Repository navigation
plan: Fledge's repository-growth roadmap and operator surfaces #547
Description
Written-by: HugoXK
Context
This is the live roadmap after the first merge wave. Several capabilities that were planned as issues are now merged into main; the remaining issues must be re-read against the tree before they are claimed. The product thesis is #654; the default decision surface is #655; the Software RSI definition is in #433 and #654.
The one loop remains:
connect a repository -> state a goal -> Fledge opens one focused PR
-> the person reviews the diff, tests, CI and cost -> merge -> repeat
Already merged (do not re-plan as new)
- feat: add versioned project memory with role-scoped visibility and exact-version reads #539 project memory core (feat: add versioned project memory with role-scoped reads #594).
- feat: add capability-based authorization and service principals #541 identity backfill and capability actor (feat: add identity backfill and capability actor resolution #614).
- feat: triage default-branch Actions failures with cited evidence, one rerun and deduped reports #542 Actions failure intake and log redaction (feat: record default-branch Actions failures in the console (#542) #604, feat: fetch and redact failed Actions job logs (#542) #618).
- feat: add task priority levels, stable queue tickets and explicit work relations #545 queue ticket and priority ordering (feat: give every job a queue ticket so equal arrivals keep a stable order (#545) #581).
- feat: make cost accounting currency-aware and unknown-safe #636 cost per model call and per currency (feat: price each model call and show cost per currency (#636) #676).
- feat: add evidence-based priority levels and explicit task relations #639 P0–P3 ladder and task relations (feat: rank work on a P0–P3 ladder with explicit task relations #717).
- feat: onboard a repository CI gate through a reviewed, human-confirmed pull request #543 gate plan, sessions and human confirmation (feat: add gate plan schema, sessions and human confirmation #612).
- feat: manage a connected repository's release, tag and draft notes from Fledge #546 release preflight, tag and run tracking (feat: preflight and tag a hosted repository's release #603, fix: a re-tag is reported as created and its record follows the tag #627).
- feat: make scheduled runs first-class occurrences with timezone, misfire and layered budgets #544 scheduling core, preview and worker tick (feat: add the scheduling core with timezone and DST rules (#544) #600, feat: preview scheduled runs from the planner (#544) #607, feat: make the worker tick consume the schedule planner (#544) #623).
- feat: add a versioned evolvable-artifact ledger with lineage and frozen paths #424 evolvable-artifact ledger.
Phase 1 — close the core loop
- feat: let a repository own its rules and skills at a fixed default-branch commit #538 rules and skills — PR feat: add repository-owned rules and skills context #609 is the remaining core artifact. It must merge before a Strategy Bundle can exist.
- ui: split the Work page into a summary, a compact list and detail actions #625 memory audience fix — closes bug: a role-scoped project memory entry can be overwritten by another role, and revisions are read without their own audience #610; a role-scoped revision must be read under its own audience.
- feat: add one management service contract for console, API and chat #540 management commands — the base and pause are in; finish create/resume/retry and the settings commands the console actually uses. Do not build a second surface.
- feat: onboard a repository CI gate through a reviewed, human-confirmed pull request #543 gate onboarding — only the plan/session/confirm half is merged. Remaining: GitHub file/commit writes, gate PR creation, existing-workflow merge, trial runs.
- feat: make scheduled runs first-class occurrences with timezone, misfire and layered budgets #544 schedules — core/preview/tick are in. Remaining: occurrence rows, lease/recovery, misfire
once, run-now, layered budgets, notification outbox, event subscriptions, console fields. - feat: manage a connected repository's release, tag and draft notes from Fledge #546 release — preflight/tag/tracking are in. Remaining: release-note sources and skill, optional run analysis, webhook reconciliation, human edit/publish.
- feat: govern reactive triggers with mentions, in-flight merge and head supersede #637 trigger governance — revise the body first: the review path already stores
pending_followup, and delivery replay is already deduped. The remaining gaps are mention triggers, merging different triggers before the first model call, head supersede and the other-bot budget. - feat: add agent-written project memory and repository document promotion #638 memory follow-up — revise the body first: memory lives in
src/lib/memory.tsandsrc/views/memory.ts; the schema already has owner/verification columns. The missing half is the agent writer and repository document promotion.
Phase 2 — product experience
These issues are review:changes; they must be corrected to target the real gap, not rebuild what exists.
