Roadmap
Alpha: not for production. APIs, CLI, storage and schemas may change without migration. See the README for status and the changelog for known limits.
What AgentSCM does today and what is planned, in terms of what a user can do. Nothing here is a delivery date or a commitment, and nothing has been measured at tens or hundreds of concurrent agents.
Start with ordinary Git work: catch up on ownership and reported progress, inspect source and available action evidence, then decide what to check or hand over. Native admission is a separate opt-in path. A Work report, capture receipt, skill-gate report and native workflow receipt carry different assurances; none alone is a forge merge or a human approval.
Status labels follow the specification, plus Experimental as a stricter qualifier on rows the specification calls Implemented:
- Implemented: in this repository’s code and tests. The native ledger rows are the trusted-local, single-operator profile; hub rows are a multi-user service that is alpha. Not a production or scale claim.
- Experimental: implemented, but exercised only against fakes or a narrow environment; the limits are named in the row. Treat it as less settled than Implemented.
- Partial: some of the behavior exists; the gap is named.
- Proposed: described, with no implementation yet.
| Capability | What a user gets | Status |
|---|---|---|
| Early collision warnings | See which branches and worktrees touch the same files before a merge, from the CLI or GET /v1/collisions. Git only, read-only, bounded by a deadline and output budget in the service. It sees only what is in the scanned repository. See collisions. | Implemented |
| Immutable ledger | An append-only record of exact revisions, review contexts, approvals and protected-target moves, with durable retries. Local SQLite, one operator. Revisions carry regular, executable and symlink entries. | Implemented (experimental; local, one operator) |
| Task-scoped source and workspaces | Explore immutable source without a checkout, materialize explicit paths into an ordinary local workspace, expand the scope deliberately and checkpoint a complete revision without deleting unmaterialized base paths. See task workspaces. | Implemented (experimental; trusted-local): explicit source objects must already be present; no virtual filesystem, automatic dependency discovery or authenticated remote task mutation |
| Git shadow workflow | Capture a clean Git commit, work and land natively, reconcile with Git and export to a local mirror you own. Git stays authoritative; nothing is pushed. | Implemented (experimental; local, one operator; one-way snapshot; export v2 preserves executable and symlink entries; legacy export v1 and reconcile refuse them) |
| Attached Git worktree lifecycle | Attach an existing named-branch checkout without writing its files, index or refs; capture committed or explicitly selected raw source; bind and qualify an exact native Change; retain Git/native/candidate mappings; refresh conservatively; and publish a separate leased branch and GitHub PR or GitLab MR without native landing. See attached Git worktrees. | Experimental (Unix, trusted local): the workspace Hub prepares and publishes operator-pinned branches and bound PRs/MRs under current actor and imported-origin authorization, with observation-only recovery and imported-origin-aware status; the joined fake-GitHub scenario covers exact human review/merge guards using real bare Git through an explicitly synthetic transport adapter; live protections remain unverified; local bare and loopback HTTPS transport with existing Hub PR recovery is tested against fake GitHub and fake GitLab (GitLab MR publication for candidates is fake-tested only, nested groups included); index capture, live forge/SSH qualification, provider protection admission, live GitLab status qualification (GitLab status projection is fake-tested only), native backup API support for nonempty attachment journals, attachment-level supersede/rebase recovery, common SSH remote forms, submodules and unavailable shallow/partial history are unsupported; this is not native authority cutover |
| Deterministic checks | A built-in source-path check bound to the exact revision and review context. | Implemented (experimental; local, one operator) |
