Open work

The one live list of what is being built, what comes next, and what is waiting on a decision. Last reconciled against main at b4fc2ffa (2026-11-02, the dev head).

The rule. A shipped item is deleted, not struck through: its record is the CHANGELOG entry and the PR. A wrong row is corrected in place, never answered by a new row beside it. Nothing in Now or Next is marked done. Feature PRs do not edit this file; the coordinator reconciles it after merges, because every PR editing its own row made every PR conflict with every other. scripts/check-open-work.sh (CI job open work, not required) runs on main and on a PR that edits this file, and fails when a PR listed under Now has merged or the stamp above is not on the branch. Red on main means reconcile.

History (the dated programs, audits and dispositions this file carried until 2026-09-29) is in Open Work 2026-08-25 to 2026-09-28. Direction is in Roadmap; what shipped is in Capabilities and CHANGELOG.md.

Before anyone deploys

No blocker is open. main is prod and dev takes the work (decided 2026-10-27): every pull request targets dev, and the coordinator promotes by fast-forwarding main to the newest green dev commit, with no soak wait (decided 2026-10-30), then tags it. A published release tag on main deploys maidan.world through the prod GitHub environment (#1738), which allows only main and v* tags. maidan.world runs v419.0.0 (2026-10-27), and every deploy path and install command pins it; scripts/check-deploy-pins.sh (CI job deploy pins) keeps them on the newest tagged CHANGELOG section. dev.maidan.world and the swarm's local stack run dev. The :dev images in compose.yaml and the charts' default values.yaml are built from source on purpose. Pointing anyone else at a deploy is part of the launch, which is the maintainer's call.

Do not tag a commit whose push CI is red or unfinished. open work is not a required check, so a red open work alone does not block a tag; the eight required checks on the tagged commit do.

Now: in flight

Merge order matters where one PR builds on another; the column says so. A lane marked Active is being built in the coordinator's session from a local worktree: an agent outside that session does not start it, and takes a row of its own instead. No lane is active. Work left in stopped lanes is on wip/ and wip/rescue-* branches, named in the Next items it belongs to. Rows without a PR number are being built and get one when opened. The coordinator's merge loops run in its own session; whoever merges without them follows the merge rule in CLAUDE.md (all eight required checks on the exact head commit, --match-head-commit, and every CodeRabbit comment answered) and, before merging, builds the PR on current main if another PR merged since its CI ran.

Open pull requests are not listed here: the list went stale at every merge and failed the open work check that deploys wait on. They are on GitHub, gh pr list -R david-engelmann/maidan --base dev, and what each one fixes is in its body and its Next row.

Next: ranked

The launch path, ranked by what the launch needs first. The launch is open source plus a hosted service at maidan.world (decided 2026-10-12): the hosted rows (Next 24 onward) come after the OAuth server people connect through, and the list closes with the launch release and its gate (Next 29). The directory listings follow the launch, on the maintainer's go. An item enters this table with acceptance criteria and a check that shows it is still open. "Thread" numbers refer to the 2026-09-29/30 enhancement thread, whose dispositions are recorded below.