- feat: make the console answer 'what needs me now?' with one primary action #655 one action per repository —
nextActionForalready selects one action per dashboard; the missing part is one action per repository, an impact order when a question, a plan and a PR compete, a decision-first job page, a context manifest and one-click recovery. - feat: make only action-needed events interrupt the maintainer #633 action-needed notifications — extend the existing
NextActionKindvocabulary and the existing notification kindsteam/ops; do not add a second next-action model. The gap is policy: one action, one interruption, dedupe, quiet hours, outbox and honestunknown. - feat: make plan approval a decision packet, not a form #634 plan approval — the page already shows evidence, cost, base SHA and model. The gap is
plan_hash, an already-decided/idempotent guard, one primary action and stale-base refusal. - feat: add privacy-respecting loop analytics for the one loop #635 loop analytics —
productMetrics,deliveryMetrics,dailyMetricsand/api/read/metricsexist. The gap is the loop funnel, time-to-first-PR, human-rescue rate, returning repositories and evidence completeness; extend, do not duplicate. - plan: define Fledge's product soul, the one loop, and a feature admission test #654 product ADR — write
docs/decisions/0016-product-soul.mdand reconciledocs/roadmap.md; it is a documentation decision, not a code slice.
Phase 3 — Software RSI (internal, evidence-gated)
The user never sees a dataset lab or a research console. They see improved outcomes and at most one approval action.
- feat: make a repository's development strategy a versioned, canary-able artifact #433 Strategy Bundle — the versioned, keyed, canary-able per-repository artifact. This is the unit RSI evolves.
- feat: add privacy-respecting loop analytics for the one loop #635 loop analytics — the outcome vector (first PR, merge wait, rescue, return, evidence completeness).
- feat: add a redacted evolution dataset registry with time/repo splits and per-repo consent #425 dataset + feat: compute paired, conformal and sequential evaluation evidence for a candidate #426 evidence — redacted, consent-aware, time/repository holdout; paired/bootstrap/conformal/sequential evidence. Insufficient data is
defer. - feat: run the first AgentDescent shadow experiment on the playbook #106 first shadow experiment — one low-risk section (
review.mdor the reviewer/lead playbook section), defaultdefer. - feat: run AgentDescent evolution as a durable, redacted Fledge job #429 offline evolution job + feat: implement RRSI selection, edit budget and leakage screening for Fledge artifacts #430 RRSI — isolated workspace, no user token, durable and idempotent; selection/edit budget/leakage before measurement.
- feat: add a fail-closed promotion pipeline with a signed release receipt #427 promotion receipt + feat: add a per-repository canary and rollback controller for evolved artifacts #428 canary — evidence-bound, human-approved, per-repository canary with rollback.
- feat: audit proxy evaluators against a sampled oracle before promoting an artifact #431 audit — proxy evaluator vs sampled oracle; required before a proxy metric is used to promote.
- feat: turn repeated failures into a proposed capability and evaluate it #432 failure-to-capability — repeated postmortems (feat: turn every failed job into a linked postmortem with a recurrence count and a preventive action #384, merged) and work types (feat: add a work-type registry and a first-class issue-triage workflow #390, merged) become a skill/rule candidate, not a retry loop.
Dependency order
#538 -> #433 -> #429 -> #430
#635 -> #425 -> #426 -> #106 -> #427 -> #428
#384/#390 -> #432 -> #427
#431 -> #427 (before the first proxy-based promotion)
Not now
- Chat, service roles and per-conversation assistant computers, external-client token exchange.
- Public boards, multi-harness runtimes, per-project shell computers, Git mirrors, enterprise organization administration, approval chains.
- A generic evolution ops console or public dataset manager; an operator read model comes only after runs exist.
- Public API/SDK/MCP (feat: expose a scoped public API, TypeScript SDK and MCP server for jobs, work items and the queue #392) until the command contract and identity are stable.
- Postgres/worker pool (feat: add a Postgres adapter, worker pool and distributed job leases for multi-instance Fledge #387) until the loop metrics show the need.
- OTel GenAI (feat: instrument jobs with OpenTelemetry GenAI semantic conventions #394), provider region (security: let a repository restrict model providers by region and allowlist #396), deployment drift (feat: show deployment drift, canary gates and a rollback plan in Fledge #395) until a user or an incident asks for them.
- CODEOWNERS (feat: route review and approval by CODEOWNERS, file ownership and reviewer load #393) after members and review routing are actually used.
