Repository navigation
Roadmap: upstream parity, local correctness and product delivery #1056
Description
Owner-confirmed V5 release gate — 2026-11-01
Continue development and upstream ports autonomously; Antigravity is mandatory V5 work, not an interruption of the current sequence (#1398, coordinated with #1369).
V5 is not ready to release until:
- Every tracked issue has its required implementation in linked, merged PRs and all acceptance obligations are met.
- All DurinDoor PRs are merged. Duplicate/superseded or incompatible proposals are not silently counted as complete; any exception needs explicit owner disposition.
- Upstream corrections are incorporated, and every new upstream PR through the final release reconciliation is accounted for and its applicable completed change is incorporated.
- Fresh repository-required validation and review prove the integrated release head. Drafts, focused tests, stale receipts and open implementation branches are not completion.
Open/unmerged upstream proposals remain tracked pending source review/merge; they are not blindly imported. Refresh source heads and the PR inventory before the final release decision. Preserve existing security, credential, license, live-evidence and repository approval requirements. No V5 publication is authorized merely because this checklist was recorded.
Current delivery cycles and AI execution contract
V5 covers stability, new functionality and a new interface. Use the existing private Project. The four roadmap milestones remain the phases; Delivery Cycle groups related outcomes, and Execution Step selects a small packet inside a cycle. A cycle is not one giant PR, a new issue, a promised date, or automatic acceptance of every candidate.
Release blocker map: six tracked release/work blockers, unblock evidence and decision ownership in #1067. This is a tracking register; implementation remains in the linked canonical issues.
The current planning map covers 200 open issues and 35 open PRs, with 29 delivery outcomes plus Portfolio / Reference. There are 83 bounded issue packets; each has at most 4 distinct canonical issues. Repeated appearances of a canonical issue are smaller sequential slices, not duplicate checklists. Structural epics/inventories are navigation, not implementation assignments.
Readiness and permission boundary
- Ready for discovery: only the named read-only source/contract/design step is ready. Do not write code, run tests, enable a provider, make live calls or spend quota from this state alone.
- Ready for AI: a bounded implementation/review packet has explicit prerequisites and an approved write set. None is claimed at this planning snapshot.
- In flight / coordinate: existing PR/claimed work; reconcile the owner, exact head and residual scope before starting another writer.
- Waiting prerequisite: the listed predecessor/contract is unresolved; independent source research may continue.
- Human gate: source/owner, trust, runtime, live-evidence or license decision is missing.
- Needs refinement: acceptance exists, but the next implementation slice/write set still needs preparation.
- Portfolio/reference items have no execution step or AI readiness. Status, priority, V5 scope, workstream and milestones retain their separate meanings.
Every executable issue has its cycle, packet, readiness and exact next action in the top table of its existing epic. Read that row and the canonical issue together. The current 92 discovery-ready issues are source/design work only. Planning/grouping does not authorize code execution, credential use, CI/status publication, branch changes, merge or release. Those need the applicable task authorization and repository gates.
Existing phases and entry/exit gates
| Existing milestone | Work and exit |
|---|---|
| 1 Correctness and safety | Protocol/media loss, crypto/privacy, authorization, paid usage and installed-artifact contracts. Exit: selected acceptance verified and fresh exact-head gates; draft presence is not completion. |
| 2 Provider, routing and compression coverage | Qualify independent provider contracts; prove routing/cost boundaries and compression fidelity before enabling behavior. |
| 3 Operator and developer workflows | Deliver selected telemetry, CLI, agent and dashboard workflows; mandatory new-UI acceptance is #1300. |
| 4 Optional advanced capabilities | Selected memory/cache, advanced identity, experiments and packaging require explicit opt-in/design evidence. Optional/P3 does not itself exclude them from V5. |
Cycle numbers are coordination IDs, not a new serial stage chain. Source research and UI discovery can start in parallel with Stage 1. Existing milestones, native parents and hard dependencies stay authoritative.
Start queue: three small reconciliation packets
- C01.01:fix(crypto): prevent concurrent first-start master-key creation races #1086, fix(audit): read provider identities from exports instead of filenames or first nested IDs #1087, fix(privacy): redact MiMo OAuth takeover diagnostics #1088. Reconcile existing fix(crypto): publish first-start keys atomically #1265, fix(audit): derive provider identities from exports #1266, fix(privacy): redact MiMo login diagnostics #1267. Independent investigations can proceed in parallel; serialize final gates/integration.
- C02.01:fix(translator): Stop injecting the Claude Code persona into compatible providers #1075, fix(translator): Preserve tool failure semantics through the Claude to OpenAI bridge #1077, fix(translator): Define a lossless or explicit-rejection contract for redacted thinking #1081. One shared-translator writer; preferred sequence fix(translator): preserve client system authority #1257→fix(translator): preserve tool failure semantics #1260→fix(translator): protect opaque thinking continuity #1258.
- C02.02:fix(translator): Reject unsupported OpenAI audio blocks instead of silently discarding them #1076, fix(translator): Honor client output limits when translating requests to Kiro #1078, fix(translator): Preserve supported remote images on the Kiro request path #1079, fix(translator): Make Cursor image handling explicit instead of silently dropping image input #1083. Serialize fix(kiro): reject unverified output-limit enforcement #1263→fix(kiro): reject unresolved remote image loss #1255 for Kiro and fix(translator): reject unsupported audio blocks #1259→fix(cursor): reject unsupported image input explicitly #1262 for chatCore.
Prepare the selected #1296 dependency/lockfile slice early with #1150/#1144 so later full-gate/artifact receipts are not invalidated. This is an efficiency recommendation, not a new hard dependency on every issue. In parallel, resolve #1300’s actual UI branch/PR and owner. The 193 audited published branches contained no identified dedicated V5 UI source; do not invent it.
Small-step execution loop and handoff
- Qualify: read current issue and applicable AGENTS.md; pin current main, source revision and existing PR head; compare local equivalent and every original/transferred acceptance criterion.
- Bound: select one outcome, explicit non-goals, literal existing/proposed paths, failure/negative controls and one write owner. Discover missing paths before edits.
- Implement or reconcile: preserve source deltas; use a separate focused PR for independent acceptance. Stop if scope, credential/runtime needs or shared-risk files exceed the agreed boundary.
- Review and prove: independent reviewer; focused feedback first, then required trusted exact-head gates. No baseline additions, skipped security tests or timeout/concurrency workarounds.
- Handoff: exact base/head, source-delta disposition, diff paths, original acceptance IDs, command results/receipt hashes, reviewer, remaining risks and next bounded action. Merge alone does not mark acceptance Done.
Ownership: repository CODEOWNERS lists@bloodf; this plan assigns no person. Confirm current branch ownership. One writer per shared translator/chatCore/RTK, auth/native-resource, DB/accounting, registry/capability/pricing, manifest/lockfile or UI integration surface. Independent source review is parallel-safe; isolated fixtures may be parallel only after path ownership. One integration/gate owner serializes composed proof.
