Skip to content
MonStaff Docs

Plan registry

Interpretation

Section titled “Interpretation”

This register records where every historical plan now lives and how it relates to the current roadmap. Historically completed means the file was found in a done/ directory; it does not assert that implementation and regression tests were independently verified.

Current execution authority

Section titled “Current execution authority”

Factory integration and delivery is proposed (FCT0–FCT13): existing Monstaff SPA plus separate Fabric execution, KISS/YAGNI and Fabric skill lifecycle. It does not authorize implementation, supersede WA, enroll repositories or change automation grants. WA overlap must be resolved in FCT0.

The open-source release plan is a proposed OSS0–OSS12 program. It separates public source readiness (G-S), an installable preview (G-B) and operational use of real data (G-D). AGPL selection and the first local license implementation are already complete; credentials/history, complete distribution evidence, self-hosting and publication remain open. OSS1 proposes a separate owner for SEC-01/POT-01 without changing the historical remediation exclusion. Existing MDG/CIR/Core/SD/PSB and feature plans retain their technical authority; the OSS program coordinates their applicable release evidence. Planning alone authorizes neither production changes nor repository publication.12

Database follow-up — 2026-09-08: the DBO0–DBO12 plan is proposed in response to the populated live-database audit. Its migration design preserves current data and requires verified recovery; the historical greenfield assumptions below do not constitute authorization to reset that database. DBO0 records the necessary decision reconciliation. This entry authorizes no execution and does not rewrite the historical decisions.34

ADR-016 establishes that MonStaff is pre-production, has no historical MonStaff data and has no supported installed-client base. All active plans therefore target one clean schema/API/client release: no backfill, dual read/write, legacy route or DTO projection, stable-ID/session preservation, old-client support or adoption threshold is required solely for backward compatibility. Security controls, staged enablement for dangerous features, audit/recovery evidence and truthful import of external Hubstaff history remain mandatory.5

The Alternative Rust/Tauri Desktop program was a deliberate exception to that default: ADR-021 required the new client to coexist with, and not replace, Electron during evaluation. ADR-024 ended that exception on 2026-09-05; the single desktop client consolidation plan removes Electron and the coexistence machinery while MCC6/TD5 keep governing installed qualification.6 The exception is limited to the two desktop client families and does not reopen obsolete database/API compatibility work elsewhere. Preview .23 is now public beside Electron Stable .43, with four-target installed qualification, byte-identical public artifacts and one exact-cohort production registration/read-only login canary; tracking remains disabled, and permission-granted monitoring, review, soak, wider rollout and final evaluation remain open.789