| Local validation attestations | A maintainer runs the repository gate locally, signs a Git-bound record and posts it to a pull request; the agentscm local-validation reconcile verifier, run by a thin workflow, checks it against the default branch’s policy, recipe and registry and posts the agentscm/local-validation status for every open pull request. Recipes may declare their own dependency files and toolchain probes, and a policy may require no services. Recipe commands may be path-scoped and a policy may list exempt paths whose pull requests need no attestation (fake GitHub only). See local validation. | Experimental: Unix only, GitHub only; one maintainer key enrolled; reconcile is tested only against a fake GitHub and has not run on live GitHub; the earlier shell verifier was qualified through act on pull request #86; anonymous public fetch is the default, with an opt-in canonical private-GitHub fetch that is command-boundary tested but has not used live private credentials, TLS redirects or transport timeouts; a reusable exact-release workflow is present in source but activation awaits a published release containing the complete command set, so the repository keeps its source-build verifier; hosted suites are opt-in (ci-extended label or workflow_dispatch) for same-repository pull requests and still automatic on main; on fork pull requests the CI tests run automatically and the Windows, container, hub end-to-end and live execution suites run once per ci-extended labelling; the status is not a required check; execution is worker-asserted and the standalone evidence verifier is not exercised on these envelopes |
| Isolated command checks | Run a declared command against an exact revision in a locked-down container, bind the result to approval, cancel or recover a run, and turn a successful agent run’s output into a candidate revision. See execution. | Experimental (trusted-local, Unix with Docker): hostile-boundary canaries qualify only the runtime they run on; no unattended recovery after a controller crash; records are unsigned; not a sandbox for arbitrary hostile code |
| Source-bound skill workflows | Run a bounded graph of exact-file checks and pinned command recipes on one immutable revision, retain results and explicitly cancel or recover command work. See skill workflows. | Experimental: Unix/Docker for commands; configured native targets can require a finalized graph receipt; legacy Hub/MCP/dashboard are inspection-only |
| Local workflow and skill authoring | Create immutable skill and workflow versions, preview bounded public GitHub imports pinned to a full commit, simulate declarations and export setup for the existing pipeline. See workflow library. | Experimental, trusted-local: connected-page writes need a same-origin browser grant; simulation performs no execution; runnable exports still require reviewed files, a commit and explicit operator pipeline installation; deploy declarations have no deployment executor |
| Productive workflow actions | Compose bounded prompt-generated text and deterministic command artifacts in the source-bound graph, retaining per-step outcomes and named dependencies. See productive actions. | Experimental, trusted-local Unix: operator-pinned runtimes and profiles; no automatic publishing or deployment; every graph containing a productive action is refused as a native admission requirement |
| Post-merge pipeline rules | Install local repository rules and enqueue an existing workflow after the observer re-reads a provider-confirmed merge. See pipeline rules. | Experimental Unix: operator-local manifests, profiles and exact Git source; synthetic provider qualification; no shared Hub rule management, automatic fetch, PR creation or merge authority |
| Intent review | Let the existing coding agent assess a Git Work against a pinned skill and retained human-request criteria, then track bounded corrections and reassessment. See intent review. | Experimental, trusted-local: standalone skill step only; findings and supplied evidence are advisory and caller asserted; no native qualification, new tool access or replacement for required review/human approval; synthetic host fixtures do not establish live agent execution |
| Agent-driven workflow automation | Trigger selected workflows from agent events, expose authenticated execution tools and require current workflow results at a controlled landing boundary. | Partial: optional Claude Code and Codex CLI Stop triggers (local and hosted) and read-only agent-owned task Stop modes (task-stop, task-codex-stop), with a thin instruction entrypoint in the init-repo block. Live CLI qualification (2026-10-20, one machine, synthetic fixture) covers local claude-stop in Claude Code print mode and local codex-stop in codex exec with --dangerously-bypass-hook-trust; hosted and agent-owned stops and editor/desktop surfaces are fixture-only. The Stop loop allows at most 8 consecutive automatic continuations per agent, session, workspace and change. Also a previewed local installer (skill-workflow install-stop); exact-current native target gate, opt-in server execution API, workspace-authenticated HTTP/MCP agent-task facade, and a Unix CLI for enrolled exact-source local collection and signed upload. Task-only profiles do not bootstrap source to another machine; existing file-edit hooks remain contention-only |
