Open work

The one live list of what is being built, what comes next, and what is waiting on a decision. Last reconciled against main at f4c6fa7f (2026-10-16).

The rule. A shipped item is deleted, not struck through: its record is the CHANGELOG entry and the PR. A wrong row is corrected in place, never answered by a new row beside it. Nothing in Now or Next is marked done. Feature PRs do not edit this file; the coordinator reconciles it after merges, because every PR editing its own row made every PR conflict with every other. scripts/check-open-work.sh (CI job open work, not required) runs on main and on a PR that edits this file, and fails when a PR listed under Now has merged or the stamp above is not on the branch. Red on main means reconcile.

History (the dated programs, audits and dispositions this file carried until 2026-09-29) is in Open Work 2026-08-25 to 2026-09-28. Direction is in Roadmap; what shipped is in Capabilities and CHANGELOG.md.

Before anyone deploys

No blocker is open. B2 (the stack's prod values pulled the dev image), B3 (working default credentials) and B5 (deploy paths that pointed at a missing tag or the wrong image) were fixed by #1156, and B6 (the stack's bundled datastores pulled images that no longer exist) by #1172. B1 (the pins named a release from before the cross-tenant fixes) and B4 (the ARM64 page ran v315.0.0 with auth off) were fixed by the v413.0.0 tag and the pin bump after it: every deploy path and install command pins v413.0.0, docs/Pi.md runs it with auth on and maidan init, and scripts/check-deploy-pins.sh (CI job deploy pins) keeps fifteen pins on the newest tagged release. The :dev images in compose.yaml and the charts' default values.yaml are built from source on purpose. Pointing anyone at a deploy is part of the launch, which is the maintainer's call.

Do not tag a commit whose push CI is red or unfinished. open work is not a required check, so a red open work alone does not block a tag; the eight required checks on the tagged commit do.

Now: in flight

Merge order matters where one PR builds on another; the column says so. A lane marked Active is being built in the coordinator's session from a local worktree: an agent outside that session does not start it, and takes a row of its own instead. No lane is active. Work left in stopped lanes is on wip/ and wip/rescue-* branches, named in the Next items it belongs to. Rows without a PR number are being built and get one when opened. The coordinator's merge loops run in its own session; whoever merges without them follows the merge rule in CLAUDE.md (all eight required checks on the exact head commit, --match-head-commit, and every CodeRabbit comment answered) and, before merging, builds the PR on current main if another PR merged since its CI ran.

Next: ranked

The launch path, ranked by what the launch needs first. The launch is open source plus a hosted service at maidan.world (decided 2026-10-12): the hosted rows (Next 24 to Next 28) come after the OAuth server people connect through, and the list closes with the launch release and its gate (Next 29). The directory listings follow the launch, on the maintainer's go. An item enters this table with acceptance criteria and a check that shows it is still open. "Thread" numbers refer to the 2026-09-29/30 enhancement thread, whose dispositions are recorded below.

Connected apps (Next 10 to Next 17, and Later CA). The no-authorization-server fast track the maintainer chose on 2026-10-03, in the strategy's lane order, with Lane 9's hint pass pulled forward as Next 14. Nothing is published or submitted to any directory, catalog or registry until the maintainer says go (2026-10-04), and never without Next 14's validation record. Until then a lane is done when it is built and validated. Every listing row depends on a validated release and the maintainer's go, because every listing points at a release, and the listings follow the launch. Each directory size includes one assumed rejection and resubmit cycle. No estimate is discounted for the the sibling app work, which transfers the OAuth protocol mechanics, the privacy policy's section headings, the Muse form mechanics and the sibling app's review outcome as an early signal, and nothing else (not the consent design, the reviewer identity path, the policy's substance, the crypto-shredding tail or the runbooks). Each lane is judged on its own. A lane whose connects reach the demo endpoint ships a token prefix per listing (half a day to a day each), so attempts attribute to the lane that earned them. The self-hosted lanes (Next 11, Next 12, the registry and image entries of Next 13, and Next 15) cannot see connects by design, and are judged on proxies, namely registry pulls, install counts, topic-driven GitHub traffic, recipe page views and any visibility a directory reports. A hybrid directory lane is judged on reported visibility plus those proxies, because its real users self-host. A near-free catalog PR promotes on acceptance. A heavier later lane promotes when two directory lanes each hold at least 25 attributed connects a week, on a four-week rolling average or in three of any four weeks, after scanner and reviewer traffic is filtered out, or when it reaches an audience the directory lanes cannot. The AWS lane and the IDE wrappers promote on acceptance plus one clean end-to-end install. The 25 is a starting guess, recalibrated after 90 days of data and recorded here. A lane is killed when a rejection has no remediation path, when a queue stalls 90 days with no response and no escalation, when 60 days live bring zero attributed connects on a hosted lane of size M or larger, or on the day a platform rule removes its fit. A killed lane stays recorded with its reason and date. Review-gated lanes are judged after 30 days live or two review cycles, whichever is later, and zero-review lanes after 30 days. Support tickets are tagged by surface at intake. Cursor and Anthropic re-review every update, so updates are batched, and each one re-runs Next 14's validation record. The strategy master is the connected-apps research of 2026-10-03, kept outside the repo. The supervision-session walkthroughs the directory rows require were walked and audited on 2026-10-05, with per-surface verdicts in the walkthrough synthesis kept outside the repo. ChatGPT, Cursor, Gemini CLI and Copilot CLI survive with mitigations. Claude connectors and Muse do not survive as shipped. How a human learns of a waiting gate is unbuilt on every surface except ChatGPT Work chats, where MCP Events are the documented wake-up path, and whether any directory surface has a push channel for connector events is open. Cursor 1.5 added OS notifications when input is required, which re-opens that question for Cursor without resolving it. Every listing, parked ones included, carries the three protocol-layer properties in Next 14.

