98 lines
5.0 KiB
Markdown
98 lines
5.0 KiB
Markdown
|
# Archipelago Roadmap
|
|||
|
|
|
|||
|
|
_Last updated: 2026-07-08. This is the public-facing summary. The live,
|
|||
|
|
priority-ordered engineering list is [`UNIFIED-TASK-TRACKER.md`](UNIFIED-TASK-TRACKER.md);
|
|||
|
|
the narrative plan behind it is [`PRODUCTION-MASTER-PLAN.md`](PRODUCTION-MASTER-PLAN.md)._
|
|||
|
|
|
|||
|
|
## North star
|
|||
|
|
|
|||
|
|
A world-class, **developer-ready app platform**: every app manifest-driven,
|
|||
|
|
manifests distributed via a **signed registry**, and third-party developers
|
|||
|
|
publishing through an **external/decentralized marketplace** — all rootless,
|
|||
|
|
secure, robust, and 100%-uptime-capable.
|
|||
|
|
|
|||
|
|
Five pillars every app must satisfy: Quadlet-everywhere · level-triggered
|
|||
|
|
reconciler · lifecycle-bulletproof (full test matrix, repeatedly green) ·
|
|||
|
|
data-driven (no host changes, no per-app binary code) · rootless +
|
|||
|
|
security-first.
|
|||
|
|
|
|||
|
|
## ✅ Shipped
|
|||
|
|
|
|||
|
|
- **Single-node production gate GREEN** (2026-06-23) — the full destructive
|
|||
|
|
lifecycle matrix (install / UI / stop / start / restart / reinstall /
|
|||
|
|
reboot-survive / backend-restart-survive / uninstall) passed 5 consecutive
|
|||
|
|
times with zero failures on real hardware. This was the first exit criterion.
|
|||
|
|
- **Manifest-driven app platform** — 50+ apps as declarative manifests; all
|
|||
|
|
multi-container stacks (BTCPay, Mempool, Immich, NetBird, IndeeHub) install
|
|||
|
|
through the orchestrator; generated-secrets system replaces per-app secret code.
|
|||
|
|
- **Rust orchestrator + level-triggered reconciler** — the bash-script era is
|
|||
|
|
retired; drift self-heals on a 30-second loop.
|
|||
|
|
- **Registry-distributed manifests** — the signed catalog embeds full manifests
|
|||
|
|
per app; nodes verify against the pinned release-root key and overlay
|
|||
|
|
catalog manifests over disk files (catalog wins).
|
|||
|
|
- **Release signing ceremony** (2026-07-02) — release-root Ed25519 key pinned
|
|||
|
|
in the binary; OTA release manifests and the app catalog are signed;
|
|||
|
|
auto-apply refuses unsigned manifests.
|
|||
|
|
- **1.8.0 hardening batches** — supply-chain signature verification, deepened
|
|||
|
|
post-OTA health checks, async-executor and secret-handling fixes, browser
|
|||
|
|
origin checks, dist shrink.
|
|||
|
|
- **Reticulum third mesh transport** — RNS/LXMF over real LoRa hardware
|
|||
|
|
(RNode), interop verified against Sideband; joins Meshtastic and MeshCore
|
|||
|
|
behind one chat UI with X3DH + double-ratchet E2E, attachments, and mesh AI.
|
|||
|
|
- **Bitcoin multi-version** — Core and Knots with per-app version pinning and
|
|||
|
|
safe switching (fleet rollout pending below).
|
|||
|
|
- **Decentralized marketplace backend** — Nostr NIP-78 discovery, DID-signed
|
|||
|
|
manifests, federation-weighted trust scoring, Lightning purchase invoices.
|
|||
|
|
- **Quadlet migration validated** — all backends run as `user.slice` Quadlet
|
|||
|
|
services on the canary node (default flip pending below).
|
|||
|
|
- **Public demo** — multi-visitor sandbox deployed.
|
|||
|
|
|
|||
|
|
## 🔄 In progress
|
|||
|
|
|
|||
|
|
- **Multinode pass** — run the same production gate across the whole test
|
|||
|
|
fleet, plus cross-node federation/mesh suites
|
|||
|
|
([`multinode-testing-plan.md`](multinode-testing-plan.md)). This is the
|
|||
|
|
current exit criterion.
|
|||
|
|
- **Quadlet default flip** — flip the validated Quadlet path from opt-in to
|
|||
|
|
default fleet-wide; eliminates the last container-flapping root cause.
|
|||
|
|
- **Container-flapping elimination** — reconciler churn and failed-unit
|
|||
|
|
self-healing gaps observed on live nodes.
|
|||
|
|
- **Reticulum tail** — ship the daemon binary inside the release tarball;
|
|||
|
|
final fleet redeploys.
|
|||
|
|
|
|||
|
|
## ⏳ Release-blocking for 1.8.0
|
|||
|
|
|
|||
|
|
Tracked in detail in [`1.8.0-RELEASE-HARDENING-PLAN.md`](1.8.0-RELEASE-HARDENING-PLAN.md):
|
|||
|
|
|
|||
|
|
- **OTA upgrade-from-previous-version soak** on real hardware — the top
|
|||
|
|
untested release risk.
|
|||
|
|
- **ISO/image hardening** — per-device TLS/SSH keys on first boot, remove
|
|||
|
|
default credentials and SSH password auth, signed + checksummed ISO,
|
|||
|
|
registries over HTTPS, unattended-upgrades and firewall defaults.
|
|||
|
|
- **Bitcoin multi-version fleet OTA** — code done; rollout timing is a
|
|||
|
|
deliberate hold.
|
|||
|
|
- Version bump to `1.8.0-alpha` + tag once the pre-tag items close.
|
|||
|
|
|
|||
|
|
## 🔭 Planned (post-1.8.0)
|
|||
|
|
|
|||
|
|
- **Developer CLI** — `archy app validate / render / install / test`; the gate
|
|||
|
|
for opening third-party app publishing.
|
|||
|
|
- **External marketplace maturation** — publishing tooling, trust UX, and
|
|||
|
|
reputation surfaces on top of the shipped backend
|
|||
|
|
([`marketplace-protocol.md`](marketplace-protocol.md)).
|
|||
|
|
- **DHT/P2P distribution** — releases and app images over iroh-based swarm
|
|||
|
|
([`dht-distribution-design.md`](dht-distribution-design.md); feature-gated
|
|||
|
|
skeleton exists).
|
|||
|
|
- **P2P encrypted voice/video** over Tor between federated nodes.
|
|||
|
|
- **Dual ecash** — Fedimint + Cashu phases 2–6, networking-sats
|
|||
|
|
([`dual-ecash-design.md`](dual-ecash-design.md)).
|
|||
|
|
- **Paid streaming** — streaming ecash for content
|
|||
|
|
([`phase4-streaming-ecash-plan.md`](phase4-streaming-ecash-plan.md)).
|
|||
|
|
- **Hardware signer** support ([`hardware-signer-design.md`](hardware-signer-design.md)).
|
|||
|
|
- **Code health** — split god-modules, remove dead crates, route all
|
|||
|
|
podman/systemctl calls through the wrapper.
|
|||
|
|
|
|||
|
|
## Release pipeline
|
|||
|
|
|
|||
|
|
Feature Testing (internal) → User Testing (controlled hardware) → Beta Live (public).
|