Roadmap

Where MainSDK is going, one milestone at a time. Each heading links to its GitHub milestone, which is the source of truth for scope and progress.

Milestone 0.1

Exit criteria: every acceptance criterion of these specs passes.

• The main.yaml manifest, overlays and inheritance (main-yaml)
• Repository foundation, signed builds and security policy (repo-foundation)
• Versioned contracts from one TypeSpec source (versioned-contracts)

Milestone 0.2

Exit criteria: every acceptance criterion of these specs passes.

• Framework adapters for Next.js, Hono, Express, Node workers, Prisma and Drizzle (adapters)
• The core CLI loop - init, sync, check, info, logs and dev (cli-core)
• The config and secrets interfaces (config-secrets)
• AI-ready errors with stable codes and problem details (errors)
• Inbound protection - secure headers, CSP nonces, CSRF, CORS, cookies and security.txt (inbound-protection)
• Logs, audit log, redaction and the telemetry data contract (log-telemetry)
• The policy interface with a built-in TypeScript Cedar engine and an OPA driver (policy)
• Safe HTML from users and from model output with sanitize (sanitize)
• One native schema and safe parsers for app data (schema)
• The seal - a signed build record served at /.well-known/mainsdk.json and checked at boot (seal)

Milestone 0.3

Exit criteria: every acceptance criterion of these specs passes.

• Access control on any model and any engine (access)
• Agents with an identity, a budget and a human in the loop (agent-governance)
• Private, limited and audited model calls (ai)
• Product events, metrics and usage, private by default (analytics)
• API keys an app issues to its own customers (apikeys)
• A generated OpenAPI document and typed client for the app's actions (app-api)
• App permissions for disk, system facts and programs on the server (app-permissions)
• Sign-in and sessions for web apps (auth)
• Bot defence and abuse signals on the doors bots hammer (bot-defence)
• One runtime - one context, one call shape, shared primitives and the catalog as the single source (cohesion)
• Connections that let app agents act for a person in other services (connections)
• Database queries that are bounded, pooled and watched for slow and repeated calls (db-queries)
• Deletes you can undo, updates that never overwrite, and jobs that commit with the data (db-writes)
• Data by owner, label and region (db)
• A beautiful SDK - one design language for the API, the CLI, the docs, the README and every error (design-language)
• Eject to plain provider code (eject)
• Email and notifications that respect people (email-notify)
• Plans and entitlements for each tenant (entitlements)
• A working, checked app in under thirty minutes (fast-start)
• Files and share links through getqr.id (files-share)
• Feature flags on live config, with stable rollout and targeting (flags)
• Envelope encryption with keys in a cloud KMS (keys)
• Small values with an expiry, scoped to the tenant (kv)
• Rate limits, quotas and locks with Retry-After, failing by declared policy (limits)
• Every action is also a tool (mcp-actions)
• Calls to other MCP servers that stay inside the wall (mcp-client)
• Usage metering per tenant, API key and feature, idempotent and exportable to pay (meter)
• Network permissions with an egress allowlist (network)
• Observe every SDK decision and side effect on diagnostics channels (observe)
• Cursor pagination for every list call (pagination)
• Payments with hosted checkout and verified webhooks (pay)
• Data labels, retention, export and erasure (privacy-lifecycle)
• Live updates to browsers over SSE, checked per channel and tenant (realtime)
• SDK conventions for cancellation, error codes, dry runs, experimental exports, changes and fuzzing (sdk-conventions)
• Secret rotation with overlap windows, live client swaps and age limits (secret-rotation)
• Security events in OCSF, with in-app detections, streamed to the app's own SIEM (security-events)
• Tenants, with isolation enforced in every interface (tenancy)
• Webhooks, events and jobs that never double-apply (webhooks-jobs)
• Durable workflows that resume after a crash and never redo a finished step (workflows)

Milestone 0.4

Exit criteria: every acceptance criterion of these specs passes.