Plan or program Greenfield simplification Executable boundary
Provider-independent platform One clean Prisma/API/client cutover; delete GitHub-owned core fields, /issues, bridges and compatibility DTOs Implemented, committed and online; PI8 provider/deployment verification remains residual evidence
Desktop Installation Clean DesktopInstallation baseline; no old installation identity or membership adapter DI0 implemented, committed and online; signed-platform verification remains residual evidence
Device Compliance Empty target tables and first supported protocol; no old-client or membership-adapter transition Implemented, committed and online through DC7 repository/load/recovery scope; independent review and platform rollout remain residual evidence
Remote Actions Empty target tables; no installed-base adoption threshold or old desktop protocol Control plane, runner and user-level terminal implemented, committed and online; signed elevation/platform review remains residual evidence
Attended screen sharing and remote control New clean support-session, consent and control-grant schema; no compatibility or call surface Proposed SC0–SC10; start only with architecture, threat-model, privacy and signed platform spikes
Single desktop client consolidation Greenfield default restored for the desktop: delete Electron/agent-cli, no migration, version-only fence, one MonStaff identity SDC0–SDC5 closed 2026-09-05: Electron and agent-cli removed, version-only fence, MonStaff identity and 0.3.0 version line, core/GUI hardening; installed qualification stays in MCC6/TD5
Local AI Pack Delete free-form local provider/model compatibility and legacy Ollama mode Implemented and published; signed sidecar, evaluation/privacy and broader platform evidence remain residual
Hubstaff history import Delete ImportConnection/legacy mappings instead of migrating them Implemented, committed and online through HI8 repository/load/recovery scope; live-provider evidence remains residual
CTO Dashboard Start snapshots at feature enablement; no MonStaff historical backfill CD0–CD4 implemented, committed and online; calibration is post-implementation observation
Complete remediation Historical compatibility windows and previous-schema rollback no longer constrain release Implemented security/reliability controls and external verification gates remain authoritative
CI/CD build, release and deployment remediation Preserve every applicable gate while removing duplicate execution, redundant native compilation and rebuild-on-qualification-failure coupling Active two-wave CIR1–CIR7; exact-SHA Preview lanes, interrupted immutable promotion and fail-fast advisory-outage containment are remotely proven, while measurement, qualification-only retry, OCI digest delivery and rollback evidence remain open
Agent telemetry, chat audit and parallel time One clean OTEL/ClickHouse/PostgreSQL contract and first supported agent adapters; no compatibility with tst-telemetry deployment or schemas AT0–AT9 implemented, committed and online; production identity, live-client approval and AT10 rollout remain residual evidence
Tenant Wiki and GitHub work automation New clean knowledge/policy/intent/decision/action schema over the provider-neutral core; no legacy AI-estimate container, NATS dependency or user-token automation bridge Proposed WA0–WA11; start only with product/ADR, privacy, minimal GitHub App permissions, provider spikes and evaluation baseline
Agent sessions explorer and provider-neutral analytics Extend the first supported AT contracts/read models directly; no SigNoz/Python service compatibility or legacy analytics DTO is required Active; local P0/P1/P2 paths implemented, deployed ClickHouse queries and ASA8 evidence remain open
Desktop monitoring OpenTelemetry projection Clean monitoring outbox/event catalog and derived ClickHouse schema; no historical projection or compatibility stream Proposed DMO0–DMO9; start only with authority, event-contract, privacy and architecture acceptance
Developer monitoring disclosure and lawful-use governance Clean immutable policy/disclosure/acknowledgement schema with sensitive classes disabled; no legacy acknowledgement or raw feature-flag compatibility Proposed MDG0–MDG10; start only with data map, purpose/legal contract, DPIA template, reviewed copy and ADR
Idle-aware screenshot capture and exact deduplication Clean occurrence/asset/suppression schema and one first supported Desktop/API contract; no historical MonStaff screenshot backfill Proposed SD0–SD9; start only with product/ADR/privacy contract and exact-byte fixtures
Private object-storage boundary and backend data plane One coordinated Desktop/Admin/API/CI cutover; no permanent presigned external contract or old-client storage DTO Proposed PSB0–PSB10; start only with boundary ADR, threat model, route contracts, capacity baseline and complete consumer inventory
Desktop setup checklist and managed agent hooks One setup page replacing permissions, Core-owned readiness and Codex managed hooks written once through the operating-system administrator prompt; no privileged service, no trusted_hash writes, no installer package Active; SU0–SU4 shipped in 0.3.14/0.3.15 and closed on the product owner’s machine on 2026-09-06, SU5 open
Raw aggregate input and key-translation elimination Replace the first Preview aggregate listener directly; no compatibility listener or translating fallback Active P0 RIC0–RIC6; .23 publicly packages RIC1–RIC4 and isolated macOS import evidence, while permission-granted lifecycle/layout, review, soak, rollback and rollout gates keep RIC5–RIC6 and TD5 open
Alternative Rust/Tauri desktop client Deliberate side-by-side Electron/Preview window with separate application identity and a server-fenced single tracking collector Active TD0–TD12; public .23 passed four-target installed qualification and one exact-cohort production registration/read-only login canary beside Electron Stable .43; tracking remains disabled and monitoring, durability, independent review, soak, wider rollout and evaluation gates remain open; coexistence and Electron-comparison criteria void since ADR-024 (2026-09-05); TD5 and the remaining TD gates apply to the single MonStaff client 0.3.0
Italian web and Electron i18n One first supported locale/profile/catalog contract and coordinated UI/API/IPC cutover; no old-client error-prose or locale fallback Implemented; Admin/Electron zero-residual gate, Chrome editorial review, rollout flag and metrics complete; native Windows/Linux and screen-reader observations remain release evidence
Table standardization and remote query One table/query contract cutover; no legacy URL-key or compatibility-prop transition TS0–TS9 implemented, committed and online; manual assistive-technology/browser evidence remains residual
Customer domain and project engagements Empty customer/allocation tables; no historical MonStaff allocation migration CU0–CU9 implementation and gates committed and online; independent privacy/accessibility evidence remains residual
Report models, OnlyOffice and delivery Empty report stores and one first supported model/template contract RP0–RP10 implemented, committed and online with renderer/OnlyOffice health; RP11/RP12 external evidence remains residual

