Roadmap

Roadmap

The authoritative version is ARCHITECTURE.md §8. Ideas and votes are welcome in Discussions → Ideas. Planned work is tracked as issues under the v0.1.2 and v0.2 milestones.

v0.1.x: hardening (next)

• Retention and a prune command for the MCP audit log shipped in 0.1.1: castra mcp audit prune --older-than <days>
• Rate limiting guidance (and a ready-made Cloudflare rule) for /mcp
• Problem+json for Better Auth's own /api/auth/* errors
• A signal when a one-to-many include is truncated
• Column collations in the snapshot, so check_access matches real writes

v0.2: agents write

MCP write tools on the same write checks as REST · migrations · propose_policy · deploy_status and a richer doctor

v0.3: expansion

R2 storage routes · multi-level includes · bulk operations · multi-tenancy (open question). A read-only admin panel (data browser, roles, policy inspector, audit log) is being discussed for this release.

v1.0: stable

Plugin SDK · custom hooks · admin UI · a stable config API

Out of scope until v1.0: PostgreSQL/MySQL/Hyperdrive, realtime (Durable Objects), queues, Redis/S3/OIDC adapters, and a hosted offering.