Roadmap

Offing H1 — Coverage & Proof · 2026-10-15 → 2027-04-15 · 21 phases, each its own milestone, run in order · project board

This file is generated from planning/roadmap/ by node planning/roadmap/roadmap-md.mjs. Edit the data, not this file. Scope changes still require an explicit decision recorded in docs/decisions/.

Direction

Offing's engineering is ahead of its data and its evidence. For the next six months the order is:

1. Content before new surfaces. Lifecycle rules are generated from authoritative machine-readable sources and reviewed, not hand-written one by one.
2. Independent proof. Accuracy is measured against ground truth Offing did not write: real migration commits, upstream changelogs, and differential testing.
3. Agent-native by default. Agents check dependencies as they add them, and every push can run Offing through hooks.
4. Standards, not a new format. Rules are keyed by PURL and VERS and exported as CLE (ECMA-428) and CycloneDX lifecycle data.
5. Grow inside existing workflows. Offing ships into pipelines people already run and launches once, on a release that works.

The long-term goal is for Offing to be the first lifecycle reference agents and DevOps teams reach for. This roadmap builds the foundation: open evidence, standard formats, and presence in every common pipeline.

Releases before v1

v1 is a compatibility promise, so it should rest on how real people use Offing. One release comes first (decision):

1. v0.8.0 — Adoption and visibility. Get Offing used, by developers and by agents: a clean package on external scorecards, a short README with demos, a first run that just works, setups for every common agent host and stack, organization-wide rollout, and five pilot users. Then get it known: contributors, one launch, open data, search, and proof.
2. v1.0 — Hardening. Phase 37: contract audit, compatibility guarantees, threat model, and performance budget.

Ideas for after v1 are tracked as epics in the After v1 — Future milestone and are not scheduled.

v1 targets

Measure	Today	Target
Ecosystems and platforms detected	4	25+ (12 stable, the rest experimental)
Lifecycle signals imported with evidence	0	3,000+
Curated rules with migration packets	15	300+
Symbol-level API deprecation rules	0	100+
Independent ground-truth corpus	20 repositories, self-defined	300 repositories, ground truth not authored by Offing
Precision per stable detector	1.0 against own rules	≥ 0.95 against independent ground truth
Data freshness	tied to package releases	≤ 7 days through a signed data channel
Distribution	npm, skills.sh	+ MCP Registry, GitHub Marketplace, GitLab Catalog, Docker, pre-commit, MegaLinter, VS Code, Claude, Codex
External contributors with merged PRs	0	15+

Phases

Each phase is a GitHub milestone. A phase starts when the previous one is complete, and no task depends on a later phase.

Phase	Window	Issues
Phase 20 — Ready for contributors and real data	2026-10-15 → 2026-11-15	71
Phase 21 — Fresh data and agent guardrails	2026-11-16 → 2026-12-15	61
Phase 21.5 — Release 0.2: ship what is built	2026-10-17 → 2026-10-31	26
Phase 22 — Backend, cloud, and Kubernetes coverage	2026-12-16 → 2027-01-15	95
Phase 23 — Standards and precise code analysis	2027-01-16 → 2027-02-15	60
Phase 24 — Community ecosystems and open data	2027-02-16 → 2027-03-15	71
Phase 25 — Offing v1	2027-03-16 → 2027-04-15	4
Phase 26 — Offing checks itself	2026-10-23 → 2026-11-12	6
Phase 27 — Trust and accuracy	2026-11-13 → 2026-12-03	11
Phase 28 — Data freshness	2026-12-04 → 2026-12-24	6
Phase 29 — Agent-native	2026-12-25 → 2027-01-14	8
Phase 30 — Personal use	2027-01-15 → 2027-02-04	11
Phase 31 — Forecast and planning	2027-02-05 → 2027-02-25	9
Phase 32 — Fix and automation	2027-02-26 → 2027-03-18	6
Phase 33 — Team and DevOps	2027-03-19 → 2027-04-08	17
Phase 34 — Editor and guard	2027-04-09 → 2027-04-29	6
Phase 35 — Coverage: cloud, OS, and runtimes	2027-04-30 → 2027-05-20	12
Phase 36 — Interop and standards	2027-05-21 → 2027-06-10	12
v0.8.0 — Adoption and visibility	2026-10-28 → 2027-01-26	171
Phase 37 — Offing v1 hardening	2027-01-27 → 2027-02-23	16
After v1 — Future	after v1, unscheduled	7

