Synced from Hive. This page is pulled from hivecommons/hive@v5 during the docs build. Edit the canonical source in the Hive repository.
Hive public roadmap
Directional, not a promise. This roadmap reflects the direction of the v5 stable line as of 2026-09-22 (v5 has been the default branch and supported stable line since the 2026-09-21 cut-over, #7721). It is maintained by pull request and can change as issues, security reviews, and operator feedback change the order of work.
The umbrella issues this page grew out of — #2812 (catch-up epic) and #2811 (docs catch-up) — were both closed on 2026-08-08. They are cited below as the origin of a line of work, not as live trackers: a closed umbrella says nothing about whether any particular item under it shipped, so each row states its own status.
Hive’s roadmap is organized as Now / Next / Later: near-term work already in flight, likely follow-ups, and longer-horizon bets. Items are listed in planning order, not priority rank.
Now
| Work | Outcome | Tracking |
|---|---|---|
| Prompt-injection defense-in-depth | Canary-token checks, output redaction, fail-closed scanning, and the optional model-based semantic classifier build on deterministic ioscan kick-path redaction. | #2805, security threat model, ADR-0008 |
| Intent verification | Tier-based change authorization is in the merge-gate path; trajectory-integrated intent-alignment review remains the next slice. | #2803, intent verification |
| Review fan-out | Structured review reports and deterministic aggregation are in place; scheduler fan-out to parallel review perspectives is the deferred wiring. | #2807, review swarm |
| Credential-free sandbox kick path | Move agent execution toward no live token and no direct network in the sandbox, with trusted host-side post-steps retaining the MITM proxy as an outer layer. | #2804, security threat model |
| Long-running runs and convergence generality | Document the provisional runs archetypes — Oracle (pkg/worksource), Generator, Executor (pkg/convergence/mutation), and Gate (pkg/convergence), with Proof and Outcome as Gate inputs — in the reference architecture. The convergence rollout’s definition of done requires the mutation, proof, and outcome path to be exercised end to end by a workload that never opens a pull request; the report-only audit campaign is the proving workload. External-execution binding — #8201 Gate 1 shipped 2026-09-23 (#8361, merged via #8404): pkg/extwork carries the engine-neutral contract (keyed admission with the task lease as the authority record, five-state observation, digest-verified receipt fetch, crash-window recovery by pinned incarnation) and a Flue adapter proves it against a foreign durable-workflow engine — report-only, no publication credentials, default off behind runs.external.flue, linked under the extwork_flue build tag. | #8290, #8201, #8300, #8345 |
| Spoke-based lite enrollment | Keep hivectl enroll OWNER/REPO as a zero-secret on-ramp by adding repos to an existing spoke or provisioning a hosted lite spoke; the hub tracks spokes. | #2808, lite enrollment |
| Multi-spoke constellation foundations | Accepted for v5 phase 1 after production evidence from tunaos.org (self-hosted hub, two ACMM L5/L6 spokes, 43 repos). The first slice, repo-claim overlap detection, shipped in #5705; remaining slices add spoke charters, fleet headroom, GitHub App budget visibility, shared-credential guidance, and route recommendations without turning the hub into a hard control plane. | #5691, RFC #5691, #5705, #5796 |
| Backend capacity, model inventory, and placement | Accepted for v5 phase 1 because multi-spoke fleets are constrained by shared provider quota, model availability, and policy, not by repo ownership. The work standardizes capacity readings, inventory authority, tier floors, scoped limits, and opt-in placement / pacing before scheduler behaviour depends on them. | #5698, RFC #5698, #5784 |
| Hosted Hive Hub positioning | Anchor the hosted hub (hive.hivecommons.dev) as the evaluation-grade, best-effort on-ramp: OAuth/OIDC accounts, admin-granted hosted quota, per-user and per-cluster capacity controls, /data/saas records, bounded usage/timeline history, hosted-vs-self-hosted guidance, and early exercise of the v5 constellation/capacity workstreams. | #6017, ROADMAP.md, hosted-hub |
| Retrospective learning lane | Build from deterministic post-completion advisory beads toward LLM-assisted retro summaries and knowledge extraction. | #2809, retro lane |
