Roadmap through v1.5.0: bounded builders, Graphify, Board, and supervised Slack

[jeffhuber]

Canonical v1.5.0 critical path — owner-approved, reconciled 2026-09-17

This section supersedes older v1.5 dependency/checklist text below where it conflicts.

1. Audit provenance: Lineage: attest issue-to-PR creation and local audit publication #1020 and Lineage: publish local audits through a verified GitHub workflow #1022 are complete through merged Lineage: attest initial issue-to-PR creation #1021/Publish local audit verdicts through a verified GitHub workflow #1023. Audit publication: verify repository-dispatch workflow identity correctly #1025 is the remaining bootstrap correction for verified repository-dispatch publication.
2. Basic Slack operator surface: merge Slack: explicit private-workspace setup, readiness doctor and runbook #1024 and close Slack: minimal opt-in setup, doctor, and runbook for v1.5.0 #922 after a verified exact-head Claude PASS and authoritative gate.
3. Private operational acceptance: complete CodeMower.com: single-workspace Slack OAuth installation and explicit policy binding #918's isolated-workspace install, immutable binding, rotation, disable, deletion/reinstall, privacy-log, rollout and rollback exercise.
4. Immutable candidate: build one candidate artifact from the intended v1.5 commit; rehearse default Slack-free install, explicit Slack opt-in, v1.4.2 upgrade, disable/uninstall and rollback. Include Fix Graphify inventory limits and frontend test discovery #1007 in package and release notes.
5. Live qualification: after explicit numeric authorization, run Slack: Devin dispatch, clarification, completion, and cancellation bridge #920's completion and cancellation canaries against that immutable candidate. Recommended cap remains 1 ACU each, 2 ACU aggregate, zero automatic recovery creates.
6. Release: finish Release: qualify and publish basic supervised Slack ingress in v1.5.0 #923 exact-head audit/gate, publish tag/package, independently reinstall, reconcile evidence, then close Epic: Basic supervised Slack ingress for v1.5.0 #903 and Roadmap through v1.5.0: bounded builders, Graphify, Board, and supervised Slack #900.

#921/#978 telemetry and hosted analytics, rich Slack UX, Slack Connect, public channels, broad provider selection and optional #951 are v1.5.1 work. Canaries qualify the immutable candidate before final publication; final publication is not a canary prerequisite.

Completion roadmap through v1.5.0

Current position

Release	Result	Canonical evidence	Remaining boundary
v1.4.0	Published and qualified	bounded hosted-builder campaign complete	Devin remains qualified only for bounded builder work
v1.4.1	Published and qualified	Graphify release commit d52bc68396397edfeae782d08a768386f89a00f2; #902/#915 closed	none for the release
v1.4.2	Published and qualified	Board release commit 55339bf1acf76d33be5937e80bdaad772e0b2bf5; #952 closed	#951 remains open only for a separately authorized hosted Devin observation canary
v1.5.0	Active phase	Slack foundations #916/#929 and #917/#933 are merged	deliver and qualify supervised Slack ingress

The repository-wide post-v1.4.2 documentation audit merged through #1009 at 5272bfe33d5d5fc583ab672352ee86f880ec5701. It reconciles installation, Graphify, Board, qualification, release and roadmap guidance. PR #1007 is also merged on main but is not in the immutable v1.4.2 package; its Graphify compatibility fixes will ship in the next appropriate release.

Approved revisions carried forward

1. Precise provider qualification. Transport support, bounded builder eligibility, orchestration authority and merge-review authority remain separate claims.
2. Verified handoff and contributor lineage. Replacement writers require source quiescence; exact-head contributors and reviewers must be reconciled before acceptance.
3. Qualified Slack supervision. Slack is ingress and conversation transport. A separately qualified Codex/Claude supervisor owns dispatch, clarification, review, cancellation and recovery decisions.
4. Independent operational evidence. Implementation completion, provider exit, reviewed head, authorized/settled spend, upload receipt and fresh aggregate visibility remain independent facts.
5. Accurate release and tracker state. A merged change is recorded as shipped only after the verified package or deployment contains it; historical evidence stays bound to its original head.

