Post-Stabilization Roadmap — 8 Phases / 60 items / 16 weeks (May–Aug 2026)

[bobrapp]

Context

Prerequisite: #31 — Quality & Stability Improvement Plan (30 PRs) must be fully merged and CI green on master before this plan begins. Estimated completion of #31: April 30, 2026.

This issue tracks the post-stabilization roadmap to transform openclaw-installer from a functional repo into a credible, adopted, global open-source project. 8 phases, ~60 items, 16 weeks.

---

📅 Phase 1 — Foundation & Identity

May 1–14, 2026 (Weeks 1–2)

Goal: Establish institutional credibility before any public launch.

• 1.1 Create aigovops GitHub Organization — move repo to aigovops/openclaw-installer; org profile + logo (Bob, May 1–2)
• 1.2 Register custom domain (aigovops.org or openclaw.dev) → point to GitHub Pages; update all links (Bob, May 1–2)
• 1.3 Publish foundation legal status on site (501c3/LLC/informal) + registration info (Bob + Ken, May 3–9)
• 1.4 Write GOVERNANCE.md — decision-making process, contributor → maintainer → core roles, voting, CoI (Bob + Ken, May 5–7)
• 1.5 Choose DCO or CLA; add probot/dco or CLA-assistant bot (Bob, May 7–8)
• 1.6 Write TRADEMARK.md — usage rights for "OpenClaw", "AiGovOps", logo guidelines (Ken, May 8–10)

Milestone: Org live, domain pointing, governance docs published.

---

📅 Phase 2 — Documentation & Developer Experience

May 12–30, 2026 (Weeks 2–4)

Goal: Clone-to-contribute in under 15 minutes.

• 2.1 60-second quickstart at top of README with expected output screenshot (May 12–13)
• 2.2 docs/architecture.md — system diagram, component map, data flow (May 13–15)
• 2.3 docs/adr/ADR-001 through ADR-010 — governance-as-code, SHA-256, offline wizard, i18n, YAML schema, deploy pipeline (May 15–18)
• 2.4 docs/marketplace-guide.md — YAML schema reference, validation rules, PR workflow, example (May 18–20)
• 2.5 Cloud deployment guides ×6: docs/deploy/{aws,gcp,azure,digitalocean,vps,macos}.md — tested walkthroughs (May 19–25)
• 2.6 API reference — auto-generate from Express routes (OpenAPI) or manual docs/api.md (May 22–25)
• 2.7 Translate quickstart + deploy guides into top 5 languages (EN, ES, ZH, JA, DE) (May 25–30)
• 2.8 README badges — CI status, license, OSSF scorecard, npm version, Playwright E2E, i18n count (May 12, 1 hour)

Milestone: Complete docs site; any developer can clone → run → deploy → contribute.

---

📅 Phase 3 — Distribution & Packaging

May 19 – Jun 6, 2026 (Weeks 3–5)

Goal: Installable through standard channels.

• 3.1 Publish @aigovops/openclaw-installer to npm with CLI entry point, exports, types (May 19–21)
• 3.2 Publish Homebrew tap: aigovops/homebrew-tap → brew install openclaw (May 21–22)
• 3.3 Dockerfile + auto-publish to ghcr.io/aigovops/openclaw-installer on release tags (May 22–24)
• 3.4 Signed releases: semantic-release + Sigstore cosign for binaries + SBOM attachment (May 26–28)
• 3.5 CycloneDX SBOM generation in CI; attach to every release (May 28–29)
• 3.6 Design OpenGraph image (og-image.png) for link previews — logo + tagline + screenshot (May 29, 2 hours)

Milestone: npm install, brew install, docker pull all work; releases are signed with SBOM.

---

📅 Phase 4 — Product Hardening & Accessibility

Jun 2–20, 2026 (Weeks 4–6)

Goal: Flawless for a global, diverse audience.

• 4.1 Fix broken links — "Buy Us a Coffee" www. prefix; audit all external links with linkcheck (Jun 2, 1 hour)
• 4.2 Wizard functional validation — clarify demo vs. real deploy; add E2E deploy smoke tests per host if real (Jun 2–5)
• 4.3 Marketplace entry validation — verify all 87 entries: valid upstream links, descriptions, working YAML (Jun 5–7)
• 4.4 WCAG 2.1 AA accessibility audit — Lighthouse + axe-core; fix critical/serious; add aria- labels; keyboard nav (Jun 7–10)
• 4.5 Mobile responsive audit — test at 320/375/768/1024px breakpoints; fix layouts (Jun 10–12)
• 4.6 Performance audit — Lighthouse ≥ 90; lazy-load images; code-split React; compress assets (Jun 12–14)
• 4.7 RTL language verification — test Arabic/Hebrew end-to-end; verify direction: rtl across components (Jun 14–15)

Milestone: WCAG AA compliant, all links working, Lighthouse ≥ 90, mobile + RTL verified.