Dependency graph: hard edges versus coordination
- Existing native hard edges: port(omniroute): add compression fidelity evaluation and protected-block gates #1099→port(omniroute): add adaptive context budgets and explicit plan precedence #1100/port(omniroute): isolate expensive compression in bounded workers #1101/research(compression): evaluate opt-in context-as-image encoding #1103; port(omniroute): add explainable cost and latency routing policies #1104→port(omniroute): add routing shadow evaluation and quality feedback #1109; port(omniroute): add an authenticated A2A agent card and task API #1116→port(omniroute): add discoverable agent skills and controlled orchestration #1122; port(omniroute): add optional persistent memory with caller isolation #1124→port(omniroute): add configurable embedding and hybrid memory retrieval #1125/port(omniroute): evaluate Obsidian, Notion and local-corpus context connectors #1126/port(omniroute): add memory inspection and retrieval evaluation UI #1127; port(omniroute): add configurable embedding and hybrid memory retrieval #1125→port(omniroute): add memory inspection and retrieval evaluation UI #1127; port(omniroute): coordinate quota and rate limits across instances #1107→port(omniroute): evaluate Kubernetes deployment manifests #1146; chore(runtime): plan Node support upgrade and artifact compatibility matrix #1143+test(release): verify npm, Docker and standalone runtime dependency closure #1144→port(upstream): evaluate reproducible Nix packaging #1147; feat(ui): track V5 interface integration and release acceptance #1300→Epic: Release quality, runtime compatibility and deployment #1067 final release.
- Release contracts: compression engines need port(omniroute): add compression fidelity evaluation and protected-block gates #1099 fidelity evidence before enabling; new caller-owned agent/cache/memory surfaces preserve test(security): audit authorization across aliases and native resource routes #1115 authorization; routing unknown-price semantics use fix(usage): complete paid usage, price provenance and dollar-budget accounting #1085 cost provenance. These do not imply every research step is blocked.
- Source preservation: current fix(translator): reject unresolved image file IDs #1256 has newer converter/public POST residuals absent from fix(translator): integrate Responses media validation and tool-output compatibility #1297; reconcile before accepting fix(translator): integrate Responses media validation and tool-output compatibility #1297. Current fix(translator): repair Gemini stream usage, Chat to Claude parallel limit, nested tool_result document #1274 is contained in fix(translator): integrate Responses media validation and tool-output compatibility #1297. fix(providers): integrate discovery and provider boundary regressions #1298 composes test(provider): distinguish xkiro candidate from native Kiro contracts #1286–fix(providers): discover compatible models relative to stored API base #1295 source blobs but does not complete nine provider issues.
- fix(mcp): integrate diagnostic privacy boundaries and regressions #1284 delivered the older docs: record partial OmniRoute security audit source inventory #1268/fix(mcp): sanitize consumer error boundaries #1269/fix(mcp): sanitize rendered retry and list diagnostics #1270 stack; newer fix(mcp): sanitize rendered retry and list diagnostics #1270 sanitizer residual remains active. Reconcile fix(stream): redact translated upstream errors and preserve passthrough errors #1276 against the selected Responses/sanitizer contracts. Reconcile feat(accounting): attribute durable paid usage and enforce per-key dollar budgets #1275 accounting against native ownership/stream contracts.
- ci: move pull request checks to exact-sha local runner #1272 retains a hosted-workflow policy decision after newer runner amendments already merged. Decide that residual separately; it is not a universal blocker and the old runner must not replace current main.
- Shared-file serialization is a coordination constraint, not a new native issue dependency. No extra issues are closed by grouping.
Outcome cycles and bounded packets
C01 Trust foundations
C01 Trust foundations
Shared write boundary: src/lib/, scripts/, tests/unit/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C01.01 01 auth, identity and redaction | #1086, #1087, #1088 | Reconcile the three existing PRs with current main; preserve first-start crypto safety, exported provider identity semantics and diagnostic redaction. Exit: Each focused regression and exact-head review is current; shared full-gate execution is serialized. |
| Non-goal: No new identity model, bulk provider enablement or production credential access. |
C02 Translator fidelity
C02 Translator fidelity
Shared write boundary: open-sse/translator/, open-sse/handlers/chatCore.js, open-sse/rtk/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C02.01 01 persona, tools and thinking | #1075, #1077, #1081 | Integrate bounded existing fixes for persona injection, tool failures and redacted thinking. Exit: No silent tool/thinking loss; serialize overlapping translator edits: PR #1257 then #1260 then #1258. |
| C02.02 02 media and output limits | #1076, #1078, #1079, #1083 | Verify explicit audio rejection, Kiro output limits/remote images and Cursor image handling. Exit: Serialize #1263→#1255 for Kiro;1259→#1262 for chatCore; complete each client-format regression. |
| Non-goal: No broad translator rewrite or simultaneous writers in shared translators/chatCore. |
C03 Responses conformance
C03 Responses conformance
Shared write boundary: open-sse/translator/, open-sse/handlers/chatCore.js, tests/unit/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C03.01 01 residual then integration | #1080, #1089 | Reconcile newer PR #1256 converter/public POST residual with PR #1297 and the canonical cross-format schema matrix. Exit: Verify newer #1256 bytes/tests are not lost, review #1297 against current main and retain all #1089 residual matrix cases. |
| Non-goal: Do not call #1256 superseded by #1297; no claiming all protocol conformance from a partial draft. |
C04 Security closure
C04 Security closure
Shared write boundary: src/lib/, src/app/api/, package.json, package-lock.json, tests/unit/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C04.01 01 dependency and diagnostic slices | #1150 | Record a finding-to-local-call-path disposition matrix. Reconcile #1296 dependency/lockfile evidence early, then #1270 sanitizer and #1276 stream slices. Exit: Every source finding has reproduced/fixed/not-applicable evidence; no blanket upstream vulnerability claim. |
| C04.02 02 authorization matrix | #1115 | Complete canonical/alias/encoded path and caller-owned native-resource authorization evidence. Exit: Anonymous/wrong-key/cross-caller denial and allowed flows pass for the full advertised route matrix. |
| C04.03 03 opt-in masking boundary | #1112 | Specify one bounded masking flow and opt-in/redaction limits before implementation. Exit: Preserve off/default behavior; test masking failures, false positives and no credential disclosure. |
| Non-goal: Do not combine dependency remediation, authorization and new masking into one PR; no security claim based only on upstream status. |
C05 Paid usage accounting
C05 Paid usage accounting
Shared write boundary: src/lib/db/, src/app/api/, open-sse/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C05.01 01 ledger and provenance | #1085 | Define event identity, known/unknown price state and durable cost provenance for existing paid modalities. Exit: Canonical paid-event/unknown-cost contract and DB migration tests are reviewed. |
| C05.02 02 synchronous modality records | #1085 | Cover image/audio/embedding/rerank success/failure accounting against the approved ledger. Exit: No successful paid call is silently free; no failed request is charged without provider evidence. |
| C05.03 03 asynchronous dedup and budgets | #1085 | Close polling/retry duplicate-charge and dollar-budget/reporting residuals, preserving #1275 history. Exit: One charge per billable event and consistent budget/report/export totals. |
| Non-goal: No arbitrary price estimates labelled provider-reported; no separate reimplementation of closed #1133. |
C06 Artifact compatibility
C06 Artifact compatibility
Shared write boundary: package.json, package-lock.json, .github/, cli/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C06.01 01 installed artifact closure | #1144 | Complete clean packed npm/Docker/standalone smoke evidence after dependency baseline is settled. Exit: Health/auth/static/provider discovery and optional-runtime prerequisites verified without publishing. |
| C06.02 02 runtime and release matrix | #1143, #1145 | Define supported Node/artifact combinations, then verify manifest/provenance consistency. Exit: Supported combinations have reproducible evidence; unsupported ones are explicit. |
| C06.03 03 opt-in deployment variants | #1146, #1147, #1141 | Qualify Kubernetes, Nix and desktop/PWA independently; implement only selected variants in separate PRs. Exit: Each variant retains its independent entry prerequisites, artifact tests and product acceptance. |
| Non-goal: No package publication, deployment, generated credentials or forced adoption of optional packaging. |
C07 Compression safety
C07 Compression safety
