commitwork

Roadmap

Features by target release

Targets give the order of the work, not dates: a feature moves when what it depends on moves, and stays on its target card with a pill naming the release that shipped it. Releases 0.2.0 to 0.8.0 are the milestones M0 to M6. 0.9.0 is the release candidate, and nothing changes in a frozen format after it.

0.1done

Built in private from 2026-06-24, with a version on every commit and no release cut

  • A repository’s CI on your machine: a repository’s GitHub Actions jobs run locally before they run on GitHub. It began as a way to run CI without spending Actions minutes, and that runner is still its core.
  • A security baseline in 71 lanes: one command runs secrets, SAST, dependency, supply-chain, IaC, CI, runtime and posture checks over a repository. The manifest declared 80 checks at the end of 0.1. Each wraps a third-party scanner or a bundled one and writes a normalised report.
  • A fleet monitor: the baseline keeps running across many repositories on a schedule, with rollups, an issue tracker whose finding identities survive code moving, and daily remediation suggestions for each complete sweep.
  • A loopback panel: posture, findings, sweeps and settings in one local web page.
  • Compliance evidence: CRA and SOC 2 evidence packs, from the same findings. Evidence is signed and hash-chained, and the POA&M lists every open scanner finding.
  • An MCP server: an agent can run the bundled checks and read their results, through 16 tools over stdio. A repository’s own manifest never runs without --trust-repo-manifest.
  • The cobolwork lane: COBOL, CICS and JCL estates are scanned by cobolwork, installed from the release commitwork pins and checked against its sha256.
  • A version on every commit: every commit names the version it carries. Since 2026-09-26 each commit moves package.json’s patch version, from 0.1.0. Before that the version stood at 0.1.0 and one interim tag counted commits.

0.2.0released

Health, and a measured floor under every lane

6 of 6 features done · 15 changes

  • Golden fixtures for every lane: each lane is shown to produce counts from its tool’s output before its results are relied on. All 74 lanes count against a golden fixture: 56 from the lane’s own tool run over a seed project, 8 synthetic with the reason a real run cannot measure them here, and 10 older fixtures with no recorded provenance. On 2026-09-30 it was 10.in v0.5.0
    8 changes
    • Extract Go with CodeQL's extractor, not a traced build
    • A networked lane reads the resolver config
    • A networked lane reads the scoped docker config
    • Gradle-deps-scan reads single-quoted Groovy coordinates
    • Golden fixtures for nine more lanes, each from the real tool
    • Let sandboxed CodeQL lanes find Java and the Xcode toolchain
    • Build a Swift package under the sandbox through SwiftPM
    • Golden fixtures for the Go and Swift CodeQL lanes; every lane now counts
  • Lane capability counted from all its evidence: the measured count includes lanes already shown to work by other evidence. Six lanes are measured in both directions by the scan canary and six by real tool output in their extractor tests, and the count credits that evidence beside the fixtures.in v0.5.0
    2 changes
    • Credit lanes from canary and extractor-test evidence
    • State how far to trust each scanner lane
  • The POA&M covers every scanner finding: the plan of action lists every open scanner finding, not only dependency advisories. A finding whose severity is undetermined carries no deadline.in v0.5.0
    1 change
    • The POA&M covers every scanner finding, not only deps
  • Failed exports shown: a failed or timed-out export to the memory layer shows in sweep health and in the panel. The sweep’s verdict, the Fleet tab and the memory visualiser read one classifier, which recounts each receipt rather than taking its presence as health.in v0.5.0
    1 change
    • Record whether the memory export stored its records
  • The taxonomy database rebuilt with its registry: the failure taxonomy’s query database never answers from a superseded registry. It is rebuilt whenever the registry’s hash changes.in v0.5.0
    1 change
    • Rebuild the taxonomy store when its registry hash changes
  • Releases as tags: each release is a tag naming the version package.json carries at that commit. A minor or major release is a commit that sets the version by hand, tagged v plus the version. The interim tags that counted commits are retired, since a rebase renumbers them. 0.2.0 is the last release cut before the public repository.in v0.5.0
    2 changes
    • Tag a release by the version package.json carries
    • A patch version is never tagged as a release