v1.5.0 delivery map

Wave	Issues	Deliverable
Foundation already accepted	#916/#929, #917/#933	provider-neutral Slack contract and authenticated receipt-before-ack ingress
Parallel prerequisites	#918, #977, #983	hosted OAuth/policy binding; qualified OSS supervisor adapter; isolated headless Codex campaign authentication
Durable interaction and bridge	#919, then #920	durable start/status/cancel/answer flow and supervised hosted-builder bridge
Paired telemetry	#921, then #978	frozen OSS contract/emitters followed by hosted validation, aggregation and fresh views
Setup and operation	#922	optional setup, doctor, readiness and operating guidance
Release convergence	#923	completion/cancellation canaries, adversarial/retry/upgrade checks, hosted rollout/rollback, package publication and final evidence

#951 may run its one bounded hosted observation canary in parallel only after the owner explicitly authorizes a new campaign-wide 1 ACU cap. No prior #935 allowance is reusable. The pending canary does not undo the published v1.4.2 result and no hosted session is implied by roadmap execution.

Delivery contract

• One named Code Mower builder and one writer per branch.
• Every PR requires an independent eligible exact-head audit, zero P0/P1/P2 findings, relevant tests, privacy/package checks, normal CI and authoritative code-mower/gate.
• A changed head invalidates prior audit evidence. Release, tag, package publication and deployment actions remain serialized.
• Board stays a read-only local observation model. Graphify stays optional, local and explicit-refresh. Slack stays authorized ingress under a qualified supervisor.
• Public evidence excludes source, diffs, prompts, task/answer prose, private identities, credentials, raw provider records, private repository names and graph contents.
• Paid campaigns require an explicit per-campaign and aggregate cap, no blind retry after an uncertain create, and separate authorized-versus-settled spend reporting.

Completion gates

• Epic: Devin peer participant and lifecycle support for v1.4.0 #901 — v1.4.0 release and bounded builder qualification
• Epic: qualification, handoff reliability, and operational evidence through v1.5.0 #979 — qualification, handoff reliability and operational evidence
• Epic: Graphify local repository context for v1.4.1 #902/Release: qualify and publish optional Graphify context in v1.4.1 #915 — Graphify v1.4.1 published and qualified
• Epic: Board clarity and provider-neutral session visibility for v1.4.2 #945 implementation and Release: publish and qualify Board clarity v1.4.2 #952 — Board v1.4.2 published and qualified
• Board: integrate head-bound evidence and qualify local and hosted session visibility #951 — optional follow-through acceptance: one newly authorized hosted Devin Board observation canary
• Epic: Basic supervised Slack ingress for v1.5.0 #903 children — supervised Slack implementation, hosted integration and telemetry
• Campaign: support isolated Codex authentication on headless Linux #983 — isolated headless Codex campaign authentication
• Release: qualify and publish basic supervised Slack ingress in v1.5.0 #923 — v1.5.0 qualification, publication and fresh operational evidence
• Fix Graphify inventory limits and frontend test discovery #1007 compatibility fixes included and called out in the next appropriate published release
• Board: manage persistent services and reject stale keepalive bindings during release restart #1001 persistent Board service lifecycle merged for inclusion in v1.5.0
• Release integrity: reject transient publication text in final tags #1014 — prevent stale final-tag state before v1.5.0
• Adoption polish: explain drift direction and stabilize Board startup evidence #1015 — incorporate v1.4.1 adoption evidence polish before v1.5.0
• Lineage: attest issue-to-PR creation and local audit publication #1020 — remove routine owner overrides by attesting issue-to-PR creation and local audit publication

Close #900 only after v1.5.0 is published and every required release, deployment, canary, package and evidence boundary is accepted.

