Roadmap and current state
Where Orgabot actually is: the delivered programs, the ones still in flight, what is honestly not built yet, and what is deliberately off the critical path.
Status here reflects the current-state audit and the active build sequence, not the status line an ADR carried when it was written. The governing decision is ADR 0055; the sequence lives in docs/org-staffing-roadmap.md and the evidence in docs/current-state-audit.md.
Where the product is
Orgabot has a substantial local-first control plane today. A typed instruction can be resolved to a project and an organization, decomposed across roles, run in an isolated git worktree, independently verified and reviewed, and delivered through scoped GitHub App authority. On top of that sit organization staffing, role capabilities, approvals, context and memory, duties, recovery, quota failover, and a broad local dashboard.
The programs
| Program | Status | What it is |
|---|---|---|
| 1. Documentation and baseline alignment | Complete | One product sequence and one implementation truth for every contributor and agent |
| 2. Authoritative mission lifecycle | Complete | One persisted lifecycle owns mission truth; every other record is a projection |
| 3. Interactive dashboard mission terminal | Substantially delivered | The dashboard replaces the day-to-day terminal without reducing control |
| 4. Modularization | Complete (2026-08-13) | The four concentration points are composition points now, held there by a test |
| 5. API-key-backed coding parity | Complete | Secure API coding worker, governed selection, streaming, cancellation, quota and cost parity |
| 6. Capability-gap autonomy (ADR 0037) | Complete | Detect an unstaffed capability, hold it, propose staffing, resume through ordinary gates |
| 7. Voice mission sessions | P7.1 delivered; remainder planned | Voice as a primary layer over the same mission-session contract |
| Department Operating Model (ADR 0056) | Delivered (D0–D9) | Departments as business operating workspaces, not org-chart labels |
| Workflow orchestration (ADR 0062) | Delivered (W1–W9), residuals named | Missions execute workflow definitions as data; gates are one mechanism; one event spine |
| Dashboard performance (P1–P7) | Delivered | Bounded read path, SQLite operational store, change outbox, SSE streaming |
| Operational-store cutover (ADR 0063) | Delivered | Peripheral-domain authority moved to SQLite, equivalence was proved, the compatibility writers were retired, and the dual-write machinery was removed: those domains are store-only |
| First-time handoff and workflow contracts (#1614) | Delivered | Resumable onboarding, explicit verification/issue-source choices, workflow-first scope, and milestone-specific acceptance |
| Composable local-cloud foundation (#1692) | Delivered | Provider-neutral topology, managed data/artifacts/secrets, isolated hosted tenants, and the published GitHub App trust service |
Recently completed reliability programs
The late-August epic pass closed seven large programs, each after its child issues and implementation evidence were reconciled:
| Epic | Delivered outcome |
|---|---|
| #1685 | Mission-to-merge reliability, correct role identity and routing, live observation, and recovery that drives work to done |
| #1686 | Trustworthy dashboard state, usable mission terminals, governed merge/ship actions, and missing operator affordances |
| #1687 | Convergent store rebuilds, test-home isolation, sealed legacy archive, compatibility retirement, and the lifecycle-store decision |
| #1688 | Orgabot rename completion, legacy-surface diagnostics, retired demo entrypoint, and CLI-checked skills |
| #1689 | Trusted issue authors, issue discussion/chat, webhook loop guards, and dependency-ordered epic grouping |
| #1691 | Consent-aware analytics, commercial and definitional pages, and a verified GA documentation flip runbook |
| #1692 | Composable deployment, hosted isolation, departments, extensions, signing, MCP custody, external trackers, and shared GitHub App operation |
Program 2 in one line
The lifecycle journal is the authority for mission truth. Process, heartbeat, worktree, session, verification, review, delivery, and recovery evidence are recorded where those facts happen, and the legacy record is projected from it; the reverse inference is gone. One boundary stays explicit: a record whose shape the lifecycle cannot represent faithfully stays legacy-sourced and is reported, never reshaped to fit.
Program 7 in one line
Voice is not abandoned; it is sequenced after the text foundation. P7.1 (read-only session visibility in the macOS app) is delivered. Acknowledged interruption and same-lineage redirection, answering prompts and routing approvals, executive check-ins, and packaging remain planned, and have received no work since early August while the performance, workflow, and storage programs shipped.
Honestly not built yet
Re-audited against the code on 2026-08-29 after the completed epic pass. Anything that shipped came off this list rather than being restated in softer words.
- the cross-process live-steering bridge (ADR 0058 slice S3, issue #1251). Steering a running mission is already the default and is never refused, but a steer issued from a process that does not host the mission is durably queued for the next round rather than injected live;
- arbitrary executable third-party plugins and sandboxed third-party code loading. Declarative extensions, replacement and schema migration, signing, revocation, quarantine, and governed package distribution are delivered; this remaining boundary is specifically untrusted executable code;
- configurable workflow orchestration's promotion-stage residual (issue #1511). Workflow-first scope, configuration-loaded sources, organization-supplied definitions, gates, event subscribers, and milestone-specific acceptance are delivered; a release-shaped objective still holds rather than executing and re-observing the promotion itself;
- the providers still marked
plannedbyorgabot topology --matrix: managed Restate, cloud sandbox mission execution, managed edge ingress, managed scheduling, and managed backup. The isolated hosted control plane and shared GitHub App do not imply those providers have shipped; - the remaining voice/cross-device interaction slices after read-only session visibility.
Foreground CLI output and governed dashboard merge are both delivered through the same mission-session and gate contracts.
Deliberately off the critical path
The MVP boundary remains local and macOS-first: no cloud account is required, and hosted work may not weaken or replace local operation. Later decisions did, however, deliver selected work that ADR 0055 originally kept off its critical path: cross-platform secret custody, provider-neutral placement, isolated hosted tenant control planes, managed PostgreSQL and object storage, and the published shared GitHub App.
Still deliberately outside the local critical path are the planned providers in the deployment matrix and mobile/cross-device approval. This is sequencing, not a claim that the implemented hosted foundation does not exist.
Reading the decisions
Architecture decisions live in docs/adr/ and are numbered in the order they were taken. The ones that most change how the product behaves today:
| ADR | Decision |
|---|---|
| 0064 | Mission state stays on the lifecycle journal; a derived projection index serves listings |
| 0063 | The operational-store authority switch for the five peripheral domains |
| 0062 | Configurable workflow orchestration and the one event spine |
| 0055 | Local interactive orchestration foundation (the governing near-term decision) |
| 0058 | Live steering by default (the cross-process bridge is still unbuilt; an out-of-process steer is queued) |
| 0059 | Agent toolchests, shell access derived from the toolchest, and blocked missions that ask for help instead of dying |
| 0056 | The Department Operating Model |
| 0037 | Capability-gap staffing and human-in-the-loop escalation |
| 0035 | Executor fallback chains for quota recovery |
| 0031 | Text-first org orchestration MVP, and memorialization before execution |
| 0025 | Fail-closed delivery authority |
| 0016 | Capability categories and tool slots |
| 0010 | The extensible capability system |