Measure before scheduling: the per-response query count (F-51); whether the workspace context pack filters before it builds; the search deny-set query; the board's full re-render on large channels (thread 17); catch_up page cost as the event log grows (thread 18).

Found by the 2026-10-04 lanes, small enough to fold into the nearest PR. #1250 left an events-behind lag gauge undone and its new alert cases not yet run through promtool.

Found reviewing the installed-app OAuth flow (2026-10-08), small enough to fold into the nearest PR. exchange_app_code consumes a code before it checks redirect_uri and the verifier, so anyone holding a stolen code can burn it. The fix checks every binding, then consumes atomically, and app_oauth_e2e, which asserts today's order, changes with it. The token it mints has no expiry, and the exchange never authenticates the app, so PKCE, which the flow makes optional, is the only proof of possession. docs/OAuth.md carries all three as acceptance criteria for the new server.

Found running Claude clients against a local Maidan (2026-10-07), small enough to fold into the nearest PR. Claude Code passed discovery, search, post and an ordered search-then-post against a seeded workspace, and Claude Desktop passed discovery and search before the run stopped, each call confirmed in the request log. Search results carried ids but no names, so the model reported ids to the user (fixed by #1300). post_message needs a thread, so "post to #general" costs two lookups and is ambiguous in a channel with several threads. Claude Code speaks 2026-07-28 (server/discover, per-request _meta) on every call, which makes Next 8 a live client problem. A managed third-party Claude Desktop reads ~/Library/Application Support/Claude-3p/, not Claude/. claude.ai and Desktop custom connectors still need a public HTTPS URL, which the anonymous dev mode and MAIDAN_ALLOWED_HOSTS now make possible on the maintainer's go. The dev-instance recipe in docs/Clients.md names MAIDAN_ALLOWED_HOSTS.

Found by the #1247 and #1248 lane (2026-10-04), small enough to fold into the nearest PR. compose.yaml hides the root-owned /data volume problem because it stores artifacts in MinIO. A first install that collides with a hand-made app:<slug> member still answers with the generic handle conflict.

Found by the 2026-09-30 lanes, small enough to fold into the nearest PR: the store's *_audited methods do not check that an audit's scope matches the workspace they write in (#1134); the request-layer mutation row stamps the token's workspace, not the path's, for a bypass caller (#1134); a receiver that echoes a secret back in a slash response puts it in metadata.slash_response (#1140, documented); the retry budget is per replica and does not bound first-attempt floods (#1122, documented); and crypto_shredding blob_reap::sqlite_backend can fail with database is locked in the coverage job (seen on #1155, whose change touches no store code).

Later: by program

One line per item, promoted into Next when it gets acceptance criteria.

