Update

docs/ROADMAP.md

@@ -0,0 +1,95 @@
+# ForgeFlow roadmap
+
+## Delivered through v0.4
+
+- coherent Local -> Gitea -> Server desktop model;
+- protected Gitea credential storage and strict IPC boundary;
+- real Git status, diff, stage, commit, push, fetch and fast-forward pull;
+- branches, stashes, favorites and automatic local awareness;
+- multiple Gitea Actions and SSH / Unraid deployment profiles;
+- exact-SHA remote-branch validation, runner polling, request-ID verification, health and rollback;
+- five-step readiness/setup wizard;
+- system and deployment preflight engine;
+- structured rotating diagnostic JSONL logs;
+- aggressive credential/path redaction;
+- standard/strict support bundles with SHA-256 and fail-closed safety audit;
+- no automatic ingestion or persistence of raw runner logs;
+- root-owned declarative server target configuration;
+- cross-layer request-ID correlation;
+- canonical end-to-end setup guide;
+- 36 automated tests.
+
+The source is now intended to be locally configured and testable without
+sharing credentials. It remains a developer preview until a real environment
+acceptance pass is completed.
+
+## Milestone A — Real personal acceptance
+
+- run the canonical setup guide on the target Windows machine;
+- connect the actual Gitea instance locally;
+- use one non-critical staging repository;
+- register a narrowly scoped trusted runner;
+- install the target configuration, entry point and status endpoint;
+- pass Deployment preflight;
+- validate commit -> push -> deploy -> status -> health -> rollback;
+- deliberately test stopped runner, wrong branch, missing workflow, failed
+  health and lock contention;
+- export/inspect a strict diagnostic bundle from a failed test;
+- capture only non-secret environment-specific adjustments in documentation.
+
+Exit: one real application can be released and restored without code changes to
+ForgeFlow itself.
+
+## Milestone B — Git completeness
+
+- partial-hunk staging/discard;
+- amend and signing checks;
+- richer branch publication/upstream controls;
+- conflict helper and editor integration;
+- protected-branch awareness;
+- pull-request creation;
+- submodule/worktree policy.
+
+## Milestone C — Desktop operations
+
+- native notifications and system tray;
+- background start preference;
+- notification center;
+- native menus and expanded keyboard navigation;
+- configurable editor/terminal commands;
+- repository attention rules and snoozing;
+- safer periodic remote fetch scheduling.
+
+## Milestone D — Recovery and audit
+
+- append-only audit export distinct from diagnostics;
+- deployment notes and release annotations;
+- explicit reconciliation of externally deployed versions;
+- per-environment recovery runbook links;
+- encrypted configuration backup/restore without token export;
+- deployment freeze and maintenance-window policies.
+
+## Milestone E — Additional controlled adapters
+
+- mutually authenticated ForgeFlow server agent;
+- Portainer stack deployment;
+- systemd adapter;
+- Kubernetes adapter.
+
+Every adapter must retain exact version identity, allowlisting, lock control,
+health verification, diagnostic correlation and no arbitrary shell input.
+
+## Milestone F — Productization
+
+- Windows installer/portable acceptance;
+- macOS/Linux package validation;
+- code signing, notarization and signed updates;
+- dependency/secret/package scans;
+- accessibility review;
+- hundreds-of-repositories performance tests;
+- opt-in privacy-aware crash reporting;
+- documented Gitea/Git/runner support matrix;
+- stable configuration migration rollback policy.
+
+- built-in private-Gitea source updater with backup and rollback;
+- Unraid server inventory, generated basic Compose and exact-SHA SSH deployment.