0.3.0released

Public: a reviewed snapshot becomes the first commit of a new public repository

9 of 9 features done · 32 changes

  • Tests pass on a fresh checkout: the build and its whole test suite run on the fixtures in the repository, with nothing supplied from outside it. CI passed every job on 2026-10-02.Limit: main’s latest run, on 2026-10-03, fails 2 of its 11,232 tests.in v0.5.0
    8 changes
    • The suite and the smoke hold on Linux and Windows runners
    • Run the launchlist public test in a one-commit repository
    • Report the public test's counts and failing names
    • Keep the candidate's scratch HOME away from the checkout
    • Probe for a default keychain before writing to it
    • Skip the taint entry test when the Pro engine did not run
    • Count the account's home as this machine's home
    • Fix two tests that fail on GitHub's Ubuntu runners
  • Every operator-specific store is configured, not committed: the registry, the issue store, annotations and evidence each resolve through a declared path with one CW_* override, read at call time. An absent store is reported absent, never as an empty result.Verified in the released tree: v0.5.0 carries monitor/store-paths.mjs with 29 CW_* overrides and no monitor/private/ path at all.in v0.5.0
  • Synthetic fixtures and example configuration ship with it: each store has an *.example.json beside it, and the suite runs on those. A contributor can run the whole thing without being handed anything.Verified in the released tree: v0.5.0 carries 15 *.example.json records.in v0.5.0
  • Documentation cites only what a reader can check: a verified-against stamp names a date, not a commit a fresh repository cannot contain. docs-doctor gates every durable document against it.in v0.5.0
    3 changes
    • Strip all-digit and paired commit SHAs from the snapshot
    • Remove private-history citations from the source
    • Drop baseline suppressions of stripped commits in snapshots
  • One read-only command for a release candidate: the snapshot is built in a fresh root, then scanned, documentation-checked and tested, by one command that changes nothing. A secret-shaped row passes only with a reviewed disposition, kept in the operator store.in v0.5.0
    4 changes
    • Build and gate the public snapshot of a ref
    • Run the launchlist content checks on a release candidate
    • Run the launchlist public test in a one-commit repository
    • Keep the candidate's scratch HOME away from the checkout
  • Third-party notices: every bundled third-party file is credited, with the type provenance of the mark.in v0.5.0
    5 changes
    • Disclose every third-party work the tree redistributes
    • Keep the OFL notice free of a URL
    • Fail on a vendored file the roster does not name
    • Give the build-box page the default mark as its tab icon
    • Say which mark the raster tab icons show
  • Linux: commitwork runs on Linux, with the Linux CI failures cleared, and a container and an installer.Limit: measured on a real Debian 12 host (Lima VM, kernel 6.1, unprivileged user namespaces on) rather than inferred: bwrap confines the lanes there, probeHostSandbox reports it available, doctor reads a tick, and four lanes of the fast set record isolation full. One gap remains and it is narrower than the lane set: an egress lane needs pasta for its network namespace, and Debian 12 ships a March 2023 passt that fails to join the namespace (Permission denied on the namespace file under /proc), with no newer build in bookworm-backports. Those lanes refuse and say so rather than running on the host network.in v0.5.0
    7 changes
    • Tell a machine without brew which manager setup needs
    • Write the first-run state a fresh clone lacks
    • Install the language managers through apt or dnf on Linux
    • Report a tool installed outside PATH as installed, not failed
    • Install gitleaks and trufflehog on Linux from pinned releases
    • Confine sandboxed lanes from loopback, secrets and host shells
    • Describe setup's Linux managers as they are now
  • The licences in force: LICENSING.md states AGPL-3.0-or-later, PolyForm Internal Use 1.0.0 by agreement, and Apache-2.0 on the wire layer. Until then the only permission is to evaluate.in v0.5.0
    1 change
    • State the licences in force for the public repository
  • A documentation freshness pass: every durable document is current at the snapshot, run last so nothing goes stale after it.in v0.5.0
    4 changes
    • Re-verify the thirteen orange docs against the code
    • Stamp the README with a commit on main
    • Stop docs-doctor reading a partial supersession as closed
    • Re-verify nine documents against main