| Community workspace | Share members, settings and workflow execution, with explicit approval and native landing controls. See workspace pilot. | Experimental single-server trusted-team pilot: persistent independent roles and browser sessions, bounded serial server queue, task-only agent profiles, repository-scoped tokens and explicit native landing. The joined acceptance lifecycle uses two synthetic contributors with real linked Git worktrees and bare Git, target advancement, current imported evidence, exact human review/merge guards, retained collector recovery and revocation; Docker, HTTPS identity transport and forge behavior remain synthetic/fake, with no live identities, physical machines, vendor clients or models. A same-host built-UI/Chromium walkthrough covers synthetic OAuth and the task-only read surface. Server queue restart becomes Unknown without replay; task-only attempts retain their separate typed recovery state. No automatic failover or live two-machine qualification |
| Supervised single-server workspace deployment | Run one persistent Community workspace service with a documented one-writer state, credential, supervision, readiness and HTTPS boundary. | Partial: the selected profile is one native hub serve process with local SQLite, task-only profiles and same-host trusted-local collectors. A synthetic joined scenario qualifies a fully stopped, same-host restore to the same absolute paths with complete local inventory, manifest preflight, later-revocation reconciliation, retained optional server queue/source-transfer Unknown envelopes without replay and a second restart. The source-admission boundary is injected durable state, not an actual process kill. It does not qualify online or relocated restore, HA, real collector/provider runtimes or a live forge. The stock image defaults to unauthenticated native serve and lacks collector runtimes/configuration; native recovery still refuses nonempty attached stores |
| Skill distribution and agent adapters | Select pinned packages or author local skills; run review tasks through operator-selected agents or provider credentials. | Partial: bounded Claude Code subscription adapter; no catalog installer or general provider adapter |
| Multi-user coordination hub | agentscm hub serve on SQLite or PostgreSQL, with local or S3-compatible object storage: sign-in with GitHub or GitLab (gated by the person’s access to a connected repository), owner-scoped expiring agent tokens and an event log. General events are append-only; stand-up work has explicit operator retention. See hub. | Implemented (alpha): CLI login sessions live in memory (computers and agents use persistent computer credentials); the Hub API offers a persistent cookie sign-in with CSRF tokens for its web pages, which the bundled UI does not use yet; workspace browser sessions persist separately. The hub does not terminate TLS and has no TLS to PostgreSQL. Optional profiles join selected native workflows |
| Agent connection and Setup › Agents page | agentscm client setup --agent claude|codex|cursor|copilot|gemini binds a checkout to an existing hub and installs local hooks and MCP config; the hub’s Setup › Agents page (/v1/hub/onboarding, agentscm_setup_status) reports readiness per agent. See onboarding. | Partial: implemented and covered by unit and stub-hub tests; candidate behavior, not qualified end to end across all five clients or against a hosted hub. agentscm quickstart runs this same setup for the agents you choose |
| Sign in once per computer | A sign-in (browser first on desktops, a code over SSH) also signs the computer in with a revocable credential that survives Hub restarts; its agent tokens last 24 hours and renew in the background with the repository role re-checked through the connection’s own credential under the same rule as sign-in; opt-in auto-connect connects a checkout of a connected repository at session start, with a fork hint; refusals carry the Hub’s own sentence to the agent, the menu bar app, agentscm open and the CLI; hub whoami, client doctor and the menu bar app show the sign-in; people and admins list and revoke computers. See connect this computer and the design. | Experimental: tested against an in-process fake GitHub and GitLab with the real binary, hook and SQLite, and against a local PostgreSQL for the store; not run against live forges, a hosted Hub or in live agent sessions; the menu bar items are not accepted by a human |
| Native menu-bar companion | Inspect saved checkout connections, recent Hub checks and observed hook/MCP activity, configure agent integrations, open the Hub with a read-only session and opt into Start at Login or conversation sharing per checkout. Included in the existing binary; see install options. | Experimental: macOS only, unsigned and unnotarized, with no independent updater. Local tests and process smoke checks cover startup, singleton launch and restart. Human native UI acceptance, OS login/logout, older-macOS behavior and successful live authenticated browser handoff remain unverified. Missing or expired activity stays unknown; no mobile app is implemented |
