| 1 | # Roadmap |
| 2 | |
| 3 | Feature parity checklist against GitHub. Snapshot taken 2026-09-26 from the |
| 4 | API routes, DB schema, web pages and auth plugins. |
| 5 | |
| 6 | ## Done |
| 7 | |
| 8 | ### Git hosting |
| 9 | - [x] Create repositories (public/private), fork |
| 10 | - [x] Push/clone over HTTP (Basic auth) |
| 11 | - [x] Push/clone over SSH, SSH key management |
| 12 | - [x] WAL-on-S3 storage with materialized local cache |
| 13 | - [x] GPG commit signature verification, Verified badges, GPG key management |
| 14 | |
| 15 | ### Code browsing |
| 16 | - [x] Tree, blob, raw files, README rendering |
| 17 | - [x] Branch list, commit history, single commit diff and patch |
| 18 | - [x] Languages, contributors, stargazers, forks |
| 19 | - [x] Code search (Zoekt, indexed on push), repository search |
| 20 | |
| 21 | ### Issues |
| 22 | - [x] Create, edit, close, reopen |
| 23 | - [x] Comments, labels, assignees, timeline |
| 24 | - [x] `#123 |
| 25 | |
| 26 | ### Pull requests |
| 27 | - [x] Compare branches, create, view commits/files/patch |
| 28 | - [x] Merge (merge commit only) |
| 29 | - [x] Closing issues from pull requests |
| 30 | |
| 31 | ### Users and accounts |
| 32 | - [x] Profile, contribution graph, avatar |
| 33 | - [x] Stars, dashboard |
| 34 | - [x] Multiple emails with verification, password reset, sessions, API keys |
| 35 | - [x] Organizations: create/invite/accept UI (Better Auth plugin only) |
| 36 | |
| 37 | ### Other |
| 38 | - [x] OG images, docs site, Grafana/metrics, themes |
| 39 | |
| 40 | ## Not done |
| 41 | |
| 42 | ### Tier 1: obvious gaps |
| 43 | 1. [x] ** |
| 44 | and a Settings tab: rename, description, visibility, default branch, |
| 45 | delete. Delete purges the log, cache and search shards before it answers |
| 46 | ([0020](0020-deletion-is-a-tombstone-then-a-purge.md |
| 47 | redirects from old slugs after a rename. |
| 48 | 2. [x] ** |
| 49 | namespace, org profile ([0022](0022-owners-share-one-namespace.md |
| 50 | Teams, fork into an organization, transfer, org contributions. Base |
| 51 | permission and member policies, outside collaborators, leaving, public |
| 52 | membership, profile details and pins, team pages and maintainers, |
| 53 | `@org/team` mentions, org defaults, guided deletion, transfers with |
| 54 | acceptance and redirects, `org:` search, dashboard switcher |
| 55 | ([0023](0023-organization-access-is-a-base-permission.md |
| 56 | 3. [x] ** |
| 57 | read/triage/write/maintain/admin ([0021](0021-access-is-a-role-ladder.md |
| 58 | Invitations lapse after 7 days; the dashboard lists owned and shared |
| 59 | repositories. |
| 60 | 4. [x] ** |
| 61 | with Markdown notes, drafts and prereleases, a computed latest release in |
| 62 | the sidebar; creating a release creates its tag |
| 63 | ([0024](0024-tags-live-in-git-releases-in-rows.md |
| 64 | per-account storage quota, off unless configured |
| 65 | ([0025](0025-storage-is-billed-to-the-owning-account.md |
| 66 | deleting tags from the UI, source archives (#18), per-account quota |
| 67 | overrides, upload progress. |
| 68 | 5. [x] ** |
| 69 | comments batched in a pending review or posted singly, checked against the |
| 70 | diff's hunks; threaded replies; editing and deleting comments and summaries; |
| 71 | dismissing a verdict; `#123` references from reviews; each reviewer's |
| 72 | standing verdict beside the merge button; draft pull requests that cannot |
| 73 | merge until marked ready, and back again; comments on a range of lines; |
| 74 | suggested changes applied as a commit to the head branch |
| 75 | ([0026](0026-a-review-is-pinned-to-the-head-it-read.md |
| 76 | applying several suggestions in one commit. |
| 77 | 6. [ ] **Merge strategies.** Only merge commit. No squash or rebase, no |
| 78 | conflict detection UI. |
| 79 | 7. [ ] **Branch management.** No create/delete branch from the UI. Branch |
| 80 | protection is deferred (see below). |
| 81 | 8. [ ] **Notifications.** No inbox, no email on mention/assign/review, no |
| 82 | watch/subscribe. |
| 83 | |
| 84 | ### Tier 2: platform |
| 85 | 9. [ ] **Webhooks.** Push/PR/issue events, HMAC signing, delivery log, |
| 86 | redelivery. Already advertised on the landing page. |
| 87 | 10. [ ] **CI / Actions.** Runner, job logs, commit status checks. Start with a |
| 88 | commit status API (`POST /statuses/:sha`) so external CI can report; a |
| 89 | runner is a much larger project. |
| 90 | 11. [ ] **2FA / passkeys.** |
| 91 | exists, but the API's Better Auth has no `twoFactor` plugin. No OAuth |
| 92 | login (GitHub/Google). |
| 93 | 12. [ ] **Push errors over sideband.** Failures render as JSON, so the git CLI |
| 94 | shows an unhelpful error (see [0011](0011-deferred.md |
| 95 | 13. [ ] **Anonymous push note.** |
| 96 | `receive-pack` accepts anonymous pushes, but `GitBasicAuthMiddleware` now |
| 97 | rejects read-only actors. Verify and update the doc. |
| 98 | |
| 99 | ### Organizations, later |
| 100 | - [ ] **Audit log.** Member added or removed, role changed, repository |
| 101 | transferred, settings changed; filterable by actor and action. |
| 102 | - [ ] **Custom organization roles.** Better Auth's dynamic access control is |
| 103 | on, but only the built-in roles grant repository access. |
| 104 | - [ ] **Blocking users** at organization level. |
| 105 | - [ ] **Organization webhooks and secrets**, with webhooks (#9) and CI (#10). |
| 106 | - [ ] **Security policy:** required two-factor for members (needs #11), SSO / |
| 107 | SAML, verified domains. |
| 108 | |
| 109 | ### Branches, later |
| 110 | - [ ] **Branch protection.** Deferred from #7: required reviews (needs #5), |
| 111 | required status checks (needs #10), no force push, no deletion. |
| 112 | |
| 113 | ### Tier 3: nice to have |
| 114 | 14. [ ] Milestones, issue templates, reactions, lock conversation |
| 115 | 15. [ ] Follow users, activity feed, explore/trending |
| 116 | 16. [ ] Web file editor, file upload, blame, per-file history |
| 117 | 17. [ ] Gists, wiki, projects/kanban |
| 118 | 18. [ ] Repository mirroring, import from GitHub, archive download (zip/tar) |
| 119 | 19. [ ] WAL checkpoints/compaction (push currently reads full log, O(history)) |
| 120 | 20. [ ] Rate limiting, audit log, admin panel |
| 121 | |
| 122 | ## Known stale content |
| 123 | - Landing page (`apps/web/src/app/page.tsx:147`) says SSH is missing. SSH is |
| 124 | implemented. |
| 125 | |
| 126 | ## Suggested order |
| 127 | 1 → 3 → 2 → 9 → 10 (status API first). Settings and collaborators unblock |
| 128 | team use; webhooks then let external CI plug in. |