Shared write boundary: open-sse/services/compression/, open-sse/handlers/chatCore.js, open-sse/rtk/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C07.01 01 offline fidelity corpus | #1099 | Freeze corpus classes and expected invariants from the issue, compare current engine behavior and source evidence without enabling an engine. Exit: Versioned corpus/expected outcomes and estimated-vs-reported token distinction are approved; implementation tests follow the trusted gate. |
| C07.02 02 safe plan integration | #1093, #1098, #1100 | Qualify Lite invariants, one-pass RTK stack placement and explicit adaptive plan precedence. Exit: No double compression or protected-block loss; enabling new engines waits for #1099 fidelity evidence. |
| Non-goal: No default enabling before fidelity evidence; no README savings claims treated as measurements. |
C08 Compression engines
C08 Compression engines
Shared write boundary: open-sse/services/compression/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C08.01 01 retrieval and bounded outputs | #1092, #1102 | Implement independently bounded callable retrieval and Responses tool-output compression contracts. Exit: Denied/unavailable retrieval and failed compression leave source content usable; independent criteria pass. |
| C08.02 02 relevance and aging | #1094, #1095 | Qualify query-aware relevance and progressive summaries as separate engines. Exit: Preserve protected semantics across disabled/success/unchanged/failure/mixed-stack cases. |
| C08.03 03 optional model backends | #1096, #1097 | Select and bound LLMLingua and small-model runtime/resource contracts before enabling either. Exit: Backend absence, limits and fail-open paths documented and tested. |
| C08.04 04 workers and image research | #1101, #1103 | Isolate expensive work after #1099; evaluate context-as-image as a distinct research deliverable. Exit: Worker resource limits are proven; image encoding has an evidence decision rather than automatic runtime promotion. |
| Non-goal: No eight-engine implementation batch; no inferred shared acceptance across engines. |
C09 Routing reliability
C09 Routing reliability
Shared write boundary: open-sse/handlers/chatCore.js, open-sse/services/, src/lib/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C09.01 01 deterministic selection and recovery | #1104, #1108 | Define explainable cost/latency scoring and per-connection circuit recovery without replacing existing hard filters. Exit: Unknown costs never rank free; cold starts/ties/probes are bounded and explainable. |
| C09.02 02 pressure and distributed quota | #1106, #1107 | Bound local admission first; qualify multi-instance coordination separately against explicit storage/runtime contracts. Exit: Pressure shedding is deterministic; distributed quota cannot weaken per-key/connection limits. |
| C09.03 03 measured routing experiments | #1105, #1109 | Evaluate hedging and shadow feedback behind independent opt-in policies. Exit: Cancellation, additional cost and shadow isolation are measured;1109 follows #1104. |
| Non-goal: No adaptive policy silently replacing capability/auth filters; no mandatory distributed service. |
C10 Operational visibility
C10 Operational visibility
Shared write boundary: src/lib/, src/sse/utils/requestCorrelation.js, src/app/api/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C10.01 01 secure metrics and traces | #1129, #1128 | Deliver authenticated operational metrics/runtime pressure and opt-in bounded telemetry with redaction. Exit: No raw prompts/credentials; exporter failure does not fail inference;1129 includes consolidated #1132 acceptance. |
| C10.02 02 attribution and evaluations | #1131, #1130 | Add agent/project attribution and explicit evaluation runs as independently testable outputs. Exit: Stable attribution respects caller boundaries; evaluation costs/results do not masquerade as production traffic. |
| Non-goal: No public metrics endpoint or implicit external telemetry. |
C11 Media contracts
C11 Media contracts
Shared write boundary: open-sse/, src/app/api/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C11.01 01 native capability contracts | #1090, #1135, #1136 | Verify nested tool images, transcription parity and endpoint-specific discovery/pickers. Exit: Advertised media capabilities match native endpoint semantics and unsupported inputs fail explicitly. |
| C11.02 02 opt-in bridges | #1134 | Decide a single explicit bridge contract, external processing and cost implications before implementation. Exit: Bridge stays off by default; provenance, consent, cost and unsupported formats are explicit. |
| Non-goal: No synthetic support claims or automatic cross-modality external processing. |
C12 V5 interface delivery
C12 V5 interface delivery
Shared write boundary: src/app/(dashboard)/dashboard/, src/shared/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C12.01 00 source and ownership gate | #1300 | Link the actual V5 UI branch/PR and integration owner, then enumerate affected existing screens and release acceptance. Exit: User/maintainer identifies source; no dedicated published UI branch was found in the audited 193 branches. |
| C12.02 01 account workflows | #1300, #1142 | Integrate the supplied UI slice and independently close selection/filter/pagination/readiness UX criteria. Exit: UI release contract and account-workflow criteria pass without exposing secrets or auto-pruning models. |
| C12.03 02 playground comparisons | #1137 | Implement a bounded comparison flow after current UI integration surface is agreed. Exit: Explicit selected models, supported modalities and cost/error handling. |
| C12.04 03 optional model intelligence | #1139, #1140 | Qualify comparison UI and signed catalog feed independently of mandatory new-UI acceptance. Exit: Feed trust/freshness/failure contract and UX behavior are independently reviewed. |
| Non-goal: No invented visual requirements, new UI branch or owner; no optional catalog feature made a mandatory release gate. |
C13 Agent APIs
C13 Agent APIs
Shared write boundary: src/lib/mcp/control/, src/app/api/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C13.01 01 authenticated interfaces | #1116, #1118 | Deliver A2A task/discovery and signed operator event webhooks in separate bounded PRs after authorization matrix. Exit: Cancellation/lifetime/caller isolation and webhook signing/replay/failure behavior are independently proven. |
| C13.02 02 skills orchestration | #1122 | Extend approved #1116 surfaces with discoverable skills and controlled orchestration. Exit: Only supported capabilities advertised; limits and authorization remain explicit. |
| Non-goal: No unbounded agent execution or general-purpose orchestration bundled into interface delivery. |
C14 Operator processes
C14 Operator processes
Shared write boundary: cli/, src/lib/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C14.01 01 remote CLI | #1138 | Add one reviewed remote-admin command family with scoped credentials and machine-readable outcomes. Exit: Current launcher stays compatible; every path parameter resolves and exit codes are stable. |
| C14.02 02 local agent processes | #1117, #1121 | Qualify registered local ACP agents and optional service supervision separately. Exit: Explicit installation, startup/shutdown, limits and failure ownership before implementation. |
| C14.03 03 remote coding jobs | #1120 | Select bounded cloud job lifecycle and provider/credential contract before implementation. Exit: Opt-in, cancellation, cost/credential boundaries and caller isolation are approved. |
| Non-goal: No process launch, deployment, cloud spend or persistent credential setup from this planning task. |
C15 Identity and extensions
C15 Identity and extensions
Shared write boundary: src/lib/, src/shared/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C15.01 01 caller identity design | #1113, #1114 | Evaluate Entra inference-client auth and organization/member/cost-center boundaries as separate design outputs. Exit: Trust boundaries and local compatibility approved before migrations or auth changes. |
| C15.02 02 executable extensions | #1119 | Separate metadata manifests from executable plugins and define version/trust/install boundaries. Exit: Offline core registry works without plugins; no extension overrides core policy. |
| Non-goal: No automatic executable plugin loading or unapproved new tenant identity model. |
C16 Isolated memory
C16 Isolated memory
Shared write boundary: src/lib/db/, src/app/(dashboard)/dashboard/, src/app/api/. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C16.01 01 cache and local memory | #1123, #1124 | Specify independent opt-in cache and caller-isolated local memory retention/storage contracts. Exit: Disabled defaults, namespaces, TTL/export/delete and cross-key isolation pass after #1115. |
| C16.02 02 retrieval and connectors | #1125, #1126 | Add configured retrieval and separately qualified corpus connectors after #1124. Exit: Bound data ingestion, injection handling and namespace isolation; optional remote adapters are explicit. |
| C16.03 03 inspection and evaluation | #1127 | Expose memory inspection/evaluation only after #1124/#1125 behavior is proven. Exit: UI accurately reflects authorized retained/retrieved data and deletion outcomes. |
| Non-goal: No bulk external data import, default memory activation or cross-caller shared cache. |
C17 Upstream intake
C17 Upstream intake
Shared write boundary: scripts/upstream-scan-report.sh, scripts/upstream-ported-ids.sh, .github/workflows/upstream-watch.yml, internal/docs/upstream-sync.mdx. Separate issue acceptance remains authoritative.
