Skip to content

ROADMAP.md

Latest commit

 

History

History
84 lines (71 loc) · 6.51 KB

ROADMAP.md

File metadata and controls

84 lines (71 loc) · 6.51 KB
Raw

Roadmap

Milestone 0 — first vertical slice

  • Preserve exact dependency nodes, edges, duplicate versions, and root-to-node paths.
  • Query OSV for exact installed npm versions.
  • Emit only new, materially updated, and resolved vulnerability events.
  • Recognize malicious-package records.
  • Route every event to a project, owner, and configured channel.
  • Persist pending DSH Agent analysis tasks before delivery.
  • Bind DSH model results to the exact message, session, task, and event; reject ordinary chat and stale conclusions.
  • Ship an installable DSH bundle with a bounded fixed polling interval.
  • Ship a one-command CLI watch loop for demos, CI, and local diagnosis.
  • Provide a deterministic vulnerability and breaking-change showcase.
  • Prove bundle installation, plugin-source attribution, Session persistence, and Agent delivery in a real DSH headless profile.
  • Generate an explicit DSH --patch overlay so first use does not require environment variables.
  • Auto-select the only DSH profile with third-party bundles and provide a network-free first-run status snapshot.
  • Provide a network-free doctor command for DSH bundle registration, overlay/config alignment, state readability, and dependency coverage.
  • Show bounded active-incident paths, candidate signals, and next-step guidance in the network-free status command.
  • Make the generated project workspace portable by default so the reviewed inventory can be committed and reused.
  • Provide one explicit DSH setup command that installs the exact Radar version, generates wiring, and runs the network-free doctor check.

Milestone 1 — compatibility radar

  • Monitor npm latest for installed plugin releases and DSH packages.
  • Detect Node.js, entrypoint, export-map, bundle, peer-range, and pre-1.0 DSH changes.
  • Separate compatibility facts from model conclusions.
  • Track compatibility incidents through new, updated, and resolved states.
  • Replace stale queued analysis when an incident changes and cancel it when resolved.
  • Keep a text/JSON task export as a debugging surface for the DSH outbox.
  • Expose verified analysis results through radar status and analysis list/show.
  • Read the exact public GitHub Release notes for a candidate version; changelogs, comparison diffs, and migration guides remain deferred.
  • Track DSH package families as one coordinated release rather than unrelated npm packages.
  • Group pending same-project DSH runtime compatibility tasks into one native Agent notice without merging state incidents.
  • Resolve the first newer plugin candidate without a deterministic blocker or known OSV vulnerability, while leaving final compatibility to DSH project analysis.
  • Resolve a bounded prefix of each candidate's transitive dependency graph with lifecycle scripts disabled, query graph nodes against OSV, and withhold candidates whose graph is incomplete or unavailable.
  • Discover a named DSH profile's installed third-party bundles and generate a reviewable inventory.
  • Auto-select the only DSH profile with third-party bundles when --profile is omitted.
  • Use the selected profile's installed node_modules tree as the source of truth, including unresolved-edge visibility.
  • Refresh generated native DSH inventories from the current installed profile before each poll.
  • Keep CLI radar check/watch aligned with the refreshed native DSH profile path.
  • Parse the native pnpm lockfile for pre-install and CI inspection.
  • Run a plugin bundle-load probe in a disposable DSH profile for one explicit DSH version.
  • Record compatible, incompatible, and unknown against an explicit DSH version matrix.

Milestone 2 — reliable project routing

  • Add pnpm and Yarn lock graph adapters.
  • Maintain one durable project registry across multiple machines.
  • Deliver to the correct DSH project session instead of one security-inbox Agent.
  • Add Feishu, Slack, email, and generic webhook delivery with acknowledgement state.
  • Add suppression, ownership, maintenance-window, and dev-only rules.
  • Keep event history for new, updated, acknowledged, fixed, withdrawn, and ignored states.

Milestone 3 — richer vulnerability intelligence

  • Ingest GitHub Security Advisories incrementally as a second source.
  • Enrich matched CVEs with CISA KEV and EPSS.
  • Deduplicate OSV, GHSA, CVE, and malicious-package aliases.
  • Detect when a previously unavailable fixed version is published.
  • Calculate whether a top-level plugin update actually removes every affected path.
  • Persist per-source health, alert after three consecutive failures, and resolve the alert when the source recovers without asking the model to decide version applicability.
  • Detect conflicting source claims without asking the model to decide version applicability.
  • Preserve confirmed vulnerability state and pending DSH tasks when OSV is temporarily unavailable; surface the failure to CLI and DSH logs.

Milestone 4 — GitHub execution arm

  • Provide a frozen one-shot CI check with severity exit codes and a copyable GitHub Actions workflow.
  • Publish a reusable composite GitHub Action for the frozen deterministic CI gate.
  • Verify the published Action with a real DSH plugin consumer snapshot and a dogfood workflow.
  • Add an opt-in Action input that packs one exact plugin release and runs the bounded DSH load matrix.
  • Add an opt-in compatibility-change gate for breaking DSH/plugin updates.
  • Provide an offline compatibility-rule benchmark covering deterministic and analysis-only outcomes.
  • Re-check the installed and proposed graph in GitHub Actions.
  • Attach project evidence to a GitHub Issue only after routing policy permits it.
  • Generate an upgrade branch or Pull Request behind explicit approval.
  • Run tests against the old and candidate DSH/plugin combinations.
  • Report residual paths and avoid claiming a partial upgrade fixed the alert.

Supporting work

The pre-install scanner remains useful for collecting manifests and exact graphs. Signature, provenance, artifact identity, isolated detonation, and admission receipts are secondary tracks; they must not delay continuous vulnerability and compatibility monitoring.

Plugin runtime usefulness, task success, cost, and latency benchmarks remain out of scope. The repository does include an offline compatibility-rule contract benchmark; it is a regression surface for deterministic Radar behavior, not a plugin capability score.