0.4.0released

Results a reader can check

5 of 5 features done · 7 changes

  • Every lane measured: every declared lane counts against a fixture, and a new lane lands with its fixture in the same change or waits: the suite fails naming any declared lane that does not count, and any extractor no manifest declares.in v0.5.0
    1 change
    • Fail when a declared lane has no counting fixture
  • The gate’s own error rate: each sweep’s verdict carries the scan canary’s false-clean and false-alarm rates, and the panel shows them. The canary runs every sweep today; its rate is read only through the verdict journal.in v0.5.0
    1 change
    • Record canary error rates in each sweep verdict
  • Ledgers that survive an edit: a rewritten record shows as a broken chain or a head that disagrees with its witness. The agent-tag ledger is hash-chained like the touch ledger, and every ledger’s head is witnessed off this machine, as the two anchor stores are today.in v0.5.0
    1 change
    • Chain the agent-tag roster and witness its head off-box
  • A worklist that can be finished: an item with no path to done leaves the queue with its reason. An unsatisfiable state joins open, claimed, blocked and closed.in v0.5.0
    2 changes
    • Add an unsatisfiable worklist state and its reader
    • Declare regrade and classify event types
  • Disregarded warnings recorded: a warning that was seen and set aside is kept, so its return is visible.in v0.5.0
    2 changes
    • Record disregarded warnings so their return is visible
    • Register the disregarded-warning example with a schema

0.5.0released

Fits the developer’s own tools

6 of 6 features done · 9 changes

  • SARIF export: commitwork’s findings open in VS Code, JetBrains and GitHub code scanning, from one writer.in v0.5.0
    1 change
    • Export a run's findings as SARIF 2.1.0
  • A GitHub Action: the baseline runs on GitHub-hosted runners, wrapping commitwork run as cobolwork’s Action wraps its build gate.Limit: it has run on a GitHub-hosted runner only in its own workflow so far.in v0.5.0
    1 change
    • Add a GitHub Action that runs the baseline on hosted runners
  • A pre-commit hook for any repository: a commit is checked before it lands, in any repository. Today’s hook serves commitwork itself.in v0.5.0
    3 changes
    • Add a pre-commit hook that checks staged content for secrets
    • Restore the hook subcommand and its usage text
    • Write the pre-commit hook through writeAtomic with its mode
  • MCP checks that do not block: an agent starts a run and collects it later. run_checks becomes a job on a bounded queue, replacing a call that blocks for up to ten minutes, and the prompt-injection signals the server already detects are recorded.in v0.5.0
    2 changes
    • Run checks as a bounded job and record injection signals
    • Pin both MCP run spawns to the scanner env builder
  • Standard formats in and out: SPDX beside CycloneDX, and SARIF in, so a scanner commitwork does not wrap still lands as findings.in v0.5.0
    2 changes
    • Write SPDX 2.3 beside the product CycloneDX SBOM
    • Import third-party SARIF 2.1.0 as normalised findings
  • The public repository: created from the accepted snapshot, with GitHub’s security features on. Its root commit carries 0.5.0, and its first GitHub release is v0.5.0.Verified against the GitHub API on 2026-10-11: Portll/commitwork is public with secret scanning and push protection enabled, private vulnerability reporting on, and the rulesets "main keeps its history" and "release tags are immutable". v0.5.0 is tagged on it.released

0.6.0started

Compliance evidence that keeps itself current

4 of 4 features done · 5 changes

  • The evidence pipeline on a schedule: evidence packs are current without a hand run. Only the exploited-vulnerability watch, with its CRA reporting clocks, is scheduled today.in v0.5.0
    1 change
    • Schedule the evidence refresh and report pack freshness
  • OSCAL, with SOC 2: evidence is written as OSCAL, mapped to SOC 2 as well as NIST 800-53. The OSCAL writer is tested and has never produced a file.in v0.5.0
    1 change
    • Map OSCAL component evidence to SOC 2 alongside NIST 800-53
  • A trusted timestamp: a signed evidence record can be shown to have existed at a time, by a clock other than this machine’s.on main
    2 changes
    • Add an RFC 3161 time-stamp client for signed evidence
    • Add RFC 3161 timestamps to the scheduled evidence refresh
  • Dependency updates, audited and proposed: commitwork deps audits npm versions and advisories, proposes updates on their own branches, and merges only behind the repository’s policy and its tests. Experimental, behind the npm-updates flag. It runs when asked; no scheduled job runs it yet.on mainadditional
    1 change
    • Audit and update npm dependencies with commitwork deps