Connected apps (Next 10 to Next 17, and Later CA). The no-authorization-server fast track the maintainer chose on 2026-10-03, in the strategy's lane order, with Lane 9's hint pass pulled forward as Next 14. Nothing is published or submitted to any directory, catalog or registry until the maintainer says go (2026-10-04), and never without Next 14's validation record. Until then a lane is done when it is built and validated. Every listing row depends on a validated release and the maintainer's go, because every listing points at a release, and the listings follow the launch. Each directory size includes one assumed rejection and resubmit cycle. No estimate is discounted for the the sibling app work, which transfers the OAuth protocol mechanics, the privacy policy's section headings, the Muse form mechanics and the sibling app's review outcome as an early signal, and nothing else (not the consent design, the reviewer identity path, the policy's substance, the crypto-shredding tail or the runbooks). Each lane is judged on its own. A lane whose connects reach the demo endpoint ships a token prefix per listing (half a day to a day each), so attempts attribute to the lane that earned them. The self-hosted lanes (Next 11, Next 12, the registry and image entries of Next 13, and Next 15) cannot see connects by design, and are judged on proxies, namely registry pulls, install counts, topic-driven GitHub traffic, recipe page views and any visibility a directory reports. A hybrid directory lane is judged on reported visibility plus those proxies, because its real users self-host. A near-free catalog PR promotes on acceptance. A heavier later lane promotes when two directory lanes each hold at least 25 attributed connects a week, on a four-week rolling average or in three of any four weeks, after scanner and reviewer traffic is filtered out, or when it reaches an audience the directory lanes cannot. The AWS lane and the IDE wrappers promote on acceptance plus one clean end-to-end install. The 25 is a starting guess, recalibrated after 90 days of data and recorded here. A lane is killed when a rejection has no remediation path, when a queue stalls 90 days with no response and no escalation, when 60 days live bring zero attributed connects on a hosted lane of size M or larger, or on the day a platform rule removes its fit. A killed lane stays recorded with its reason and date. Review-gated lanes are judged after 30 days live or two review cycles, whichever is later, and zero-review lanes after 30 days. Support tickets are tagged by surface at intake. Cursor and Anthropic re-review every update, so updates are batched, and each one re-runs Next 14's validation record. The strategy master is the connected-apps research of 2026-10-03, kept outside the repo. The supervision-session walkthroughs the directory rows require were walked and audited on 2026-10-05, with per-surface verdicts in the walkthrough synthesis kept outside the repo. ChatGPT, Cursor, Gemini CLI and Copilot CLI survive with mitigations. Claude connectors and Muse do not survive as shipped. How a human learns of a waiting gate is unbuilt on every surface except ChatGPT Work chats, where MCP Events are the documented wake-up path, and whether any directory surface has a push channel for connector events is open. Cursor 1.5 added OS notifications when input is required, which re-opens that question for Cursor without resolving it. Every listing, parked ones included, carries the three protocol-layer properties in Next 14.

Measure before scheduling: the per-response query count (F-51); whether the workspace context pack filters before it builds; the search deny-set query; the board's full re-render on large channels (thread 17); catch_up page cost as the event log grows (thread 18).

Found running Claude clients against a local Maidan (2026-10-07), small enough to fold into the nearest PR. post_message needs a thread, so "post to #general" costs two lookups and is ambiguous in a channel with several threads. A managed third-party Claude Desktop reads ~/Library/Application Support/Claude-3p/, not Claude/.

Found by the #1247 and #1248 lane (2026-10-04), small enough to fold into the nearest PR. compose.yaml hides the root-owned /data volume problem because it stores artifacts in MinIO. A first install that collides with a hand-made app:<slug> member still answers with the generic handle conflict.

Found on 2026-10-28. Observability follow-ups from ENG-6218 (#1769 and #1770 shipped one trace per thread, claim latency, the delivery surface and the swarm dashboard): per-seat cost from the usage ledger and spans (#1771), and the egress surface (#1772). The DeepSeek review seat reports zero tokens, because Claude Code does not hand DeepSeek's usage back to the seat.

Found on 2026-10-26, small enough to fold into the nearest PR.

• A result with no result_kind (#1649). #1718 refuses unroutable waiter result envelopes, and a delivery that gives up alerts the operator (#1863). Close #1649 once that lands.
• Context economics follow-ups. The ordering tests for C6 (#1584), and an app-clock claimed_at on explicit claim or assign plus a hold policy for manual sub-threads under a recipe root (#1586).

Found on 2026-10-24, small enough to fold into the nearest PR. web_push moves to p256 0.14 when openidconnect does, retiring the RUSTSEC-2026-0387 ignore for crypto-bigint 0.5.5 (#1594). A from_env test that MAIDAN_OIDC_EMAILS_VERIFIED parses.

Found by the 2026-10-23 Playwright runs, small enough to fold into the nearest UI PR. audit.spec.ts:205 (a phone-width boundingBox read as null) and needs-you-focus.spec.ts:94 (focus checked before the row redraws) flake on timing; each waits for layout or the redraw first.

Later: by program

One line per item, promoted into Next when it gets acceptance criteria.