---

Owner-approved v1.5.0 release boundary (2026-09-17)

v1.5.0 ships basic supervised Slack for one private workspace. One explicitly configured qualified Codex or Claude supervisor may accept authorized work and use hosted Devin as a bounded builder. Required user functions are private start, status, clarification answer, completion, and confirmed cancellation. Authorization is restricted by immutable workspace, user, channel, and repository bindings.

Required before publication: #1022; the remaining #918 private administration exercise; minimal #922 setup, doctor, and runbook; two explicitly capped #920 live canaries; fresh install and upgrade rehearsals; hosted rollout and rollback evidence; exact-head release audit; package/tag publication; and final reconciliation through #923.

Deferred to v1.5.1: #921/#978 Slack telemetry and hosted analytics, rich Slack UX, Slack Connect, public-channel posting, broad provider selection, and optional #951 Board hosted observation. The telemetry deferral does not weaken durable local state, provider-exit evidence, privacy, authorization, replay protection, cancellation confirmation, or exact PR/head verification.

[jeffhuber]

Execution started

• Local Board: http://127.0.0.1:5332/
• CodeMower.com dashboard: https://codemower.com/dashboard
• Metadata upload evidence: https://github.com/codemower-ai/code-mower/actions/runs/34684055961
• Active Devin work: Devin: capability model and safe reviewer posture #904, Codex builder
• Active Graphify spike: Context: evaluate official Graphify as a local repository provider for v1.4.1 #876, Claude builder
• Slack contract: Slack: freeze command, identity, lifecycle, privacy, and event contracts #916, planned against the stabilized remote-session lifecycle

The dispatcher selected both active issues in dry-run before applying dispatch. Both builder units use isolated lane checkouts and the normal single-writer contract. Raw task/provider/context/graph content is not part of the cloud upload.

[jeffhuber]

A metadata-only hosted Ubuntu v1.3.1 adoption rehearsal produced three nonblocking follow-ups. These are deliberately outside the Devin v1.4.0 critical path:

• Doctor: scope release-campaign auth readiness to campaign intent on headless hosts #953 — scope release-campaign authentication readiness to actual campaign intent, including truthful headless-host guidance (P2)
• Init: make documented --builders selection work from a fresh repository #954 — make the documented init --builders ... cold-start path work consistently (P2)
• Adoption polish: report effective review authority and superseded Devin bridge drift #955 — render effective reviewer authority, flag superseded Devin bridge drift, and reduce posture noise (P3)

Each should ship as an independently reviewed PR after #912. No P0/P1 issue was reported; install, upgrade, Board, lane status, productivity, and session start --host devin all worked.

[jeffhuber]

Roadmap milestone: Devin v1.4.0 released

The first roadmap capability is complete. Devin peer support shipped in Code Mower v1.4.0, with matching package artifacts, local installation, an exact three-provider cold-install campaign, three upgraded Boards, and accepted metadata-only cloud evidence.

This clears the release-order dependency for Graphify and the later Board and Slack work. The roadmap remains open for those capabilities.

[jeffhuber]

Post-v1.4.0 hosted-Devin dogfood plan

Five representative delivery tasks will be measured through Code Mower:

Order	Issue	Task class	ACU cap	State
1	#960	release/package safety	5	dispatched; sole live writer
2	#954	cold-start init/runtime	2	work order prepared; zero-access preview passed
3	#953	doctor operability/privacy	3	work order prepared; zero-access preview passed
4	#865	repository delivery policy	3	work order prepared; zero-access preview passed
5	#935	session discovery/security	4	work order prepared; zero-access preview passed

Runs 2–5 use the trusted hosted work-order seam with exact repository, issue, branch, base, expected author, PR, and head verification. Run 1 was already created through the provider-neutral remote-session lifecycle; it counts only if hosted Devin remains the sole writer and its resulting PR/branch/author/head are independently verified.

For each run, record create count, dispatch-to-verified-collection time, PR-open-to-merge time, owner and orchestrator interventions, audit/CI fix rounds, recovery episodes, duplicate creates, cap, observed ACU, exact-head audits, gate, merge, and post-merge health. Dollar cost remains unavailable unless the organization-specific contractual ACU rate is available; never report missing cost as zero.

