Roadmap

Roadmap

Sardine CMS is a CMS: the bar for "complete" is what editors already expect from the mature CMSs they come from. The full capability inventory — what ships today, what is partial, and where each gap is scheduled — lives in docs/ROADMAP.md, kept honest next to the code. The headlines:

Shipped (Milestones 0–5)

Content core with per-language translation states, four storage engines, validation engine with per-rule reporting, deterministic builder with full multilingual SEO, theme system, deployment targets, the cms CLI, and the complete browser admin (accounts and roles, editors, media library, workflow, publishing) on AdminLTE with its behaviors. v0.1.x on PyPI; live demo at https://sardine.ph7x.com.

M5 — Editorial completeness (closed)

Trash/restore, duplicate-as-draft, per-entry preview, quick list actions, featured content, authorship, media library filters, a users screen, editorial notes.

M6 — Extensibility and adoption

Shipped: the explicit extension contract and custom fields (ADR-0028), menu manager, responsive image derivatives (ADR-0029), redirect maps, lossless portable dump/import, a controlled foreign-blog adapter (ADR-0030), and design-aware autosave/live preview (ADR-0027).

Reusable-block authoring shipped: the section-kind gallery is now a tested contract — nine bundled kinds (including quote, FAQ, CTA and image gallery), both themes, admin field suggestions and extension-added kinds. Milestone 6 is closed: the comments contract shipped (ADR-0031, providers as extensions, consent-first) and the versioned JSON content target now accompanies every opt-in build (Content API). Milestone 7 is underway: ADR-0032 phase 1 shipped — enumeration-safe password reset over a pluggable mail-transport contract (smtp baseline; extensions carry passwordless provider APIs). Phase 2 shipped too — ADR-0032 is accepted: review-requested and published notifications, localized per recipient. TOTP 2FA shipped (ADR-0035). Milestone 7 is closed: pluggable email with enumeration-safe reset and notifications (ADR-0032), TOTP two-factor with per-role enforcement (ADR-0035), signed on-publish webhooks (ADR-0036) and cms doctor. v0.2.0 is on PyPI. ADR-0034 phase 1a is in: the locale type opened — validated tags behind the old enum surface, with Language.register as the pack entry point. Phase 1b is in: language packs work end to end — an extension's pack makes its tag a full content language (config, build, labels, dates, RTL direction on the markup). The multilingual bar is explicit now — every language is a pack, the bundled five included, and no admin surface may grow horizontally per language (content lists show a constant-width coverage summary). Next: the bundled five's data migrates into packs, configurable source language, admin catalogs from packs, full RTL, a translation queue and state filters — the full map lives in the repository's docs/ROADMAP.md. Milestone 8 opens with ADR-0034 (written): tag-based locales, contributable language packs and RTL/LTR text direction — languages are data, never schema; execution is phased (core, builder/themes, admin, ecosystem).

Beyond M7 the scope is now written down as two further horizons. Milestone 8 — editorial power and content depth: bulk actions, admin-wide search, scheduled unpublish, an editorial calendar, an audit log, custom taxonomies, content relations, media crop/focal point and WebP/AVIF derivatives, an embeds contract, a forms contract and per-entry SEO controls. Milestone 9 — platform and ecosystem: a privacy-first analytics contract, external review links, incremental builds and a published ecosystem catalog. Arbitrary locale sets and SSO/OIDC are recorded as post-1.0 architectural decisions. The full capability map with per-item status lives in the repository's docs/ROADMAP.md; ADR-first items start with their decision record, as always.

M7 — Operations

Email/notifications (password reset, review requests), TOTP two-factor, on-publish webhooks, cms doctor, documented backup/restore and scheduled-build recipes.

1.0

M5–M7 shipped, admin stable, two production deployments beyond the original site, a deprecation policy on PyPI, and every conformance suite documented as a public contract.