Roadmap - FIM One

Goal: Build an all-in-one agent platform for Global × China enterprises — delivered through three progressive modes: Standalone (portal assistant), Copilot (embedded in host system), Hub (central cross-system orchestration). Principles: Provider-agnostic (no vendor lock-in), minimal-abstraction, protocol-first, connector-first (integration is the core value).

Product Vision

FIM One is an all-in-one agent platform that serves three progressive delivery modes:

Standalone   → Your own AI assistant (Portal)
Copilot      → AI embedded in a host system (iframe / widget / embed)
Hub          → Central cross-system orchestration (Portal / API)

Cross-system orchestration is the core differentiator. Enterprise clients have legacy systems — ERP, CRM, OA, finance, HR — that need to talk to each other through AI: GTM path: Land and Expand

Step	Mode	What happens
Land	Copilot	Embed into one system, prove value inside their UI
Expand	Copilot → Hub	Roll out to more systems; Hub mode aggregates them

Known Issues

Tracked bugs that are reproducible in production but not yet fixed. Each entry names the symptom, the suspected surface area, and the workaround (if any). Items move to a version section once a fix is scoped and scheduled.

Playground stop-and-retry shows transient visual artefacts that a page refresh always clears. Three concurrent render sources — activeConversation.messages (DB snapshot), the SSE messages stream, and the optimistic pendingQuery placeholder — are not collapsed into a single derived state, so between clicking “Retry” and the paired assistant response landing, the UI can (a) briefly render the same query twice in the pre-stream window, (b) drop prior orphan user bubbles from the retry history while hasLiveMessages is true and before the snapshot reloads, and (c) flicker in the narrow window between the SSE “done” event and the next selectConversation refresh. Data is never lost — every user message (including aborted retries) is persisted in conversation.messages, carried into the next LLM call via normalize_alternating_messages, and rendered correctly after refresh via HistoryTurn.orphanUserContents introduced in the 48ba08c6 render fix. For context, Claude’s own web UI exhibits an analogous class of bug — stopping mid-response and immediately sending a follow-up query sometimes forks the follow-up as a sibling-edit branch of the first query rather than appending it as a new turn — so this is a known hard problem in optimistic-UI + SSE + persisted-history designs, not a FIM-One-specific defect. A proper fix requires collapsing the three render sources into a single derived state; deferred until a broader Playground state-machine refactor.

Backlog (Low Priority)

Deferred hardening — not blocking; pick up only if the matching scenario shows up.

DAG evidence gets its own truncation budget, decoupled from DAG_ANALYZER_TRUNCATION, so source evidence isn’t re-clipped by the summary budget before the analyzer/synthesis verify against it.
Structure-aware evidence truncation (head+tail / keep lists & tables) so long enumerations survive the cap instead of silently losing their tail.
Port the source-fidelity guideline into the ReAct fallback synthesis prompt so total/severity mislabels are caught in ReAct too, not only in DAG.

Shipped Versions

v0.1 (2026-02-22) — MVP: ReAct + DAG Planner

ReActAgent with tools (calculator, python_exec, web_search)
DAG Planner (LLM generates dependency graphs)
Portal UI with streaming + KaTeX

v0.2 (2026-02-24) — Multi-Model + Memory

Retry / rate limiting / usage tracking
Native function calling (no JSON-only parsing)
Multi-model support (fast + main LLM)
Memory: WindowMemory, SummaryMemory
FastAPI backend with SSE streaming

v0.3 (2026-02-25) — Web Tools + MCP

Web tools (web_search, web_fetch) via Jina/Tavily/Brave
File operations tool
MCP client (standard tool integration)
Tool auto-discovery + categories
DAG visualization with click-to-scroll
Code exec in Docker (--network=none)

v0.4 (2026-02-25) — Multi-Turn + Agents

Multi-turn conversations (DbMemory)
Tool step folding UI
HTTP request + shell exec tools
Agent management (create, configure, publish)
JWT authentication
Per-agent execution mode + temperature control

v0.5 (2026-02-28) — Full RAG + Grounded Gen

Full RAG pipeline (embedding + vector store + FTS + RRF + reranker)
Grounded Generation (citations, confidence scores)
Knowledge base document management (CRUD, search, retry, schema migration)
ContextGuard + pinned messages (token budget manager)
DbMemory persistence + LLM Compact
DAG Re-Planning (up to 3 rounds)

