Roadmap

Roadmap

Start: Wed 2026-09-16. Target v0.1 tag: Tue 2026-09-29 (10 working days).

The sequence matters more than the dates. Call sites before spec, spec before runtime, chaos plugin before the error-handling section is considered written, deletion pass before the tag.

---

The 10 days

Day	Date	Work	Done when
1–2	Sep 16–17	Call sites first, then spec skeleton. Deliberately incomplete.	A host adapter and a plugin exist as code you wish you could write, and the spec skeleton is reverse-engineered from them.
3–5	Sep 18, 21–22	Runtime: subprocess invocation, handshake, codec, verdict composition, timeouts, content-addressed cache.	A hand-written echo plugin round-trips all four verdicts, and a second run of the same corpus hits the cache.
6	Sep 23	Gitleaks adapter. Wrap the unmodified binary — write no detection logic.	rsp-gitleaks is under 80 lines and the upstream binary is untouched.
7	Sep 24	rsp-chaos. Expect to rewrite the error-handling section.	Every chaos mode maps to a spec clause, and each has a fixture.
8	Sep 25	LlamaIndex guards + MCP server + demo corpus.	rsp ingest demo/sample-docs/ prints the demo output, with 2 blocks out of 42 chunks.
9	Sep 28	Conformance kit, packaged to run standalone.	The kit runs against a plugin binary with the runtime source absent.
10	Sep 29	Delete dead clauses, add Rationales, write README.	Every remaining MUST has a fixture; every clause has a Rationale; the README's first screen is the protocol.

---

Milestones

M1 — Contract legible (end of Day 2)

The spec skeleton exists and is wrong in known places. Hooks, verdicts, and the wire format are named. No prose defending clauses nobody has implemented against.

Exit: a plugin author could guess the wire format from the call sites alone.

M2 — Runtime honest (end of Day 5)

Subprocess lifecycle, handshake, codec, composition, timeouts, cache. This is the bulk of the real work — ~200 lines that decide whether the rest is credible.

Exit: verdict composition is table-driven, not branching prose translated into ifs.

M3 — Both ends third-party (end of Day 8)

Gitleaks on the plugin side, LlamaIndex on the host side, both unmodified. This is what separates a protocol from an API with extra steps.

Exit: success criteria 1 and 2 met — both adapters under 80 lines.

M4 — Adversarially tested (end of Day 7, re-checked Day 9)

rsp-chaos crashes, hangs, emits garbage, floods stdout, and returns out-of-range spans on demand. The out-of-range span case especially: an unvalidated span turns a malicious plugin into a host DoS via a slicing exception.

Exit: success criterion 3 met — a crashing plugin blocks its chunk and the host survives the index.

M5 — Spec standalone (Day 10)

The freeze pass. Delete every clause not exercised by an implementation and a fixture.

Exit: success criterion 4 tested for real — spec plus conformance kit handed to someone with no context, and they ship a conforming plugin without asking questions or reading the runtime.

---

After v0.1

Ordered by what evidence would justify starting. None of these begin before the tag.

Item	Starts when
on_document and on_source hooks	A plugin exists that cannot express itself at chunk granularity — e.g. path-level allow/deny, or whole-file entropy scoring.
Presidio adapter (PII)	Someone wants per-path policy proven with two genuinely different threat models, not one.
Injection-scrubbing plugin on on_retrieve	The retrieve path needs a real plugin; today's evidence is all on on_chunk.
Second host implementation	The strongest possible answer to the one-implementation risk. LangChain or Haystack.
Persistent plugin processes	Only if profiling shows spawn cost dominates after caching. See Open Questions → Q6.
Streaming on_response	Deferred until a host needs verdicts on partial output.

---

Not on the roadmap, at any version

• Detection rules shipped by RSP itself.
• A plugin registry, marketplace, or dependency resolver.
• Hot reload.
• Version negotiation beyond the rsp_version handshake field.
• Networked or multi-tenant operation.

Listed here so that "should we add…" has an answer that isn't a discussion.