| Packet | Canonical tickets | Output and exit |
|---|---|---|
| C17.01 01 source ledger and blocker refresh | #1148, #1149 | Produce complete pinned source/disposition evidence and revalidate existing legacy blockers; then scope any tooling change separately. Exit: Every source has SHA/final diff/local equivalent/tests/disposition/owner issue; pagination and duplicate handling explicit; manual scans remain manual. |
| Non-goal: No scheduled monitor, title-driven automatic porting or duplicate legacy tickets. |
Provider contract families
Provider cycles group qualification/reusable contracts, not blanket support or forced multi-provider implementation. Every provider keeps independent identity/auth/runtime/catalog/capability/license criteria. Unknown helper definitions remain unresolved until source review. No alphabetical/source-template cohort asserts runtime equivalence.
For each provider packet: A) record identity, aliases, endpoint, format, credentials and runtime; B) map local equivalent and per-criterion fixtures; C) select one bounded admitted implementation; D) serialize shared registry/capability/pricing/discovery changes; E) run current gates; F) record independent authorized live/local proof or the exact remaining blocker. A discovery packet may finish while its issue remains Backlog/Blocked.
S2-P00 Shared provider-boundary integration
S2-P00 Shared provider-boundary integration
One existing integration-review packet for #1298, with #1286–#1295 preserved as source evidence. Review the shared discovery seam and independent offline boundary tests; candidate issues stay in their home families. No provider acceptance is inherited from this integration.
S2-P01 Readiness and existing-provider evidence
S2-P01 Readiness and existing-provider evidence
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P01.01 Define truthful provider readiness | #1111 | One cross-provider readiness schema separates metadata, dispatchability, authenticated validation, actual inference and stale evidence. |
| S2-P01.02 Reconcile existing provider evidence | #768, #1224 | Both identities already exist; compare current catalogs, aliases and evidence before any change. |
S2-P02 Compatible remote API contracts
S2-P02 Compatible remote API contracts
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P02.01 Qualify Agnes regional contracts | #1151, #1152 | Pinned source shares OpenAI chat and reasoning effort vocabulary, with separate regional endpoints and CN live-catalog policy. |
| S2-P02.02 Qualify compatible API contracts A | #1156, #1184, #1208, #1213 | All issue inventories explicitly specify default executor, API-key auth and OpenAI format; use one registry contract checklist and independent endpoint fixtures. |
| S2-P02.03 Qualify compatible API contracts B | #1217, #1219, #1227, #1229 | All inventories explicitly specify default/API-key/OpenAI; independent provider files can reuse verified generic plumbing. |
| S2-P02.04 Qualify compatible endpoint adapters | #1171, #1225, #1238, #1242 | Default/openai-compatible request plumbing is shared; each exact base-URL and authentication scheme is an independent acceptance row. |
| S2-P02.05 Verify non-colliding Meta AI contract | #765 | One first-party endpoint/catalog/price and alias-safety contract; rejected local draft is not an approved starting point. |
S2-P03 Optional-auth gateway contracts
S2-P03 Optional-auth gateway contracts
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P03.01 Resolve Naga authentication modes | #1209, #1210 | Pinned sources share api.naga.ac chat/models but optional-auth versus helper-default API-key semantics conflict. |
| S2-P03.02 Qualify g4f gateway backends A | #1185, #1186, #1187 | Same g4f.space/api/{backend}/v1 pattern, optional member bearer and anonymous proof-of-work cake-credit prerequisites. |
| S2-P03.03 Qualify g4f gateway backends B | #1188, #1189 | Reuse the explicitly verified gateway auth/discovery mechanism from the g4f family, keeping backend catalog and request/tool/stream/error proof separate. |
S2-P04 OAuth and credential-mode lifecycles
S2-P04 OAuth and credential-mode lifecycles
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P04.01 Qualify Openference credential modes | #1220, #1221 | Pinned sources share REST/catalog/Responses surfaces; independent OAuth and API-key lanes can share HTTP fixtures. |
| S2-P04.02 Qualify OAuth provider lifecycles | #1175, #1246, #1247 | Shared prerequisite is a complete authorization/token-lifecycle and account-isolation contract, with provider-specific runtime boundaries. |
S2-P05 App, CLI and local runtime contracts
S2-P05 App, CLI and local runtime contracts
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P05.01 Qualify app and CLI runtimes | #1168, #1174 | Both require explicit executor/runtime discovery beyond ordinary remote API-key registration; source inventory advertises auth none. |
| S2-P05.02 Validate both MLX runtime presets | #1205 | Canonical #1205 owns Gemma and transferred Qwen acceptance from closed #1206; same local helper with ports 11435 and 11436. |
S2-P06 Specialized executor qualification
S2-P06 Specialized executor qualification
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P06.01 Qualify specialized API executors A | #1164, #1182, #1194 | All inventories specify an API-key OpenAI-format path but a provider-specific executor; resolve the necessity and delta before code. |
| S2-P06.02 Qualify specialized API executors B | #1228, #1234, #1240 | Same source-review checklist for named executors with API-key/OpenAI metadata, independent auth and dispatch acceptance. |
| S2-P06.03 Qualify DeepAI custom protocol | #1172 | Custom format is explicitly recorded, so this needs a bounded protocol contract before default-provider registration. |
| S2-P06.04 Qualify Claude-compatible API contract | #1235 | Tabitoken inventory declares API-key auth and Claude format; retain the native-format header/request/tool/error boundary. |
| S2-P06.05 Qualify zcode executor prerequisites | #1252 | Resolve this executor's actual runtime/auth requirements from source; auth none does not prove credential-free access. |
S2-P07 Kiro/Cursor identity and routing boundaries
S2-P07 Kiro/Cursor identity and routing boundaries
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P07.01 Reconcile native versus relay identities | #1170, #1248 | Existing native-comparison evidence can establish rejection/isolation boundaries while candidate identity, endpoint and credentials remain independently unproven. |
| S2-P07.02 Verify Kiro credential surfaces | #755 | One runtime-routing/affinity contract with credential-class matrix and legacy payload concerns. |
S2-P08 Browser and session provider contracts
S2-P08 Browser and session provider contracts
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P08.01 Qualify browser candidate boundaries | #1162, #1190, #1251 | All three have offline native-comparison fixtures already represented in integration PR #1298, while browser candidate identities remain unregistered. |
| S2-P08.02 Qualify session executor contracts A | #1159, #1163, #1165 | Browser/session classification and provider-specific executors share a prerequisite: determine actual account/session acquisition, expiry, refresh and transport requirements. |
| S2-P08.03 Qualify session executor contracts B | #1169, #1173, #1176 | Same bounded session-contract discovery process; each service remains an independent endpoint/account test lane. |
| S2-P08.04 Qualify session executor contracts C | #1198, #1202, #1214 | Shared prerequisite is permitted account/session operation, lifecycle and request/stream/error contract discovery. |
| S2-P08.05 Qualify session executor contracts D | #1215, #1236, #1237 | Provider-specific browser/session mechanisms need the same evidence checklist before implementation. |
| S2-P08.06 Qualify Cloudflare playground prerequisites | #1167 | Resolve this executor's actual runtime/auth requirements from source; auth none does not prove credential-free access. |
| S2-P08.07 Qualify UC persona WebSocket | #1241 | Pinned source specifies durable Clerk client cookie/session/account data and per-connect JWT for the persona WebSocket. |
