Synced from Hive. This page is pulled from hivecommons/hive@v5 during the docs build. Edit the canonical source in the Hive repository.
Hive public roadmap
Hive’s direction is to make ongoing agent work easier to operate: safer permissions, useful review evidence, reliable long-running tasks, and clear cost and fleet health. Directional, not a delivery promise. The short tables separate available foundations from follow-up work; the dated decision record below preserves the original evidence.
Release status and operator action
| Line | Availability | What an operator should know |
|---|---|---|
| v5 | Supported stable line since 2026-09-21 | stable and candidate follow v5; release channels explains promotion and update timing. |
| v4 | Maintenance only until 2026-12-21 EOL | Security/critical fixes only until EOL; then no further releases or image retags and the branch becomes read-only. Use v4 → v5 migration. |
| v6 | Development branch; edge, not stable | Branch availability is not a stable-release commitment. The checked release allowlist is still [v4, v5]; v6 promotion requires its readiness bar. |
The v5 readiness tracker closed 2026-09-21. The cutover and the EOL announcement are completed work, not future roadmap items. The source and channel distinction above was checked against the current release configuration; the historical item dates below are not a fresh audit of every linked issue.
Now
| Work | Status | Reader-facing outcome | Primary record |
|---|---|---|---|
| Prompt-injection controls | Foundations available; hardening continues | Check untrusted agent input and limit unsafe output. | Security threat model |
| Intent verification | Partial | Check change authority; extend review of whether work matches the requested intent. | Intent verification |
| Review evidence and fan-out | Foundations available; follow-on work | Make reviews structured and combine perspectives into a usable verdict. | Review swarm |
| Credential-free execution | Direction / follow-on work | Keep credentials and network effects outside agent sandboxes. | #2804 |
| Long-running work | Foundations available; integration work | Track stages and verified results, including work that never opens a PR. | #8290 |
| Multi-spoke operation | Accepted direction; foundations available | See overlapping repository claims, shared capacity, and provider limits. | #5691 |
| Backend capacity and placement | Accepted direction | Make scheduling respect model availability, quota, and policy. | #5698 |
| Hosted onboarding | Available service; improvements continue | Try Hive without operating a cluster, subject to approval and capacity. | Hosted onboarding |
| Retrospective learning | Deterministic foundation; further work | Learn from completed tasks through reviewable findings and knowledge. | Retro lane |
| Large-spoke reliability | Fixes and reference available; measurement continues | Handle a growing backlog without hiding or stranding the work. | Scale envelope |
Next
| Work | Status | Reader-facing outcome | Primary record |
|---|---|---|---|
| Token-metering sourcing | Design decision recorded; not a claim of full cutover | Reuse backend parsers while retaining Hive attribution, budgets, and price labels. | ccusage design |
| Non-GitHub forge integration | Adapters available; complete hive operation not supported | Separate tracker/forge policy from GitHub-specific enumeration before widening deployment support. | ADR-0005 |
| Contributor distribution | Homebrew route shipped; later phases separate | Make installing and connecting contributor compute easier. | Distribution roadmap |
Later
| Work | Status | Reader-facing outcome | Primary record |
|---|---|---|---|
| Cross-forge orchestration | Direction | Coordinate tasks, proposed changes, policy, and evidence across code hosts. | ADR-0005 |
| Memory and learning | Direction | Keep reusable knowledge durable, testable, and auditable. | Knowledge design |
| Kubernetes-native sandboxes | Direction | Isolate agent workloads with cluster policy where the complexity is justified. | Security threat model |
| v6 dashboard-optional operation | Development branch available; stable promotion gated | Let people act through GitHub threads, chat, and escalation surfaces with the same permission checks. | #7563 |
Recently completed and available foundations
| Work | Status / date from the decision record | Operator consequence | Primary record |
|---|---|---|---|
| v5 readiness and channel cutover | Completed 2026-09-21 | v5 is the stable line; migrate v4 before 2026-12-21. | #6016 |
| Documentation publication | Live; v5 sync cutover resolved | Read v5 docs at docs.hivecommons.dev; Hive remains the canonical source for synced pages. | #7814 |
| HiveCommons org migration | Tracker closed 2026-09-03 | Native org/package names changed; mirror tags and redirects remain compatibility surfaces pending dated deprecation. | Migration tracker |
| Architecture decision records | Back-fill completed | Knowledge, skills, triggers, and hub/spoke choices have an auditable record. | ADR index |
| Stable promotion gate | Available; originally introduced on v4 | Current v5 stable promotion waits for age, evidence, blocker, smoke, and generation gates. | Stable policy |
| Repo-scoped controls | Pause/custom-agent decisions recorded 2026-09-09; current code also supports narrower ACMM overrides | A repository override cannot raise authority above the hive-wide ACMM ceiling. | Per-repo agents |
| Lite enrollment | Available entry path | hivectl enroll OWNER/REPO enrolls with a spoke; the hub tracks spokes, not a second repo registry. | Lite enrollment |
Detailed decision record and historical evidence
Optional: dated delivery history, implementation contracts, and supporting issue/PR links
The tables below preserve the earlier planning record, including its original
Now/Next/Later grouping. They are not a second current roadmap.