How work is organized

Every roadmap issue belongs to one phase milestone and is small enough for one pull request. Labels say who it suits:

Label	Meaning
lane: strong-agent	Codex or Claude (or an experienced contributor)
lane: free-agent	Freebuff, Kilo Code, or any contributor
lane: maintainer	Maintainer only (accounts, submissions, releases, outreach)
size: XS / S / M	Under an hour / a few hours / about a day
good first issue	A complete brief, isolated change, and fixtures — a good first contribution
type: epic	Tracking issue that lists its tasks

Pick any open task whose dependencies are closed. Each task includes an agent brief with files, steps, commands, and a done-check. See CONTRIBUTING.md.

Phase 20 — Ready for contributors and real data

2026-10-15 → 2026-11-15 · 68 tasks · milestone

When this phase is complete, Offing has:

• AGENTS.md, issue forms, PR template, CODEOWNERS, dev container, and a 30-minute first-contribution path
• Lifecycle rule format v2 keyed by PURL and VERS, with provenance and freshness; all bundled registries migrated
• SHA-pinned GitHub Actions classified instead of silently ignored
• Importer framework plus importers for Node.js, Python, npm, PyPI, GitHub Actions runtimes, and runner images
• Independent ground truth from real migration commits; 10 new GitHub Actions corpus repositories; weekly corpus runs
• Shared detector conformance suite run by every built-in detector
• CI on Linux, Windows, and macOS with Node 22 and 24; npm trusted publishing with provenance
• 40+ new curated npm, Python, and GitHub Actions rules; weekly adoption measurement

Epics

• Make the repository agent- and contributor-ready — Let four coding agents and new contributors work in parallel safely, one small issue per PR. (9 tasks)

• Lifecycle rule format v2 (PURL, VERS, provenance, freshness) — Key every lifecycle rule by PURL and VERS with auditable provenance so rules can be imported, exported as CLE, and checked for freshness. (16 tasks)

• Classify SHA-pinned GitHub Actions — Security-focused teams pin actions to commit SHAs; today those references are silently unclassified. Classify them deterministically. (5 tasks)

  Also in this phase, from epics listed in other phases:

  • Define the lifecycle importer interface
  • Add offline recording and replay for importer tests
  • Diff draft rules against the registry
  • Generate a reviewable PR body with an evidence table
  • Document how to write an importer
  • Importer: Node.js release schedule
  • Importer: Python release cycle
  • Importer: npm deprecated metadata for direct dependencies
  • Importer: PyPI project status markers (PEP 792)
  • Importer: GitHub Actions runtime deprecations (Node runtimes in action.yml)
  • Importer: GitHub-hosted runner image retirements
  • Add groundTruthSource to the validation corpus schema
  • Define migration-commit mining queries
  • Mine candidate migration commits into review files
  • Add a reviewed/rejected log for corpus candidates
  • Add 10 GitHub Actions repositories to the corpus
  • Schedule the pinned public-repository validation corpus
  • Build the detector conformance harness
  • Conformance check: determinism
  • Conformance check: locations
  • Conformance check: evidence
  • Conformance check: zero
  • Conformance check: malformed
  • Conformance check: bounds
  • Run every built-in detector through conformance
  • Export the conformance harness from the SDK
  • Run the core test suite on Windows
  • Add macOS to the CI matrix
  • Test on Node.js 24 in CI
  • Automate changelog and release notes
  • Add a release checklist
  • Add 10 curated npm package lifecycle rules (batch 1)
  • Add 10 curated npm package lifecycle rules (batch 2)
  • Add 10 curated Python package lifecycle rules (batch 1)
  • Add 10 curated Python package lifecycle rules (batch 2)
  • Add 10 curated GitHub Actions lifecycle rules (batch 1)
  • Add 10 curated GitHub Actions lifecycle rules (batch 2)
  • Measure adoption weekly without telemetry