| Declared work intent and notices | Agents announce the files they are about to edit; overlapping agents get attributed notices across machines, from the hub API, agentscm intent, a Claude Code hook, the hub’s MCP endpoint or its per-agent hook endpoints (Claude Code, Codex, Cursor, Copilot). See intents. | Implemented (alpha): advisory, except that the first contested edit per session and file is refused once on Claude Code, Codex and Copilot hooks (a repeat passes); notices are collected by long-poll or on the next call, not pushed; only announced work is visible; the hook endpoints are tested with fixture payloads built from each agent’s documentation, not in live agent sessions |
| Asynchronous agent stand-up | Retrieve current unfinished engineering work and a bounded change briefing, atomically claim or join explicit work, report progress/decisions/blockers and leave a resumable handover. Plain Git work and linked GitHub/GitLab issues use the same Hub records. See stand-up. | Implemented (alpha): durable repository-scoped SQLite/PostgreSQL records, CLI/MCP/HTTP participation and read-only Hub inspection; agent checkpoints are self-reports, existing hooks do not infer meaningful progress, stale/unknown remains claimed, and real-client/two-machine/live-forge/PostgreSQL deployment qualification remains incomplete |
| Source-bound change record | Configure a Claude Code checkout to capture bounded session facts and source-bound action receipts, then read a concise intent/source/decision/next-action handoff without transcript access. Existing Codex hooks expose session boundaries and selected edit starts, with narrower coverage. Execution outcome, verification result, applicability, assurance, availability and coverage remain separate. See local change capture. | Experimental (Unix, Claude Code adapter): SQLite/PostgreSQL storage, HTTP/MCP/CLI/UI reads and synthetic adapter fixtures are implemented; private bodies and source snapshots remain in an operator-chosen spool unless a checkout opts into shared-conversation mode, which uploads best-effort-redacted conversation bodies readable only by the person who shared them and Hub admins, kept 30 days by default and deletable early (a first slice of the shared-retention milestone; team retention policy, Hub-side redaction verification, export and live object-store qualification remain open); local Claude Code, browser and interface checks are recorded with their limits in the implementation status; multi-machine and deployment qualification remain pending; Codex does not expose user prompts, assistant messages, every tool completion or retrospective visible history to this adapter and does not provide full-session capture, and other hosts lack equivalent full-session adapters |
| Connected local page and repository explorer | Run agentscm open to browse connected checkouts, committed files, history, diffs and available local conversations/evidence beside shared work. See connect this computer and repository explorer. | Experimental Unix: loopback local service and explicit browser authorization; source browsing is read-only and does not fetch or run checks; committed source, local observations and tested source stay separate; local sharing settings require confirmation to enable uploads |
| Living Promises | Retain immutable owner-authorized commitments, criteria and version history, with stewardship, proposal adoption and advisory agent reports. See Living Promises. | Experimental Workspace foundation: current roles, grants and source admissions govern access; reports do not prove fulfillment; affected-Work resolution and check-specific fulfillment assessment are not implemented |
| Slack coordination messages | Send private direct messages for repeated contested edits, declined handoffs and similar-work notices; let a holder answer their own agent’s handoff. See capability map. | Experimental optional adapter: signed synthetic requests and fake Slack API qualification; live installation, delivery and rendering remain operator checks; no channel posting, workflow execution, approval or landing from Slack |
| External CI and deployment outcomes | Show GitHub Actions push runs and deployments for a landed publication’s exact merge commit beside it in the Hub, separate from source approval and forge_check; missing data is shown as unobserved or incomplete, never as success. See external outcomes. | Experimental: GitHub only, opt-in per repository, polling, observation only (no logs, reruns or gating), tested only against an in-process fake GitHub and not live-verified; GitLab pipelines, Jenkins and webhook hints are unsupported |
| Two-way forge coordination | Observe open pull or merge requests and branches from GitHub and GitLab; optionally post a comment and a status (off by default). | Experimental: GitHub and GitLab, tested only against in-process fakes. The agentscm/coordination status is always success and is not a gate |