---

📅 Phase 5 — Security Posture

Jun 9–27, 2026 (Weeks 5–7)

Goal: Enterprise-grade security matching the governance narrative.

• 5.1 Update SECURITY.md: 48h ack, 7d triage, 90d fix SLA; add PGP key (Jun 9–10)
• 5.2 Add actions/dependency-review-action to PR checks (Jun 10, 1 hour)
• 5.3 Achieve OSSF Scorecard ≥ 7 — branch protection, signed commits, token permissions (Jun 10–17)
• 5.4 Require GPG-signed commits via branch protection on master (Jun 12–13)
• 5.5 Commission or request external security review; publish results (Jun 13–27)

Milestone: Scorecard ≥ 7, signed commits enforced, security audit published.

---

📅 Phase 6 — Launch & Community Building

Jun 16 – Jul 10, 2026 (Weeks 6–10)

Goal: Go from 0 stars to meaningful community signal.

• 6.1 LinkedIn launch post — 10-language MRD package; Bob + Ken cross-post from personal + foundation (Jun 16–17)
• 6.2 Hacker News "Show HN" — "Show HN: OpenClaw – Governance-as-Code installer for AI systems" (Jun 17)
• 6.3 Reddit cross-post to r/opensource, r/artificial, r/devops (Jun 17)
• 6.4 DEV.to article — "Why we built governance-as-code for AI" tutorial (Jun 18–19)
• 6.5 Seed GitHub Discussions — Welcome, Feature Requests, Show & Tell, Q&A categories (Jun 16, 2 hours)
• 6.6 Label 10 "good first issue"s — docs typos, i18n keys, CSS tweaks, test coverage gaps (Jun 16, 2 hours)
• 6.7 YouTube walkthrough — 5-min demo: clone → run → deploy → audit chain; embed in README (Jun 20–21)
• 6.8 Newsletter via Buttondown or Substack for monthly project updates (Jun 22)

Milestone: Public launch across 5+ channels; Discussions seeded; contributor funnel open.

---

📅 Phase 7 — Ecosystem & Partnerships

Jun 30 – Aug 14, 2026 (Weeks 8–16)

Goal: Position within the AI governance ecosystem.

• 7.1 Apply to AWS Open Source Credits, Azure for Open Source, GCP for Open Source (Jun 30 – Jul 7)
• 7.2 Evaluate Linux Foundation AI & Data membership or landscape listing (Jul 7–18)
• 7.3 Build integrations: OPA/Rego, Backstage, Terraform, Pulumi — 2 weeks each (Jul 7 – Aug 1)
• 7.4 Submit CFPs: KubeCon NA (Oct deadline), AI Engineer Summit, All Things Open (Jul 14–21)
• 7.5 Academic partnerships — CWU + 2 other CS programs for student contributors (Jul 21 – Aug 7)
• 7.6 Enterprise pilot program — "Partner" tier, 3 companies, feedback loop, logo placement (Aug 1–14)

Milestone: Cloud credits active; 1+ conference accepted; 3+ enterprise pilots.

---

📅 Phase 8 — Analytics & Continuous Improvement

Jul 14, 2026 → Ongoing

• 8.1 Deploy Plausible/Umami analytics (self-hosted) — page views, wizard completion, language distribution (Jul 14–15)
• 8.2 Feedback widget on wizard steps + marketplace → pipes to GitHub Issues (Jul 15–16)
• 8.3 Contributor health dashboard — time-to-first-response, PR velocity, issue close rate; monthly in Discussions (Jul 17–18)
• 8.4 User interviews — 3–5 calls/month with actual users; findings → roadmap (Jul 21 → ongoing)
• 8.5 Quarterly roadmap review — publish in GitHub Projects; community input (Aug 1 → quarterly)

Milestone: Data-driven iteration loop established.

---

📊 Calendar Overview

Apr 17–30  #31 Stabilization (30 PRs — in progress)
           ════════════════════
May 1–14   Phase 1: Foundation & Identity
           ══════════════
May 12–30  Phase 2: Documentation & DX
              ══════════════════════
May 19–Jun 6  Phase 3: Distribution & Packaging
                 ══════════════════
Jun 2–20   Phase 4: Product Hardening & A11y
              ══════════════════
Jun 9–27   Phase 5: Security Posture
                ══════════════════
Jun 16–Jul 10  Phase 6: 🚀 PUBLIC LAUNCH
                  ════════════════════════
Jun 30–Aug 14  Phase 7: Ecosystem & Partnerships
                  ══════════════════════════════
Jul 14→        Phase 8: Analytics & Continuous Improvement
                  ═══════════════════════════════════════→