Phase 21 — Fresh data and agent guardrails

2026-11-16 → 2026-12-15 · 57 tasks · milestone

When this phase is complete, Offing has:

• Signed lifecycle data bundle with offing data update and offing data status; scans stay offline
• Agent guardrail: offing check, the check_dependency MCP tool, and hooks for Claude Code and Codex, with setups for Cursor, Gemini CLI, Copilot, and Kilo Code
• MCP resources, prompts, and typed outputs; listing in the official MCP Registry; llms.txt
• offing init --agents --hooks with a git pre-push hook and a pre-commit hook
• SARIF output and GitHub Code Scanning upload
• Detector scaffolding generator; Go and container base-image detection
• Scheduled importers opening data PRs; differential testing against Renovate and xeol; 50-repository corpus

Epics

• Detector scaffolding generator — Reduce a new ecosystem detector to one command and a predictable, reviewable structure. (5 tasks)

• Richer MCP surface: resources, prompts, structured outputs — Expose rules and findings as MCP resources, migrations as prompts, and typed outputs for every tool. (5 tasks)

• SARIF and native CI reporting — Expose findings through code-scanning interfaces without losing the canonical JSON report. (5 tasks)

• Container base images lifecycle detection — Detect evidence-backed Container base images lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (10 tasks)

  Also in this phase, from epics listed in other phases:

  • Importer: endoflife.date adapter with mandatory vendor sources
  • Differential testing against Renovate deprecation output
  • Grow the independent corpus to 50 repositories
  • Separate checkout time from scan time in benchmark results
  • Add 10 curated npm package lifecycle rules (batch 3)
  • Add 10 curated npm package lifecycle rules (batch 4)
  • Add 10 curated Python package lifecycle rules (batch 3)
  • Define the lifecycle data bundle format
  • Build the data bundle in CI
  • Verify bundle signatures before loading
  • Add offing data update
  • Add offing data status
  • Pin a data bundle version in config
  • Guarantee offline behavior of scans
  • Show data age and stale warnings in all outputs
  • Document the data channel and trust model
  • Add the checkDependency core API
  • Add offing check <purl>
  • Add the check_dependency MCP tool
  • Claude Code hook: check dependencies an agent adds
  • Codex integration: check dependencies an agent adds
  • Evaluate guardrail triggering across agents
  • Add offing init --agents
  • Publish llms.txt and generated llms-full.txt
  • Improve npm and README discoverability metadata
  • Generate an EOL event calendar from the registry
  • Go: add positive, negative, zero-finding, and malformed fixtures
  • Go: parse go.mod with exact line locations
  • Go: parse go.work with exact line locations
  • Go: create the registry file and the first 5 curated rules
  • Go: import lifecycle signals from Go release support policy
  • Go: import lifecycle signals from // Deprecated: comments on direct modules

Phase 21.5 — Release 0.2: ship what is built

2026-10-17 → 2026-10-31 · 21 tasks · milestone

When this phase is complete, Offing has:

• Offing 0.2.0 on npm with trusted publishing, provenance, and a post-publish smoke test
• The first signed data bundle and the first scheduled importer run
• Agent host setups verified in live hosts; Offing listed in the official MCP Registry
• Bounded monorepo discovery, proven on monorepos in the public corpus
• Go detection wired and documented; a full corpus run on the current rules

Epics

• Cross-platform CI and safe release automation — Run on every supported platform and release without long-lived credentials. (9 tasks)

• Deepen JavaScript, Python, and GitHub Actions coverage — Grow the four shipped ecosystems from 15 rules to hundreds before expanding further. (12 tasks)

• Signed lifecycle data channel — Ship lifecycle data independently of code releases so freshness no longer depends on upgrading Offing. (10 tasks)

• Agent guardrail: check dependencies as agents add them — Coding agents often choose deprecated packages from training data. Check every dependency an agent adds, at the moment it adds it. (10 tasks)

• Go lifecycle detection — Detect evidence-backed Go lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks)

  Also in this phase, from epics listed in other phases:

  • Schedule importers to open data PRs
  • Run the full public corpus after the container and Go additions
  • Add server.json for the official MCP Registry
  • Publish Offing to the official MCP Registry

Phase 22 — Backend, cloud, and Kubernetes coverage

2026-12-16 → 2027-01-15 · 85 tasks · milestone

When this phase is complete, Offing has:

• Rust, Java and Kotlin, .NET, Kubernetes API, and serverless runtime (AWS Lambda, Azure Functions, Google Cloud) detection
• Polished one-step GitHub Action published in GitHub Marketplace; container image on GHCR; README badge
• Expiring, machine-readable suppression reasons
• Detector maturity levels and a generated coverage matrix; 100-repository corpus with regression thresholds
• Public reference page for every lifecycle rule, with JSON-LD and a sitemap
• Integrations: GitHub starter workflow, MegaLinter, reviewdog, and trunk

Epics

• Shared detector contract, conformance suite, and maturity levels — Apply one quality bar to every built-in and external detector, and expose detector maturity. (11 tasks)

• One-step GitHub Action and Marketplace — One Offing step after checkout with safe defaults, published in GitHub Marketplace. (6 tasks)

• Expiring, machine-readable suppression reasons — Prevent baselines from becoming permanent invisible debt. (5 tasks)

• More installation channels — Install Offing where people already work: container image and a README badge. (3 tasks)

• Canonical lifecycle reference pages — Make Offing evidence useful as a public reference before anyone installs the CLI. (4 tasks)

• Rust lifecycle detection — Detect evidence-backed Rust lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (12 tasks)

• Java and Kotlin (JVM) lifecycle detection — Detect evidence-backed Java and Kotlin (JVM) lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (13 tasks)

• .NET lifecycle detection — Detect evidence-backed .NET lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (13 tasks)

• Kubernetes APIs lifecycle detection — Detect evidence-backed Kubernetes APIs lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks)

• Serverless runtimes lifecycle detection — Detect evidence-backed Serverless runtimes lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks)

  Also in this phase, from epics listed in other phases:

  • Add the npm deprecations Renovate found to the importer candidates
  • Generate an ecosystem coverage matrix
  • Enforce per-detector regression thresholds
  • Emit reviewdog diagnostic format (rdjson)
  • Add "Scanned by Offing" attribution to Action summaries and badges

Phase 23 — Standards and precise code analysis

2027-01-16 → 2027-02-15 · 55 tasks · milestone

When this phase is complete, Offing has:

• tree-sitter usage analysis for JavaScript, TypeScript, and Python, replacing regex matching
• Symbol-level API deprecation rules for Node.js and Python
• CLE (ECMA-428) export, CycloneDX lifecycle enrichment, and CycloneDX/SPDX SBOM input
• Agent migration benchmark with published results
• Terraform and Android detection; community-led Dart/Flutter and Swift detection
• Lifecycle rules for Django, Angular, Vue, React Native, Next.js, and Spring Boot

Epics

• Parser-backed usage analysis and symbol-level rules — Replace regex usage analysis with tree-sitter (WASM, offline) and add API-level deprecation rules. (9 tasks)

• Terraform lifecycle detection — Detect evidence-backed Terraform lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks)

• Android lifecycle detection — Detect evidence-backed Android lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (9 tasks) (community-led; may slip without blocking v1)

• Dart and Flutter lifecycle detection — Detect evidence-backed Dart and Flutter lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks) (community-led; may slip without blocking v1)

• Swift and Apple toolchains lifecycle detection — Detect evidence-backed Swift and Apple toolchains lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks) (community-led; may slip without blocking v1)

  Also in this phase, from epics listed in other phases:

  • Django: curated lifecycle rules, fixtures, and migration packets
  • Angular: curated lifecycle rules, fixtures, and migration packets
  • Vue: curated lifecycle rules, fixtures, and migration packets
  • Next.js: curated lifecycle rules, fixtures, and migration packets

Phase 24 — Community ecosystems and open data

2027-02-16 → 2027-03-15 · 65 tasks · milestone

When this phase is complete, Offing has:

