Roadmap

Roadmap

Work is organised as packages in docs/execution/work-packages.adoc. This is the summary; that file is authoritative.

Built

• The engine. Metadata round-tripping, hierarchy, backlinks, diagnostics, deterministic sidebar generation.
• The store. Atomic writes, path validation, stale-write guard, sidebar regenerated inside every mutation.
• Out-of-clone app state and the draft store.
• The reader. Zero-JavaScript three-pane explorer with search and diagnostics.
• The editor. Source editing with preview, page create and delete, explicit Save and Save-draft, two-layer stale guard.
• The git engine and sync layer. One store mutation becomes one atomic logical commit.
• A GitHub mirror, read-only.
• The writer lock. One clone has at most one BerryWiki writer at a time — an OS advisory lock held by serve for its lifetime, and by a CLI mutation for its duration. The kernel releases it however the process exits, so there is no stale lock to reclaim.
• Attachments, tags and per-page history in the reader.
• Backup and restore as CLI commands: a git bundle of committed history plus drafts and the operation journal.
• CherryTree .ctd import, dry-run and apply.

Next

• Conflict handling — classifying a conflict and presenting it per page. A conflict is already detected and rendered on a single /conflicts page for the whole wiki; what is missing is the per-page view and the experience of resolving one without dropping to git.
• Subtree move — validate, compute every descendant rename, rewrite inbound links, regenerate the sidebar, all as one commit that never half-applies.
• The live GitHub spikes — see Compatibility and Limits. Until these run, the compatibility report stays a hypothesis list.

Later

Zim import — the second importer, and the one that actually tests whether the neutral model is a contract rather than one command's internals. Then packaging, and the SPARK proof work on the invariants.

Deliberately parked

A richer client-side experience — inline autocomplete, drag-and-drop reordering, live preview — was gated on whether generated client script may ever ship. ADR-0007 ruled that question on 2026-09-03: it may, generated only, and only behind a manifest recording each artefact's sources, pinned toolchain, reproduced hash and permitted routes.

It stays parked all the same. Nothing has been built against the ruling, the no-<script> test is unchanged, and the manifest gate has to exist before any of it can start.