The complete remediation plan remains the closure authority for security, reliability, quality and platform work. Its repository workstreams, representative local load and local PostgreSQL restore are implemented; independent review, production rollout/canary, signed-client tests, privacy approval and isolated production-equivalent recovery remain verification gates. It supersedes the technical improvement roadmap, which remains only as historical context. The plan explicitly excludes SEC-01 and POT-01; their open state is preserved in the risk register.1011

The CI/CD build, release and deployment remediation plan is an active two-wave CIR1–CIR7 cross-product program. Exact-SHA Quality reuse, four independent Preview build/installed-qualification lanes and fail-closed recovery of an interrupted immutable publication are now remotely exercised by .23. Quality also gates every expensive lane on one required production dependency audit: a live npm advisory outage consumed 92 seconds on one runner while all downstream jobs stayed skipped. Re-measurement, qualification-only re-execution, OCI digest deployment and rollback drills remain open, so CIR6–CIR7 are not closed; Electron adoption is void under ADR-024.12813

The desktop installation foundation plan is the implemented shared prerequisite for device-scoped features. DI0 owns the single Ed25519-authenticated DesktopInstallation; Device Compliance, Local AI Pack and Remote Actions add typed feature extensions without competing credentials.1415

The Device Compliance implementation plan is implemented and online. The repository implements the read-only administrator-configured, server-evaluated path on the shared installation/grant resolver, including refresh, retention, audit and replay/membership tests. DC7 independent review and signed-platform observations remain residual evidence; Remote Actions remains separate and a finding cannot automatically authorize or execute it.1516

The remote actions implementation plan is implemented, committed and online with its control plane, device runner and Redis terminal relay. Signed elevation brokers, the full platform matrix, independent security evidence and staged observation remain residual verification and are not unfinished repository implementation.1516

The attended screen sharing and remote control plan is a proposed, not-yet-implemented SC0–SC10 program. It reuses installation identity, recent authentication and bounded relay patterns without inheriting terminal authority. Screen viewing is locally approved per session, graphical control requires a second expiring consent, media/input retention is zero and voice, microphone, camera, meeting and every other calling capability are excluded. SC0 architecture, threat-model, privacy and signed platform spikes are the only ready entrypoint.1718

The CTO dashboard plan is implemented and online through CD0–CD4, including a bounded 5,000-work-item/7,500-transition fixture. Post-launch calibration/usefulness is observation after implementation; positive health claims remain withheld until that evidence exists.151116

The Local AI Pack implementation plan is implemented and published: the repository-managed pack/policy/download/runtime path, independently approved operator publication and audited pause/resume/revoke/retire propagation exist. Desktop 0.2.27 and restricted real Qwen/Gemma macOS arm64 canaries are published; the macOS arm64 application is Developer-ID signed, notarized and built with the configured v2 trust set. Signed sidecar runtime, measured evaluation, privacy approval and broader signed-platform canaries remain residual evidence.1519201121222316 On 2026-09-05 the installed desktop 0.3.6 could not run the published Gemma pack: the sidecar rejects its profile with UNSUPPORTED_PROFILE while resolution still reports READY, and the desktop check presents the failure as a safe no-match; the proposed Phase 8 owns the profile-contract and disclosure repair.24