• Community-led PHP, Ruby, C/C++, Shell/PowerShell, database, and CI runner-image detection
• Lifecycle rules for Rails and Laravel
• GitLab CI/CD component published in the GitLab CI/CD Catalog
• Open lifecycle dataset with a static JSON API, and maintainer-declared lifecycle read from CLE files
• Public governance, RFC process, detector owners, and Code of Conduct
• VS Code extension with inline diagnostics

Epics

• PHP lifecycle detection — Detect evidence-backed PHP lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (12 tasks) (community-led; may slip without blocking v1)

• Ruby lifecycle detection — Detect evidence-backed Ruby lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (12 tasks) (community-led; may slip without blocking v1)

• C and C++ lifecycle detection — Detect evidence-backed C and C++ lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (10 tasks) (community-led; may slip without blocking v1)

• Shell and PowerShell lifecycle detection — Detect evidence-backed Shell and PowerShell lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (9 tasks) (community-led; may slip without blocking v1)

• Database runtimes lifecycle detection — Detect evidence-backed Database runtimes lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (10 tasks) (community-led; may slip without blocking v1)

• CI runner images (GitLab, CircleCI, Azure Pipelines) lifecycle detection — Detect evidence-backed CI runner images (GitLab, CircleCI, Azure Pipelines) lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (10 tasks) (community-led; may slip without blocking v1)

  Also in this phase, from epics listed in other phases:

  • Scaffold the VS Code extension
  • Show findings as diagnostics

Phase 25 — Offing v1

2027-03-16 → 2027-04-15 · 3 tasks · milestone

When this phase is complete, Offing has:

• Offing v1 with published compatibility guarantees and release notes
• Public accuracy and performance dashboard; 300-repository independent corpus
• Tested playbooks for CLI, agents, GitHub, and GitLab
• Threat model, parser fuzzing, SLSA provenance, and a 100k-file monorepo benchmark
• Persian README and quickstart
• Demo video, case studies, and the v1 launch

Epics

• Reproducible accuracy and performance dashboard — Make quality claims inspectable rather than promotional. (3 tasks)

Phase 26 — Offing checks itself

2026-10-23 → 2026-11-12 · 6 tasks · milestone

When this phase is complete, Offing has:

• Offing scans its own repository in CI and fails on new findings
• Its own Actions and dependencies are pinned and monitored with Offing
• Every self-scan finding is triaged, and the released CLI is smoke-tested on this repository

Epics

Also in this phase, from epics listed in other phases:

• Scan this repository with Offing in CI and fail on new findings
• Pin and monitor this repository's own GitHub Actions with Offing
• Run Offing as a pre-push hook in this repository
• Label self-scan findings and publish a monthly self-scan report
• Smoke-test the published CLI against this repository after every release
• Require agents working in this repository to check dependencies with Offing

Phase 27 — Trust and accuracy

2026-11-13 → 2026-12-03 · 10 tasks · milestone

When this phase is complete, Offing has:

• Detectors promoted from experimental to beta on measured recall and precision
• Independent corpus, differential testing, and a regression gate on every pull request
• Confidence levels, report-issue, and per-detector accuracy tables

Epics

• Independent ground truth and the public benchmark corpus — Make accuracy claims independent of Offing's own rule set: ground truth comes from real migration commits, upstream changelogs, CI failures, and differential testing. (22 tasks)

Phase 28 — Data freshness

2026-12-04 → 2026-12-24 · 5 tasks · milestone

When this phase is complete, Offing has:

• Scheduled end-of-life rules for Node.js, Python, Go, and PostgreSQL
• Importers that open reviewed rule PRs, and recorded future end-of-life dates
• Curated framework rules with migration packets

Epics

• Framework lifecycle coverage — Cover the frameworks teams actually upgrade: Django, Angular, Vue, React Native, Next.js, Spring Boot, Rails, Laravel. (20 tasks)

  Also in this phase, from epics listed in other phases:

  • Record announced future end-of-life dates

Phase 29 — Agent-native

2026-12-25 → 2027-01-14 · 8 tasks · milestone

When this phase is complete, Offing has:

• One-command setup that configures every agent host
• Compact, stable, machine-readable output with documented error codes
• A repository lifecycle status file agents can read, and one focused Skill per ecosystem