In particular, the September per-repo-ACMM rejection is historical:
Config.EffectiveACMMLevelForRepo now takes the narrower of the hive level
and a repository override. The current .github/release-lines.yml still
excludes v6 as a supported release line. Use the concise status tables above
and linked current guides for operator decisions.
Directional, not a promise. This roadmap reflects the direction of the v5 stable line as of 2026-09-22 (v5 has been the default branch and supported stable line since the 2026-09-21 cut-over, #7721). It is maintained by pull request and can change as issues, security reviews, and operator feedback change the order of work.
The umbrella issues this page grew out of — #2812 (catch-up epic) and #2811 (docs catch-up) — were both closed on 2026-08-08. They are cited below as the origin of a line of work, not as live trackers: a closed umbrella says nothing about whether any particular item under it shipped, so each row states its own status.
Prior Now records
| Work | Outcome | Tracking |
|---|---|---|
| Prompt-injection defense-in-depth | Canary-token checks, output redaction, fail-closed scanning, and the optional model-based semantic classifier build on deterministic ioscan kick-path redaction. | #2805, security threat model, ADR-0008 |
| Intent verification | Tier-based change authorization is in the merge-gate path; trajectory-integrated intent-alignment review remains the next slice. | #2803, intent verification |
| Review fan-out | Structured review reports and deterministic aggregation are in place; scheduler fan-out to parallel review perspectives is the deferred wiring. | #2807, review swarm |
| Credential-free sandbox kick path | Move agent execution toward no live token and no direct network in the sandbox, with trusted host-side post-steps retaining the MITM proxy as an outer layer. | #2804, security threat model |
| Long-running runs and convergence generality | Document the provisional runs archetypes — Oracle (pkg/worksource), Generator, Executor (pkg/convergence/mutation), and Gate (pkg/convergence), with Proof and Outcome as Gate inputs — in the reference architecture. The convergence rollout’s definition of done requires the mutation, proof, and outcome path to be exercised end to end by a workload that never opens a pull request; the report-only audit campaign is the proving workload. External-execution binding — #8201 Gate 1 shipped 2026-09-23 (#8361, merged via #8404): pkg/extwork carries the engine-neutral contract (keyed admission with the task lease as the authority record, five-state observation, digest-verified receipt fetch, crash-window recovery by pinned incarnation) and a Flue adapter proves it against a foreign durable-workflow engine — report-only, no publication credentials, default off behind runs.external.flue, linked only under the extwork_flue build tag. | #8290, #8201, #8300, #8345 |
| Spoke-based lite enrollment | Keep hivectl enroll OWNER/REPO as a zero-secret on-ramp by adding repos to an existing spoke or provisioning a hosted lite spoke; the hub tracks only spokes. | #2808, lite enrollment |
| Multi-spoke constellation foundations | Accepted for v5 phase 1 after production evidence from tunaos.org (self-hosted hub, two ACMM L5/L6 spokes, 43 repos). The first slice, repo-claim overlap detection, shipped in #5705; remaining slices add spoke charters, fleet headroom, GitHub App budget visibility, shared-credential guidance, and route recommendations without turning the hub into a hard control plane. | #5691, RFC #5691, #5705, #5796 |
| Backend capacity, model inventory, and placement | Accepted for v5 phase 1 because multi-spoke fleets are constrained by shared provider quota, model availability, and policy, not only by repo ownership. The work standardizes capacity readings, inventory authority, tier floors, scoped limits, and opt-in placement / pacing before scheduler behaviour depends on them. | #5698, RFC #5698, #5784 |
