<!-- mixed -->

# Roadmap

## Initial Practical Boundary

The first implementation should not attempt every feature in this document.

### Minimum viable control plane

Implement:

- a single-process controller;
- a transactional append-only event store;
- one global event sequence and graph-version counter;
- a deterministic reducer implementing [State Machines](control-plane.md#state-machines);
- versioned node, relation, attempt, artefact, evidence, conflict, timer, and budget stores;
- proposal-level optimistic checks over referenced node, relation, contract, input, policy and budget versions, while
  retaining one global event sequence and graph-version counter for ordering and audit;
- event-driven readiness and scheduling;
- recorded executor-capacity and scheduling events;
- global worker and resource limits;
- the executor protocol in [Executor protocol](executors.md#executor-protocol);
- a deterministic command executor;
- one reasoning-model adapter;
- disposable Git worktrees per writing attempt;
- deterministic diff-based write-scope enforcement;
- deterministic Git integration;
- artefact references and hashes;
- pre-existing visible and hidden acceptance-check interfaces;
- a no-overcommitment hierarchical token and cost ledger;
- retry and repeated-failure limits;
- [Run termination, quiescence, crash recovery](control-plane.md#run-termination-and-outcomes);
- audit output;
- replay and state-equivalence tests.

Multi-model routing, speculative alternatives, distributed execution, and partitioned ordering are outside the
MVP.
The executor protocol and sandbox are documented in [Executor protocol and sandbox](executors.md#executor-protocol).

The experiment procedure is documented in [Experiment procedure](experiment.md#experiment-procedure).

Run termination, quiescence, and crash recovery are documented in
[Run termination and crash recovery](control-plane.md#run-termination-and-outcomes).

## Deferred Design Questions

The single-machine reference implementation fixes the following decisions:

- one global authoritative event sequence;
- one global graph-version counter;
- transactional event and state persistence;
- proposal-level optimistic concurrency;
- three independent lifecycle machines plus result freshness;
- event-backed capacity, scheduling, timers, and observations;
- no budget overcommitment;
- disposable Git worktrees per writing attempt;
- deterministic diff-based write-scope enforcement;
- deterministic Git merge and validation integration;
- fail-and-retry recovery for interrupted attempts;
- one model adapter;
- pre-existing hidden root acceptance oracle.

The following remain incremental design questions:

- event-store technology satisfying the required transaction semantics;
- concrete schema serialisation format;
- artefact blob-storage technology;
- model-provider abstraction beyond one adapter;
- secrets-management implementation;
- policy-language representation;
- schema-evolution and compatibility rules;
- additional budget dimensions;
- human-approval integration;
- observability backend;
- model-output retention and data-classification policy;
- partitioned ordering;
- distributed execution;
- resumable executors after controller failure;
- multi-model routing;
- speculative alternatives.

No deferred decision may weaken the authoritative event, acceptance-independence, scope-isolation, or budget invariants.

## Suggested First Implementation Sequence

01. Define event, proposal, node, relation, attempt, artefact, evidence, conflict, timer, run, and budget schemas with
    uppercase enums.
02. Implement the transactional append-only log, global event sequence, global graph version, and deterministic reducer.
03. Implement the node, attempt, artefact, and freshness state machines from
    [State Machines](control-plane.md#state-machines).
04. Implement proposal-level optimistic checks over referenced node, relation, contract, input, policy and budget
    versions, while retaining one global event sequence and graph-version counter for ordering and audit.
05. Implement canonical hierarchy, dependency, production, integration, conflict, alternative, and supersession
    relations.
06. Implement criterion identifiers and deterministic decomposition-coverage checks.
07. Implement reservations, commitments, actuals, reclamation, ancestor projections, and no-overcommitment enforcement.
08. Implement executor availability, capacity, timer, scheduling, dispatch, cancellation, and observation events.
09. Implement the deterministic command executor and [Executor protocol](executors.md#executor-protocol).
10. Implement disposable Git worktrees and post-attempt write-scope checks.
11. Implement deterministic integration, artefact hashing, and evidence recording.
12. Implement typed conflicts and the initial deterministic resolution-policy registry.
13. Implement readiness and concurrent scheduling, permitting concurrency only for deterministically disjoint write
    scopes and serialising valid overlapping scopes.
14. Implement one reasoning-model adapter with typed output validation and enforceable cost caps.
15. Implement decomposition proposals without direct graph mutation.
16. Implement bounded fan-out and deterministic criterion coverage.
17. Implement independent visible and hidden acceptance-check interfaces.
18. Implement run termination, repeated-failure detection, and crash recovery.
19. Implement transition-table and policy-path completeness checks.
20. Implement attempt accounting as a lifecycle separate from execution.
21. Implement secure executor and validator sandboxing.
22. Implement event replay and state-and-ledger equivalence tests.
23. Implement complete root-state-to-run-outcome mapping.
24. Implement bidirectional hidden-oracle coverage validation.
25. Implement oracle grading, indeterminate outcomes, and infrastructure-only rerun policy.
26. Run scripted controller conformance tests.
27. Run crash-injection and sandbox-isolation tests.
28. Calibrate the hidden oracle using known-good, unchanged, broken, timeout, and infrastructure-failure candidates.
29. Run unmeasured `DIRECT` and `FIXED_ONE_LEVEL` pilots.
30. Run unmeasured recursive and concurrent pilots.
31. Freeze the experiment manifest.
32. Run the four-arm measured comparison.

## Non-Goals for the First Version

The first version should not attempt:

- unrestricted autonomous production deployment;
- arbitrary distributed execution;
- perfect semantic decomposition;
- universal project support;
- unbounded model autonomy;
- automatically trusted model-based validation;
- true shared mutable ownership;
- speculative execution by default;
- learning-based routing before sufficient observations exist;
- exhaustive up-front project specification;
- exhaustive up-front decomposition.