Epics

Also in this phase, from epics listed in other phases:

• Playbook: agent-driven migrations
• Add offing setup to configure every detected agent host in one command
• Write a lifecycle status file that agents can read
• Publish one focused Skill per ecosystem
• Add a local-only report of what agents checked and what was blocked
• Test and document that the MCP server never writes by default
• Define stable machine-readable error codes and exit codes
• Add a compact output mode sized for agent context windows

Phase 30 — Personal use

2027-01-15 → 2027-02-04 · 11 tasks · milestone

When this phase is complete, Offing has:

• Scan many projects at once, and check the tools installed on this machine
• A standalone binary, a friendly first run, a terminal browser, and an HTML report
• A global pre-push hook and a weekly digest for personal projects

Epics

Also in this phase, from epics listed in other phases:

• Install a git pre-push hook with offing init --hooks
• Playbook: manual CLI checks
• Scan several paths in one run with a combined summary
• Add offing doctor --system to check tools installed on this machine
• Ship a standalone binary that needs no Node.js
• Add offing watch and a weekly digest for personal projects
• Make the first run zero-config with a friendly summary
• Add an interactive terminal browser for findings
• Add offing init --personal for a global config and pre-push hook
• Add shell completions and examples to --help
• Add a single-file HTML report

Phase 31 — Forecast and planning

2027-02-05 → 2027-02-25 · 9 tasks · milestone

When this phase is complete, Offing has:

• offing forecast and --as-of show what becomes end of life next
• Upgrade paths, replacement compatibility checks, and a lifecycle risk score
• Transitive dependencies with the path that pulls them in, and an exposure timeline from git history

Epics

Also in this phase, from epics listed in other phases:

• Add offing forecast for what becomes end of life in the next 6 and 12 months
• Add --as-of <date> to scan as the world will look on a date
• Add an upgrade path planner with safe intermediate versions
• Add a lifecycle risk score from time since end of life, usage, and advisories
• Show how long a finding has been end of life using git history
• Check that a suggested replacement supports the repository's runtime
• Add --min-support-days to flag lines ending soon
• Report deprecated transitive dependencies with the path that pulls them in
• Track a lifecycle debt score over time

Phase 32 — Fix and automation

2027-02-26 → 2027-03-18 · 6 tasks · milestone

When this phase is complete, Offing has:

• offing fix --dry-run prints deterministic patches
• Fixers for Actions versions and runtime pins, and codemod packs for common replacements
• Verify-after-fix, and tested playbooks for CLI, agents, GitHub, and GitLab

Epics

Also in this phase, from epics listed in other phases:

• Add offing fix --dry-run to print patches for deterministic fixes
• Fix GitHub Actions references deterministically
• Fix runtime pins in .nvmrc, engines, and .python-version
• Add offing fix --branch to apply fixes on a local git branch
• Ship codemod packs for the most common package replacements
• Re-scan and run the migration's verification command after a fix

Phase 33 — Team and DevOps

2027-03-19 → 2027-04-08 · 16 tasks · milestone

When this phase is complete, Offing has:

• GitLab CI/CD component in the Catalog, with Code Quality reports
• Pre-commit, MegaLinter, trunk, and starter-workflow integrations
• Pull-request summaries, offing diff, owner routing, and scheduled lifecycle-watch workflows

Epics

• GitLab CI/CD component and Catalog — Give GitLab users the same scan, baseline, gate, and report workflow as GitHub users. (5 tasks)

  Also in this phase, from epics listed in other phases:

  • Ship a pre-commit framework hook
  • Playbook: GitHub Actions
  • Playbook: GitLab pipelines
  • Post one summary comment on pull requests
  • Add offing diff <base>..<head> to show findings a change introduced or fixed
  • Add a multi-repository rollup report for organizations
  • Route findings to owners through CODEOWNERS
  • Add Slack, Teams, and generic webhook output formats
  • Provide a scheduled workflow that opens an issue when an end-of-life date nears
  • Add a Markdown report format
  • Add a JUnit XML report format

Phase 34 — Editor and guard

2027-04-09 → 2027-04-29 · 5 tasks · milestone

When this phase is complete, Offing has:

