-
Notifications
You must be signed in to change notification settings - Fork 0
Roadmap
This page summarizes the direction of travel. It records intent, not a release promise. The canonical version lives in ROADMAP.md, and every item still requires tests-first implementation and the security gates in AGENTS.md.
The first open-source alpha is feature-frozen. Work stays focused on security, correctness, release readiness, documentation, and small usability fixes. The alpha keeps a deliberately narrow model:
- personal and shared workspaces are flat, independent permission boundaries;
- pages may already have parent and child relationships inside one workspace;
- pages inherit workspace access by default, with existing page-level overrides;
- registered human accounts are installation-wide discoverable coworkers whose identifiers do not confer authority (Reader page grants may target any registered human; Editor and Admin grants require page-workspace membership);
- categories, storage accounting, search filters, memberships, invitations, and MCP scopes stay workspace-specific.
No nested-workspace schema or effective-membership behavior ships before the alpha.
The page model already supports a parent page, but the Library does not surface it. A navigation pass would show an authorization-filtered content tree, breadcrumbs, and child counts, without changing page authorization and without ever rendering an inaccessible ancestor or child. This is presentation work over the existing model, not a second permission system.
A later sharing surface would let an authorized access manager create a high-entropy capability link for someone without an account, in two modes: a time-bounded link with a required expiry, and a one-time link consumed atomically on first redemption. It would store only a hash of the secret, re-check page and link state on every redemption with uniform not-found failures, keep executable HTML on the isolated artifact origin, and never place a bearer token or untrusted content into the authenticated app. It requires an architecture decision and a threat-model update first.
PDF upload is deferred to beta. A PDF would join the same catalog, permissions, lifecycle, versioning, tags, and search as other pages, while staying a distinct non-executable type. Text extraction and OCR would make content searchable in a permission-aware way, running in an isolated no-network worker with hard resource limits. PDFs would never become executable HTML or render on the app origin.
Nested workspaces are deferred until after alpha feedback. The agreed shape is at most three levels, shared workspaces only, with parent memberships flowing downward, effective authority being the strongest applicable role, and MCP selected scopes staying exact (choosing a parent never silently adds descendants). It requires an architecture decision, a centralized effective-membership resolver, transactional invalidation of descendant previews on access change, and browser-level proof before scheduling.
For the full detail and the required security proofs on each item, read the canonical roadmap.