The Hubstaff complete history import plan is implemented, committed and online with the canonical connection, durable API tiers, CSV fallback, incremental scheduler and tombstone reconciliation path through HI7 plus HI8 repository/load/recovery scope. Authorized live-provider/export/screenshot canaries, privacy approval and rollout observations remain residual evidence.151116

The provider-independent platform plan is implemented, committed and online with its clean provider-neutral schema/API/Admin/Desktop cutover and PostgreSQL recovery. The outbound-GitHub-blocked journey, authorized full GitHub parity canary, independent review and signed-client observations remain residual evidence.151116

The agent telemetry, chat audit and parallel-time plan is implemented, committed and online through AT0–AT9: Collector/ClickHouse ingest, durable projection/governance, exact official accounting, merge-safe CLI lifecycle, adapters and Admin/Desktop surfaces are present. Late-event and 20,000-row backup/delete/restore exercises pass. Real global clients, Pi availability, production identity/TLS, provenance approval and staged rollout remain residual external evidence.252616

The tenant Wiki and GitHub work automation plan is a proposed, not-yet-implemented WA0–WA11 program. It adds structured work intent, a published tenant/project Automation Wiki, compiled action-specific policy, deterministic correlation and duplicate prevention, schema-bound LLM decisions, approval/durable execution and a least-privilege GitHub App adapter for issue, Projects V2, story-point and demo workflows. OpenTelemetry remains evidence and PostgreSQL remains decision/action authority. WA0 product/ADR/privacy/permission/provider/evaluation acceptance is the only ready entrypoint.2728

The agent sessions explorer and provider-neutral analytics plan is an active ASA0–ASA8 extension of the implemented AT foundation. ASA1–ASA7 are repository-local, including the governed explorer, P0 lifecycle/dual-time/attribution analytics, P1 overlap-aware inter-turn waiting, P2 usage/cost facts, typed ClickHouse projection/query with a 100,000-row recovery drill, and automated distributed cluster readiness/MDG lawful TTL validation. Cross-user production analytics, chat content, multi-node cluster deployment and inter-turn waiting remain subject to ASA8 and MDG governance gates.293031

The desktop monitoring OpenTelemetry projection plan is implemented through DMO0–DMO9. It keeps the authenticated desktop monitoring APIs, PostgreSQL and object storage authoritative, projecting minimized named OTEL events through a transactional outbox, private Collector gateway and ClickHouse. Prohibited data cannot enter the outbox, and canonical writes remain available with telemetry disabled.3233

The developer monitoring disclosure and lawful-use governance plan is a proposed, not-yet-implemented MDG0–MDG10 cross-product program. It replaces default-on raw monitoring flags with immutable purpose/data-class policy, organization-specific notice and acknowledgement, Article 4/DPIA readiness, customer-billing isolation and centralized collection/read enforcement. MDG0 is the only ready entrypoint and production enablement remains subject to named Italian employment/privacy review.3435

The idle-aware screenshot capture and exact storage deduplication plan is implemented through SD0–SD9. It separates temporal capture occurrences from owner/time-entry-scoped binary assets, reuses only byte-identical finalized images via SHA-256 digests, persists idle/lock/suspend suppression intervals and removes captures from discarded idle time.3637

The active-timer project mismatch detection and notification plan is a proposed, not-yet-implemented TM0–TM6 program. It moves project inference into the Core while a timer runs, notifies the developer on a confident and stable mismatch, and offers a one-action switch through the existing stop/start path on GUI and CLI. It delivers the running-timer items of the Local AI Pack plan’s Phase 5, stays suggest-only and defers automatic switching to a separately gated TM6. TM0 is the only ready entrypoint.3839

The desktop setup checklist and managed agent hooks plan is an active SU0–SU6 program authorized on 2026-09-05. It replaces the Permissions page with one readiness screen for native permissions, notifications, agent hooks per client, the managed Local AI pack and compliance enrollment, computes the readiness in the Core for GUI and CLI, reads Codex hook trust from the Codex app-server, and installs Codex hooks as managed hooks in the system requirements.toml through a single operating-system administrator prompt on explicit user action. Consent stays in user space, refused elevation is a normal outcome and users without administrator rights keep user-level hooks with /hooks guidance. No persistent privileged service is introduced and ADR-010 is unchanged. SU0–SU4 are shipped in desktop 0.3.14/0.3.15 and closed on the product owner’s machine on 2026-09-06 (final managed hooks installed, user-level copies retired, Codex session in the bridge); the desktop-driven prompt path and SU5 documentation remain open.404142