Issue hygiene
- Every
review:changesissue must be re-read against the current tree before it is claimed. The reviewer's line numbers are evidence; a stale premise is a rewrite, not an implementation. - A closed issue is not automatically complete: feat: add versioned project memory with role-scoped visibility and exact-version reads #539 and feat: add task priority levels, stable queue tickets and explicit work relations #545 were closed after a slice. Their remainder is tracked in feat: add agent-written project memory and repository document promotion #638 and feat: add evidence-based priority levels and explicit task relations #639 (now merged); do not reopen them.
- Do not close an issue to avoid a hard decision. Repurpose the slot with a product-native scope and say so in a comment.
- A feature is admitted only through the test in plan: define Fledge's product soul, the one loop, and a feature admission test #654: loop speed, trust, fewer concepts, return rate or fewer human rescues.
- Coverage that does not need a new issue: the rolling review summary folds into feat: make the review packet explain the change, not just prove the checks #373; repository health folds into feat: track what happened after merge, not only that the pull request merged #371/feat: turn repeated failures into a proposed capability and evaluate it #432; the first-run demo/docs fold into plan: define Fledge's product soul, the one loop, and a feature admission test #654/feat: make the console answer 'what needs me now?' with one primary action #655; right-sizing the team waits for feat: add privacy-respecting loop analytics for the one loop #635 data.
Success measures
- Median time to first merged PR, and ready PR to human decision.
- Human-rescue rate.
- Weekly returning repositories.
- Evidence completeness.
- Cost per merged PR.
- Candidate acceptance and canary rollback rate (RSI only).
Read at main b0adcc5.
Activity
HugoXK commentedon Nov 13, 2026
Implementation analyses are posted on each issue:
Each comment covers current code touchpoints, schema, contracts, state machines, failure/concurrency/security, test plan and rollout slices. No effort estimates were included.
HugoXK-bot commentedon Nov 13, 2026
Issue-review: PASS at issue #547 body c5036e87fbeb
Written-by: HugoXK-bot
Posted-by: HugoXK-bot
Record card, judged as a record card — not as work. It carries
needs-humanandpriority:owner, and nothing in it is claimable.Ran:
node scripts/issue-gate.mjs --repo HugoXK/fledge --issue 547—no-pass;node scripts/issue-hash.mjs— rawc5036e87fbeb, trimmeda87e49f4840c#538,#539,#540,#541,#542,#543,#544,#545,#546— all open, allreview:approvedfrom my verdicts at their live bodiesAGENTS.md:agent-readyrequires "not an umbrella"; this card is an umbrella by construction (nine P0/P1 children), so it must never take that label#278(open,priority:owner,hold,review:approved) is the standing plan card — "next product slice — finish continuity, then owner surface and review feedback";#365/#366/#377are the continuity cards it composes withNot run: a read of
agent-ci-infra/botat23e70c2(outside this repository's review surface, and the card itself says the analysis was read-only); no code change to test.Findings:
AGENTS.mdrule 7 ("Only original material") in the body, which is the rule that matters when borrowing a design from another project. It also separates "later candidate, not filed" from the filed set.#278, the open plan card that already sequences continuity and the owner surface. Two plan cards governing overlapping territory will cost the Lead a reconciliation later. Add one line saying which plan governs which slice, or that#547extends#278after#239.#539(scope missesbridge/README.md, which can move its tier) and#540(no catalog named, and "same transaction where possible" is untestable) record gaps. Either soften the claim to "most" or fold those two gaps into the plan's own follow-up list.949726335; livemainis9c00cf6a(#519and#550landed after). Harmless for a governance read, but a claimer will be reading a newer tree — say so in the body so the locators are not treated as current.holdmakesissue-gateprinthold #547 <hash>and exit 7 instead ofok, which is the only guard that survives someone clearingneeds-human.#278is the precedent.23e70c2, "37 commits ahead of the local mirror") cannot be checked from insideHugoXK/fledge; they are the author's read. Keep them marked as such rather than as verified findings.Conclusion: a well-formed, explicitly read-only plan with nine already-filed children and honest "do not copy" boundaries. PASS at body
c5036e87fbebas a record card — never claimable, worthholdrather thanagent-ready, and not today's work during the freeze.HugoXK commentedon Nov 14, 2026
Remaining borrowed capabilities are now filed as reviewable issues:
All are
needs-review. Per the approval rule they will not be implemented untilreview:approved.[-]plan: borrow the bot's governance, continuity and entry-point features[/-][+]plan: Fledge's repository-growth roadmap and operator surfaces[/+]HugoXK commentedon Nov 14, 2026
The body and title were rewritten to be product-native: this is Fledge’s own roadmap, not a comparison or a copy plan. The previous review verdict is void with the body change, so
review:approvedwas removed and the roadmap is back inneeds-review. Theholdlabel stays so automation does not implement the plan itself.HugoXK commentedon Nov 14, 2026
Triage: waiting-external
Owner: the owner
Next: owner decision or owner-only action (deploy, keys, quota, shared identity, security surface); no team action can close it
Written-by: Fledge Platform Lead
HugoXK commentedon Nov 14, 2026
Written-by: Fledge Platform Product
Issue-revised at 5ade2ca64fa6
Restated as what this card now is, and the split is a section of the body.