v0.6 (2026-03-01) — Connector Platform

Connector CRUD: create, read, update, delete
ConnectorToolAdapter: converts Connector → BaseTool
Per-user credentials: AES-GCM encryption
Confirmation gate: write operation approval
Audit logging: all tool calls recorded
Circuit breaker: graceful degradation on failures
Utility tools: email_send, json_transform, template_render, text_utils
Embedding options: Jina, OpenAI, custom providers

v0.7 (2026-03-06) — Admin Platform + Multi-Tenant

Admin Platform: user management, role toggle, password reset, account enable/disable
Invite-only registration: three modes (open/invite/disabled) + invite code CRUD
Storage management: per-user disk usage, clear, orphan cleanup
Conversation moderation: admin list/delete all
Per-user force logout: revoke all tokens
API health dashboard: system stats, connector metrics
First-run setup wizard: guided admin account creation
Personal Center: per-user global instructions, language preference
JWT auth: token-based SSE auth, conversation ownership
Global MCP servers: admin-provisioned, loaded in all sessions
Backward-compat: registration_enabled → registration_mode auto-migration

Invite code management
Per-user quotas (429 enforcement)
Structured audit logging
Sensitive word filtering
Admin login history
Admin file browser
Enhanced admin views (model_name, tools, kb_ids fields)
Docker Compose deployment (single image, named volumes)
OAuth auto-detection from window.location
Extended thinking / reasoning support (LLM_REASONING_EFFORT, LLM_REASONING_BUDGET_TOKENS) for OpenAI o-series, Gemini 2.5+, Claude
Admin per-tool enable/disable (disabled tools excluded from chat at runtime)
MCP servers management moved to Connectors page
Dual database support: SQLite (zero-config default) + PostgreSQL (production); Docker Compose auto-provisions PostgreSQL
Models configuration documentation page with extended thinking setup per provider
SSE Protocol v2: real-time answer streaming with delta_reasoning, usage fields, and split done/suggestions/title/end events; SQLite pool size 5 -> 20
AI Builder expansion: 7 new builder tools (GetSettings, TestConnection, ImportOpenAPI for connectors; ListConnectors, AddConnector, RemoveConnector, SetModel for agents), is_builder flag on agents, builder prompt auto-refresh, SSRF guard
SSE v2 frontend: streaming dot-pulse cursor, DAG re-plan round snapshots as collapsible cards, DAG layout decoupled from step states
AI Builder concept documentation page with connector and agent builder guides
Organization system: full CRUD with role-based membership (owner/admin/member), admin management UI
Three-tier resource visibility (personal/org/global) for agents, connectors, knowledge bases, MCP servers
Publish/unpublish API for all resource types; owner delegation for published agents
Admin set-visibility endpoint (replaces clone-to-global); unified build_visibility_filter() query helper
Database Connectors (Phase 1-3): direct SQL access to PG/MySQL/Oracle/SQL Server + Chinese legacy DBs; schema introspection, AI annotation, read-only query execution, encrypted credentials, 3 tools per connector (list_tables, describe_table, query)
Evaluation Center: quantitative agent quality benchmarking — test dataset CRUD (prompt + expected behavior + assertions), eval runs (parallel execution + LLM grader + per-case pass/fail/latency/token results), results viewer with auto-polling; migration r8t0v2x4z567
Three model roles (General/Fast/Reasoning) with per-tier env config isolation; fast model no longer inherits main model settings
StepOutput dataclass replacing plain string step results for structured data and artifact passing
Tool cache for DAG execution — identical tool calls cached per-run with async lock stampede prevention (DAG_TOOL_CACHE)
Per-step LLM verification with 1 retry on failure (DAG_STEP_VERIFICATION)
Auto-routing: fast LLM classifies queries as ReAct or DAG; /api/auto endpoint; frontend 3-way mode toggle (AUTO_ROUTING)
~~Shadow Market Organization + Resource Subscriptions~~: Built-in Market org (shadow, no auto-join) replaces Platform org; resources discovered via marketplace browsing and explicitly subscribed (pull model); Market API for subscribing to shared resources; publish-to-Market always requires review; Resource subscriptions table; org-based resource sharing replacing global visibility
~~Agent Auto-discovery and Sub-agent Binding~~: discoverable flag on agents; sub_agent_ids whitelist; CallAgentTool for delegating tasks to specialist agents
~~MCP Server Credentials + Per-User Override~~: mcp_server_credentials table; PUT /api/mcp-servers/{id}/my-credentials endpoint; allow_fallback flag for credential fallback behavior
~~Connector/KB Toggle~~: POST /api/connectors/{id}/toggle and POST /api/knowledge-bases/{id}/toggle for suspending/resuming resources
~~Standalone KB Conversations~~: kb_ids field on conversations for direct KB chat without agent binding

