Roadmap: ship the adaptive EgoLint quality distribution

[szmyty]

Outcome

Deliver EgoLint as an adaptive, opinionated quality distribution: install or invoke one control plane, inspect the repository, run every safe applicable capability, skip irrelevant tools, and emit consistent evidence through one reusable Relay workflow.

Product boundary

EgoLint is not a fork of every underlying linter. It owns:

• native CLI and policy rules;
• egolint-full and specialized capability images;
• pinned MegaLinter distribution and complementary adapters;
• shared defaults and applicability decisions;
• profiles, enforcement semantics, normalized evidence, and fix-preview contracts.

Relay owns reusable GitHub Actions execution and evidence publication. Holon templates declare capabilities without becoming runtime dependencies. Pace owns reviewable fleet rollout.

Ordered program

Foundation and identity

• Adopt a governed EgoLint Identity Brand Kit #34 — governed Identity Brand Kit
• Release Egolint with security and dependency-debt profiles #5 — immutable first release
• Define adaptive capability detection and execution policy #35 — adaptive capability registry and execution policy
• Implement manual, observe, ratchet, and enforce modes #36 — manual/observe/ratchet/enforce semantics
• Run pinned EgoLint profiles through a reusable workflow relay#49 — reusable GitHub Actions execution

Existing contract work

• Evaluate JSONSkooma as an adaptive Ruby schema capability #14 — JSONSkooma/Ruby schema capability decision
• feat(releases): validate semantic release, changelog, and version-source conformance #29 — semantic-release conformance

Capability expansion

• Evaluate ast-grep for cross-language structural policy #37 — ast-grep structural policy
• Add cargo-machete to the Rust dependency-debt capability #38 — Rust unused-dependency detection
• Add cargo-semver-checks to the Rust release capability #39 — Rust API compatibility
• Add a template-driven web runtime quality capability #40 — served-site accessibility and quality
• Design an authorized DAST capability with DalFox #41 — authorized dynamic web security

Adoption

• Roll out EgoLint through manual, observe, ratchet, and enforce waves pace#20 — fleet rollout from manual audit to enforcement

Operating principles

• Full means complete repository inspection, not indiscriminate execution.
• Safe applicable static checks may auto-activate.
• Inapplicable tools skip with an explicit reason.
• Active-network and served-application checks require declarations and authorization.
• Organization defaults live centrally; repositories carry only thin selection and real semantic exceptions.
• Validation never mutates a source worktree.
• Current rapid development remains manual/non-blocking until each repository is ready.
• Future contribution gates run before merge; post-merge full scans provide durable evidence.

Program exit criteria

• Immutable CLI and image artifacts are published with checksums, provenance, SBOMs, and license inventory.
• Capability activation is explainable and deterministic.
• Progressive enforcement prevents new debt without hiding existing debt.
• Relay provides one thin reusable workflow.
• Representative polyglot repositories prove automatic adaptation.
• The fleet has an evidence-backed rollout plan and rollback boundary.