The private object-storage boundary and backend data-plane migration plan is implemented through PSB0–PSB10. It makes MinIO cluster-private, replaces external presigned transfers with authorized bounded backend streaming via streamUploadToObjectStorage and streamDownloadFromObjectStorage, and removes direct public S3 exposure.4344

The raw aggregate input and key-translation elimination plan is an active P0 RIC0–RIC6 corrective program. Preview .23 now publicly packages the content-free adapters, rdev removal, supply-chain evidence and isolated macOS arm64/x86_64 import reports. Its four-target installed qualification covers package and coexistence mechanics, not permission-granted aggregate-input lifecycle/layout execution. Signed soak, independent released-path review, cohort observation and rollback still block RIC5–RIC6, TD5 closure and cohort expansion.458

The Alternative Rust/Tauri desktop client plan is active. Preview .23 is publicly available beside Electron Stable .43, with independent credentials/protocol/updater, hardened repository parity, protected promotion and four-target installed hash/identity/coexistence qualification. One exact production cohort passed challenge/registration, protected-session restore and read-only dashboard bootstrap while tracking remained intentionally disabled. Both macOS artifacts passed publisher trust; Linux/Windows publisher trust is explicitly not applicable while updater signatures passed. TD5 monitoring, TD7 durability, comprehensive review/soak/wider rollout and TD10–TD12 evaluation remain open. Since 2026-09-05 ADR-024 and the closed SDC1–SDC4 phases make this client the only MonStaff desktop application; the Electron-comparison criteria are void and TD5 with the remaining TD gates qualify MonStaff 0.3.0.7896

The Italian web and Electron i18n implementation plan is implemented through I18N0–I18N9. One bilingual locale/profile contract and static catalog now cover the React Admin, Svelte renderer and Electron main process while keeping UI language, timezone and report-recipient locale distinct. The Admin legacy routes are fully migrated, AST source gates cover the supported UI, Chrome review verifies live switching and reduced viewports, and the server flag plus bounded metrics provide rollout control. Native Windows/Linux and independent screen-reader observations remain release evidence rather than unfinished repository work.464748

The table standardization and remote query plan is implemented, committed and online through TS0–TS9 across React and Svelte, including abort/stale/error lifecycle, semantic keyboard/ARIA automation and representative bounded volume. Manual assistive-technology/browser review and staged observation remain residual evidence.252616

The customer domain and multi-customer project engagement plan is implemented, committed and online through CU0–CU9 with lifecycle/detail, contacts, engagements, fail-closed visibility, conservative allocation, audit/retention operations, report-read boundary and clean-install/concurrency/volume gates. Independent PII/privacy/accessibility review and rollout observation remain residual evidence.252616

The report models, OnlyOffice authoring and customer delivery plan is implemented, committed and online through RP0–RP10: immutable storage, signed editor callbacks, renderer conversion, durable runs/deliveries/schedules, Admin review, portable bundles and retention/orphan recovery are present. RP11 independent review/live provider/browser-editor canaries and RP12 staged observation remain residual evidence.252616