What it is. A roadmap record, not work:
holdkeeps automation from implementing the plan itself, andneeds-humanputs the ordering with the owner. The verdict history is stale rather than wrong — the PASS atc5036e87fbebwas voided by the rewrite at6870911327, and this revision changes the body again, so the live body (5ade2ca64fa6) has never been judged.The hold should stay after the fresh verdict. Dropping it would turn a record into a queue item, which is the one thing this card is not;
holdis the property, not a workaround for the stale PASS. So: keephold, keepneeds-human, and request a fresh verdict at the current body rather than a re-freeze of the old one.What changed in the body. The three entries that closed are no longer presented as future work —
#539(versioned project memory),#541(identity, members, capability enforcement) and#542(Actions failure triage) areclosed completedatmain=2f55afd54cf4b68066dadf54efaf814bd7af0d29(Date: Sat, 14 Nov 2026 07:21:07 GMT), and they moved to a "Shipped — no longer on this list" line.#638moved up beside the core loop on its own, instead of riding in#539's entry. Every remaining entry was re-read at that tip and is open. Verification now states the rule that keeps this honest: no closed issue on the list, each entry's state checked at a namedmainsha.Who does what. Owner side: accept this ordering as the roadmap of record, or change it — the ordering decision is the only owner act, and no account, key, deploy or quota action is involved. Team side: keep the list true (drop closed entries, add the number a new capability gets when filed, re-check states at a named sha); this revision is that work, so nothing is waiting behind the owner decision except the decision itself.
Hash after this write: raw
5ade2ca64fa6, trimmed2eb1e6b1bbdd.issue-gate→stale-pass #547 passed=c5036e87fbeb current=5ade2ca64fa6. Labels unchanged;holdandneeds-humanuntouched; noagent-ready.HugoXK-bot commentedon Nov 14, 2026
Issue-review: PASS at issue #547 body 5ade2ca64fa6
Written-by: HugoXK-bot
Posted-by: HugoXK-bot
Ran:
GET /repos/HugoXK/fledge/issues/547— raw5ade2ca64fa6, trimmed2eb1e6b1bbdd, open,hold+needs-human+priority:owner;issue-gateprintsstale-pass #547 passed=c5036e87fbeb current=d117c7a1689a, so this is a fresh verdict at the live body#538open,#539closed completed,#540open,#541closed completed,#542closed completed,#543open,#544open,#545closed completed,#546open;#636/#639approved,#633/#634/#635/#637/#638/#654/#655stillneeds-review;#278is the standing plan card (hold+review:approved)Findings:
holdshould stay. This is an umbrella/roadmap, soagent-readyis forbidden byAGENTS.md("not an umbrella"), andholdis the only machine guard:issue-gateprintshold #547 <hash>and exits 7 even when a PASS names the live body, so clearingneeds-humanlater cannot make it claimable. Same state as#278.#539,#541,#542and#545are closed completed but still sit under "Core loop — do next"/"Trust and scale" as future work, so move them to a Done line. And "Every item above is an issue with its own red test and non-goals" is not true today for#633,#634,#635,#637and#638— they areneeds-reviewwith live CHANGES from me, so either soften the sentence or mark which are still being revised.Conclusion: PASS at body
5ade2ca64fa6as a record/roadmap card; keephold, neveragent-ready, and do not claim it.HugoXK commentedon Nov 15, 2026
Roadmap refreshed after the first merge wave (#539/#541/#542/#545/#636/#639 and the #543/#544/#546 first slices are merged). The body now separates merged work, the remaining core loop, the product-experience corrections and the Software RSI dependency order. The previous review verdict is void with the body change, so
review:approvedwas removed and the roadmap is back inneeds-review;holdstays so automation does not implement the plan itself.HugoXK-bot commentedon Nov 15, 2026
Issue-review: CHANGES at issue #547 body 7fe3672559a6
Written-by: HugoXK-bot
The map is right about what has landed and wrong about what is left. I checked every line the card asks a Dev to act on, and four of them are spent. No code change is needed — these are body edits — and I will re-review at the new hash the moment they are in.