S2-P09 Media and multi-surface provider contracts
S2-P09 Media and multi-surface provider contracts
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P09.01 Qualify Magnific asynchronous images | #1201 | Pinned source uses x-magnific-api-key and async task_id submit/poll; one image-lifecycle acceptance contract. |
| S2-P09.02 Qualify Alibaba Token Plan campaign | #762 | Five separately accepted contract units: discovery, OpenAI transports, disputed Anthropic transport, media and per-model capabilities. |
S2-P10 Quota and billing evidence contracts
S2-P10 Quota and billing evidence contracts
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P10.01 Qualify snapshot adapters and CommandCode math | #1110, #758 | One provider-specific three-endpoint evidence and monthly-cap/cooldown contract. |
S2-P11 Unresolved helper source qualification
S2-P11 Unresolved helper source qualification
| Packet | Canonical tickets | Qualification output |
|---|---|---|
| S2-P11.01 Resolve helper-derived provider contracts 01 | #1153, #1154, #1155, #1157 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.02 Resolve helper-derived provider contracts 02 | #1158, #1160, #1161, #1166 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.03 Resolve helper-derived provider contracts 03 | #1177, #1178, #1179, #1180 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.04 Resolve helper-derived provider contracts 04 | #1181, #1183, #1191, #1192 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.05 Resolve helper-derived provider contracts 05 | #1193, #1195, #1196, #1197 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.06 Resolve helper-derived provider contracts 06 | #1199, #1200, #1203, #1204 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.07 Resolve helper-derived provider contracts 07 | #1207, #1211, #1212, #1216 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.08 Resolve helper-derived provider contracts 08 | #1218, #1222, #1223, #1226 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.09 Resolve helper-derived provider contracts 09 | #1230, #1231, #1232, #1233 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.10 Resolve helper-derived provider contracts 10 | #1239, #1243, #1244, #1245 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
| S2-P11.11 Resolve helper-derived provider contracts 11 | #1249, #1250, #1253, #1254 | Shared unresolved prerequisite: evaluate actual exported helper semantics, endpoint/auth/model contract and local equivalence. Cohort order is only issue-number ordering, not asserted runtime similarity. |
Verified command templates and first-packet path evidence
Commands below were verified from repository policy/scripts; none was run for this planning task. Resolve the approved checkout, current head and toolchain first. Node 20.20.2/npm 10.8.2 are the audited documented toolchain; re-read current policy on execution. Focused feedback never substitutes for exact-head acceptance. All 35 current candidate PR diffs require FULL under the audited policy.
- Lint:
npm run lint. - Full wrapper:
cd tests && npm run test:ci. Do not append selectors through its npm wrapper. - Focused feedback:
cd tests && node node_modules/vitest/vitest.mjs run <literal-files-relative-to-tests> --maxWorkers=2. - Root alternative:
node tests/node_modules/vitest/vitest.mjs run --config tests/vitest.config.js <literal-test-files> --maxWorkers=2. - Frozen FULL runner template:
node <frozen-reviewed-runner>/scripts/local-ci.mjs --repo <approved-checkout> --base <full-current-base-sha> --head <full-candidate-sha> --mode full --out <new-private-output-dir> --title "<PR title>". - Commit/title checks:
npx commitlint --from=origin/main --to=HEAD;echo "<PR title>" | npx commitlint. - Applicable generated/runtime/UI checks are selected from current scripts, including
npm run check:docs,npm run check:agent-index,npm run check:registry-index,npm run check:provider-catalog,npm run check:postgres-migrations,npm run build,npm run storybook:build,npm run check:storybook-coverage,npm run test:ui.
Freeze and independently review the runner plus imported helpers outside the candidate; bind policy/runner/helper hashes, base/head, locks and environment. No candidate self-approval. Current FULL amendment permits at most 4 sequential supervised test batches whose union equals the entire eligible inventory, with at most 4 fork workers per command and 5-minute command ceilings. Bootstrap, upstream integration, every 5 merges, stage boundaries and final readiness require FULL. Missing/stale reports, empty collection, drift or baseline additions fail closed. The runner does not receive GitHub/provider credentials or publish status; authorized integration owner verifies/publishes separately.
Sources: AGENTS.md, testing, agent workflow, scripts. Historical audit head:e94884312ff6651f80d13f1c862e54a916bc870e; always refresh it.
C01.01 source paths and focused selectors
- fix(crypto): publish first-start keys atomically #1265 audit head
d31d43923598. Write-set evidence:docs/operations/security.mdx,src/lib/crypto/columnCrypto.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run unit/column-crypto-master-key-race.test.js --maxWorkers=2. - fix(audit): derive provider identities from exports #1266 audit head
047558cbf9e3. Write-set evidence:internal/docs/omniroute-provider-matrix.json,internal/docs/provider-registry.mdx,scripts/audit-omniroute-providers.mjs.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run unit/fleet-pr1266-reexports.test.js unit/omniroute-provider-audit.test.js --maxWorkers=2. - fix(privacy): redact MiMo login diagnostics #1267 audit head
66d4f054b9c8. Write-set evidence:open-sse/shared/mimoAccount.js,src/app/api/oauth/xiaomi-mimo/login/start/route.js,src/lib/mimoLoginSession.js,src/proxy.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run unit/fleet-pr1267-acceptance.test.js unit/xiaomi-mimo-login-redaction.test.js --maxWorkers=2.
These are source-diff selectors, not a complete FULL inventory. Re-read current PR files; preserve downstream caller tests and expand the reviewed literal inventory when required.
C02.01 source paths and focused selectors
- fix(translator): preserve client system authority #1257 audit head
d64380cb5cd7. Write-set evidence:open-sse/executors/github.js,open-sse/translator/request/openai-to-claude.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run translator/bugs-toClaude-context.test.js translator/golden-request.test.js unit/fleet-next-1075-persona-role-order.test.js unit/fleet-pr1257-native-persona.test.js unit/github-claude-messages.test.js unit/openai-to-claude.test.js --maxWorkers=2. - fix(translator): preserve tool failure semantics #1260 audit head
a7d575f4234f. Write-set evidence:open-sse/executors/base.js,open-sse/executors/bedrock.js,open-sse/executors/cliproxyapi.js,open-sse/executors/mimo-free.js,open-sse/executors/mimocode.js,open-sse/executors/qoder.js,open-sse/executors/theoldllm.js,open-sse/executors/vertex.js,open-sse/rtk/index.js,open-sse/translator/request/claude-to-kiro.js,open-sse/translator/request/claude-to-openai.js,open-sse/translator/request/openai-to-claude.js,open-sse/translator/request/openai-to-commandcode.js,open-sse/translator/request/openai-to-kiro.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run translator/bugs-openai-bridge.test.js unit/rtk.test.js --maxWorkers=2. - fix(translator): protect opaque thinking continuity #1258 audit head
b1f0039cb7ef. Write-set evidence:open-sse/rtk/headroom.js,open-sse/translator/concerns/assistantPrefillPolicy.js,open-sse/translator/formats/claude.js,open-sse/translator/request/claude-to-gemini.js,open-sse/translator/request/claude-to-kiro.js,open-sse/translator/request/claude-to-openai.js,open-sse/translator/request/openai-to-claude.js,open-sse/translator/schema/blocks.js,open-sse/translator/schema/index.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run translator/bugs-claudeCode-context.test.js translator/port-2401-reasoning-history-bridge.test.js unit/fleet-pr1258-headroom-caller.test.js --maxWorkers=2.