v0.8 (2026-03-20) — Connector Declarative Config + Progressive Disclosure

v0.8.1 (2026-03-29) — Progressive Disclosure Maturity + ReAct Hardening

Progressive disclosure for DB connectors (DatabaseMetaTool), MCP servers (MCPServerMetaTool), and on-demand tool loading (request_tools meta-tool)
DAG quality overhaul (5 improvements: model upgrade, skill auto-discovery, citation verifier, structured content preservation, domain-aware routing)
Domain model escalation in ReAct (specialist domains auto-escalate to reasoning model)
Per-model Native Function Calling toggle (tool_choice_enabled)
ReAct cycle detection (deterministic duplicate tool call prevention)
ReAct completion checklist (pre-answer verification when tools were used)
Resource Fork Phase 1 (MCP Server + Skill fork endpoints with lineage tracking)
Workflow Connection Dep Auto-Subscribe (recursive sub-workflow dependency resolution)
Prebuilt Solution Templates (8 vertical solutions seeded to Market on first registration)
Admin notification improvements (timezone-aware, master switch, SMTP Reply-To)
Per-turn token budget circuit breaker (REACT_MAX_TURN_TOKENS)
Centralized tool truncation, dynamic system prompt budgeting
File attachment download, duplicate message submission fix

v0.8.2 (2026-04-10) — Agent Core Hardening + Vision Documents

Agent Core Phase 0 — Compact prompt upgraded to 9-section structured format; empty tool result protection (descriptive message instead of (no output)); anti-loop prompt + cycle detection threshold lowered to 2; domain classifier + pre-flight DB config resolution parallelized (400–1100 ms saved per request); SSE end event sent immediately after answer, with title/suggestions moved to background tasks
Agent Core Phase 1 (Context Anti-Bloat) — MicroCompact rule-based old tool result cleanup (keep last 6); REACT_TOOL_RESULT_BUDGET=40000 aggregate cap; reactive compact on context overflow (auto-compact to 50% budget and retry instead of crashing)
Agent Core Phase 2 (Speed) — Keyword-based tool pre-selection (skips LLM call on obvious matches, 200–500 ms saved); SharedHttpClient LLM connection pooling; completion check skipped for answers >200 tokens; FallbackLLM wraps primary+fast with automatic failover on 429/503/529/connection errors
Intelligent Document Processing (Vision-Aware) — Adaptive document handling: PDF pages rendered as images via PyMuPDF for vision-capable models (GPT-4o, Claude 3/4, Gemini), text-only fallback via pdfplumber. Per-model supports_vision flag. Modes via DOCUMENT_PROCESSING_MODE, DOCUMENT_VISION_DPI, DOCUMENT_VISION_MAX_PAGES. DOCX/PPTX embedded image extraction. Multi-turn vision persistence across conversation turns. Smart PDF processing (text-rich pages extract text + images; scanned pages render as full-page PNG). Pre-built sandbox image (Dockerfile.sandbox) with common data-science packages for --network=none code execution
Resource Fork completion — Agent / Connector / Workflow fork endpoints added, completing the five-type lineage tracking (KB fork removed — inherently user-local)
File integrity guardrail — System prompt rule prevents the agent from substituting unrelated file contents when a target file is unreadable; uploaded files now include file_id in message context for direct read_uploaded_file access