| Large-spoke scale envelope | State how a single spoke behaves as its backlog grows, rather than discovering it bug at a time. The scale envelope page now records the design rule (overflow must paginate, prioritize, or shed load — never fail closed on the work that would drain the backlog), the fact that caps are render-side while issue/PR enumeration is uncapped, and an inventory of every cap with its overflow behaviour and tunability. Evidence base: the 2026-09-17 projectbluefin cluster (~304 open PRs across 16 repos) — uncapped kick PR list (#7368, fixed by #7379/#7395), restart/kick loop on a long delivery (#7363, fixed by #7378), stand-down on render-cap overflow (#7385, scoped per repo by #7391), fork-unaware repair queue (#7386). Remaining: decide policy for which caps are operator-tunable vs hardcoded-and-narrowly-scoped, and measure enumeration cost against API rate limits at this shape. | #7392, scale envelope, #7385 |
| ADR back-fill for remaining subsystems | Done. Back-filled accepted ADRs capture the knowledge system, skill registry, CEL/channel triggers, and hub/spoke mechanics, so architecture decisions stay auditable. | ADR-0011, ADR-0012, ADR-0013, ADR-0014 |
| HiveCommons org migration | Make the hivecommons-to-hivecommons migration auditable before package or repository defaults change, including image mirror phases, docs sweeps, v5 edge coverage, and operator communications. | migration tracker, #5686 |
| v4 stable soak gate | Done. CI now keeps candidate moving on every green v4 image build and promotes stable later by digest after the soak, evidence, blocker, smoke, and monotonic guards pass. | stable soak policy, #5974 |
Next
| Work | Outcome | Tracking |
|---|---|---|
| Token-metering sourcing | Decided — #6234/#6242 closed 2026-09-09. The hybrid sourcing model is accepted: a pinned ccusage --json --offline subprocess parses the covered CLI backends, while Hive keeps attribution, budget windows, price labels (native vs estimated), and the Bob scanner until ccusage covers it. The decision is recorded in token-tracking.md via #6366, with the accepted sequencing in the design doc (#6371): tokens.Source seam first, then a parallel-run diff before cutover. Implementation PRs against v5 referencing that design doc are welcome (v4 is feature-frozen and its merge gate rejects non-security work). | #6242, #6234, token tracking, ccusage design |
| v5 GA readiness bar | A v5 stable release is declared when every row of the GA bar has an owner, a reproducible measurement source, and passing evidence. The v4 EOL announcement was blocked on this checklist being complete — no EOL date before the tracker closed. The bar doc lives on the v5 branch (v5-ga.md); this row keeps the dependency visible on the published roadmap. Decision-complete as of 2026-09-09: every row is bound or accepted — the row trackers (#6112, #6113, #6125, #6130, #6171, #6346) are all closed as decided, with bindings recorded in v5-ga.md via #6394, #6362, and #6361. Closed 2026-09-21: the live tracker (#6016) closed and the channels were re-based v5 the same day (#7721 Phases 1–3, executed as an emergency exception with a deviation record on that tracker; post-hoc soak evidence in #8062). EOL date announced 2026-09-22 (#8168, recorded in ROADMAP.md via #8219): v4 reaches end-of-life on 2026-12-21 — 90 days after v5.0.0 (2026-09-21). Until then v4 receives security and critical fixes; after it, no further v4 releases or image retags, the v4 branch is archived read-only, and operators still on v4 should follow the v4→v5 migration guide (shipped via #8265; operator notice: v5-migration-announcement.md). | live tracker: #6016 (closed) |
| Per-repo policy scoping | Decided — #6208 closed 2026-09-09. Repo-scoped policy is theme: project.paused_repos is the shipped pause precedent, and the accepted slices are per-repo pause (#6211, merged) and per-repo custom agents (#6215, merged). Per-repo ACMM levels are not accepted: #6111 is on hold and the-reconciler RFC #6235 was declined (design record: repo ACMM reconciler — declined). Any future ACMM scoping goes back through #6111, keeping hive-wide ACMM the ceiling with repo overrides narrower. | #6208, #6111, #6203, #6204, #6211, #6215, #6235, #6263, #6264 |
| Docs site publication | Live at docs.hivecommons.dev. The org docs site — hivecommons/docs (Next.js + Nextra on Netlify) — pulls src/docs/ from this repo at build time via scripts/sync-hive-docs.ts (default branch v5; overridable with HIVE_DOCS_OWNER/HIVE_DOCS_REPO/HIVE_DOCS_REF), with links rewritten to site routes and committed copies as a fallback when the source is unreachable. The former hivecommons/docs pipeline is retired: hivecommons.dev/docs/hive is now a redirect stub pointing here. There is deliberately no second site generator in this tree (a per-repo MkDocs/Docusaurus config would duplicate that pipeline); hive.hivecommons.dev serves the product/dashboard landing page, not docs. This repo’s job is keeping src/docs/ a correct source for that sync — see Docs Link Check, which gates relative links and heading anchors on every PR touching src/docs/. Migration dependency — resolved (#7814, closed): after the 2026-09-21 cut-over (#7721 Phase 3), the sync’s default ref moved v4 → v5 in hivecommons/docs (hivecommons/docs#13), so the published site renders the v5 line. | docs index, origin: #2811 (closed), tracker: #7814 (closed) |