There will be no automatic retry after an uncertain mutation. Subsequent work remains staged until the active run provides a useful completion or intervention signal.

[jeffhuber]

Hosted Devin stabilization dogfood is now 2/5 delivered.

• Release: keep TestPyPI sdist verification source-exclusive without PEP 517 dependency failure #960 / PR Release: keep TestPyPI sdist verification source-exclusive without PEP 517 dependency failure #964: merged; exact-head Codex and Claude reviews passed; one create, no duplicate create.
• Doctor: scope release-campaign auth readiness to campaign intent on headless hosts #953 / PR Doctor: scope release-campaign auth readiness to campaign intent #966: merged; exact-head Codex and Claude reviews passed; one create, one bounded fix round, no duplicate create, no owner intervention.

The second run validated stale-head rejection and same-session recovery, while exposing the post-completion writer quiescence and checked-in labeler parity gaps tracked in #962. Next is #954 from current main, followed by #865 and #935.

[jeffhuber]

Hosted Devin stabilization dogfood is now 3/5 delivered. #954 / PR #969 merged from one create with no fix round, no duplicate create, and no owner intervention. The hosted writer was quiesced before independent Codex and Claude audits, the exact head remained stable, and the gate passed. Next is the tightened #865 delivery-policy work order, followed by #935.

[jeffhuber]

Five-task hosted-Devin qualification scorecard

Decision: Devin is qualified as a bounded hosted builder for small and medium, well-scoped implementation tasks. It is not yet peer-equivalent to Codex or Claude for complex cross-cutting recovery work, orchestration, or merge-eligible independent review. Claude + Codex remain the first-run defaults and required independent review lanes for this campaign.

Observed delivery: 3/5 hosted-Devin samples merged. #865 exhausted five recoveries with a blocked Devin head; #935 remained blocked after two repair commits, and its final authorized recovery was interrupted by an owner task stop before delivering a change. That interruption is not evidence of a completed failed repair. Both user-facing issues were completed separately by Codex; neither replacement counts as a Devin success.

Issue / hosted PR	Class and outcome	Devin head / merge	Dispatch → PR / PR → merge / total seconds	Creates / recovery episodes / fix rounds	Orchestrator / owner interventions	Aggregate ACU cap
#960 / #964	release/package safety; delivered	d6edd41 / db22b1f	668 / 314 / 982	1 / 1 / 0	2 / 0	5
#953 / #966	doctor/headless operability; delivered	ca51eb8 / c28b953	836 / 970 / 1,806	1 / 1 / 1	3 / 0	3
#954 / #969	fresh-install builder selection; delivered	3d0a2dd / e86e486	419 / 243 / 662	1 / 0 / 0	2 / 0	2
#865 / #970	cross-cutting branch/security policy; unsuccessful	b9ef7e4 / unmerged	1,262 / n/a / 13,983 to close	6 / 5 / 5	5 / 0	8 (3 + five × 1)
#935 / #972	checkout session discovery; blocked, final recovery interrupted	541bde0 / unmerged	874 / n/a / 2,973 to close	3 / 2 / 2 completed	7 / 1	6 (4 + two × 1)

Recovery episodes include in-session intervention; they are not all new paid creates. Across the campaign: 12 deliberate creates, zero accidental duplicate creates, and a maximum aggregate authorized cap of 24 ACU. Actual settled ACU and dollar cost remain unavailable. Some collection/provider snapshots returned 0.0; those are unsettled snapshots and must not be reported as zero cost.

The first three delivered samples had zero owner intervention, seven orchestrator interventions, and median total delivery time 982 seconds. #935 adds one owner stop, so the full campaign does not establish zero owner intervention. Its seven grouped operational interventions are label repair, invalid-request handling, first recovery creation, completion prompting, a same-recovery review fix, writer quiescence, and final recovery creation; these are episodes, not raw API-call counts. Its start time is the verified provider create timestamp (2026-09-14 00:33:03 UTC); the public dispatch comment was posted later. The final recovery ran from 01:16:49 to 01:17:19 UTC and delivered no commit.

