ForgeFlow/docs/ROADMAP.md

ForgeFlow roadmap

Delivered in v0.8

• partial-hunk staging with staged-only commits;
• guided conflict resolution and safe continue/abort controls;
• Gitea branch-protection awareness and pull-request creation;
• configurable editor/terminal integration;
• deployment freezes, maintenance windows, release notes and overrides;
• append-only audit export and encrypted credential-free configuration backup;
• native notifications, tray, close-to-tray and start-at-login;
• guarded real-environment deploy/rollback acceptance harness.

Delivered through v0.4

• coherent Local -> Gitea -> Server desktop model;
• protected Gitea credential storage and strict IPC boundary;
• real Git status, diff, stage, commit, push, fetch and fast-forward pull;
• branches, stashes, favorites and automatic local awareness;
• multiple Gitea Actions and SSH / Unraid deployment profiles;
• exact-SHA remote-branch validation, runner polling, request-ID verification, health and rollback;
• five-step readiness/setup wizard;
• system and deployment preflight engine;
• structured rotating diagnostic JSONL logs;
• aggressive credential/path redaction;
• standard/strict support bundles with SHA-256 and fail-closed safety audit;
• no automatic ingestion or persistence of raw runner logs;
• root-owned declarative server target configuration;
• cross-layer request-ID correlation;
• canonical end-to-end setup guide;
• 36 automated tests.

The source is now intended to be locally configured and testable without sharing credentials. It remains a developer preview until a real environment acceptance pass is completed.

Milestone A — Real personal acceptance

• run the canonical setup guide on the target Windows machine;
• connect the actual Gitea instance locally;
• use one non-critical staging repository;
• register a narrowly scoped trusted runner;
• install the target configuration, entry point and status endpoint;
• pass Deployment preflight;
• validate commit -> push -> deploy -> status -> health -> rollback;
• deliberately test stopped runner, wrong branch, missing workflow, failed health and lock contention;
• export/inspect a strict diagnostic bundle from a failed test;
• capture only non-secret environment-specific adjustments in documentation.

Exit: one real application can be released and restored without code changes to ForgeFlow itself.

Milestone B — Git completeness

• partial-hunk staging/discard;
• amend and signing checks;
• richer branch publication/upstream controls;
• conflict helper and editor integration;
• protected-branch awareness;
• pull-request creation;
• submodule/worktree policy.

Milestone C — Desktop operations

• native notifications and system tray;
• background start preference;
• notification center;
• native menus and expanded keyboard navigation;
• configurable editor/terminal commands;
• repository attention rules and snoozing;
• safer periodic remote fetch scheduling.

Milestone D — Recovery and audit

• append-only audit export distinct from diagnostics;
• deployment notes and release annotations;
• explicit reconciliation of externally deployed versions;
• per-environment recovery runbook links;
• encrypted configuration backup/restore without token export;
• deployment freeze and maintenance-window policies.

Milestone E — Additional controlled adapters

• mutually authenticated ForgeFlow server agent;
• Portainer stack deployment;
• systemd adapter;
• Kubernetes adapter.

Every adapter must retain exact version identity, allowlisting, lock control, health verification, diagnostic correlation and no arbitrary shell input.

Milestone F — Productization

• Windows installer/portable acceptance;

• macOS/Linux package validation;

• code signing, notarization and signed updates;

• dependency/secret/package scans;

• accessibility review;

• hundreds-of-repositories performance tests;

• opt-in privacy-aware crash reporting;

• documented Gitea/Git/runner support matrix;

• stable configuration migration rollback policy.

• built-in private-Gitea source updater with backup and rollback;

• Unraid server inventory, generated basic Compose and exact-SHA SSH deployment.