Roadmap

This roadmap describes the long-term shape of Regesta. It is not a protocol specification and it is not limited to one implementation stage.

Registry Kernel

• Define V0 canonical package identity as ecosystem:domain/name.
• Keep V0 release manifests immutable and content-addressed.
• Keep V0 channels as event-backed pointers, not release mutations.
• Keep V0 core metadata intentionally small and ecosystem-neutral.
• Keep V0 dependency and resolver metadata inside artifact-level ecosystem metadata.
• Add V0 conformance tests for core replay, channel state, object addressing, and event ordering.

Trust And Identity

• Support V0 domain-bound publishing as the base trust primitive.
• Document the V0 key lifecycle boundary for new writes, historical proofs, and compromise response.
• Document V0 package freeze and compromise response behavior as operator policy.
• Define key rotation and revocation behavior.
• Define package freeze and compromise response behavior.
• Design UID plus passkey accounts.
• Design domain claim flows with DNS verification.
• Design owner, admin, and transfer rules for claimed domains.
• Design hardened publishing with both domain signatures and passkeys.

Transparency

• Provide V0 canonical JSON and deterministic digest checks.
• Make V0 release verification independent from server convenience endpoints.
• Verify V0 event-log replay and package-state projections from public APIs.
• Define public signed-intent representation.
• Define checkpoint objects.
• Define inclusion proof and consistency proof formats.
• Define witness discovery and witness threshold policy.
• Build V0 mirror and auditor tooling that can replay events and verify objects without private database access.

The unchecked transparency items are intentionally unresolved protocol work. See Open Transparency Decisions for the questions that must be answered before they become object formats or server behavior.

Ecosystem Projections

• Keep V0 ecosystem projection code outside the core registry model.
• Provide V0 npm-compatible packument, version, tag, dist-tag, and tarball projection.
• Keep V0 progressive migration fallback policies in projections or clients, not in core registry state.
• Allow deployment composition to replace the default artifact processor pipeline without changing core semantics.
• Allow deployment composition to disable the default npm projection mount.
• Document ecosystem projection boundaries and mapping responsibilities.
• Define PyPI Simple API projection behavior.
• Define Cargo crate index projection behavior.
• Define Go module proxy projection behavior.
• Define OCI manifest, blob, and tag projection behavior.
• Keep V0 package id inference in clients and ecosystem adapters, not in core.

Storage And Scale

• Define V0 storage adapter conformance requirements.
• Support V0 local database adapters for durable release, channel, event, and metadata state.
• Support V0 local object storage adapters for source, artifact, manifest, and proof bytes.
• Support V0 local queue adapters for derived and async work.
• Support V0 signer adapters for readiness and future server-side signing hooks.
• Design checkpoint storage adapters.
• Run the V0 server with SQLite and filesystem storage on a persistent OCI container volume.
• Define V0 backup, restore, retention, and disaster-recovery expectations.
• Add V0 server concurrency tests for publish, package reads, event reads, object reads, and npm projection reads.
• Add a local V0 load smoke for publish, package reads, event reads, object reads, and npm projection reads.
• Define repeatable V0 load-smoke thresholds and runtime profiles for the local SQLite/filesystem adapter path.
• Define production load-test thresholds and CI/runtime profiles.

Mirrors And Forkability

• Provide V0 public event log export.
• Document the V0 manual mirror and auditor workflow over existing public APIs.
• Define object inventory export.
• Define the V0 mirror synchronization profile over public APIs.
• Provide V0 replay tooling that reconstructs package state from public event data.
• Document the V0 manual fork bootstrap workflow over existing public mirror data.
• Define checkpoint-based fork procedure.
• Define V0 auditor behavior for comparing sampled registry views.

Fork procedures depend on the same checkpoint and witness decisions described in Mirroring.

Governance

• Document the V0 governance boundary for abuse handling, takedown, compromise response, domain policy, and community control.
• Define protocol events that keep governance actions auditable when they affect public package state.
• Define V0 abuse handling and takedown policy.
• Define V0 compromise response and recovery policy.
• Define V0 root key stewardship boundaries.
• Define V0 witness and mirror participation boundaries.
• Keep the project community-driven and resistant to capture by one company, operator, or package ecosystem.

The unchecked governance event item is intentionally unresolved protocol work. See Open Governance Event Decisions for the decisions that must be made before governance actions become public event types.

Tooling And Knowledge

• Build a V0 npm-first publisher client for development and compatibility testing.
• Build package-manager-specific publisher clients beyond the V0 npm-first client.
• Build a V0 verifier CLI for release, event-log, and package-state checks.
• Build a V0 auditor CLI helper for comparing public event-log views.
• Build a V0 auditor CLI helper for comparing local mirror directories.
• Build auditor CLIs for checkpoints and governance events.
• Build a V0 local mirror CLI over existing public registry APIs.
• Publish machine-readable protocol and schema references.
• Document V0 source, release, artifact, event, and authorization metadata preserved for security tools and AI agents.
• Document V0 package identity and npm mapping rules for package managers and clients.