0.7.0started

Presentation and notification

6 of 6 features done · 8 changes

  • A digest: one periodic summary of severity crossings, ratchet breaches and failed work, before any alert per event, since alert volume is itself a defect.on main
    2 changes
    • Summarise severity crossings, ratchet breaches, failed work
    • Schedule the daily digest and record each run
  • Slack and a generic webhook: the digest reaches a channel, and describes without applying anything. One outbound webhook replaces three single-purpose ones.in v0.5.0
    1 change
    • Deliver the digest to Slack and a generic webhook
  • The digest by email: the digest reaches an inbox through Resend, as plain text and HTML with nothing to press.on mainadditional
    1 change
    • Send the digest by email through lib/mail
  • Correlation views and history: coincidence, divergence and artifact anomalies each have a panel tab, with history for the undetermined rate and the ratchets.in v0.5.0
    1 change
    • Add a correlations view with rate and ratchet history
  • One graph: findings, taxonomy classes, lanes, repositories and sessions are related in one store, queried from the panel and over MCP.on main
    2 changes
    • Add a graph joining findings, lanes, repositories and areas
    • Add a graph view with neighbours, paths and related links
  • The docsite published on a schedule: rather than by hand.in v0.5.0
    1 change
    • Publish the docsite from committed main on a schedule

0.8.0started

Beyond one machine, beyond macOS

3 of 4 features done · 8 changes

  • Windows from a measured run: Windows support is stated from the suite’s result on Windows CI. Eighteen Windows fixes landed in September; each remaining failure is fixed or named.on main
    1 change
    • State Windows support from a measured CI run
  • macOS-only seams named: launchd, the keychain, zsh and /Users paths are each listed with a portable alternative or a stated limit.in v0.5.0
    2 changes
    • Name the macOS-only seams with portable paths or stated limits
    • Stop counting interpreter name lists as macOS seams
  • Model providers beyond the local machine: API providers sit behind the local-provider interface, and local models stay first-class. A model emits an artifact that a deterministic step executes, never a verdict.on main
    5 changes
    • Put hosted model APIs behind one provider interface
    • Route the cobolwork drafter and D1 reducer via model-provider
    • Route the panel model calls through model-provider
    • Route the rater, analyst and A/B loop via model-provider
    • Send Claude no temperature it rejects, fail its refusals
  • The layers it connects to, published: the memory and orchestration layers commitwork can use are public under their own licences.planned

0.9.0started

The release candidate: frozen formats, stated commands, and releases that publish themselves

5 of 5 features done · 8 changes

  • Formats frozen: every file commitwork writes or reads carries a version and a schema, and changes only at a major release. Lane reports, the check manifest and repository manifests, issues, the verdict journal, evidence packs and their chain, the SARIF export and the MCP tool schemas. Finding identities, which never include a line number, are pinned by test.on main
    3 changes
    • Freeze public formats and pin finding identities
    • Freeze six report formats and stamp the CRA evidence index
    • Freeze the seven versioned report and job formats
  • Commands and exit codes stated: each command’s exit codes are in one table, and a stability policy says what changes only at a major release. A renamed command or flag keeps an alias for one major, and a deprecation warns one minor ahead.in v0.5.0
    1 change
    • State the stability policy and generate exit-code tables
  • A threat model for scanning untrusted repositories: what commitwork runs, reads and reaches over the network is stated per command. A repository’s manifest runs only when trusted by flag, runtime probes reach only declared targets, and scanners run inside stated limits.in v0.5.0
    2 changes
    • Add a threat model for scanning untrusted repositories
    • Require --trust-repo-manifest for repo scripts and URLs
  • Releases that publish themselves: each release is built, attested and published by the release workflow, after every build passes. Release tags are protected, publishing waits for the maintainer’s approval, and the workflow refuses a tag that is not the version at the head of main with green CI.in v0.5.0
    1 change
    • Build, attest and publish releases from v* tags
  • A supported Node.js: the declared Node.js range is one still maintained, tested in CI on macOS, Linux and Windows.in v0.5.0
    1 change
    • Require Node 22.18 and test it on three platforms