| Hosted Hive Hub positioning | Anchor the hosted hub (hive.hivecommons.dev) as the evaluation-grade, best-effort on-ramp: OAuth/OIDC accounts, admin-granted hosted quota, per-user and per-cluster capacity controls, /data/saas records, bounded usage/timeline history, hosted-vs-self-hosted guidance, and early exercise of the v5 constellation/capacity workstreams. | #6017, ROADMAP.md, hosted-hub |
| Retrospective learning lane | Build from deterministic post-completion advisory beads toward LLM-assisted retro summaries and knowledge extraction. | #2809, retro lane |
| Large-spoke scale envelope | State how a single spoke behaves as its backlog grows, rather than discovering it one bug at a time. The scale envelope page now records the design rule (overflow must paginate, prioritize, or shed load — never fail closed on the work that would drain the backlog), the fact that caps are render-side while issue/PR enumeration is uncapped, and an inventory of every cap with its overflow behaviour and tunability. Evidence base: the 2026-09-17 projectbluefin cluster (~304 open PRs across 16 repos) — uncapped kick PR list (#7368, fixed by #7379/#7395), restart/kick loop on a long delivery (#7363, fixed by #7378), stand-down on render-cap overflow (#7385, scoped per repo by #7391), fork-unaware repair queue (#7386). Remaining: decide one policy for which caps are operator-tunable vs hardcoded-and-narrowly-scoped, and measure enumeration cost against API rate limits at this shape. | #7392, scale envelope, #7385 |
| ADR back-fill for remaining subsystems | Done. Back-filled accepted ADRs capture the knowledge system, skill registry, CEL/channel triggers, and hub/spoke mechanics, so architecture decisions stay auditable. | ADR-0011, ADR-0012, ADR-0013, ADR-0014 |
| HiveCommons org migration | Tracker closed 2026-09-03 (#5686). The hivecommons→hivecommons move is auditable in the migration tracker: repo transfer, Go module rename, GHCR namespace and the hive.hivecommons.dev hub cutover are done; the ghcr.io/kubestellar/* mirror tags and hive.hivecommons.dev redirect stay as compatibility surfaces until the dated package deprecation (P6) is announced. | migration tracker, #5686 |
| v4 stable soak gate | Done. CI now keeps candidate moving on every green v4 image build and promotes stable later by digest only after the soak, evidence, blocker, smoke, and monotonic guards pass. | stable soak policy, #5974 |
Prior Next records
| Work | Outcome | Tracking |
|---|---|---|
| Token-metering sourcing | Decided — #6234/#6242 closed 2026-09-09. The hybrid sourcing model is accepted: a pinned ccusage --json --offline subprocess parses the covered CLI backends, while Hive keeps attribution, budget windows, price labels (native vs estimated), and the Bob scanner until ccusage covers it. The decision is recorded in token-tracking.md via #6366, with the accepted sequencing in the design doc (#6371): tokens.Source seam first, then a parallel-run diff before cutover. Implementation PRs against v5 referencing that design doc are welcome (v4 is feature-frozen and its merge gate rejects non-security work). | #6242, #6234, token tracking, ccusage design |
| v5 GA readiness bar | A v5 stable release is declared only when every row of the GA bar has an owner, a reproducible measurement source, and passing evidence. The v4 EOL announcement was blocked on this checklist being complete — no EOL date before the tracker closed. The bar doc lives on the v5 branch (v5-ga.md); this row keeps the dependency visible on the published roadmap. Decision-complete as of 2026-09-09: every row is bound or accepted — the row trackers (#6112, #6113, #6125, #6130, #6171, #6346) are all closed as decided, with bindings recorded in v5-ga.md via #6394, #6362, and #6361. Closed 2026-09-21: the live tracker (#6016) closed and the channels were re-based onto v5 the same day (#7721 Phases 1–3, executed as an emergency exception with a deviation record on that tracker; post-hoc soak evidence in #8062). EOL date announced 2026-09-22 (#8168, recorded in ROADMAP.md via #8219): v4 reaches end-of-life on 2026-12-21 — 90 days after v5.0.0 (2026-09-21). Until then v4 receives security and critical fixes only; after it, no further v4 releases or image retags, the v4 branch is archived read-only, and operators still on v4 should follow the v4→v5 migration guide (shipped via #8265; operator notice: v5-migration-announcement.md). | live tracker: #6016 (closed) |