• R — resilience: chaos steady-state checks; native TLS on the gRPC listener (#1114 requires an acknowledgement instead).
• V — verification: stateful model tests beyond the claim lease; Kani over idempotency keys and FSM totality.
• D — Postgres operations: a durable retry for orphaned artifact blobs: DELETE /artifacts/{sha}, workspace purge and media expiry each log a failed blob delete (purge.orphaned_blob_not_deleted) and move on, leaving unreachable bytes, so a pending-reap row written with the erase or a storage reconciler should finish them; rebuild-derived --verify (re-fold the notification ledger, follow counts and inbox cursors from the log, with a drift metric); XID-age, bloat, WAL and replication-slot metrics; a pool-topology guide; a UTF-8 pin.
• B — protocol conformance: snapshot tests over normalized MCP, A2A, OpenAPI and audit shapes, so wire drift is a reviewed diff.
• S — security: thread_access::readable_thread requiring the reader to be a member of the thread's workspace, so the store predicate holds without each caller pinning the workspace first (search, the explorer and the context pack all do today); authority_audit_contract over every crate and example with its two carve-outs (maidan init, the Playwright harness) named, so a call outside the two watched crates cannot slip past (thread 14b); threat-regression gates (each Threat-Model row names its test) and a per-PR threat-model delta; token TTLs with DPoP or mTLS binding; audience-bound step-up auth for sensitive MCP tools; an over-permission scan of the MCP surface; a provenance label on content from other tenants, tools and external sources; miri over the unsafe in dependencies.
• E — compliance: read-time PII masking on messages, content blocks and audit metadata; scheduled key rotation and a key-age policy.
• O — observability: a buffered, redacted collector pipeline with a tested loss contract; opt-in tokio-console; a named p99 on the fan-out paths; operator views.
• F — search quality: reranking (RRF or a cross-encoder); an HNSW recall evaluation (the m/ef knobs are pgvector defaults); a query-embedding cache; a search evaluation gate over relevance_eval.rs; a ParadeDB comparison; facet search by reference kind, result kind and event kind.
• G — developer experience and governance: a fitness-function catalog; semver checks for the SDKs; a glossary-grounding lint; active benchmarking with k6; a devcontainer, pipeline parity, typed config, a cross-build matrix and an S3 test double.
• U — the web UI: design tokens; a code editor, log stream and DAG view; a reference-graph pane over the backlink index; an interactive OpenAPI reference; recorded demos; one-click token mint in Connect; a member last-active endpoint; cross-channel palette search; delivery and allowlist panels.
• Federation (when federation gets real multi-peer use): a per-peer egress allowlist in place of the whole-guard MAIDAN_ALLOW_PRIVATE_EGRESS bypass, which production already refuses (thread 10); a versioned envelope contract; cross-peer causal order; verifiable-credential peer trust.
• Parked evaluations (revisit on a concrete trigger): OPA/ABAC; Tantivy; compile-time SQL; SOPS; a CI egress allowlist; an in-flight-run drain signal; allocator and zero-copy micro-evaluations; an MCP registry policy.
• C — context economics (Context Economics; research in archive): after C1 to C4 (C2 shipped in #1239 and #1240; C1 shipped in #1241; C3 shipped in #1242; C4 shipped in #1297 and #1299), C5 warm-then-fan-out for claims that share a prefix; C6 claim timing inside the cache TTL, with affinity for the agent whose cache is warm; C7 a batch lane for threads whose deadline has slack; C8 task fingerprints that link duplicate work and offer exact reuse of accepted results; C9 fleet harness profiles with a conformance check; C10 summarize-once digests served by sha256; C11 routing hints for self-hosted KV-aware routers; C12 model and effort by task class; C13 the A2A contextId as an affinity key and the PayerStamp as an A2A extension; MCEB-1, the pre-registered cost-per-success benchmark, after C3 and when the maintainer sets its budget.
• UI audit P2 and the performance Tier 0 batch (UI deep dive 2026-10-03): the P2 items and Tier 0 (response compression, ETag revalidation on /ui assets rather than immutable caching without fingerprinted URLs, modulepreload, a capped live feed, the notices-query index) are recorded in the audit digest and promoted into Next as P0 and P1 land. The UI ships as a generated, minified bundle checked into the repo, with CI failing when it is stale (as with the vendored gRPC code), so cargo build still needs no Node and the bundle can carry fingerprinted URLs (decided 2026-10-04).
• L — launch (decided 2026-10-12, with the launch-blocking work in Next 24 to Next 30): open source plus a hosted service at maidan.world, with sign-ups through a waitlist first. The hosted service is free up to an allowance, and usage past it is metered (Next 27) and billed, with billing built on the ledger after launch. Still to come here: positioning, comparison and migration pages, the in-browser playground on the demo host, and the open-core boundary written down (the room stays open source). The privacy policy, terms and trust page are the maintainer's, prepared outside the repo.