1.0.0started

Stable

5 of 5 features done · 5 changes

  • Reference for every command: each command, option, exit code, CW_* environment variable and manifest key is documented, generated from the tool itself.in v0.5.0
    1 change
    • Generate a reference for commands, CW_* variables and keys
  • How far to trust each lane: each lane states its fixture source, its last canary result in both directions, and the share of its findings left undetermined.in v0.5.0
    1 change
    • State how far to trust each scanner lane
  • A stated scope: which lanes and platforms commitwork supports, what it refuses, and what it leaves unmeasured is written down.in v0.5.0
    1 change
    • State the 1.0 scope of lanes, platforms and refusals
  • Every release file attested: each file can be traced to the build that made it and rebuilt to the same bytes, with checksums and an SBOM of commitwork itself.on main
    1 change
    • Rebuild release source archives to the same bytes
  • A changelog from each cut: each release’s notes are generated from its commit range, with a runbook for withdrawing a bad release.in v0.5.0
    1 change
    • Generate release notes from a commit range

Oct 2026 · Lane 1planned

Agent configuration, measured rather than matched. Lands on the 0.5 line beside the developer-tools work

  • The effective configuration, across every file that sets it: one picture of what an agent is actually configured to do, resolved across instruction files, hook definitions, MCP server declarations and the environment variables that override them. The lanes read these today as text matches on single files, which cannot show the result of several files and an environment disagreeing.
  • Enforced permissions, not declared ones: the grants an agent holds in practice, measured against what its configuration claims.
  • Remediation for what it finds: each finding carries the change that would close it, surfaced in the panel and the brief rather than left as a row.

Oct 2026 · Lane 2planned

Release pass over every surface a person touches, and the installer. Lands on the 0.4 and 0.8 lines

  • One pass over the web panel, the CLI and the TUI: the three surfaces say the same thing about the same run, in the same words.
  • Content and measurements: every number a surface prints names what produced it and when.
  • Portability and the installer: the documented install works for a stranger on a clean machine, on each platform the project claims. Measured on Linux and macOS on 2026-10-08; confinement on a real Linux host is still unmeasured.

Nov 2026 · Lane 1planned

Tenant and role boundaries against a deployed target. Extends the BOLA and authorisation lanes

  • Actor by resource by operation: the matrix is enumerated and probed against a running target, so broken ownership and tenant isolation are found by attempting them. The existing BOLA and authz lanes probe a declared manifest; the matrix is the generalisation of that.
  • An evidence chain per cell: each result names the actor it used, the request it sent and the response it got.
  • Why it is not already coveredLimit: A generic SAST or build scanner cannot see these: the defect is in who may act on which record, which is a property of the deployment rather than of the source.

Nov 2026 · Lane 2planned

Gap analysis: what is not covered, stated as plainly as what is

  • Coverage gaps alongside findings: the report names what nothing looked at, beside what was looked at and found.
  • Fractal completeness and recursive identification: a gap found at one level is checked for at every level below it, so one missing lane does not hide a family of them.
  • Structured output and a remediate-via-LLM path: the gap set is machine-readable, and a model can be pointed at one gap with the evidence that defines it.

Dec 2026planned

Changes between scans, which is where most risk actually arrives

  • Dependency origin, tracked as it moves: a dependency that migrates from a registry to a local store, a keychain, Git or a deployment platform is reported as having moved.
  • Expected activity, and the bursts that are not: bot activity, workflow-editing bursts and local commits are modelled, so an unexpected one is visible against the expectation rather than lost in it.
  • Findings and suppressions that expire: a suppression states when it lapses, and a stale pinned dependency is reported before it is exploited.

Jan 2027planned

Living timelines: the December work, made legible

  • Security history, posture and remediation on one timeline: where a finding came from, what state it is in now, and what is scheduled against it, in one view.
  • What is scanned, and what is not: the view names the parts of a machine still outside every scan, rather than showing coverage as the whole picture.

Feb 2027 onwardsplanned

Orchestrators, persistent memory and lifecycle tracking

  • More than one orchestrator: the task and session ledger supports several conductors and task-management engines rather than one.
  • Reporting that improves with age: persistent memory across runs, so a report can say what changed since the last one without being told.
  • Tracking extended to the whole lifecycle: every tracked thing carries its state from first sighting to retirement, not only while it is open.