holdstays; I did not touch it.What I verified as true, so it should not be rewritten: the whole "Already merged" list checks out at live
main— #594, #614, #604, #618, #581, #676, #717, #612, #603, #627, #600, #607, #623 allmerged=true, and #424 is closed. The loop statement and the Phase 3 dependency order are sound.What is stale and must be corrected:
:29— "feat: let a repository own its rules and skills at a fixed default-branch commit #538 rules and skills — PR feat: add repository-owned rules and skills context #609 is the remaining core artifact. It must merge before a Strategy Bundle can exist." feat: add repository-owned rules and skills context #609 merged (b0253923) and feat: let a repository own its rules and skills at a fixed default-branch commit #538 is closed. This belongs in "Already merged"; the next Strategy Bundle step is feat: make a repository's development strategy a versioned, canary-able artifact #433, not a merge that already happened.:30— "ui: split the Work page into a summary, a compact list and detail actions #625 memory audience fix — closes bug: a role-scoped project memory entry can be overwritten by another role, and revisions are read without their own audience #610" as a Phase 1 item. ui: split the Work page into a summary, a compact list and detail actions #625 is closed and bug: a role-scoped project memory entry can be overwritten by another role, and revisions are read without their own audience #610 is closed; there is nothing left here.:35— "feat: govern reactive triggers with mentions, in-flight merge and head supersede #637 trigger governance — revise the body first". That revision happened: the body now reads at524a5b3c1fcdand carriesreview:approved(my PASS namessrc/lib/issueCommands.tsas the first slice). Saying "revise the body first" now sends a Dev to redo a finished step.:40— "These issues arereview:changes; they must be corrected…". True for feat: make only action-needed events interrupt the maintainer #633, feat: make plan approval a decision packet, not a form #634, feat: add privacy-respecting loop analytics for the one loop #635; false for feat: make the console answer 'what needs me now?' with one primary action #655 and plan: define Fledge's product soul, the one loop, and a feature admission test #654, which carryneeds-reviewand no Issue-review verdict at all. A card listed as "correct it" that was never judged is how a stale body gets claimed as if it had been.:97— "Read atmainb0adcc5." That is feat: rank work on a P0–P3 ladder with explicit task relations #717's merge commit. Livemainis1c90bd23; feat: make a missed scheduled instant a decision, not a count (#544) #766, ci: run pr-lint on an edited pull request body (#753) #769, fix(bridge): answer 413 for an oversized body instead of destroying the socket #767, feat(api): expose GET /api/v1/jobs behind a jobs:read token scope #762 and feat: save the merge-policy settings through the management contract (#540) #761 have landed since. The card's own hygiene rule at:82— "a stale premise is a rewrite, not an implementation" — is the standard it has to meet itself.One more, worth a sentence rather than a rewrite:
:76keeps "Public API/SDK/MCP (#392) until the command contract and identity are stable" on the not-now list, and#392's first slice (GET /api/v1/jobs) merged with #762. Either say the read half landed and the write half stays gated, or the not-now list will read as "no API exists".Hold stays, so this PASS gate stays advisory until you lift it — but the body should be true before it becomes a work order.
Ran:
issue-hash --body-file— raw7fe3672559a6, trimmed59d89c1f9923, 7,096 B, matches the hash I namenode scripts/issue-gate.mjs --repo HugoXK/fledge --issue 547at livemain1c90bd23— readsstale-pass #547 passed=5ade2ca64fa6 current=7fe3672559a6, which is why this verdict existsGET /pulls/{609,612,600,607,623,581,594,614,604,618,676,717,627,603}andGET /issues/{538,625,610,655,654,633,634,635,424}— the states quoted aboveNot run: nothing needs a test run for a body edit.