Registry

Section titled “Registry”
Plan Imported state Canonical disposition
Open-source release on GitHub Proposed OSS0–OSS12; first-party AGPL foundation implemented locally Start with OSS0 scope/ownership; resolve credentials, licensing/distribution and public-repository boundaries, then qualify G-S/G-B/G-D independently
Database remediation and optimization New proposed follow-up; implementation not started DBO0–DBO12 cover DB-01–DB-09, with backup and retention containment first; data-preserving migration, measured optimization and verified rollout
Complete remediation plan Implemented with local evidence (2026-08-29) Repository work complete; retain as closure authority until external verification gates are recorded
Server-side stale timer cleanup Implemented, not regression-tested Preserve; distinguish stale cleanup from the still-open concurrent-start constraint
AI story point estimation No implementation evidence; historical proposal superseded for new work Preserve as source; WA5 owns calibrated revisions, human precedence, evaluation and provider-neutral model policy
NATS JetStream + GitHub App webhooks No implementation evidence; historical proposal partially superseded Preserve as source; WA0/WA6 own GitHub App/webhook decisions, while PostgreSQL leases remain the default and NATS is not accepted
Graceful desktop shutdown Implemented, historically completed Add automated/smoke verification and commit evidence
Active timer AI inference Historically completed in Electron, not carried over to the Rust/Tauri client Preserve as source; the active-timer project mismatch plan owns the Core-based re-implementation
shadcn-svelte migration Historically completed, scope superseded Reassess only as current per-app UI debt; admin is React and the original cross-Svelte premise is obsolete
Hide macOS dock icon Implemented Add a macOS lifecycle smoke test
Structured backend logging Partially implemented Merge remaining intent into reliability/observability phase; preserve redaction requirements
Skeleton-2025 refactor Not implemented alternative Not accepted; conflicts with the current incremental modular-monolith direction and requires an explicit architecture decision
Fix macOS tray clock freeze Implemented Add a hidden-window/App Nap regression test
Double-click issue timer Implemented Verify timer authorization and concurrent-state behavior
Skip unchanged AI inference Implemented Add deterministic fingerprint tests and telemetry for skipped calls
CTO dashboard and delivery metrics Implemented, committed and online through CD0–CD4 Done; retain explicit uncertainty until post-launch calibration/usefulness evidence exists
Desktop installation foundation DI0 implemented, committed and online Done; retain signed Windows/macOS/Linux canary evidence as residual verification
Administrator-defined device compliance Implemented, committed and online through DC7 repository/load/recovery scope Done; keep disabled by default pending residual review/privacy/platform evidence
Complete recoverable Hubstaff history import Implemented, committed and online through HI8 repository/load/recovery scope Done; retain authorized provider/export/screenshot canaries as residual evidence
CI/CD build, release and deployment remediation Active; exact-SHA Preview lanes, interrupted immutable promotion and fail-fast advisory-outage containment remotely proven; full CIR5–CIR7 closure remains open Re-measure, prove qualification-only retry, OCI digest deployment and rollback without weakening gates
Remote actions and interactive terminal Control plane, user runner and terminal implemented, committed and online Done; retain signed elevation and independent/platform verification as residual evidence
Attended screen sharing and remote control Proposed; SC0–SC10 not started Start only SC0 product/ADR/threat-model/privacy and signed capture/input spikes; view-only must stabilize before control
Local AI Pack and per-installation model policy Implemented and published; desktop 0.2.27 and restricted signed/notarized macOS arm64 canaries exist Done; retain signed sidecar/evaluation/privacy/broader-platform evidence as residual
Provider-independent platform Implemented, committed and online through PI1–PI8 repository/recovery scope Done; retain no-GitHub deployment and authorized provider-parity evidence as residual
Agent telemetry, chat audit and parallel time Implemented, committed and online through AT0–AT9 Done; retain AT10 production identity/live-client/approval/rollout evidence as residual
Tenant Wiki and GitHub work automation Proposed; WA0–WA11 not started Start only WA0 product/ADR/privacy/permission/provider/evaluation acceptance; all external actions stay disabled
Agent sessions explorer and provider-neutral analytics Active; local APIs/UI/calculations, ClickHouse DDL and cluster/MDG readiness validated Complete deployed ClickHouse query/load/recovery evidence and ASA8/MDG release gates
Desktop monitoring OpenTelemetry projection Proposed; DMO0–DMO9 not started Start only DMO0 contract/privacy/architecture acceptance; do not replace canonical REST/PostgreSQL/object-storage authority
Developer monitoring disclosure and lawful-use governance Proposed; MDG0–MDG10 not started Start only MDG0 data map, legal/product contract, DPIA/copy review and ADR; keep sensitive collection off until the program’s activation gates pass
Idle-aware screenshot capture and exact storage deduplication Proposed; SD0–SD9 not started Start only SD0 product/ADR/privacy/contract acceptance; preserve occurrences and restrict reuse to exact bytes in one owner/time entry
Private object-storage boundary and backend data plane Proposed; PSB0–PSB10 not started Start only PSB0 boundary/contract/threat/capacity acceptance; do not remove public MinIO before every consumer and release path passes
Raw aggregate input and key-translation elimination Active P0 remediation; .23 publishes RIC1–RIC4 and isolated macOS import evidence, while permission-granted lifecycle, review, soak and rollout keep RIC5–RIC6 open Complete permission-granted signed runtime/layout/soak/review/rollback/rollout gates; never fall back to key translation
Alternative Rust/Tauri desktop client Active; public .23 passed four-target installed qualification and one exact-cohort production registration/read-only login canary beside Electron Stable .43; tracking remains disabled and TD5/TD7–TD12 remain open Complete the broader authentication matrix, monitoring, review, soak/updater recovery and wider rollout evidence for the single MonStaff client; replacement is decided (ADR-024)
Single desktop client consolidation Active; SDC0 decision and freeze closed on 2026-09-05 Execute SDC1–SDC5 one phase per change set; rollout authority stays with MCC6/TD5
Italian web and Electron i18n Implemented through I18N0–I18N9 with complete Admin/Electron migration and Chrome review Done; retain native Windows/Linux and independent assistive-technology observations as release evidence
Table standardization and remote query Implemented, committed and online through TS0–TS9 Done; retain manual assistive-technology/browser evidence as residual
Customer domain and multi-customer project engagements Implemented, committed and online through CU0–CU9 Done; retain independent PII/privacy/accessibility evidence as residual
Report models, OnlyOffice and customer delivery Implemented, committed and online through RP0–RP10 Done; retain RP11/RP12 provider/browser/review/rollout evidence as residual