Dependencies

• Phase 1 → blocks Phase 6 (can't launch without org + domain + governance)
• Phase 2 → blocks Phase 6 (can't launch without docs)
• Phase 3 → blocks Phase 6 (npm/Docker/Homebrew needed for credible launch)
• Phase 4 + 5 → run in parallel with Phase 3
• Phase 6 → gates Phase 7 (partnerships require public presence)
• Phase 8 → starts after launch, runs indefinitely

Owners

Phase	Primary	Support
1	Bob + Ken	—
2	Bob + Copilot agent	Ken (review)
3	Bob + Copilot agent	—
4	Copilot agent + community	Bob (review)
5	Bob	Ken (external audit)
6	Bob + Ken	Community
7	Bob + Ken	—
8	Bob	Community

Tracking

Update this issue with phase completion checkboxes. Each checked box = done. Monthly status comment.

[bobrapp]

Credibility Plan — AiGovOps Foundation global dev community

Posted 2026-04-18. Single source of truth linking #31 batches into a credibility roadmap. Canary work is parked (log-only, ignore failures) until post-v3.0.

Five credibility axes

1. Trustworthy code — Wave 3 dep modernization (one PR per dep), Quality & Stability Improvement Plan — 12 batches / ~80 items #31 Batch 10 test tiers (smoke/regression/nightly, axe a11y gate, Lighthouse perf>=90 a11y>=95 SEO>=90, visual regression 4 hosts x light/dark x en/es/zh), i18n across 10 languages, service worker + offline.

2. Trustworthy supply chain — DONE: SHA-pin all actions, CodeQL, Dependency Review. Remaining: Wave 2 Item 6 least-privilege permissions, Item 7 OSSF Scorecard + README badge (>=8.0), Quality & Stability Improvement Plan — 12 batches / ~80 items #31 Batch 11 Semgrep+Trivy, Quality & Stability Improvement Plan — 12 batches / ~80 items #31 Batch 12 SBOM (CycloneDX) + SLSA provenance + cosign keyless signing + README verify snippet, OpenSSF Best Practices Silver.

3. Trustworthy governance — GOVERNANCE.md (Foundation, maintainer roles, voting, succession; co-founder review Ken Johnston + Bob Rapp), CODEOWNERS, SECURITY.md refresh (PGP + 90-day SLA), ADRs 0000 template / 0001 single-file wizard / 0002 SHA-256 audit-log chain / 0003 16-host-target matrix, STRIDE threat model, CITATION.cff.

4. Trustworthy release cadence — release-please + CHANGELOG + semver, signed commits, branch protection, tag protection, Homebrew/Scoop/AUR/Nix distribution.

5. Trustworthy community — YAML issue forms, PR template with test evidence + rollback, CONTRIBUTING quickstart (pre-commit install + justfile + devcontainer + .vscode recs), good-first-issue labels, contributor ladder, Discussions enabled, AIGovOps MRD publication + 10-language LinkedIn launch, public Project board linking Quality & Stability Improvement Plan — 12 batches / ~80 items #31 batches.

2-week credibility sprint

Week 1 — supply-chain + governance:

1. Close stale PR Bump drizzle-orm from 0.39.3 to 0.45.2 in the npm_and_yarn group across 1 directory #1 (pre-new-plan relic) with supersession note → Wave 3 one-PR-per-dep
2. Wave 2 Item 6 sec/workflow-permissions (Copilot)
3. Wave 2 Item 7 sec/scorecard + README badge (Copilot)
4. Quality & Stability Improvement Plan — 12 batches / ~80 items #31 Batch 8 subset: GOVERNANCE.md + CODEOWNERS + SECURITY.md refresh + CITATION.cff (one human-review PR)
5. Quality & Stability Improvement Plan — 12 batches / ~80 items #31 Batch 12: SBOM + SLSA + cosign pipeline + README verify
6. Apply OpenSSF Best Practices Silver

Week 2 — contributor onramp + quality signals:
7. #31 Batch 4 .editorconfig + .gitattributes
8. #31 Batch 5 .pre-commit-config.yaml + CI gate
9. #31 Batch 6 YAML issue templates + PR template
10. #31 Batch 9 justfile + devcontainer + .vscode
11. #31 Batch 3 CI caching
12. ADRs 0001–0003

Parked / deferred

• Canary system — log-only, ignore failures, revisit post-v3.0
• Modularize public/aigovops-wizard.html — needs ADR + planned breaking release
• Git LFS for PDFs — history-rewrite, coordinate later
• Telemetry vendor — privacy/legal decision

Exit criteria for credible

README displays: CodeQL badge, OSSF Scorecard >=8.0 badge, OpenSSF Best Practices Silver badge, SBOM+cosign verify snippet, GOVERNANCE link, CoC link, CONTRIBUTING quickstart, 10-language launch post linked, Discussions live, public Project board.

Refs #31