• R — resilience: chaos steady-state checks; native TLS on the gRPC listener (#1114 requires an acknowledgement instead).
• V — verification: stateful model tests beyond the claim lease; Kani over idempotency keys and FSM totality; a small rule set over typed references (the add_reference relations) checked on write, so a reference that breaks the room's ontology is refused rather than stored (a verifier, after Pavlyshyn; Engineering Canon V-04).
• D — Postgres operations: rebuild-derived --verify (re-fold the notification ledger, follow counts and inbox cursors from the log, with a drift metric); XID-age, bloat, WAL and replication-slot metrics; a pool-topology guide; a UTF-8 pin.
• S — security: an R2 key scoped to the prod bucket in place of the account-wide key prod and dev share today; authority_audit_contract over every crate and example with its two carve-outs (maidan init, the Playwright harness) named, so a call outside the two watched crates cannot slip past (thread 14b); threat-regression gates (each Threat-Model row names its test) and a per-PR threat-model delta; token TTLs with DPoP or mTLS binding; audience-bound step-up auth for sensitive MCP tools; an over-permission scan of the MCP surface; a provenance label on content from other tenants, tools and external sources; miri over the unsafe in dependencies.
• M — memory: memory block revisions carry two dates, recorded and effective, and a retraction with its reason is appended, never deleted, so an agent can ask what the room believed at a time; erasure still wins, and crypto-shredding removes a retracted value with the rest (Engineering Canon P-MEM-01 to 03, read from abstracts only).
• E — compliance: read-time PII masking on messages, content blocks and audit metadata; scheduled key rotation and a key-age policy, now that a workspace key can live in AWS KMS (#1534, #1566).
• O — observability: OTLP export to the local workbench Alloy (OTLP_ENDPOINT, OTLP_METRICS), so a review run shows a trace and maidan_usage_tokens_total and maidan_usage_usd_micros_total are scraped, with no prompt or diff text in span attributes and Postgres still the record (David, 2026-10-30); a buffered, redacted collector pipeline with a tested loss contract; opt-in tokio-console; a named p99 on the fan-out paths; operator views.
• F — search quality: reranking (RRF or a cross-encoder); an HNSW recall evaluation (the m/ef knobs are pgvector defaults); a query-embedding cache; a search evaluation gate over relevance_eval.rs; a ParadeDB comparison; facet search by reference kind, result kind and event kind.
• G — developer experience and governance: a fitness-function catalog; semver checks for the SDKs; a glossary-grounding lint; active benchmarking with k6; a devcontainer, pipeline parity, typed config, a cross-build matrix and an S3 test double.
• U — the web UI: design tokens; a code editor, log stream and DAG view; a reference-graph pane over the backlink index; an interactive OpenAPI reference; recorded demos; one-click token mint in Connect; a member last-active endpoint; cross-channel palette search; delivery and allowlist panels.
• Federation (when federation gets real multi-peer use): a versioned envelope contract; cross-peer causal order; verifiable-credential peer trust.
• Parked evaluations (revisit on a concrete trigger): OPA/ABAC; Tantivy; compile-time SQL; SOPS; a CI egress allowlist; an in-flight-run drain signal; allocator and zero-copy micro-evaluations; an MCP registry policy.
• C — context economics: C1 to C13 are shipped (C9 #1629, C10 #1636, C11 #1618, C12 #1637, C13 #1638); MCEB-1, the pre-registered cost-per-success benchmark, waits for the maintainer to set its budget.
• UI audit P2 and the performance Tier 0 batch (UI deep dive 2026-10-03): the P2 items and Tier 0 (response compression, ETag revalidation on /ui assets rather than immutable caching without fingerprinted URLs, modulepreload, a capped live feed, the notices-query index) are recorded in the audit digest and promoted into Next as P0 and P1 land. The UI ships as a generated, minified bundle checked into the repo, with CI failing when it is stale (as with the vendored gRPC code), so cargo build still needs no Node and the bundle can carry fingerprinted URLs (decided 2026-10-04).
• L — launch (decided 2026-10-12, with the launch-blocking work in Next 23, Next 24, Next 29 and Next 30): open source plus a hosted service at maidan.world, with sign-ups through a waitlist first. The hosted service is free up to an allowance, and usage past it is metered (Next 27) and billed, with billing built on the ledger after launch. Still to come here: positioning, comparison and migration pages, the in-browser playground on the demo host, and the open-core boundary written down (the room stays open source). The privacy policy, terms and trust page are the maintainer's, prepared outside the repo.