Priority rule

Section titled “Priority rule”

The complete remediation plan remains the closure authority. The previously active implementation programs are implemented, committed on remote main and represented by published release evidence; they must not be reimplemented. Their clean migration/seed, unit/integration/build, dependency/configuration/infrastructure gates, automated accessibility, representative bounded volume, PostgreSQL/ClickHouse recovery and document conversion evidence remains canonical. Authorized provider/real-agent canaries, signed sidecar/elevation/platform artifacts, independent security/privacy/legal/licensing review, production credentials, isolated recovery and staged observation remain mandatory where named, but are residual verification rather than unfinished repository implementation.1525261116

Proposed CIR, WA, ASA, SC, DMO, MDG, SD and PSB programs plus active RIC and TD programs are part of the registry. CIR is the CI/CD control-plane prerequisite for removing repeated work: Wave 1 (CIR1–CIR4) deduplicates the quality decision per commit, starts each platform qualification on its own artifact and parallelizes image delivery, and Wave 2 (CIR5–CIR7) preserves immutable candidates and digest-addressed delivery before any release optimization; no duplicated gate is deleted before its checks are reconciled into a named owner. RIC is the P0 corrective exception: its .17 repository/source implementation and local isolated arm64 import result do not substitute for RIC0 external acceptance or signed RIC5–RIC6 runtime, review, soak and rollout evidence, all of which block the macOS TD5 exit and affected cohort expansion. Their architecture, threat, privacy, product, terminology and legal decisions must be accepted where applicable before dependent schema or runtime work begins. WA extends, rather than reopens, the provider-neutral core and implemented AT0–AT9; its production use of employee work-intent/telemetry data is gated by the applicable MDG purpose, disclosure and review path, while synthetic/provider-sandbox planning evidence may precede production enablement. ASA extends the same AT foundation; its P0 session/lifecycle work is independent from P1 inter-turn waiting and P2 usage/cost. Implemented I18N0–I18N9 provide the single bilingual locale/profile/catalog foundation consumed by MDG3–MDG4 and later UI work; MDG retains semantic and legal authority over monitoring disclosure copy. PSB owns the object transport boundary and may begin its non-data-expansive security work independently; PSB2 must coordinate with SD0–SD4, and PSB8 cannot close public MinIO until screenshot, Admin, reporting, telemetry, AI Pack and release consumers all pass. TD creates an intentional mixed-client Preview window only after a new coexistence decision; its P0 monitoring remains gated by MDG, it adopts SD/PSB changes only after those programs are independently accepted, and its aggregate-input implementation must satisfy RIC without a translating fallback. MDG0–MDG9 are a hard production prerequisite for sensitive Agent Telemetry, Agent Sessions cross-user/content/waiting cohorts, Work Automation, Device Compliance, Desktop Monitoring OTEL and Screenshot Optimization enablement. The respective AT10/ASA8/WA11, DC7, DMO9 and SD9 canary evidence is coordinated with and closes the affected data-class cohorts in MDG10; this avoids both premature rollout and a circular requirement to finish MDG10 before its feature canaries exist. Remote Support retains its separate consent/governance path and does not inherit monitoring authority.