• CA, connected apps (later lanes). Lane 8, the OAuth authorization server, is Next 23 since the maintainer's decision of 2026-10-08. The notes below are its design inputs. What exists is an installed-app authorization code exchange with optional PKCE, started by an admin call (crates/maidan-server/src/app_oauth.rs, POST /oauth/app/token). What does not is dynamic client registration, client metadata documents, OAuth metadata endpoints, a browser consent screen that maps capabilities to scopes, refresh tokens for those clients, and a 401 carrying WWW-Authenticate. When it unparks, client metadata documents are the primary path, with pre-registration for Cursor and for clients that present no document, a human stays in the consent flow, the reviewer identity path is designed in the lane, an upstream identity provider that is itself a supervised agent platform is used only if no other exists, and a 3 to 5 day security review comes before any listing depends on it. Lane 9's hint and title pass is Next 14. Its other half, splitting tools that mix reads and writes, is not done. The maintainer kept them as single tools on 2026-10-07, each a documented write. Before submitting, each directory lane chooses between the full surface and a curated profile of about twenty tools built on the worker and reviewer profiles, and runs the directory's test cases through the platform's model against whichever it lists. Lane 10, the Claude directory (S after lanes 4, 8 and 9), and Lane 11, the ChatGPT plugin directory (M after lanes 4, 8 and 9), wait on the Lane 8 revisit. Lane 10's static-headers path is a beta for a limited set of organizations, granted by invitation, and access is checked through mcp-review@anthropic.com at lane time. The audited walkthrough verdict strengthens the parked rationale. Supervision does not survive inside Claude connectors as they work today, because the surface collapses to narration plus per-tool prompts, and the directory's review rules forbid evidence-showing instructions in tool descriptions. The verdict supports the sequencing hold rather than parking on its own, and the best mitigation, MCP Apps, is build work to size before the lane is promised. Lane 11 needs a global-residency project (seven submitter runbooks say EU-residency projects cannot submit, re-confirmed in the portal), domain verification, five positive and three negative test cases, a video, and reviewer credentials without MFA. The OpenAI enterprise marketplace is a procurement and billing channel, not a self-serve plugin directory, so it is not a lane (provider research, 2026-10-06). ChatGPT's MCP Events, a signed-webhook wake-up path documented for Work chats and dots, is the one provider push channel found, and it is the natural carrier for Needs-you when Lane 11 unparks, subscribed by the user and never unsolicited. The audited walkthrough verdict for Lane 11 is survives with mitigations, and the mitigations are load-bearing, because the approval card authorizes one tool call and shows only the app and the proposed action. destructiveHint marks the call for explicit approval, which is advisory to the host and not a guarantee. toolInput stays withheld until after approval, so evidence-first ordering holds. The DevDay sidebar and panel surfaces host the Needs-you queue. The developer-mode bearer token question stays open for lane time, and no public-directory listing ships until the OAuth authorization server exists. Cutting Lane 11 and doubling Next 13 becomes the plan if Muse rejects the room as a category, if no session topology keeps supervision intact inside ChatGPT, or if the Lane 8 revisit answers skip. Lane 12, the Microsoft tracks (M to L), stays parked until the consumer lanes clear the promotion bar or a real customer in that ecosystem reopens it. Whether Microsoft's connector write actions have shipped is UNVERIFIED first-hand. Every directory lane, these included, walks a full supervision session before submitting (see Next 14) and has Next 14's validation record. The later lanes wait until the directory lanes are live and measured. AWS Marketplace AI agents and tools (M) is the exception, a procurement lane on its own bar that starts once the fast track ships. Its stateless streamable HTTP requirement on port 8000 at /mcp is UNVERIFIED. Pointing the container at the buyer's Postgres and object store does not configure the listener or the image's exposed port, so the requirement stays unverified until an image or deployment exposes 0.0.0.0:8000 at POST /mcp with test evidence recorded in Claims.md. The rest are Google Cloud Marketplace (L), Alexa with a voice adapter (M), Poe, which needs a Chat Completions endpoint (M), Kilo Code (XS, slow merges), a Workspace Marketplace Chat app (M), VS Code and Open VSX (S), and JetBrains and Raycast (S to M each). Watched, not lanes. Salesforce AgentExchange, Atlassian Rovo's announced MCP support, a Claude Code community marketplace, the end of new custom GPTs (October 26 for Enterprise, December 11 for everyone), and Anthropic's portal analytics as a visibility source for Lane 10. The dev and test program beyond Next 17 waits here. MCP JSON-RPC cassettes recorded through a proxy (agent-vcr) start only after a spike shows the proxy captures server-initiated elicitation/create, and are redacted on save. Provider-API cassettes, an unattended nightly driver for the scriptable clients (Gemini CLI, Copilot CLI, the Grok API), and an agentic-loop load test that checks rate limits under a burst of tools/list and tools/call follow. A dev-only OAuth stub for authenticated and write flows is built only when that testing starts. It refuses to boot without a dev flag, serves one synthetic identity, and is deleted, not extended, when Lane 8 unparks. Grok now has surfaces to watch, the Grok Bot Marketplace and the Grok Build plugin marketplace, though none lists third-party MCP servers for grok.com chat. Google Cloud Marketplace's AI agents category (A2A, an Agent Card and an OAuth2 code grant) fits Maidan's existing A2A surface and gets a sizing spike among the later lanes. Grok Build's plugin marketplace (PR-based, xai-org/plugin-marketplace) is a real distribution path after the maintainer's go. A quarterly re-read checks the facts the program rests on, namely each provider's plan gating, Anthropic's static request headers (a beta for a limited set of organizations), and whether Meta starts requiring per-user OAuth.

