next begins. Scope can change when evidence from the previous release suggests a better boundary.

0.1: Portable foundation

Generalize the local control plane, establish secure onboarding and stable workspace identity, preserve CLI/dashboard/MCP parity, and create dependable packaging, CI, and release hygiene.

0.2: Activity feed

Add cross-repository projects, a rolling feed of operator progress plus normalized commits, CI runs, and releases, composed filters, links, acknowledgement and pin state, and idempotent refresh. Add optional AI summaries with exact record and field disclosure, private-provider routing, visible token and cost boundaries, durable receipts, explicit recovery, and a complete non-AI experience.

0.3: Security inbox

Unify Dependabot alerts, security update pull requests, and vulnerability findings into a deduplicated tracker with severity, ownership, repository context, acknowledgement, snooze, resolution state, history, and configurable notifications.

0.4: Canonical secret distribution

Store one private canonical value and distribute it to selected GitHub Actions repository or environment secrets. Default environment distribution to every active enrolled repository with the selected environment name, preserve per-repository selection and override drafts, expose explicit control affordances and addressable workflows, and retain exact planning, provider confirmation, durable pre-write recovery, per-destination verification, and resumable partial outcomes across the CLI, dashboard, broker, headless service, and MCP server. Extend the progress surface with keyboard catch-up, detached-session discovery, and an addressable ultrashort Activity mode whose optional AI headlines retain exact disclosure, cost, freshness, and fallback boundaries.

Later goals

• Policy packs and repository scorecards
• A richer Action Center built from activity, security, health, and maintenance signals
• Safe scheduled automation with bounded credentials, approval policy, and resumable execution
• More providers, distribution paths, collaboration seams, and public-product polish

Team and hosted operation remain a deliberate extension point rather than 0.x scope. Stable workspace scoping, storage boundaries, normalized events, provider adapters, and explicit authorization are intended to make that extension additive.