obot.roadmap v0.5 — local sessions and the tracker

See it move: the annotated v0.5 demo has screenshots, captures and the detail behind everything below.

The hub's first release since it became the standards home: a tracker in place of the project board, a cost chart that says what it covers, shorter release notes, and the fixes from a security review. Since 2026-10-07 the standards say a session runs locally and writes to GitHub as obotclaw[bot]; cloud sessions are parked. The roadmap pages no longer list draft releases.

What's new

• The tracker replaces the project board. tracker.html shows every objective opened to its requirements and their tasks, with search, filters and a link that carries the view. The nav is the four pages that get read. PR #347
• The Cost chart runs through October and says what it covers. The analytics page names the days each record runs through and the stretches where nothing was recorded. Local usage is refreshed by hand. PR #370
• The standards say how a session runs now. A session runs locally, from @jwildfire's workspace, and writes to GitHub as obotclaw[bot]. Approving a pull request, merging past a ruleset and changing a ruleset stay his alone. #384, PR #385
• Release notes are held to a length. At most 600 words a section and 70 a feature bullet, with the detail on the release's demo page (developer guidelines). obot.agent PR #341
• A release candidate is reviewed by three subagents the session spawns. They replace ultrareview, which only a person can launch. The session resolves every finding and posts the review before @jwildfire is asked. obot.agent PR #340
• The site build no longer uses the bot's key. The step that minted a bot token is gone, and the steps that install outside code no longer see a personal token. A push to main cannot act as the bot once @jwildfire deletes the two secrets the build has stopped reading. #382, #384, PR #383, PR #385

Also in this release

• The ruleset check fails when it cannot look. scripts/github-flows.sh check reports a ruleset it cannot read as drift, and any entry on a bypass list. It used to print "matches" for both. #378, PR #379, PR #387, PR #390
• The nightly local usage job is retired. Its script no longer hands control to a freshly fetched copy of itself. #378, PR #379
• The roadmap pages list release candidates from pull requests only. Reading draft releases needed a token that can write. #384, PR #385, PR #387
• Links to pages obot.agent removed point at their new homes. #372, PR #376

Tests and provenance

138 generator tests and 15 usage-aggregator tests pass, and the deploy checks that every published page describes itself. Each security finding fixed here was reproduced before its fix. The bot's token and the guard behind the third bullet are tooling of @jwildfire's workspace and are in no repository.