v0.8.3 (2026-04-16) — Universal Document Conversion + Agent Core Phase 3

Universal Document Conversion (convert_to_markdown + OCR) — Built-in Agent tool wrapping Microsoft MarkItDown; converts PDF, Word, Excel, PowerPoint, HTML, JSON, CSV, XML, ZIP, EPUB, Outlook .msg, images, audio, YouTube URLs to Markdown. LiteLLMOpenAIShim enables OCR via any vision-capable LLM (Claude, Gemini, Bedrock, Azure). Vision-aware RAG ingestion with zero-regression text-only fallback. LLM_SUPPORTS_VISION env var for opt-out
Agent Core Phase 3 (Runtime Invariant Hardening) — Conversation recovery (dangling tool_use auto-repair); structured compact work card (WorkCard typed merge across compaction rounds); turn-level profiler (REACT_TURN_PROFILE_ENABLED); per-user rate limiting (LLM_RATE_LIMIT_PER_USER); empty-content assistant message with tool_calls no longer dropped

v0.8.4 (2026-04-17) — Prompt Cache + Reasoning Correctness

System prompt section registry with cache breakpoints — Memoized PromptRegistry splits system prompts into stable prefix + dynamic suffix; cache-capable providers (Claude, Bedrock Anthropic, Vertex Claude) receive cache_control: {"type": "ephemeral"} on the prefix for ~60-80% per-turn input token savings. Non-cache providers get a single concatenated message (zero behavior change)
Prompt cache observability — cache_read_input_tokens and cache_creation_input_tokens tracked through UsageSummary → TurnProfiler → done_payload.cache field. Structured turn_cache log line per turn. Doubles as relay cache-honesty probe
Conversation recovery MVP — Synthetic tool_result rows persist after interrupted turns; POST /chat/resume replays cached SSE events from a monotonic cursor; frontend useSseResume hook auto-reconnects with exponential backoff (300ms → 1s → 3s, max 3 attempts) and “Reconnecting…” indicator
Thinking-block persistence with signature — reasoning_content + Anthropic signature persisted in metadata_["thinking"] and replayed on subsequent turns; fixes HTTP 400 signature mismatch on Claude 4 multi-turn conversations
Provider-aware reasoning replay policy — Centralized reasoning_replay_policy() in core/prompt/reasoning.py gates serialization per provider family: Claude replays thinking blocks with signature; DeepSeek-R1/Qwen-QwQ/Gemini-thinking/o-series drop reasoning_content on outbound (previously leaked, breaking provider KV caches and violating API docs)

v0.8.5 (2026-04-23) — Channel Integration + Hook System + Contributor i18n

Feishu Channel (Phase 1 subset) — Org-scoped Channel resource with Fernet-encrypted credentials; FeishuChannel supports interactive card send + callback (signature verification + URL challenge); Settings → Channels management UI (list, create/edit with dirty-state protection, details with copyable callback URL, test-send); CRUD API (/api/channels) and event callback endpoint (/api/channels/{id}/callback). Shipped early for 2026-04-24 roadshow
Agent Hook System (live in ReAct + DAG runtime) — PreToolUseHook / PostToolUseHook abstraction in src/fim_one/core/hooks/; agents declaring hooks.class_hooks in model_config_json have hooks instantiated and registered per chat session. First consumer FeishuGateHook posts an Approve/Reject card to the linked Feishu group when an agent calls a requires_confirmation=True tool, blocks execution, and resumes or aborts based on verdict
Configurable confirmation gate (inline OR channel) — Every agent gets an Approval section with three routing modes (Auto / Inline only / Channel only), approver-scope selector (initiator / owner / anyone in org), per-tool override, and explicit approval-channel picker. Auto mode gracefully falls back to an inline approval card when no channel is linked. POST /api/confirmations/{id}/respond shares a single decision-recording path with the Feishu webhook
Per-agent task completion notifications — Long-running ReAct or DAG agents can push a summary card to the org’s channel when a task finishes. First consumer of the generic outbound notification pattern
Hook Approval Playground — Channels details sheet has a “Test Approval Flow” action that exercises the full production path (genuine ConfirmationRequest row, real Feishu callback, status transitions) — same code path a production hook uses
Contributor-friendly i18n CI fallback — .github/workflows/i18n-sync.yml translates EN → ZH/JA/KO/DE/FR on master after PR merge and auto-commits with [skip ci]; contributors no longer need LLM_API_KEY locally. Pre-commit locale-edit guard refuses manual edits to generated locale files (ALLOW_LOCALE_EDIT=1 override for legitimate translation fixes). End-to-end verified via smoke-test push
Exa integration docs — Dedicated Integrations section with a first-class Exa page covering the full Exa search surface (neural / fast / deep-reasoning / instant), filtering, content retrieval, and three tuned presets
Xinchuang (信创) database support — Database Connector now lists KingbaseES (人大金仓), HighGo (瀚高), and DM8 (达梦) alongside PostgreSQL/MySQL. PG-compatible drivers reuse asyncpg; DM8 uses dmPython. scripts/test_xinchuang_dbs.py verifies live connectivity from the CLI
Channels + Hook System architecture docs — docs/architecture/hook-system.mdx explains the three hook points and walks through FeishuGateHook end-to-end; existing architecture pages cross-link; README lists Messaging Channels as a first-class capability
Hardening — Duplicate Feishu callback clicks produce a replacement card instead of double-deciding; concurrent callback clicks resolved via conditional UPDATE ... WHERE status='pending' rowcount check; pending approvals auto-expire after CHANNEL_CONFIRMATION_TTL_MINUTES (default 24h) via background sweeper; Settings → Channels respects org role (members see read-only UI); parallel tool-call aggregator handles providers that reuse index=0 for every delta; session-expiry redirect preserves query string