These are source-diff selectors, not a complete FULL inventory. Re-read current PR files; preserve downstream caller tests and expand the reviewed literal inventory when required.
C02.02 source paths and focused selectors
- fix(translator): reject unsupported audio blocks #1259 audit head
56f720cac044. Write-set evidence:open-sse/handlers/chatCore.js,open-sse/translator/request/openai-to-claude.js,open-sse/translator/request/openai-to-gemini.js,open-sse/translator/validate.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run translator/bugs-toClaude-context.test.js unit/multimodal-drop-lock.test.js --maxWorkers=2. - fix(kiro): reject unverified output-limit enforcement #1263 audit head
a5c30561e4a4. Write-set evidence:open-sse/translator/request/claude-to-kiro.js,open-sse/translator/request/openai-to-kiro.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run translator/bugs-kiro.test.js translator/coverage-all-models.test.js unit/commandcode-outbound-validation-chatcore.test.js unit/fleet-pr1263-acceptance.test.js --maxWorkers=2. - fix(kiro): reject unresolved remote image loss #1255 audit head
33d3ef364f0f. Write-set evidence:docs/providers/kiro.mdx,open-sse/translator/request/claude-to-kiro.js,open-sse/translator/request/openai-to-kiro.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run translator/bugs-kiro.test.js translator/kiro-remote-image-resolution.test.js unit/kiro-image-chatcore.test.js unit/openai-to-kiro.test.js --maxWorkers=2. - fix(cursor): reject unsupported image input explicitly #1262 audit head
4db5b9c18c30. Write-set evidence:docs/providers/cursor.mdx,open-sse/handlers/chatCore.js,open-sse/handlers/responsesHandler.js,open-sse/providers/capabilities.js,open-sse/translator/index.js,open-sse/translator/request/openai-to-cursor.js,src/app/api/v1/models/buildModelsList.js,src/sse/services/model.js.
Focused candidate-head command:cd tests && node node_modules/vitest/vitest.mjs run translator/bugs-gemini-cursor-commandcode.test.js translator/coverage-all-models.test.js unit/capabilities.test.js unit/cursor-custom-vision.test.js unit/cursor-image-runtime.test.js unit/fleet-next-1083-cursor-image-envelope.test.js unit/fleet-pr1262-acceptance.test.js --maxWorkers=2.
These are source-diff selectors, not a complete FULL inventory. Re-read current PR files; preserve downstream caller tests and expand the reviewed literal inventory when required.
Reusable AI packet prompts
Existing-PR reconciliation: Read the canonical issue and this packet. Freeze current main/source head, enumerate preserved and missing source deltas, claim exact paths with the existing owner, then propose the smallest acceptance-complete delta. Preserve unrelated edits and stop on semantic ambiguity. Return evidence matrix, allowlist, focused tests, required FULL gate and reviewer handoff before claiming completion.
Discovery-only provider: Read the epic table row and the canonical source links. Produce identity/alias/endpoint/request-format/auth/runtime/catalog/capability/license matrix, local equivalent, independent acceptance mapping and unknowns. Make no code changes, live calls or support claims. Return one admitted follow-on slice or a named blocker; do not create duplicates.
New feature refinement: Select only the first bounded criterion in the epic row. Locate actual source/local seams, define data/authorization/runtime limits, expected regression and negative controls, non-goals and dependency evidence. Return a reviewed implementation packet; do not treat the full feature as ready.
UI source gate: For #1300, link the real implementation branch/PR and owner; enumerate existing screen/API contracts and its release acceptance. Do not invent a design or create another interface implementation. Then scope one integration slice with current UI commands and ownership.
Canonical acceptance and portfolio navigation
Canonical accounting #1085 retains #1133; protocol #1089 retains #1091; metrics #1129 retains #1132; MLX #1205 retains separate Gemma/Qwen acceptance from #1206. Closed source bodies remain history, not extra active work. No new consolidations or PR closures follow from this cycle plan.
Execution rows live in existing epics: #1057, #1058, #1059, #1060, #1061, #1062, #1063, #1064, #1065, #1066, #1067, #1068, #1069, #1070, #1071. Source inventories:#1072/#1073/#1074 and historical scan #800. Legacy #755/#758/#762/#765/#768 retain their existing native relationships and gating history; their coordination rows are in #1061.
Previous roadmap and source audit (preserved historical reference)
## Roadmap and audit boundary
Created 2026-10-08. This is the PM/PO implementation roadmap. The original snapshot contains 12 domain epics, 3 provider sub-epics, 180 actionable tasks and 3 source/evidence inventories, with native GitHub sub-issue relationships and task checklists.
The audit collected **19,879 upstream records**: 9router has 2,027 issues and 2,495 PRs; OmniRoute has 4,955 issues and 10,402 PRs. Counts reflect this paginated snapshot; upstream activity continues. Metadata inventory is complete for the collected pages. Focused code review covers the linked gaps; this is not proof that every historical PR's behavior is missing or that every local bug has been found.
DurinDoor baseline: `93f6de64c69b17d52f790d6f14d09a74cffc7fa5`. 9router source: `ce4460ef79382bfddb4aa5fc0ff9f3cb0d5f95a8` (`master`). OmniRoute source: `61e07fb7e0d4e1e76111495d3718c9e4d06d2a62` (`release/v3.8.52`). Current published `main` was reviewed independently of the older local checkout. No DurinDoor source, tests, secrets, runtime or deployment were changed or run.
The separately requested README-only upstream PR is [9router #4668](https://github.com/decolua/9router/pull/4668), which adds DurinDoor below OmniRoute. It is not an implementation roadmap task.
## Delivery order
| Stage | Goal | Exit condition |
| --- | --- | --- |
| 1 | Correctness and safety | Reproduce and repair protocol loss, media accounting, key creation and release-artifact risks; required gates green. |
| 2 | Provider, routing and compression coverage | Source-qualified ports, verified provider prerequisites, bounded routing and compression fidelity tests. |
| 3 | Operator and developer workflows | Telemetry, evals, webhooks, CLI, agent and dashboard workflows meet their contracts. |
| 4 | Optional advanced capabilities | Memory/cache, distributed coordination and experimental features have explicit opt-in, design and measured evidence. |
Priorities: P1 first, P2 next, P3 optional. Priority expresses sequencing; it does not by itself exclude work from V5. The Project Status field is the delivery lifecycle source of truth. Backlog means triaged but not started; Ready requires clear dependencies and defined acceptance. Retain `status:upstream-pending` as source-availability evidence while an upstream proposal is still open. Milestones express sequence, not promised dates.
## Epics
- [ ] #1057 | Protocol correctness and client compatibility
- [ ] #1058 | Routing reliability, admission and quota coordination
- [ ] #1059 | Credential safety, privacy and authorization
- [ ] #1060 | Multimodal accounting and API parity
- [ ] #1061 | Truthful provider readiness and selected coverage
- [ ] #1062 | Compression engine parity and measurable fidelity
- [ ] #1063 | Usage, telemetry and operator diagnostics
- [ ] #1064 | Agent protocols, integrations and automation
- [ ] #1065 | Response caching and optional persistent context
- [ ] #1066 | Dashboard, developer workflows and packaging experiences
- [ ] #1067 | Release quality, runtime compatibility and deployment
- [ ] #1068 | Upstream intake, provenance and roadmap maintenance
## Start with these evidence-backed defects
- [ ] #1085 | fix(usage): complete paid usage, price provenance and dollar-budget accounting
- [ ] #1086 | fix(crypto): prevent concurrent first-start master-key creation races
- [ ] #1087 | fix(audit): read provider identities from exports instead of filenames or first nested IDs
- [x] #1082 | fix(translator): Keep every system message when translating OpenAI to Gemini
- [ ] #1077 | fix(translator): Preserve tool failure semantics through the Claude to OpenAI bridge
## Sources and duplicate controls
- #1072 contains the complete collected 9router issue/PR index and port-ledger status.
