Roadmap and Contributing

Roadmap and Contributing

What exists today

This wiki only describes things that run. As of version 1.5.0:

The language runtime in Node.js with its tests, examples and reference programs. The provisioning service with IGL Studio, a CLI and a local MCP server. The platform contract, OpenAPI 3.1, version 0.3.0, 51 operations, including the Subject service (pause, forget, reset, export). The hosted service implementing all 51 on sandbox.id-me.ai and api.id-me.ai, lint and type checks and 169 tests on every pull request, with the hosted MCP endpoint, a conformance suite that runs on every deploy, and the token host at auth.id-me.ai. The site at id-me.ai with its generated reference, developer console, User Center and Contact Sales intake. The operator console at ops.id-me.ai. Deploys, releases and security scanning from GitHub Actions.

What is planned

These are not in the repository yet. They are listed so nobody mistakes a plan for a feature.

A WASM build of the runtime with a browser playground, so a governed program can be run and traced on the documentation site without installing anything. Python and TypeScript SDKs generated from the contract, with receipt verification built in. A policy pack registry: shareable sets of purposes and policies for common regulatory settings, installed into a tenant with one call. An independent security review of the runtime and the platform, the one item of the October 2026 release gate still open. An operation in the contract to approve and resume a run parked at human_approval, so approvals are API calls with receipts rather than an administrator's action. Cloudflare Access as a first-class sign-in for the operator console with per-operator identity in the audit chain. Email on Google Workspace per the runbook.

Items are tracked as issues labelled roadmap in the repository. If you want one of them sooner, say so on the issue; that is the signal we use.

How releases work

Versions follow semantic versioning and every release has a changelog entry. A release is cut from the Actions page (Release, Run workflow): the suite runs, main is tagged with the package version, a GitHub release is published with the notes from the changelog, the npm tarball, the contract and checksums, and the package is published to npm with provenance when a token is configured. Tags are signed; verify one with git tag -v v1.5.0 before building from source.

Contributing

Pull requests are welcome, and the bar is the one the project sets for itself: npm run check passes on a clean clone (lint, type check, the full suite), the contract lints, and the change describes what it does in plain language. A few specifics:

Sign your commits off (git commit -s). The DCO check requires it. Keep changes to the contract and the service together with their tests; the conformance suite must still exercise every operation. If you touch the language, update docs/SPEC.md in the same change. Write prose, not fragments, in comments and documentation, and do not use decorative symbols; the project's documentation is meant to be read by people who are not engineers, and it is written that way on purpose.

Security problems go through private reporting, never a public issue. See Security Model.

Decisions that shape the runtime or the contract are recorded as architecture decision records in docs/adr/. If your change needs one, add it; if you are not sure, open the pull request and ask.

Trademarks and license

The code and the contract are Apache 2.0. "IGL", the logo and "Identity Governed Logic" are trademarks of SMEPro Technologies LLC; the license covers the code, not the name. Some governance mechanisms are the subject of pending patent applications, and the Apache patent grant applies as written.

Spread the word

If IGL is useful to you, the most helpful things are small: star the repository, link this wiki from the place your team keeps its AI guidelines, and when you write about it, show the receipt. The one-line version, if you need it: IGL makes every AI action answer who, what, why and what happened before it runs, and proves the answer afterwards.