Stripe billing MVP — Free + Pro tiers; Checkout, Customer Portal, webhook lifecycle; /settings?tab=billing; admin plan/subscription CRUD; quota enforcement respects each user’s plan
Admin-controlled billing feature flag — system_settings.billing_enabled gates the entire Stripe pipeline so private deployments without Stripe credentials never surface a non-functional payment UX
Per-user unlimited quota — empty inherits global default, 0 grants unlimited; previously both collapsed into the same state
Translation glossary as single source of truth — scripts/translation-glossary.md consolidates per-locale rules; pre-commit unconditionally refuses manual edits to generated locale files
License + governing law migrated to FIM Labs Pte. Ltd. (Singapore); SIAC arbitration in English; new top-level NOTICE file
Playground follow-up suggestions restored, opt-in per agent
Stability fixes — strict-alternation provider history, parallel tool-call boundary detection, unbound-agent confirmation flow, channel role gating, retry-duplicate suppression, post-rejection no-paraphrase

v0.8.7 (2026-06-10) — Security Hardening + Guardrails v0 + Billing Correctness

JWT token-type confinement — closes a 2FA bypass where any same-signed token (temp/refresh/ticket) could authenticate API and SSE endpoints
OAuth hardening — email auto-link requires a provider-verified email (account-takeover fix); OAuth refresh tokens stored hashed so session rotation works
Content guardrails v0 — input/output tripwire layer (core/agent/guardrail); ships jailbreak detector + max-length output guardrail, env-var configured
file_ops.apply_patch — V4A diff patches with fuzzy whitespace matching, complements find_replace
Billing-cycle correctness — quota resets on the subscription anniversary (not calendar month); renewals advance the period via authoritative Stripe lookup; usage display aligned to the enforcement window
Reliability fixes — pseudo-protocol tool-call leak stripped from answers; tunable HTTP keep-alive ends APIConnectionError bursts; API-key usage stats persist on read-only requests
Billing tab visual overhaul — full-width, consistent with other Settings tabs

v0.8.8 (2026-06-22) — SSRF Hardening + Reliability & Reasoning Fixes

SSRF hardening — blocklist unwraps IPv4-mapped IPv6 (::ffff: instance-metadata bypass); MCP SSE/Streamable-HTTP server URLs SSRF-validated on create + connect
LLM reliability — shared HTTP pool self-heals after a LiteLLM client-cache eviction closes it; chat sends stream instantly (history folded in background, no full reload)
Anthropic adaptive-thinking protocol for Opus 4.6+/Sonnet 4.6/Fable 5 — extended thinking works where the old fixed-budget param 400s on 4.7/4.8; warns on OpenAI-proxy misroute
Reasoning detail preserved end-to-end — genuine final answer streamed verbatim; survives compaction, context rebuilds, and sub-agent steps (no lossy re-synthesis)
PreToolUse enforcement hooks fail closed on error — a crashing approval gate no longer silently allows the call; non-enforcement hooks keep fail-open via fail_open
Force-logout timestamp comparison normalized to UTC by conversion + Docker Compose POSTGRES_* credential override (no shipped fim:fim default)