Sample	Review, validation, and stability evidence
#960	Independent Codex and Claude PASS at d6edd41; 994 focused tests; CI/gate passed. Merged PR #964.
#953	Independent Codex and Claude PASS at ca51eb8; 61 focused tests; CI/gate passed. Post-completion head drift required revalidation. Merged PR #966.
#954	Independent Codex and Claude PASS at 3d0a2dd; 10 focused tests, release readiness 20/20, CI/gate passed. Writer quiesced before review; no final head drift. Merged PR #969.
#865	Final Devin head remained Codex BLOCKED; Claude did not review that final head. Provider suspended; cancel attempt returned invalid_request; settled usage unavailable. Closure evidence. Codex #971 merged as 27aed26 after both exact-head passes.
#935	Initial Claude PASS and Codex BLOCKED; two repaired heads still Codex BLOCKED. Final Devin head passed 110 focused tests but did not clear the merge gate; final-head Claude review did not complete. All hosted writers were confirmed exited before takeover. Supersession evidence. Codex #973 at dcabddf has Codex PASS and Claude PASS; merged as ad4ba61 after full CI regression on Python 3.12/3.13/3.14 and the gate passed. Final immutable-head local regression: 3,492 tests passed (11 skipped). Post-merge: 112 focused tests, tracked-source Ruff, privacy scan, release readiness 20/20; merged tree equals the reviewed tree.

Operating limits: one stable private binding per delivery episode; an explicit ACU cap; no automatic retry after an uncertain provider result; exact PR/head binding for collection and review; quiesce the writer before final review where possible; independent Codex and Claude audits; at most one or two recovery creates before splitting work or switching builders. Target zero owner intervention and record every exception. Devin remains unqualified as an orchestrator or merge-eligible reviewer pending separate evidence.

Lifecycle evidence is recorded on #962: early #935 invalid_request results had invalid request/prose inputs and do not prove the provider refused valid completed-session operations; later keyed fix/cancel succeeded. Repeated manual Devin label repair and replacement lineage are recorded on #963.

Implementation completion: #935 final evidence. Private telemetry has been updated; the final Board snapshot and metadata-only upload are recorded in the campaign closeout.

[jeffhuber]

Hosted-Devin campaign final closeout

The five-task qualification scorecard is final and linked from this roadmap and epic #901. Devin delivered 3/5 samples under the bounded-builder decision. #865 remains unsuccessful Devin #970 / merged Codex #971. #935 remains blocked Devin #972 with a user-cancelled final recovery / merged Codex #973; cancellation is not reported as a demonstrated completed repair failure.

PR #973 merged as ad4ba6129dc90922cba63e20ea0715e424356b79, with exactly the reviewed dcabddf tree. Both independent reviews, CI and the gate passed before merge. The final immutable-head local regression passed 3,492 tests (11 skipped); post-merge checks passed 112 focused tests, tracked-source Ruff, privacy scan, and release readiness 20/20. Issue completion evidence.

Private telemetry records both outcomes, all creates/recoveries/interventions, caps, the interrupted final recovery, and unknown settled billing. Code Mower recorded the final Board state. The local Board now refreshes successfully from the verified checkout and shows the completed campaign with its scorecard link; its transient launchd job was corrected after a refresh failure. Persistent Board service work remains #961.

CodeMower.com returned HTTP 200 and confirmed storage of 3 accepted metadata events (2 builder_run, 1 board_snapshot), 0 duplicate events, 0 reports, and no report text. The exact previewed manifest, repository and private account-profile binding were verified. Author identities, private paths, provider references, raw prompts/responses, and private narrative notes were excluded. No reports were submitted or rejected.

The ingestion response reported aggregateRefreshStatus=stale; this proves accepted event storage, not fresh hosted aggregate views. That freshness limitation remains explicit rather than being reported as a successful aggregate refresh.

Main has no tracked changes. The pre-existing untracked output and temporary directories were preserved.