- #1073 contains the complete collected OmniRoute issue/PR index.
- #1074 records local defects, known overlaps, provider identity reconciliation and existing blocked tickets.
- Existing #755/#758/#762/#765/#768 retain their original scope. #800 is the earlier 9router scan, not a current completeness claim.
Already shipped PostgreSQL, API-key scoping, MCP gateway/control, media endpoints, playground, quota snapshots, native realtime, RTK, Headroom, Caveman and session dedup are excluded as wholesale feature ports. Extension tasks describe only a remaining contract or parity gap. Provider tickets are candidates and require endpoint/alias/runtime checks and first-party evidence. No account was contacted to establish live provider operation.
## Port and delivery contract
Use merged final upstream diffs or reachable commits, pin provenance, and compare local equivalents/tests before implementation. Preserve local security, quota, database and translator rules. Use `port(upstream): #N - title` or `port(omniroute): title` for ports. Every behavior change needs docs and a focused test. Required gates follow the current repository contributor contract and the exact PR head; do not add baseline failures. Generate registry/agent indexes with their scripts. Target `bloodf/durindoor:main` through a focused branch/PR; never push directly to main or rewrite stored credentials.
## V5 organization update — 2026-10-19
V5 has three workstreams: stability, new functionality and a new interface. Core, Candidate and Optional describe scope confidence; Candidate/Optional work remains available for the V5 feature cut instead of being excluded by priority alone. Track delivery in [DurinDoor V5 — Recovery & Delivery](https://github.com/users/bloodf/projects/2) (private).
- New interface delivery/release acceptance: #1300, under #1066 and blocking final release readiness in #1067. The implementation branch/PR and owner still need to be linked.
- Canonical accounting ticket: #1085 incorporates #1133 with the full source acceptance retained.
- Canonical protocol conformance ticket: #1089 incorporates #1091 with the full source acceptance retained.
- Canonical operational metrics ticket: #1129 incorporates #1132 with the full source acceptance retained.
- Canonical MLX local-runtime ticket: #1205 preserves separate Gemma and Qwen preset acceptance from #1206; the native parent is now #1070 and source #1206 is closed as superseded after preservation.
Historical source pins, counts and upstream indexes above remain evidence snapshots. For current implementation/review gates, use the current repository contributor contract and the exact PR head; the older planning command summary above is not a substitute for current required checks. Draft or stacked PRs are implementation evidence, not proof of completed acceptance.
Activity
bloodf commentedon Oct 9, 2026
Roadmap status update (not a completion claim; all roadmap items remain open).
pg).project/read:projectscope. Auth intentionally not refreshed.bloodf commentedon Oct 9, 2026
Execution status: 13 focused PRs are now open (#1255–#1267), with corresponding task issues labelled in-review. Their exact branch SHAs are pushed; completed clean local worktrees were removed after preserving gate reports. Unfinished accounting, conformance, authorization and packaging worktrees remain intact. PR #1261 is ready with squash auto-merge enabled; subsequent PRs will be rebased/reverified and queued serially after main advances. No task is considered shipped until its PR merges. Repository auto-merge capability is enabled. Creating the requested repository-linked V5 Project is blocked solely by the current token lacking
projectandread:projectscopes; PR and issue permissions work. Roadmap scope and separately owned pre-release UI redesign remain unchanged.bloodf commentedon Oct 9, 2026
PR delivery update: #1261 merged as e51ab1c and #1082 closed. Other 12 focused PRs remain open. Per maintainer request, PR-triggered CI/Tests/Commitlint workflows are temporarily disabled while a worker removes PR triggers; main-push/manual triggers will be retained and re-enabled after that change merges. The main ruleset remains active with strict up-to-date PRs, squash-only merges and resolved threads, now requiring
V5 Local CI. No local success statuses have been fabricated or posted: each will require actual exact-SHA local CI-equivalent evidence. Five visible Herdr OMP lanes currently handle local CI implementation, accounting parity, npm closure review, merge-queue recovery and dedicated verification. Completed pushed worktrees were removed; unfinished shared work remains preserved.bloodf commentedon Oct 12, 2026
Work-state update
State: In progress; Responses FULL local gate failed; diagnosis/repair pending; draft not merged.
Evidence: The roadmap retains all 180 original tasks and 710 acceptance criteria. Bootstrap #1279 is merged at 97191e7 with 12,335 passing tests, zero failures and 66 skips. Policy #1282 merged on 2026-10-12 at 22:42:07 UTC through the normal protected squash merge, producing main commit 559403e. Its exact candidate head 18905e1 has independently authenticated full-checkpoint evidence: 12,337 passing tests, zero failures and 66 skips in 644.847 seconds. The earlier 720-second timeout remains historical failure evidence. The scoped upstream-watch helper policy is now available; this does not complete the roadmap. Gemini collision repair PR #1281 merged through the normal protected squash merge on 2026-10-12 at 23:05:46 UTC, producing commit
dc8b7716568d5dc8adebdc133c7727644252f256. Exact candidatec9c91a2ee43c755c779774dea94dfe470d25c692has independently authenticated scoped evidence: 872 passing assertions across 70 files, zero failures or skips, and fresh pinned Node 20.20.2/npm 10.8.2 root lint. Attestation: #1281 (comment). The full suite was not run for this candidate; this is partial upstream/conformance delivery, not umbrella completion. Shared unknown-provider guard PR #1283 merged through the normal protected squash merge on 2026-10-12 at 23:57:15 UTC, producing commit32f71fc101953b55ccf392f8bfe18c9983b66619. Exact candidate1907097af094e0a0c25f402149b6bbe45eceeb42has an independently authenticated fresh full checkpoint: 12,397 passing tests across 1,413 files, zero failures and 66 unchanged skips; all 57 assertions across five provider acceptance files pass. Fresh root production build passes in 467.429 seconds. Attestation: #1283 (comment). Website build was conditionally skipped, not proved successful. This merges the isolation boundary only; no candidate registration or live support follows. MCP diagnostic/privacy PR #1284 merged through the normal protected squash merge on 2026-10-13 at 02:23:35 UTC, producing commitcbcd087cd5deb83a810aa49f4debbf2e81cdb11a. Exact candidate98f1a20768a8e80bc591de9891e2df0df3ea7c32has a freshness-compliant independently authenticated full checkpoint: 12,425 passing tests across 1,416 files, zero failures, 66 unchanged skips and all 87 mandatory assertions passing in 462.757 seconds. Production build was reused from an earlier authenticated invocation under exhaustive equivalence proof for 4,408 tracked inputs, environment, dependencies and toolchain; no fresh build is claimed. Website build remains conditionally skipped. Attestation: #1284 (comment). This is partial privacy integration, not complete security/V5 acceptance. Original PRs #1268, #1269 and #1270 remain open and untouched. Initial MCP egress enforcement remains unproven; remaining high-severity findings and release blockers are not cleared by this merge.18905e140a258b02dad7ca7dec6939ce5120dfcd.0cca3d4d09670c08f51a613311d0df18073c54b9.1907097af094e0a0c25f402149b6bbe45eceeb42.98f1a20768a8e80bc591de9891e2df0df3ea7c32.Upstream ledger helper: PR #1278 merged through the normal protected squash merge on 2026-10-12 at 23:14:15 UTC, producing commit
