--- title: "Roadmap" description: "Milestones 0.1 to 0.5 with their exit criteria, read from GitHub milestones." section: "community" status: "Planned for 0.5" spec: "community-launch" canonical: "https://mainsdk.dev/docs/community/roadmap" updated: "2026-10-28" --- # Roadmap > Milestones 0.1 to 0.5 with their exit criteria, read from GitHub milestones. Status: Planned for 0.5 · Canonical: https://mainsdk.dev/docs/community/roadmap · Updated: 2026-10-28 Where MainSDK is going, one milestone at a time. Each heading links to its GitHub milestone, which is the source of truth for scope and progress. ## [Milestone 0.1](https://github.com/hubxero/mainsdk/milestones) Exit criteria: every acceptance criterion of these specs passes. - The main.yaml manifest, overlays and inheritance (`main-yaml`) - Repository foundation, signed builds and security policy (`repo-foundation`) - Versioned contracts from one TypeSpec source (`versioned-contracts`) ## [Milestone 0.2](https://github.com/hubxero/mainsdk/milestones) Exit criteria: every acceptance criterion of these specs passes. - Framework adapters for Next.js, Hono, Express, Node workers, Prisma and Drizzle (`adapters`) - The core CLI loop - init, sync, check, info, logs and dev (`cli-core`) - The config and secrets interfaces (`config-secrets`) - AI-ready errors with stable codes and problem details (`errors`) - Inbound protection - secure headers, CSP nonces, CSRF, CORS, cookies and security.txt (`inbound-protection`) - Logs, audit log, redaction and the telemetry data contract (`log-telemetry`) - The policy interface with a built-in TypeScript Cedar engine and an OPA driver (`policy`) - Safe HTML from users and from model output with sanitize (`sanitize`) - One native schema and safe parsers for app data (`schema`) - The seal - a signed build record served at /.well-known/mainsdk.json and checked at boot (`seal`) ## [Milestone 0.3](https://github.com/hubxero/mainsdk/milestones) Exit criteria: every acceptance criterion of these specs passes. - Access control on any model and any engine (`access`) - Agents with an identity, a budget and a human in the loop (`agent-governance`) - Private, limited and audited model calls (`ai`) - Product events, metrics and usage, private by default (`analytics`) - API keys an app issues to its own customers (`apikeys`) - A generated OpenAPI document and typed client for the app's actions (`app-api`) - App permissions for disk, system facts and programs on the server (`app-permissions`) - Sign-in and sessions for web apps (`auth`) - Bot defence and abuse signals on the doors bots hammer (`bot-defence`) - One runtime - one context, one call shape, shared primitives and the catalog as the single source (`cohesion`) - Connections that let app agents act for a person in other services (`connections`) - Database queries that are bounded, pooled and watched for slow and repeated calls (`db-queries`) - Deletes you can undo, updates that never overwrite, and jobs that commit with the data (`db-writes`) - Data by owner, label and region (`db`) - A beautiful SDK - one design language for the API, the CLI, the docs, the README and every error (`design-language`) - Eject to plain provider code (`eject`) - Email and notifications that respect people (`email-notify`) - Plans and entitlements for each tenant (`entitlements`) - A working, checked app in under thirty minutes (`fast-start`) - Files and share links through getqr.id (`files-share`) - Feature flags on live config, with stable rollout and targeting (`flags`) - Envelope encryption with keys in a cloud KMS (`keys`) - Small values with an expiry, scoped to the tenant (`kv`) - Rate limits, quotas and locks with Retry-After, failing by declared policy (`limits`) - Every action is also a tool (`mcp-actions`) - Calls to other MCP servers that stay inside the wall (`mcp-client`) - Usage metering per tenant, API key and feature, idempotent and exportable to pay (`meter`) - Network permissions with an egress allowlist (`network`) - Observe every SDK decision and side effect on diagnostics channels (`observe`) - Cursor pagination for every list call (`pagination`) - Payments with hosted checkout and verified webhooks (`pay`) - Data labels, retention, export and erasure (`privacy-lifecycle`) - Live updates to browsers over SSE, checked per channel and tenant (`realtime`) - SDK conventions for cancellation, error codes, dry runs, experimental exports, changes and fuzzing (`sdk-conventions`) - Secret rotation with overlap windows, live client swaps and age limits (`secret-rotation`) - Security events in OCSF, with in-app detections, streamed to the app's own SIEM (`security-events`) - Tenants, with isolation enforced in every interface (`tenancy`) - Webhooks, events and jobs that never double-apply (`webhooks-jobs`) - Durable workflows that resume after a crash and never redo a finished step (`workflows`) ## [Milestone 0.4](https://github.com/hubxero/mainsdk/milestones) Exit criteria: every acceptance criterion of these specs passes. - Agent experience first - the mainsdk MCP server, machine fixes, one inner-loop command, typed declarations and recipes (`agent-experience`) - Image generation and editing, with disclosure metadata and C2PA content credentials on every AI image (`ai-image`) - Images, PDFs, audio and video frames as parts of a prompt, read through files, limited and redacted (`ai-multimodal`) - Model routing - fallback across providers, prompt caching, a tenant-safe response cache, batch jobs and local JSON repair (`ai-routing`) - The agent loop with ai.run - tools that are actions, bounded steps and budget, approval, handoff, delegation and typed output (`ai-run`) - Speech and transcription, streamed, with consented voice clones and disclosed AI audio (`ai-speech`) - Alerts that reach people - routes, dedupe, grouping, quiet hours and escalation through notify drivers (`alerts`) - The local app registry, mainsdk apps and the app link between declared peer apps (`app-registry`) - Sign-in routes mounted by the adapters and a zero-dependency browser client for passkeys, sign-in links, WhatsApp codes, step-up and sign-out (`auth-client`) - Shared context - consent-gated, first-party events and attributes between peer apps on one host, with minimisation, retention and tenant isolation (`context`) - Database migrations that never lock a busy table or break the running version (`db-migrations`) - Deploy config from main.yaml for Vercel, Cloudflare, Fly and Docker, with serverless schedules, a build preflight and environment diffs (`deploy`) - Read PDFs, Office files and scans into text, tables and layout, and render PDFs, through one documents interface (`documents`) - Engagement journeys that bring people back without dark patterns (`engagement`) - Error reporting in the app - every unhandled error captured, grouped by a stable fingerprint, alerted when new or spiking, and sent to OTLP or Sentry (`error-reporting`) - Exfiltration guard on outbound calls and responses, with canary records and canary keys (`exfiltration-guard`) - Never in the request path, fail static and performance budgets (`fail-static`) - Feeds with follows, timelines that fan out on write and on read, and trending, without endless scroll (`feeds`) - Health probes, graceful shutdown and SLOs with error-budget burn (`health`) - Safe HTTP caching and a tenant-keyed server cache - private by default, public only when declared, ETags, stampede protection and fail-static reads (`http-cache`) - Messages, plurals and formats for every locale, negotiated per request, with AI drafts a person approves (`i18n`) - Import files and pull from outside sources into the app's data (`imports`) - Incident controls - kill switch, read-only mode and signing everyone out (`incident-controls`) - A simulation harness for connected intelligence - fake clock, injected attacks and resource curves, a multi-app host and e2e coverage (`intelligence-sim`) - Application licensing in the app - signed licences verified offline, licence.require, grace, revocation and refresh (`licence`) - Invite, deep and sign-in links through getqr.id (`links`) - Main 27 baseline, the Main mark and interface stability levels (`main27-baseline`) - Images, video and audio processed as workflows, with output through files and metadata stripped by default (`media`) - Agent memory that stays in its tenant and app, with provable forgetting (`memory`) - Moderation with reports, a review queue, decisions, appeals and statements of reasons, holding content before it publishes (`moderate`) - Neighbours - a host signal bus and three fixed asks between declared peer apps on one machine (`neighbours`) - TCP and UDP sockets through the network chokepoint, with listen permissions, TLS by default and an in-process loopback for tests (`net-sockets`) - Norms - a deterministic, dependency-free learner of what normal looks like, with anomaly signals out (`norms`) - The operate surface - the app's signals, status, norms and playbooks as an MCP server on stdio and loopback, with an A2A-style agent card (`ops-mcp`) - Worker threads, process pools and cluster - CPU work and HTTP servers across cores, declared, checked and carrying the tenant (`parallelism`) - Playbooks - declared reactions to signals, with dry-run, approval, an audit trail and automatic rollback (`playbooks`) - A portable core on WinterTC APIs, with Node-only code in runtime adapters (`portable-core`) - The protect interface on TAPS - protected files, licences, release on time, delegation and the ledger, with a local driver in core (`protect-taps`) - Reaction safety - blast radius, rate limits, no loops between apps, tenancy and what is never automated (`reaction-safety`) - Two-way realtime over WebSocket, with binary streams and bounded queues (`realtime-sockets`) - Resource pressure - CPU, event-loop delay and memory watched in the app, with optional work paused or shed first (`resources`) - Run untrusted and AI-written code in a sandbox through drivers, with limits, no secrets and the app's network allowlist (`sandbox`) - Search with facets, highlighting and typo tolerance, filtered by access and tenant inside the query (`search`) - Seed data, fixtures and preview environments (`seed-preview`) - Signals - a typed, signed, local-first bus for machine and app state, with severity, TTL and dedupe (`signals`) - Testing kit, chaos drills, conformance suite, parity vectors and driver kit (`testing-kit`) - Published STRIDE threat models per interface and driver class (`threat-models`) - Safe delivery of packs and driver metadata with TUF (`tuf-delivery`) ## [Milestone 0.5](https://github.com/hubxero/mainsdk/milestones) Exit criteria: every acceptance criterion of these specs passes. - The agent benchmark - the same coding agent builds three apps with and without MainSDK, and the starter templates it uses (`agent-benchmark`) - Eval sets per AI feature, a regression gate in CI, the result in the seal, and online sampling in the app (`ai-evals`) - Local and self-hosted models through Ollama, llama.cpp and OpenAI-compatible servers, for privacy and offline development (`ai-local`) - Community launch, open governance and the bug bounty (`community-launch`) - The deps gate in mainsdk check - hallucinated, brand-new and look-alike packages, known advisories, licences and install scripts, from every lockfile (`dependency-check`) - Docs for every release, with a version switcher (`docs-versions`) - Agent memory learning, consolidation, relations, portability and provider drivers (`memory-advanced`) - AI migration skill and mainsdk adopt (`migration-skill`) - Public beta, docs site, quick starts and signed 0.x releases (`public-beta`) - mainsdk upgrade - every MainSDK package moved together, upgrade notes, codemods and main.yaml migrations on a branch, and a security-release check (`upgrade`) The roadmap is read from [GitHub milestones](https://github.com/hubxero/mainsdk/milestones); there is no separate status file.