• CA, connected apps (later lanes). Lane 8, the OAuth authorization server, is Next 23 since the maintainer's decision of 2026-10-08. The notes below are its design inputs. What exists is an installed-app authorization code exchange with optional PKCE, started by an admin call (crates/maidan-server/src/app_oauth.rs, POST /oauth/app/token). What does not is dynamic client registration, client metadata documents, OAuth metadata endpoints, a browser consent screen that maps capabilities to scopes, refresh tokens for those clients, and a 401 carrying WWW-Authenticate. When it unparks, client metadata documents are the primary path, with pre-registration for Cursor and for clients that present no document, a human stays in the consent flow, the reviewer identity path is designed in the lane, an upstream identity provider that is itself a supervised agent platform is used only if no other exists, and a 3 to 5 day security review comes before any listing depends on it. Lane 9's hint and title pass is Next 14. Its other half, splitting tools that mix reads and writes, is not done. The maintainer kept them as single tools on 2026-10-07, each a documented write. Before submitting, each directory lane chooses between the full surface and a curated profile of about twenty tools built on the worker and reviewer profiles, and runs the directory's test cases through the platform's model against whichever it lists. Lane 10, the Claude directory (S after lanes 4, 8 and 9), and Lane 11, the ChatGPT plugin directory (M after lanes 4, 8 and 9), wait on the Lane 8 revisit. Lane 10's static-headers path is a beta for a limited set of organizations, granted by invitation, and access is checked through mcp-review@anthropic.com at lane time. The audited walkthrough verdict strengthens the parked rationale. Supervision does not survive inside Claude connectors as they work today, because the surface collapses to narration plus per-tool prompts, and the directory's review rules forbid evidence-showing instructions in tool descriptions. The verdict supports the sequencing hold rather than parking on its own, and the best mitigation, MCP Apps, is build work to size before the lane is promised. Lane 11 needs a global-residency project (seven submitter runbooks say EU-residency projects cannot submit, re-confirmed in the portal), domain verification, five positive and three negative test cases, a video, and reviewer credentials without MFA. The OpenAI enterprise marketplace is a procurement and billing channel, not a self-serve plugin directory, so it is not a lane (provider research, 2026-10-06). ChatGPT's MCP Events, a signed-webhook wake-up path documented for Work chats and dots, is the one provider push channel found, and it is the natural carrier for Needs-you when Lane 11 unparks, subscribed by the user and never unsolicited. The audited walkthrough verdict for Lane 11 is survives with mitigations, and the mitigations are load-bearing, because the approval card authorizes one tool call and shows only the app and the proposed action. destructiveHint marks the call for explicit approval, which is advisory to the host and not a guarantee. toolInput stays withheld until after approval, so evidence-first ordering holds. The DevDay sidebar and panel surfaces host the Needs-you queue. The developer-mode bearer token question stays open for lane time, and no public-directory listing ships until the OAuth authorization server exists. Cutting Lane 11 and doubling Next 13 becomes the plan if Muse rejects the room as a category, if no session topology keeps supervision intact inside ChatGPT, or if the Lane 8 revisit answers skip. Lane 12, the Microsoft tracks (M to L), stays parked until the consumer lanes clear the promotion bar or a real customer in that ecosystem reopens it. Whether Microsoft's connector write actions have shipped is UNVERIFIED first-hand. Every directory lane, these included, walks a full supervision session before submitting (see Next 14) and has Next 14's validation record. The later lanes wait until the directory lanes are live and measured. AWS Marketplace AI agents and tools (M) is the exception, a procurement lane on its own bar that starts once the fast track ships. Its stateless streamable HTTP requirement on port 8000 at /mcp is UNVERIFIED. Pointing the container at the buyer's Postgres and object store does not configure the listener or the image's exposed port, so the requirement stays unverified until an image or deployment exposes 0.0.0.0:8000 at POST /mcp with test evidence recorded in Claims.md. The rest are Google Cloud Marketplace (L), Alexa with a voice adapter (M), Poe, which needs a Chat Completions endpoint (M), Kilo Code (XS, slow merges), a Workspace Marketplace Chat app (M), VS Code and Open VSX (S), and JetBrains and Raycast (S to M each). Watched, not lanes. Salesforce AgentExchange, Atlassian Rovo's announced MCP support, a Claude Code community marketplace, the end of new custom GPTs (October 26 for Enterprise, December 11 for everyone), and Anthropic's portal analytics as a visibility source for Lane 10. The dev and test program beyond Next 17 waits here. MCP JSON-RPC cassettes recorded through a proxy (agent-vcr) start only after a spike shows the proxy captures server-initiated elicitation/create, and are redacted on save. Provider-API cassettes, an unattended nightly driver for the scriptable clients (Gemini CLI, Copilot CLI, the Grok API), and an agentic-loop load test that checks rate limits under a burst of tools/list and tools/call follow. A dev-only OAuth stub for authenticated and write flows is built only when that testing starts. It refuses to boot without a dev flag, serves one synthetic identity, and is deleted, not extended, when Lane 8 unparks. Grok now has surfaces to watch, the Grok Bot Marketplace and the Grok Build plugin marketplace, though none lists third-party MCP servers for grok.com chat. Google Cloud Marketplace's AI agents category (A2A, an Agent Card and an OAuth2 code grant) fits Maidan's existing A2A surface and gets a sizing spike among the later lanes. Grok Build's plugin marketplace (PR-based, xai-org/plugin-marketplace) is a real distribution path after the maintainer's go. A quarterly re-read checks the facts the program rests on, namely each provider's plan gating, Anthropic's static request headers (a beta for a limited set of organizations), and whether Meta starts requiring per-user OAuth.