Planned Versions

Replanned 2026-07-08: FIM One is an agent runtime — one kernel (ReAct engine, credentials, approval gate, audit, multi-tenant orgs) behind multiple delivery surfaces: Web UI, API, JS embed, MCP output. Every surface reuses the same assembly layer for auth, credentials, approval, and metering: more frontends, never more logic. Near-term direction is convergence on the data-Q&A (ChatBI) slice, selling scenarios rather than a platform.

v0.9 — Connector Fences + Scenario Onboarding

Goal: The post-reduce assets assemble into a complete data-Q&A product — read-only DB connectors + fences + approval gate + IM entry. Tier-1 fences turn security debt into product features.

DB Connector Fences — Tier 1, three PRs

PII column redaction (ConnectorScopeGuard PreToolUse hook)
Schema visibility — table/column allow-deny + verb blocking (read-only enforcement)
Fence auditability — caller_user_id, effective_credential_source, scope_rules_applied in ConnectorCallLog
Per-hook config pass-through ({"name", "config"} schema) — the carrier for ScopeGuard rules
Approval gates hold across delegation — call_agent and workflow AGENT nodes run the agent’s own hooks instead of none

Scenario Onboarding

First run starts from a scenario template (solution_seeds) instead of an empty workbench
Docs landing page leads with three vertical scenario stories instead of a module reference
One scenario template distilled per delivered engagement — the moat is scenario assets × delivery speed

v0.10 — Two Mouths: JS Embed + IM Inbound

Goal: The two most sellable delivery surfaces, both on the same kernel and assembly layer.

JS bubble / iframe embed — one snippet into a host system; anonymous-visitor identity + billing attribution decided before build
Feishu inbound @mention — agents live in the group: query data, file approvals, chase flows
Outbound patterns: failure alerts, budget warnings, scheduled digests, escalation, audit receipts
WeCom / DingTalk channels following Feishu

Parked — signal-gated

Do not start these without their trigger (see the replan §3): the MCP gateway waits for ≥2 unsolicited “mount your tools in my agent” asks; channelization waits for an implementor asking about licensing; IdP/OrgSync waits for customer pull; the rest wait for a delivered engagement that needs them.

Shipped from the pre-replan v0.9 plan

v1.0 — Hot-Plug + Embeddable

Goal: Zero-restart connector addition, Package ecosystem, and embedded delivery. Impact: Enterprises deploy FIM One from zero to multi-system orchestration in days. Package system creates a creator ecosystem — solution authors publish composite bundles (Skill + Agents + Connectors + KBs + Workflows), enterprises install with one click, creators earn from adoption. Install/fork duality covers both “use as-is” and “customize from template” use cases in a single mechanism.

Frozen Features (Shipped, Maintain Only)

Per the Orthogonality Strategy, these features are shipped and working but will not receive new capabilities (bug fixes only):

Feature	Version	Why frozen
ReAct Agent	v0.1, v0.9	Models now have native tool calling. Mid-loop self-reflection (v0.9) prevents goal drift in long chains. Tool observation synthesis quality improved (8K chars, configurable via `REACT_TOOL_OBS_TRUNCATION`)
DAG Planning / Re-Planning	v0.1, v0.5, v0.7.5	Model reasoning capabilities improving; decomposition becoming single-shot. Per-step verification shipped in v0.7.5 (`DAG_STEP_VERIFICATION`). Hardened: cascade failure propagation, verifier status fix, planner tool descriptions, full replan history, whitelist-based tool cache. 14 engine constants exposed as ENV vars — no further planning primitives planned
Memory (Window, Summary, Compact)	v0.2, v0.5	Context windows growing (200K+); less need for external memory management
RAG pipeline	v0.5	Providers building retrieval natively (OpenAI file_search, Gemini Search Grounding)
Grounded Generation	v0.5	Models improving at citations; 5-stage pipeline adds diminishing value
ContextGuard / Pinned Messages	v0.5	Shipping as-is; no new features

Consider (Deferred Indefinitely)

Per the Orthogonality Strategy, these would be high-effort and face absorption risk:

