$ cat ./ROADMAP.md
what we're building. in the open.
An honest view of what's shipped, what we're working on now, and what's on the horizon. No fixed dates — we ship when it's right. Items and ordering may shift as we learn.
shipped
05engine foundation
engine extraction + ctx ports
engine pulled out of the monolith. ctx interface with logger, http, storage, secrets ports — engine never imports sdk or platform code, enforced by lint.
walker, flow dispatch, durable sleep
edge-driven workflow runtime. category=flow dispatch, delay node, and workflow.sleep wrapping temporal — workers can die mid-delay and the run resumes.
sdk + lifecycle events + sub-workflow
@flowforge-company/sdk: thin temporal-client wrapper (submit, subscribe, cancel, signal, query). lifecycle stateevents emitted. runsubworkflow primitive via executechild.
security baseline
lint blocks eval/function/vm. logger auto-redacts tokens, jwts, urls, pii. activityfailure mapped to nodeerror with classification. security.md + private disclosure across every repo.
github packages publish pipeline
versioned publish chain for types, engine, cli, stdlib under @flowforge-company. public-read with no token required, ready for the customer scaffold.
in progress
02spec locked, implementation active
subscribe protocol
two surfaces — sdk.subscribe (asynciterable) and workeroptions.onevent — both wrap the same temporal update streamevents handler. one primitive, two ergonomics.
definenode lifecycle + actor layer
authorize, validate, computecost, finalize, configure hooks on every node. actor layer separates engine wiring from customer code. spec locked after four review passes.
planned
05primitives, onboarding, payload security
zero-friction cli onboarding
npx @flowforge-company/cli init wizard → ready scaffold → flowforge start worker → flowforge run workflow.json. customer onboarding in three commands.
engine primitives suite
edge-driven walker (reachable bfs), flow primitives (if_else, switch, parallel branches, parallel join, fail), signal primitive with timeout race for hitl, decorator slots, cost channel, template grammar.
input scope + sub-workflow registry
execution input exposed as {{ input.* }} in template scope. stdlib subworkflownode with in-process child registry injection.
end-to-end payload encryption
payloadcodec option in sdk + reference aes-256-gcm codec. codec-server for temporal ui decrypt. manifest registration api with worker auto-push on connect.
workflow.json schema codegen
flowforge schema emits a json schema for workflow.json so editors give autocomplete and validation without manual setup.
exploring
04cloud, ai authoring, compliance
cloud control plane + byo worker
hosted control plane with worker running on customer vpc. multi-tenant ctx, auth handoff with signing-key rotation, cluster db cross-tenant safety, tenant isolation playbook.
codec wire format + guardrail service
grpc wire with permanent v1 backwards compat. codec contract for end-to-end encrypted payloads. internal guardrail for admission control and abuse detection.
first real customer rebuild on sdk
copa rewrites its runtime on @flowforge-company/sdk + ctx ports while keeping its own database. validates the engine-has-no-db architectural bet.
ai authoring + cost portability
authoring_session_id and node_shape_signature as first-class telemetry contract. cost model portability when the worker runs inside a customer vpc.