Decisions pending the maintainer

The maintainer delegated the rest on 2026-10-01; they are under Recently decided, and the ones that need building are in Now or Next.

External setup that blocks rows, and is not a decision: live Slack and GitHub apps for projector tests, a provider key for the Goose recipe, and Jev access for J-01.

Recently decided

Each links its record. Entries roll off after about a month.

Known risks

Won't do

Process

Merge discipline while branch protection is not strict (thread 43). A PR merges when every one of the eight required checks has passed on its exact head commit and nothing else on that commit is queued, running or failed; the merge names that commit (gh pr merge --match-head-commit), so a push in between makes GitHub refuse it. Before merging, the PR is merged onto current main locally and built, and the static contracts run on the result (attribution_scope_contract, authority_audit_contract, http_operation_kinds_contract, docs_numbers_contract, env_registry_contract, ui_js_contract, openapi_well_formed, the event-kind and lexicon contracts, migration_register, backend_parity). Stacked branches rebase in dependency order, replaying only their own commits. Two merges broke this on 2026-09-30 and are why the rules read as they do: #1124 merged while gh pr checks still showed the previous commit's runs, and #1133's last commit merged two seconds after a push, before GitHub reported the new head. main's CI passed on #1124's merge; #1133's is recorded in its PR.

Open Work is the coordinator's. Feature PRs do not edit this file or the Roadmap; the coordinator reconciles them after merges, and the open work job runs on main and on PRs that edit the file. The merge loop's pre-merge build takes a lock that names its holder, and a lock whose holder is gone is taken over: a killed loop once held every merge for five hours (2026-09-30).

Review comments. CodeRabbit reviews every PR (Decisions). Each top-level comment is fixed, or answered with the reason it does not apply, before the merge; the merge loop holds a PR while one has neither a reply nor CodeRabbit's "Addressed in commit" marker. From 2026-09-28 to 2026-10-01 the loops merged without that check, which is how 126 comments went unanswered (75 of them valid, one a cross-tenant rate-limit bug).

Old branches. A branch whose work shipped another way, or was closed, is kept as an archive/<branch> tag and then deleted (the six cursor/* branches, 2026-10-01). Stashes are not left on the shared stack: they are kept as local refs/archive/stash/* refs, which are never pushed because a stash can hold untracked files.

UI changes (thread 42, 46). The PR template's /ui checklist is run by hand before a UI PR is opened: the token path and the OIDC path, keyboard only, a 390 px viewport, and every new string re-read.

Enhancement thread 2026-09-30: dispositions

The 2026-09-30 entries (28–57) and the supersessions of 27, 28, 29 and 35. Entries marked done on main since the thread's 1e612cf8 snapshot are noted.

Done since 1e612cf8, per the thread's own list: 3 (#1118), 13, 14a, 19, 20, 22, 23 (#1113; 23's numbers corrected by lane U). The 2026-09-29 dispositions below stand, except where a row above supersedes them.

Enhancement thread 2026-09-29: dispositions

David's auditor re-verified each item five times against main and freshened it to 70a6d78b. Each item's disposition, and where it lives now. Items 5, 21 and 25 were struck by the thread itself (false premises) and are not re-filed.

Sequencing, as it ran. The P0s went first: inline errors (#1117) and one thread surface (#1118) merged on 2026-09-30, and the token chain is #1116 (merged), #1123, #1127 and #1142.

Where the thread was wrong. Item 2b assumed the UI had no cookie session: crates/maidan-server/src/session/mod.rs already issues HttpOnly; SameSite=Lax (and Secure when configured) cookies for OIDC sign-in, and each session stores a csrf_secret that no handler reads, so SameSite=Lax is the CSRF defence in force. Item 9 took the first #live-panel / #live-toolbar / #live-feed block for dead because a later block restyles the same elements, but the cascade is per property: the later block never sets the flex layout or the feed's colours, font, overflow and wrapping, so removing the first would break the Live bar. Everything else checked out.