Decisions pending the maintainer

The maintainer delegated the rest on 2026-10-01; they are under Recently decided, and the ones that need building are in Now or Next.

External setup that blocks rows, and is not a decision: live Slack and GitHub apps for projector tests, a provider key for the Goose recipe, and Jev access for J-01.

Recently decided

Each links its record. Entries roll off after about a month.

Known risks

Won't do

Process

Merge discipline while branch protection is not strict (thread 43). A PR merges when every one of the eight required checks has passed on its exact head commit and nothing else on that commit is queued, running or failed; the merge names that commit (gh pr merge --match-head-commit), so a push in between makes GitHub refuse it. Before merging, the PR is merged onto current main locally and built, and the static contracts run on the result (attribution_scope_contract, authority_audit_contract, http_operation_kinds_contract, docs_numbers_contract, env_registry_contract, ui_js_contract, openapi_well_formed, the event-kind and lexicon contracts, migration_register, backend_parity). Stacked branches rebase in dependency order, replaying only their own commits. Two merges broke this on 2026-09-30 and are why the rules read as they do: #1124 merged while gh pr checks still showed the previous commit's runs, and #1133's last commit merged two seconds after a push, before GitHub reported the new head. main's CI passed on #1124's merge; #1133's is recorded in its PR.

Open Work is the coordinator's. Feature PRs do not edit this file or the Roadmap; the coordinator reconciles them after merges, and the open work job runs on main and on PRs that edit the file. The merge loop's pre-merge build takes a lock that names its holder, and a lock whose holder is gone is taken over: a killed loop once held every merge for five hours (2026-09-30).

Review comments. CodeRabbit reviews every PR (Decisions). Each top-level comment is fixed, or answered with the reason it does not apply, before the merge; the merge loop holds a PR while one has neither a reply nor CodeRabbit's "Addressed in commit" marker. From 2026-09-28 to 2026-10-01 the loops merged without that check, which is how 126 comments went unanswered (75 of them valid, one a cross-tenant rate-limit bug).

Old branches. A branch whose work shipped another way, or was closed, is kept as an archive/<branch> tag and then deleted (the six cursor/* branches, 2026-10-01). Stashes are not left on the shared stack: they are kept as local refs/archive/stash/* refs, which are never pushed because a stash can hold untracked files.

UI changes (thread 42, 46). The PR template's /ui checklist is run by hand before a UI PR is opened: the token path and the OIDC path, keyboard only, a 390 px viewport, and every new string re-read.

Enhancement thread 2026-09-30: dispositions

The 2026-09-30 entries (28–57) and the supersessions of 27, 28, 29 and 35. Entries marked done on main since the thread's 1e612cf8 snapshot are noted.

Done since 1e612cf8, per the thread's own list: 3 (#1118), 13, 14a, 19, 20, 22, 23 (#1113; 23's numbers corrected by lane U). The 2026-09-29 dispositions below stand, except where a row above supersedes them.

Enhancement thread 2026-09-29: dispositions

David's auditor re-verified each item five times against main and freshened it to 70a6d78b. Each item's disposition, and where it lives now. Items 5, 21 and 25 were struck by the thread itself (false premises) and are not re-filed.

Sequencing, as it ran. The P0s went first: inline errors (#1117) and one thread surface (#1118) merged on 2026-09-30, and the token chain is #1116 (merged), #1123, #1127 and #1142.

Where the thread was wrong. Item 2b assumed the UI had no cookie session: crates/maidan-server/src/session/mod.rs already issues HttpOnly; SameSite=Lax (and Secure when configured) cookies for OIDC sign-in, and each session stores a csrf_secret that no handler reads, so SameSite=Lax is the CSRF defence in force. Item 9 took the first #live-panel / #live-toolbar / #live-feed block for dead because a later block restyles the same elements, but the cascade is per property: the later block never sets the flex layout or the feed's colours, font, overflow and wrapping, so removing the first would break the Live bar. Everything else checked out.