b0ec6d475dcae93bef79d389ce2b9d8fca6f1e44. Exact candidate12ee94bc7981e0f95e98115d96f325f9278ad015has independently authenticated mandatory scoped-helper evidence: 19 passing assertions, zero failures or skips, and pinned Node 20.20.2/npm 10.8.2 lint. Attestation: #1278 (comment). Source-qualified ledger membership is integrated; the 526 semantic upstream dispositions remain incomplete. The full suite was not run for this candidate. No umbrella acceptance or full-coverage claim follows from this helper repair.Ollama validation delivery: Ollama validation repair PR #1285 merged through the normal protected squash merge on 2026-10-13 at 03:01:16 UTC, producing commit
09ae535d1ad4ea70ba4a59b5877e0ba400525f8c. Exact candidate57cb6ec2f6a1ac8993bd9e2994e73f124e9b067dhas an independently authenticated fresh full checkpoint: 12,441 passing tests across 1,417 files, zero failures, 66 unchanged skips and all 33 mandatory assertions passing. Fresh production build passes in 415.470 seconds; fresh full tests pass in 546.300 seconds. Website build is conditionally skipped, not proved successful. Attestation: #1285 (comment). Public/cloud model-tags reachability does not validate supplied credentials; explicit keyless local/LAN behavior remains supported. This is partial validation repair only, not candidate registration, live-provider acceptance, complete security/release acceptance or V5 completion.Proposed shared discovery repair: Open draft PR #1295 (#1295), exact head
e5bcf6ee8fde4cbc570f12d0cf27c9f22387f35f, repairs compatible-node model URL joining relative to the stored API base, including duplicated/v1/v1/models. Independent source/security and original-run provenance review pass. Genuine Node 20 RED records 21 passing and 25 failing checks; precommit GREEN records 50 passes including four related checks; postcommit/final owned regression records 46/46 passing checks and exit 0. Fixture hashes were first measured after GREEN; RED-time immutability relies on original tool chronology, not a contemporaneous hash. This repair is proposed, not merged: a fresh FULL integration checkpoint remains pending. Authentication, headers, proxy dispatch and existing outbound/SSRF safeguards are unchanged, not newly certified. No live/provider acceptance or candidate registration follows from mocked URL-join checks.Proposed coherent Responses integration: Open draft PR #1297 (#1297) is published at
0cfa783e2206d77d40401977efd1c2bfb120ab43on base09ae535d1ad4ea70ba4a59b5877e0ba400525f8c, spanning 19 paths. Independent joint source/focused-proof approval binds 124 passing scoped tests across 13 files with actual exit 0. Fresh immutable file-ID and empty-output RED reproductions record 20 passing/six failing and 18 passing/two failing checks respectively, both actual exit 1; original historical missing exit artifacts remain missing, not backdated. The stack preserves native Responses file references while rejecting unresolved lowered file IDs, typed unsupported media, and invalid empty-array lowering. Original PRs #1256 and #1274 remain open. This is proposed, not merged or FULL-approved: fresh root build, full checkpoint, mandatory inventory and protected status remain pending. No complete conformance, live-provider or cryptographic signature acceptance is claimed.Proposed dependency remediation: Open draft PR #1296 (#1296) is published at
5c2d0284401950cca68350c1a140f79e1cb9c478on base09ae535d1ad4ea70ba4a59b5877e0ba400525f8c, changing four root/website manifest paths. Independent current-main continuity and installer authentication pass; candidate lockfiles patch the reviewed critical dependency chains, but this proposal is NOT merged and default-branch advisory exposure still needs remediation. Candidate lock-bound residual findings remain root seven high, two moderate and two low; website two moderate. These counts do not replace default-branch advisory inventory. Fresh root/website production builds, actual Storybook static build, lint and canonical full test checkpoint remain pending. Scoped installation/native/development evidence is not FULL approval, global security-green or release readiness.Responses FULL checkpoint failed; repair in progress: Draft PR #1297 remains unmerged at
0cfa783e2206d77d40401977efd1c2bfb120ab43. The actual full test:ci exits 1 with 12,545 passing assertions, one failure and 66 skips (12,612 total). The failing assertion is intests/unit/openai-responses-tool-name-map-4200.test.jsat line 330, covering re-qualified/aliased tool_choice and allowed_tools across target formats. The assertion expects a nested alias but receives undefined. Root and website builds pass, but the overall local gate is FAILED; no GREEN/status/merge approval follows. The source owner is reactivated for diagnosis and repair. Cause is not yet classified as a stale test or production defect. Earlier 124-test scoped evidence remains historical implementation proof, not full checkpoint success.Console/output-cap partial delivery MERGED: PR #1264 merged through the normal protected squash merge on 2026-10-13 at 22:16:55 UTC, producing commit
837f24568852b2e6cebd56487acff42d0529d09f. Exact candidate5257f2557afc3741ca8b0efb44bd752900f360caagainst verified base09ae535d1ad4ea70ba4a59b5877e0ba400525f8chas independently authenticated FULL evidence: 12,536 passing assertions, zero failures and 66 unchanged skips across 1,419 canonical files, each executed exactly once. Native trusted-shell checks pass 10/10; all 21 recorded verification steps pass. Conditional website build was not required, not claimed successful. Attestation: #1264 (comment). Numeric client-400/server-500 console and invalid-cap predispatch delivery is integrated; this does not complete Cursor capability acceptance, the conformance umbrella, live-provider acceptance or blanket runtime authorization. Historical failed attempts and all remaining release/security/Responses blockers remain unresolved unless separately verified.Remaining: Continue current-main refresh and independently reviewed integration after the merged policy checkpoint. Complete original task criteria rather than treating focused tests, source inventory or worker counts as completion. Provider live acceptance remains unavailable. Dependency remediation has root lifecycle/build evidence, but website build and 13 root/two website high-severity findings remain shipping blockers. Per-issue progress comments distinguish implementation, dependency blocks and unavailable live proof.
This update records progress only. Scoped checks and source inventory do not establish completion of all issue criteria.
Recorded at 2026-10-13T22:19:32+00:00.
bloodf commentedon Nov 3, 2026
Owner decision, 2026-11-03: #1248 (xkiro), #1253 (zerolimitai), #1113 (Entra ID) and #1114 (organizations) stay open but do not block V5. The first two are held pending terms review; the other two wait on upstream designs. Issues that need live provider verification ship code labelled unverified and close on merge.
bloodf commentedon Nov 3, 2026
Owner decision, 2026-11-03: the large OmniRoute feature ports on Roadmaps 3 and 4 (A2A agent card and tasks, cost and latency routing policies, evaluation and shadow runs, LLMLingua, query-aware, retrieval and ultra compression, persistent memory and retrieval, ACP client, agent skills, cloud coding-agent jobs, response caching, plugin SDK, catalog intelligence, desktop and PWA packaging, and similar) stay open but are deferred past V5 and do not block it. V5 work continues on correctness and the remaining P1 and P2 fixes.
bloodf commentedon Nov 3, 2026
Owner decision (2026-11-03): the deferred OmniRoute feature ports are closed as not planned. They are #1092, #1094 to #1097, #1101, #1103 to #1105, #1107, #1109, #1116, #1117, #1119 to #1127, #1130 and #1138 to #1141. Any of them can be reopened after V5. #755 is closed with its live credential matrix unverified.