| Per-repo policy scoping | Decided — #6208 closed 2026-09-09. Repo-scoped policy is one theme: project.paused_repos is the shipped pause precedent, and the accepted slices are per-repo pause (#6211, merged) and per-repo custom agents (#6215, merged). Per-repo ACMM levels are not accepted: #6111 is on hold and the onboarding-reconciler RFC #6235 was declined (design record: repo ACMM onboarding reconciler — declined). Any future ACMM scoping goes back through #6111, keeping hive-wide ACMM the ceiling with repo overrides only narrower. | #6208, #6111, #6203, #6204, #6211, #6215, #6235, #6263, #6264 |
| Docs site publication | Live at docs.hivecommons.dev. The org docs site — hivecommons/docs (Next.js + Nextra on Netlify) — pulls src/docs/ from this repo at build time via scripts/sync-hive-docs.ts (default branch v5; overridable with HIVE_DOCS_OWNER/HIVE_DOCS_REPO/HIVE_DOCS_REF), with links rewritten to site routes and committed copies as a fallback when the source is unreachable. The former hivecommons/docs pipeline is retired: hivecommons.dev/docs/hive is now a redirect stub pointing here. There is deliberately no second site generator in this tree (a per-repo MkDocs/Docusaurus config would duplicate that pipeline); hive.hivecommons.dev serves the product/dashboard landing page, not docs. This repo’s job is keeping src/docs/ a correct source for that sync — see Docs Link Check, which gates relative links and heading anchors on every PR touching src/docs/. Migration dependency — resolved (#7814, closed): after the 2026-09-21 cut-over (#7721 Phase 3), the sync’s default ref moved v4 → v5 in hivecommons/docs (hivecommons/docs#13), so the published site renders the v5 line. | docs index, origin: #2811 (closed), tracker: #7814 (closed) |
| Gitea/Forgejo forge program sequencing | Decided — #6177/#6167 closed 2026-09-09. The accepted sequencing: Wave 0 docs-only ADRs land now; Wave 1 may land on v5 behind the existing pkg/forge seam; Wave 2 T5 enumeration-policy extraction is post-GA-cut, or v5-first only if it does not reset the required-gate soak; the enumeration-engine ADR must address the #6090 hardcoded-org portability findings (that cluster, #6081–#6087, closed with the row bound in v5-ga.md) before the seam is widened. Follow-ups go on #6167. | #6177, #6167, #6169, #6170, #6171, #6112, #6090, #6081, #6082, #6083, #6084, #6085, #6086, #6087 |
| One-command contribute install | Shipped — #6635/#6641 closed 2026-09-11. brew install hivecommons/hive/contribute from the hivecommons/homebrew-hive tap wraps the published hive-contributor image; see Homebrew. The phased plan (distroless image → tap-repo conversion action → agent-harness integration) and its ownership split remain in the contribute distribution roadmap for the follow-on phases. | #6635, #6641 |
GitLab through pkg/forge | pkg/forge ships GitHub, GitLab, and Gitea/Forgejo adapters with the read path and core write path implemented and tested; Merge is left an explicit interface TODO because merge semantics diverge across forges. First production caller landed: the governor’s escalation writes (evidence comment + needs-human label) are now typed against the forge.IssueWriter seam, with the adapter selected from project.forge — so that key is no longer display-only. A GitHub hive is unchanged, still on *github.Client. Those writes are not yet reached on a non-GitHub hive, because the read path is still GitHub-shaped: EnumerateActionable feeds the whole governor cycle and owns hold-label filtering, issue filters and SLA tracking inside pkg/github. Neutralizing enumeration — lifting that policy above the forge boundary, and adding a bulk list method so an N-repo hive does not enumerate N times — is what remains. | ADR-0005, #5259, origin: #2812 (closed) |