• Agent experience first - the mainsdk MCP server, machine fixes, one inner-loop command, typed declarations and recipes (agent-experience)
• Image generation and editing, with disclosure metadata and C2PA content credentials on every AI image (ai-image)
• Images, PDFs, audio and video frames as parts of a prompt, read through files, limited and redacted (ai-multimodal)
• Model routing - fallback across providers, prompt caching, a tenant-safe response cache, batch jobs and local JSON repair (ai-routing)
• The agent loop with ai.run - tools that are actions, bounded steps and budget, approval, handoff, delegation and typed output (ai-run)
• Speech and transcription, streamed, with consented voice clones and disclosed AI audio (ai-speech)
• Alerts that reach people - routes, dedupe, grouping, quiet hours and escalation through notify drivers (alerts)
• The local app registry, mainsdk apps and the app link between declared peer apps (app-registry)
• Sign-in routes mounted by the adapters and a zero-dependency browser client for passkeys, sign-in links, WhatsApp codes, step-up and sign-out (auth-client)
• Shared context - consent-gated, first-party events and attributes between peer apps on one host, with minimisation, retention and tenant isolation (context)
• Database migrations that never lock a busy table or break the running version (db-migrations)
• Deploy config from main.yaml for Vercel, Cloudflare, Fly and Docker, with serverless schedules, a build preflight and environment diffs (deploy)
• Read PDFs, Office files and scans into text, tables and layout, and render PDFs, through one documents interface (documents)
• Engagement journeys that bring people back without dark patterns (engagement)
• Error reporting in the app - every unhandled error captured, grouped by a stable fingerprint, alerted when new or spiking, and sent to OTLP or Sentry (error-reporting)
• Exfiltration guard on outbound calls and responses, with canary records and canary keys (exfiltration-guard)
• Never in the request path, fail static and performance budgets (fail-static)
• Feeds with follows, timelines that fan out on write and on read, and trending, without endless scroll (feeds)
• Health probes, graceful shutdown and SLOs with error-budget burn (health)
• Safe HTTP caching and a tenant-keyed server cache - private by default, public only when declared, ETags, stampede protection and fail-static reads (http-cache)
• Messages, plurals and formats for every locale, negotiated per request, with AI drafts a person approves (i18n)
• Import files and pull from outside sources into the app's data (imports)
• Incident controls - kill switch, read-only mode and signing everyone out (incident-controls)
• A simulation harness for connected intelligence - fake clock, injected attacks and resource curves, a multi-app host and e2e coverage (intelligence-sim)
• Application licensing in the app - signed licences verified offline, licence.require, grace, revocation and refresh (licence)
• Invite, deep and sign-in links through getqr.id (links)
• Main 27 baseline, the Main mark and interface stability levels (main27-baseline)
• Images, video and audio processed as workflows, with output through files and metadata stripped by default (media)
• Agent memory that stays in its tenant and app, with provable forgetting (memory)
• Moderation with reports, a review queue, decisions, appeals and statements of reasons, holding content before it publishes (moderate)
• Neighbours - a host signal bus and three fixed asks between declared peer apps on one machine (neighbours)
• TCP and UDP sockets through the network chokepoint, with listen permissions, TLS by default and an in-process loopback for tests (net-sockets)
• Norms - a deterministic, dependency-free learner of what normal looks like, with anomaly signals out (norms)
• The operate surface - the app's signals, status, norms and playbooks as an MCP server on stdio and loopback, with an A2A-style agent card (ops-mcp)
• Worker threads, process pools and cluster - CPU work and HTTP servers across cores, declared, checked and carrying the tenant (parallelism)
• Playbooks - declared reactions to signals, with dry-run, approval, an audit trail and automatic rollback (playbooks)
• A portable core on WinterTC APIs, with Node-only code in runtime adapters (portable-core)
• The protect interface on TAPS - protected files, licences, release on time, delegation and the ledger, with a local driver in core (protect-taps)
• Reaction safety - blast radius, rate limits, no loops between apps, tenancy and what is never automated (reaction-safety)
• Two-way realtime over WebSocket, with binary streams and bounded queues (realtime-sockets)
• Resource pressure - CPU, event-loop delay and memory watched in the app, with optional work paused or shed first (resources)
• Run untrusted and AI-written code in a sandbox through drivers, with limits, no secrets and the app's network allowlist (sandbox)
• Search with facets, highlighting and typo tolerance, filtered by access and tenant inside the query (search)
• Seed data, fixtures and preview environments (seed-preview)
• Signals - a typed, signed, local-first bus for machine and app state, with severity, TTL and dedupe (signals)
• Testing kit, chaos drills, conformance suite, parity vectors and driver kit (testing-kit)
• Published STRIDE threat models per interface and driver class (threat-models)
• Safe delivery of packs and driver metadata with TUF (tuf-delivery)

Milestone 0.5

Exit criteria: every acceptance criterion of these specs passes.

• The agent benchmark - the same coding agent builds three apps with and without MainSDK, and the starter templates it uses (agent-benchmark)
• Eval sets per AI feature, a regression gate in CI, the result in the seal, and online sampling in the app (ai-evals)
• Local and self-hosted models through Ollama, llama.cpp and OpenAI-compatible servers, for privacy and offline development (ai-local)
• Community launch, open governance and the bug bounty (community-launch)
• The deps gate in mainsdk check - hallucinated, brand-new and look-alike packages, known advisories, licences and install scripts, from every lockfile (dependency-check)
• Docs for every release, with a version switcher (docs-versions)
• Agent memory learning, consolidation, relations, portability and provider drivers (memory-advanced)
• AI migration skill and mainsdk adopt (migration-skill)
• Public beta, docs site, quick starts and signed 0.x releases (public-beta)
• mainsdk upgrade - every MainSDK package moved together, upgrade notes, codemods and main.yaml migrations on a branch, and a security-release check (upgrade)

The roadmap is read from GitHub milestones; there is no separate status file.