| Gitea/Forgejo forge program sequencing | Decided — #6177/#6167 closed 2026-09-09. The accepted sequencing: Wave 0 docs-only ADRs land now; Wave 1 may land on v5 behind the existing pkg/forge seam; Wave 2 T5 enumeration-policy extraction is post-GA-cut, or v5-first if it does not reset the required-gate soak; the enumeration-engine ADR must address the #6090 hardcoded-org portability findings (that cluster, #6081–#6087, closed with the row bound in v5-ga.md) before the seam is widened. Follow-ups go on #6167. | #6177, #6167, #6169, #6170, #6171, #6112, #6090, #6081, #6082, #6083, #6084, #6085, #6086, #6087 |
| -command contribute install | Collapse the four-step ClankeR on-ramp into brew install … via an apptainer build of the published hive-contributor image, phased as distroless image → tap-repo conversion action → agent-harness integration. Ownership split and per-phase acceptance criteria are in the contribute distribution roadmap; implementation is owned by the proposer on the tracker. | #6635, #6641 |
GitLab through pkg/forge | pkg/forge ships GitHub, GitLab, and Gitea/Forgejo adapters with the read path and core write path implemented and tested; Merge is left an explicit interface TODO because merge semantics diverge across forges. First production caller landed: the governor’s escalation writes (evidence comment + needs-human label) are now typed against the forge.IssueWriter seam, with the adapter selected from project.forge — so that key is no longer display-only. A GitHub hive is unchanged, still on *github.Client. Those writes are not yet reached on a non-GitHub hive, because the read path is still GitHub-shaped: EnumerateActionable feeds the whole governor cycle and owns hold-label filtering, issue filters and SLA tracking inside pkg/github. Neutralizing enumeration — lifting that policy above the forge boundary, and adding a bulk list method so an N-repo hive does not enumerate N times — is what remains. | ADR-0005, #5259, origin: #2812 (closed) |
Later
| Work | Outcome | Tracking |
|---|---|---|
| Cross-forge orchestration | Coordinate issues, merge requests, policy, and evidence across GitHub, GitLab, and Forgejo/Gitea-style forges. | ADR-0005 |
| Memory and learning maturation | Turn retro findings and curated knowledge into durable, testable priming without hidden or unauditable agent memory. | knowledge design, retro lane |
| Kubernetes-native agent sandboxes | Graduate from tmux/container execution toward k8s-native, policy-isolated agent workloads where that complexity is justified. | architecture, security threat model |
| v6 — dashboard-optional operation (line open) | The v6 branch opened 2026-09-18 (cut from v5); v6 implementation PRs target the v6 branch and v6 tracks v5 by forward-merge. Theme: every operator interaction reachable from the places humans already are — GitHub threads (@-mention triggers), Slack/Discord/Teams/Matrix/Telegram over a shared pkg/chat spine, email and push/on-call escalation — all behind the same role/capability/ioscan guards the dashboard uses. Tracks merged on the v6 branch: the pkg/chat spine and Discord port (#7572) with reconnect/cancellation parity (#7586); Slack Socket Mode (#7585); Teams, Matrix, and Telegram (#7621, #7617, #7616); GitHub @-mention triggers phases 1–3 (#7582, #7597, #7623); outbound email and push escalation (#7618). Still unbuilt: the Slack Events API accelerator and inbound reply-to-act email. This is branch status, not stable-release status — none of it exists on v4 or v5; since the 2026-09-21 channel re-base (#7721), edge is built from v6, so operators tracking edge run these surfaces as active-development builds while stable/candidate (v5) do not have them. Beyond the dashboard-optional theme, the line accepts new tracks by RFC, each measured against the same readiness bar: task-scoped MCP — expose the hive’s view of a task to contributor agents as a Model Context Protocol endpoint (#8033; Phase 1 merged on v6 via #8164, #8177, #8179 — pkg/taskmcp, the /api/contribute/mcp endpoint, and the first four tools; Phase 2 lease-scoped auth #8228 and Phase 3 repo tools #8244 also merged on v6; the RFC closed 2026-09-22 with the first live token-delta measurement, and the remaining saving — eliding stuffed issue/PR lists when the MCP pointer is present — is #8261) — and standby contributors — a lane paused for budget hands its queue to volunteer contributors behind a model floor (#7629; design #8038; S0–S7 merged on v6, S8 waits on live-hive runbook evidence). Promotion bar: v6-readiness.md, live tracker #7683. Full policy in ROADMAP.md. | #7563 epic, #7483, mention-triggers design, Slack design, escalation design |
Reading this roadmap
- Now does not mean all work is complete; it means active phase-2 work or freshly merged foundations with known wiring still in progress.
- Next items are expected follow-ups, not release commitments.
- Later items are strategic directions that may split into narrower issues before implementation.