Roadmap

Roadmap

This page defines how the plugin's readiness is communicated and where it stands today. It is the single place that explains the maturity labels you see in the README and in the plugin's configuration page.

Where it stands

Current stage: In-Development — the first rung of the ladder.

● In-Development  →  ○ Alpha  →  ○ Beta  →  ○ Release Candidate  →  ○ Full Release
▲ you are here

Until a Full Release, this plugin is for developers to test only. Do not put it in front of a real Jellyfin instance with real user accounts — it is a login path still under reconstruction.

The maturity ladder

The project moves through five stages. Each has a plain definition, who it is for, and the explicit gates that must be met before it advances. The gates are deliberately conservative: this is a login path, so readiness is proven, not assumed.

1. In-Development — current

The core is being (re)built and hardened. Features are incomplete, interfaces and configuration can change without notice, and known security gaps are still being closed.

• For whom: developers, on throwaway instances only.
• Gates to Alpha:
  • the automated test net is established and green in CI;
  • security parity with the reference implementation is substantially reached (the P2 milestone), with no known exploitable finding left open;
  • a from-source install works end to end for both OpenID Connect and SAML.

2. Alpha

OpenID Connect and SAML sign-in work for the common providers, but the feature surface is not yet complete and breaking changes are still possible.

• For whom: early adopters willing to test on non-critical instances and report back; still never on production.
• Gates to Beta:
  • feature parity with the reference implementation reached (the P4 milestone);
  • the CI and supply-chain hardening in place (the P5 / P5b milestones);
  • user-facing documentation complete for every shipped feature;
  • no open High or Critical security finding.

3. Beta

Feature-complete and interface-stable. Work is limited to bug fixes and hardening; no new breaking change lands without a documented migration path.

• For whom: wider testing on real but non-critical instances is encouraged.
• Gates to Release Candidate:
  • a full end-to-end functional pass is green against a live Jellyfin server;
  • the test-coverage goal is met;
  • zero open security findings;
  • delivery metrics are tracked (the P6 milestone).

4. Release Candidate

This is the deliberate name for the stage between Beta and Full Release — a frozen, production-ready candidate awaiting confirmation in the field, rather than a "release beta".

The build is frozen and treated as production-ready. Only a release-blocking defect can pull a change in; everything else waits for the next cycle.

• For whom: cautious production trials on instances with a rollback plan.
• Gates to Full Release:
  • a candidate build survives a defined soak period with no release-blocking defect reported.

5. Full Release

Production-ready. Safe for real Jellyfin instances with real accounts, with the stability and upgrade guarantees expected of a stable line.

• For whom: everyone.

How the engineering work maps to the ladder

The work that carries the plugin up the ladder is tracked as phase milestones on the SSO Roadmap board:

Phase	Focus	Ladder stage it unlocks
P2 — Security parity	Port the reference implementation's hardening	In-Development → Alpha
P3 — Code quality	Thin the controller into tested, single-purpose helpers	(throughout)
P4 — Feature parity	Close the remaining feature gaps	Alpha → Beta
P5 — CI & supply chain	Reproducible builds, provenance, dependency hygiene	Alpha → Beta
P5b — Review-gap program	Independent second-perspective review on every change	Alpha → Beta
P6 — Delivery metrics	Track delivery and stability	Beta → Release Candidate

Principles

• Security before features. This is a login path; the default posture is fail-closed, and security work outranks feature work.
• Documentation describes what is implemented today, never a planned feature. If a page disagrees with the code, the code wins — please open an issue.
• Every change is issue-driven, reviewed, and documented before it merges.

Following along

• The SSO Roadmap board is the live source of truth for what is done and what is next.
• The Home page lists what the plugin does today.
• The Security Model page explains how the login path fails closed.