Prior Later records
| Work | Outcome | Tracking |
|---|---|---|
| Cross-forge orchestration | Coordinate issues, merge requests, policy, and evidence across GitHub, GitLab, and Forgejo/Gitea-style forges. | ADR-0005 |
| Memory and learning maturation | Turn retro findings and curated knowledge into durable, testable priming without hidden or unauditable agent memory. | knowledge design, retro lane |
| Kubernetes-native agent sandboxes | Graduate from tmux/container execution toward k8s-native, policy-isolated agent workloads where that complexity is justified. | architecture, security threat model |
| v6 — dashboard-optional operation (line open) | The v6 branch opened 2026-09-18 (cut from v5); v6 implementation PRs target the v6 branch only and v6 tracks v5 by forward-merge. Theme: every operator interaction reachable from the places humans already are — GitHub threads (@-mention triggers), Slack/Discord/Teams/Matrix/Telegram over a shared pkg/chat spine, email and push/on-call escalation — all behind the same role/capability/ioscan guards the dashboard uses. Tracks merged on the v6 branch: the pkg/chat spine and Discord port (#7572) with reconnect/cancellation parity (#7586); Slack Socket Mode (#7585); Teams, Matrix, and Telegram (#7621, #7617, #7616); GitHub @-mention triggers phases 1–3 (#7582, #7597, #7623); outbound email and push escalation (#7618). Still unbuilt: the Slack Events API accelerator and inbound reply-to-act email. This is branch status, not stable-release status — none of it exists on v4 or v5; since the 2026-09-21 channel re-base (#7721), edge is built from v6, so operators tracking edge run these surfaces as active-development builds while stable/candidate (v5) do not have them. Beyond the dashboard-optional theme, the line accepts new tracks by RFC, each measured against the same readiness bar: task-scoped MCP — expose the hive’s view of a task to contributor agents as a Model Context Protocol endpoint (#8033; Phase 1 merged on v6 via #8164, #8177, #8179 — pkg/taskmcp, the /api/contribute/mcp endpoint, and the first four tools; Phase 2 lease-scoped auth #8228 and Phase 3 repo tools #8244 also merged on v6; the RFC closed 2026-09-22 with the first live token-delta measurement, and the remaining saving — eliding stuffed issue/PR lists when the MCP pointer is present — is #8261) — and standby contributors — a lane paused for budget hands its queue to volunteer contributors behind a model floor (#7629; design #8038; S0–S7 merged on v6, S8 waits on live-hive runbook evidence). Promotion bar: v6-readiness.md, live tracker #7563 §v6 readiness bar. Full policy in ROADMAP.md. Known gap, updated 2026-10-02: the dangerous part of the v6 release-path gap is fixed — tagged-release.yml/promote-stable.yml now derive RELEASE_LINE/RELEASE_BRANCH from github.ref_name and refuse to run from a branch that is not in .github/release-lines.yml’s release_lines list (#9154, closed, fixed by #9307). What’s still true: release_lines remains [v4, v5] — v6 has not been added — and docker.yml’s v6 rows still only ever publish edge, never candidate/stable; this is now a deliberate, guarded GA gate pending the readiness bar, not a bug. The readiness-runbook gap is resolved (#9200, closed). Tracked together in #9227, open pending a maintainer go/no-go on flipping the gate. | #7563 epic, #7483, mention-triggers design, Slack design, escalation design, #9227 |
Reading the historical grouping
- Now does not mean all work is complete; it means active phase-2 work or freshly merged foundations with known wiring still in progress.
- Next items are expected follow-ups, not release commitments.
- Later items are strategic directions that may split into narrower issues before implementation.
Reading this roadmap
“Available” describes an existing foundation, not every planned extension. “Accepted” or “decided” records a design choice, not a release. “Development branch” does not mean “stable channel.” No ordering here commits a delivery date; completed items live separately so they do not look like the next thing to ship.