Feature	Why deferred
Multi-Agent Orchestration (deep hierarchies)	Providers building natively (OpenAI Swarm, Google A2A, and similar multi-agent offerings). FIM One’s CallAgentTool covers the one-level delegation case; event-triggered background agents are covered by Scheduled Jobs in v0.9
Agent Self-modifying Skills (Procedural Memory)	Agents updating their own `skill.md` during execution — high complexity, safety/audit surface area. Depends on Agent Skill System (v0.8) shipping first. Re-evaluate if enterprise customers request self-improving agents explicitly
~~Agent Workspace (Tool Output File Offloading)~~	Promoted to v0.9. The value is selective reading, not context capacity — cross-framework validation confirmed. Original deferral reasoning (“200K+ windows reduce urgency”) was wrong.
Cross-Session Long-Term Memory	Context windows growing rapidly (200K–2M); providers adding built-in memory (OpenAI memory, Gemini context caching); high implementation cost vs diminishing differentiation value. Re-evaluate when enterprise customers explicitly request it
Memory Lifecycle (TTL, quotas)	Depends on cross-session memory; deferred together
Active Context Compression Tool (agent-triggered)	Explicitly frozen with ContextGuard (v0.5). Context windows at 200K+ reduce value. Will not be revisited unless context costs become a major enterprise complaint
Browser Automation / Computer Use	High maintenance cost (DOM changes, anti-bot, sandboxing). Industry converging on Computer Use mode (Anthropic, OpenAI Operator, Google Mariner) and MCP browser tools (Puppeteer/Playwright MCP). Consume via MCP integration, don’t self-build. Re-evaluate when stable Computer Use MCP standard emerges
Web Push Notifications	Browser-native push via Service Worker + VAPID. Overlaps with IM Channel Integration (v0.8) which covers enterprise-preferred channels (Lark/Slack/WeCom/Email). IM push has higher enterprise value; Web Push is a nice-to-have for Portal-only users. Re-evaluate after IM Channel ships — if users request browser notifications beyond IM coverage
Multi-user workflow collaborative editing	Real-time co-editing of the same workflow blueprint (Figma/Notion style) with cursor awareness, conflict resolution, and per-node lock. High implementation cost (CRDT / OT, presence infra), unclear enterprise demand over today’s “one editor at a time + version diff” model. Re-evaluate if multiple enterprises specifically request shared live editing
Per-node workflow execution permissions (RBAC on run)	Fine-grained authorization inside a single workflow run — e.g. “node X requires role `finance_approver` to execute”. Today authorization happens at the workflow level (who can trigger) and at the connector level (whose credential runs); per-node RBAC adds a third axis with material complexity and no active customer request
Cross-org workflow sharing with live updates	Subscribe to a workflow from another org and receive upstream updates without re-forking. Today subscribe = fork (snapshot), so breaking upstream changes never propagate. Live updates would require upstream-compatible schema evolution + conflict resolution; high maintenance cost. Re-evaluate if enterprises ask for “shared workflows across subsidiaries”

How Versions Align With Modes

Version	Standalone	Copilot	Hub	Notes
v0.1–v0.3	Working	Not yet	Not yet	Portal-only, single-user
v0.4	Working	Not yet	Not yet	Multi-conversation, agent management
v0.5	Working	Not yet	Not yet	Knowledge base + RAG
v0.6	Working	Possible	Possible	Connectors ship; Copilot/Hub possible with manual wiring
v0.7	Working	Ready	Ready	Admin platform; multi-tenant auth; ready for production
v0.8	Working	Ready	Optimized	RBAC + audit log per-system; easier to onboard
v0.9	Working	Ready	Production	Observability, performance, hardening
v1.0	Working	Optimized	Enterprise	Package system, creator program, hot-plug, embeddable widget, webhooks, batch

Resource Allocation (v0.8–v1.0)

The Orthogonality Strategy shapes where effort goes:

Category	Allocation	Versions	Why
Connector Platform (v0.6+)	50%	Ongoing	Core differentiation; no absorption risk
Enterprise Features (RBAC, audit, security, observability)	30%	v0.8–v1.0	Boring but durable; production requirement. Agent Trace Layer is commercial anchor
Agent Intelligence (Skill System, scheduled agents)	15%	v0.8–v0.9	指令+工具+技能 differentiation story; low absorption risk — frameworks validate patterns, but enterprise SOPs are customer-specific
v0.1–v0.5 maintenance	5%	Ongoing	Bug fixes only; no new features