| Publish branch and pull request | Turn a native revision exported to a mirror into a GitHub branch and pull request, through the hub. | Experimental: event publication (hub publish) is GitHub only and not yet verified against live GitHub. Attached-worktree candidate publication also creates or adopts GitLab merge requests, tested only against an in-process fake GitLab and never a live or self-managed one. An opt-in publish_forge_status agent-task profile also lets the Hub post an agentscm/workflow/<target> commit status on a candidate pull request only when the pinned read-only native store qualifies the exact candidate and the head matches (GitHub and GitLab merge requests, fakes only; GitLab status is not a merged-result pipeline result, and it is not posted on GitLab merged-result or merge train commits; that binding is not implemented and awaits live verification). The same status is posted on GitHub merge queue groups (Unix, GitHub App connections) only when the group’s base is the candidate baseline, the group commit is built on the base (a single parent that is not the base stays pending as unsupported), and its tree is the qualified revision’s; stacked multi-entry groups stay pending, and this is fake-tested only (see GitHub merge queues). Live GitHub, live GitLab and branch-protection verification are pending, and signed local attestations for laptop-only stores are not part of the Hub (see Local validation attestations) |
| One container, two machines | The hub as a container with shared object storage, with an end-to-end test of two agents on two machine names. | Implemented as compose profiles and an end-to-end test on one host; a test on two real machines is still needed |
| Authenticated team profile | PostgreSQL-backed scoped identities and draft publication through the agentscm team commands. | Partial: no approval or landing admission |
| Automated model review | A bounded review adapter that records coverage and findings against the exact reviewed bytes. | Experimental Claude Code adapter through the finite controller; explicit budget/dispatch reservations and no candidate tools. Broader adapters and live scale qualification remain planned |
| Optional native authority per target | Exact commit-to-revision and pull-request-to-change mappings in the ledger, a verified round trip back to Git and a recorded decision per target, so a team that chooses to can make the ledger the landing authority for one target while Git and the forge stay fully supported. Optional and reversible; most teams can stay on Git. See the path to cutover. | Proposed |
| Supported skills library | Browse a catalog of versioned, declarative workflows (gates, required evidence, roles, when to use them, parameters), adopt them per repository by pinning them in a committed agentscm-skills.lock.json, and have agents record evidence per gate and read where each pull request stands from the CLI, MCP and the Hub Skills page. See the design. | Experimental: one first-party skill (pr-gate v1) on the Git pull-request path. All evidence is self-reported by agents and labelled as such; the review-independence check refuses only a review recorded with the same agent token and session as an author, so it is self-reported beyond that. Enforcement is the opt-in agentscm skill stop Stop hook (author sessions at tests, review and fix, and at any pre-merge gate when HEAD is not the head the run last saw; fails open when the hub is unreachable or the checkout is detached), tested with fixture hook payloads only. The native enforcement for skill gates is planned, not built. The hub reads the lock from the default branch on GitHub (fake-tested) and GitLab (untested), otherwise uses the checkout’s report. Not built: the agentscm/skill/<name> forge status, forge-observed CI/approval/merge evidence, parallel-work and post-merge skills, workspace-level adoption, repo-local, third-party and private skill sources |
| Resource claims | Claim shared host resources (build slots, disk budget, ports, containers) like file intents, with notices on over-subscription and release at session end. Advisory; AgentSCM does not control the build tools. | Proposed |
| Main-red signal | When a post-merge regression pass fails on the target, every session based on or after the failing commit is told it inherits the failure, until a later pass is green. Information, not a merge freeze. | Proposed |
| Orchestrator view | One read-only Hub page across sessions: claims, intents, resource claims, current skill gates, collisions between open branches and the main-red signal. | Proposed |
| Measured scale | Published capacity, latency and cost at tens to hundreds of agents. | Proposed: not measured |
Attached candidate preparation inherits the 100,000-object/128 MiB seed ceiling and refuses shallow metadata and grafts. Journals are finite without pruning; closed/merged PR lineages are terminal. These limits and explicit no-effect prepare abandonment are described in attached Git worktrees. This path does not implement automatic native cutover or history migration.