Footnotes

Section titled “Footnotes”

  1. Complete open-source release plan request. ↩

  2. Open-source release baseline and existing-plan boundaries. ↩

  3. Database planning request. ↩

  4. Database audit evidence. ↩

  5. Pre-production greenfield compatibility constraint. ↩

  6. Single Rust desktop client and Electron end-of-life. ↩ ↩2

  7. Alternative Tauri desktop client request. ↩ ↩2

  8. Preview .23 final qualification and public publication evidence. ↩ ↩2 ↩3 ↩4

  9. Preview .23 production login smoke evidence. ↩ ↩2

  10. Complete remediation implementation evidence. ↩

  11. Residual active-plan repository-local closure. ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  12. CI/CD build, release and deployment remediation request. ↩

  13. Fail-fast production dependency audit gate. ↩

  14. Active plan implementation-readiness request. ↩

  15. Greenfield release-candidate local implementation evidence. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8

  16. Implemented plans committed and online state. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11

  17. Attended screen sharing and remote control request. ↩

  18. Attended screen sharing and remote control baseline. ↩

  19. Managed AI Pack publication workflow evidence. ↩

  20. Managed model-pack greenfield canary publication. ↩

  21. Desktop 0.2.26 release preparation. ↩

  22. Desktop 0.2.27 release preparation. ↩

  23. Desktop 0.2.27 publication evidence. ↩

  24. Local AI Gemma pack profile rejection diagnosis. ↩

  25. Active AT, TS, CU and RP workstreams at maximum repository-local implementation. ↩ ↩2 ↩3 ↩4 ↩5

  26. Active workstream quality, load and recovery evidence. ↩ ↩2 ↩3 ↩4 ↩5

  27. Tenant Wiki and GitHub work automation request. ↩

  28. Tenant Wiki and GitHub work automation baseline. ↩

  29. Agent sessions explorer and provider-neutral analytics request. ↩

  30. Agent sessions and analytics implementation baseline. ↩

  31. Agent analytics ClickHouse and Admin i18n follow-up evidence. ↩

  32. Desktop monitoring OpenTelemetry evolution request. ↩

  33. Desktop monitoring and OTEL projection baseline. ↩

  34. Developer monitoring disclosure and governance request. ↩

  35. Developer monitoring disclosure and governance baseline. ↩

  36. Idle-aware screenshot capture and exact deduplication request. ↩

  37. Screenshot capture, idle and storage deduplication baseline. ↩

  38. Active-timer project mismatch detection and notification request. ↩

  39. Active-timer project mismatch baseline. ↩

  40. Desktop setup checklist and managed agent hooks request. ↩

  41. Desktop setup checklist and managed hooks baseline. ↩

  42. Desktop setup checklist and managed hooks implementation. ↩

  43. Private object-storage boundary request. ↩

  44. Public object-storage access baseline. ↩

  45. Aggregate input without key translation request. ↩

  46. Italian application localization request. ↩

  47. Web and Electron internationalization baseline. ↩

  48. Italian Admin and Electron localization completion evidence. ↩