Metric-Driven Milestones

Success is measured by:

Metric	v0.7 Target	v0.8 Target	v1.0 Target
Connectors deployed	5	20+	100+
Enterprise customers	1–2	5–10	20+
Avg connector setup time	2 weeks	2 days	5 minutes (hot-plug)
Token efficiency (DAG vs ReAct-only)	30% reduction	40% reduction	50% reduction
Uptime SLA	99.5%	99.9%	99.95%
Support ticket themes	Integration, setup	Connector custom logic	Hot-plug, scaling

Open Questions / TBD

Marketplace moderation: How to validate community packages and individual resources? Automated scanning for credential leaks in package configs? (v1.0)
Token economics: How to price multi-user, multi-agent scenarios? (v1.0)
Package versioning: Breaking changes in installed packages — auto-upgrade with migration scripts, or manual approval per update? Dependency diamond problem resolution? (v1.0)
Package pricing: Free vs paid tiers, commission rates for Creator Program, payment provider integration? (v1.0)
Package credential UX: Install-time credential collection — wizard-style step-by-step or deferred setup? Credential sharing across packages that use the same connector type? (v1.0)
Telemetry opt-out: How to honor privacy preferences? (v0.8)
Connector versioning: How to manage breaking changes in connector APIs? (v0.8)
Rate limiting: Per-user workflow rate limiting shipped (sliding window 10 runs/min, 3 concurrent). Per-connector and per-agent rate limiting TBD (v0.9)
Connector authorization tier selection: how does an admin discover which tier applies to a given upstream system? Auto-probe (try per-user API key → fall back to login-ticket → fall back to shared-DB) vs. explicit declaration in the connector spec? How do we express “this connector supports Tier 2 but the admin chose to operate in Tier 1” in the UI without confusing non-technical admins? (v0.9)
Integration vs Connector duality: when a Feishu binding is simultaneously an SSO provider AND an API-call surface, how do we present it in Settings? One object with three toggles, or three separate bindings that share a credential? Implications for uninstall semantics (does revoking SSO kill the Connector?) (v0.9)

​Product Vision

​Known Issues

​Backlog (Low Priority)

​Shipped Versions

​v0.1 (2026-02-22) — MVP: ReAct + DAG Planner

​v0.2 (2026-02-24) — Multi-Model + Memory

​v0.3 (2026-02-25) — Web Tools + MCP

​v0.4 (2026-02-25) — Multi-Turn + Agents

​v0.5 (2026-02-28) — Full RAG + Grounded Gen

​v0.6 (2026-03-01) — Connector Platform

​v0.7 (2026-03-06) — Admin Platform + Multi-Tenant

​v0.7.x (2026-03-07 to 2026-03-12) — Stability + Refinements

​v0.8 (2026-03-20) — Connector Declarative Config + Progressive Disclosure

​v0.8.1 (2026-03-29) — Progressive Disclosure Maturity + ReAct Hardening

​v0.8.2 (2026-04-10) — Agent Core Hardening + Vision Documents

​v0.8.3 (2026-04-16) — Universal Document Conversion + Agent Core Phase 3

​v0.8.4 (2026-04-17) — Prompt Cache + Reasoning Correctness

​v0.8.5 (2026-04-23) — Channel Integration + Hook System + Contributor i18n

​v0.8.6 (2026-05-08) — Stripe Billing + Refinements

​v0.8.7 (2026-06-10) — Security Hardening + Guardrails v0 + Billing Correctness

​v0.8.8 (2026-06-22) — SSRF Hardening + Reliability & Reasoning Fixes

​v0.8.9 (2026-07-08) — Module Slim-down + Sharing Convergence + Approval Hardening

​Planned Versions

​v0.9 — Connector Fences + Scenario Onboarding

​DB Connector Fences — Tier 1, three PRs

​Scenario Onboarding

​v0.10 — Two Mouths: JS Embed + IM Inbound

​Parked — signal-gated

​Shipped from the pre-replan v0.9 plan

​v1.0 — Hot-Plug + Embeddable

​Frozen Features (Shipped, Maintain Only)

​Consider (Deferred Indefinitely)

​How Versions Align With Modes

​Resource Allocation (v0.8–v1.0)

​Metric-Driven Milestones

​Open Questions / TBD