• VS Code extension on the Marketplace and Open VSX
• A language server that shows lifecycle diagnostics in any editor, and a JetBrains plugin
• offing guard blocks end-of-life packages before npm, pip, or uv installs them

Epics

• VS Code extension — Show lifecycle findings inline in the editor using the local CLI. (7 tasks)

Phase 35 — Coverage: cloud, OS, and runtimes

2027-04-30 → 2027-05-20 · 12 tasks · milestone

When this phase is complete, Offing has:

• Scan built container images, kubectl dumps, Terraform plan JSON, and rendered Helm output
• Managed Kubernetes and Azure and Google Cloud database engines
• Elixir, Scala, Deno, and Bun detection, and runtime pins in Dockerfile RUN lines

Epics

Also in this phase, from epics listed in other phases:

• Judge managed Kubernetes versions in Terraform
• Judge OS distro base images in Dockerfiles
• Judge Helm chart and chart dependency deprecations
• Add an Elixir and Mix detector
• Add a Scala and sbt detector
• Add Deno and Bun runtime detection
• Judge Azure and Google Cloud database engine versions
• Scan a built container image or root filesystem
• Scan a kubectl get -o yaml dump
• Scan Terraform plan JSON
• Scan rendered Helm output
• Judge runtime pins in Dockerfile RUN lines and scripts

Phase 36 — Interop and standards

2027-05-21 → 2027-06-10 · 11 tasks · milestone

When this phase is complete, Offing has:

• CLE (ECMA-428) export and validation, CycloneDX enrichment, and CycloneDX and SPDX input
• Maintainer-declared lifecycle read from dependencies
• Renovate presets and OSV cross-reference for unpatched exposure

Epics

• Lifecycle standards: CLE (ECMA-428), CycloneDX, SPDX — Become the reference implementation of existing lifecycle standards rather than inventing a new one. (9 tasks)

  Also in this phase, from epics listed in other phases:

  • Read maintainer-declared CLE lifecycle from dependencies
  • Share implementation feedback with Ecma TC54 (CLE)

v0.8.0 — Adoption and visibility

2026-10-28 → 2027-01-26 · 152 tasks · milestone

When this phase is complete, Offing has:

• A clean npm package: no dependency alerts from a shipped fixture, provenance, and passing OpenSSF Scorecard and Best Practices checks
• The documentation site on Slipway with every existing URL preserved, and Offing scanning Slipway and the maintainer's other repositories
• A shorter README with reproducible demos a few seconds long
• A first run that works from the published package on Linux, macOS, and Windows
• Install paths and daily-loop setups for Claude Code, Codex, Cursor, Copilot, Windsurf, Cline, and Aider
• Starter kits for common stacks and an organization-wide rollout workflow
• Pipeline integrations people already run, and five pilot users with written feedback
• A five-minute contributor path, governance, and a steady supply of good first issues
• The launch kit, demo video, one launch, and recurring end-of-life posts
• The open lifecycle dataset, a public lookup page, and a "State of EOL" report
• Rule pages that rank in search, comparison pages, and listings where developers look
• Agent migration benchmark results and real migration case studies
• Monthly star, contributor, and repeat-use numbers from public signals only

Epics

• Auto-discoverability for agents and humans — Make Offing findable wherever agents and developers look: MCP Registry, llms.txt, agent instruction files, marketplaces. (18 tasks)
• Agent migration benchmark — Prove that Offing migration packets help agents complete real migrations. (7 tasks)
• Open lifecycle dataset and maintainer-declared lifecycle — Publish Offing's evidence as an open dataset and let maintainers declare lifecycle in their own repositories. (18 tasks)
• Governance, ownership, and community — Let Offing scale beyond one maintainer without weakening evidence standards. (9 tasks)
• Growth and distribution loops — Put Offing inside the pipelines and agent workflows people already run, and grow through one launch. (30 tasks)
• Launch and adoption — Turn each release into real usage through a strong demo, case studies, and community outreach. (8 tasks)
• Clean scores on external quality and security services — Developers check Socket, OpenSSF, Snyk, and deps.dev before they install a package. Offing should look as clean there as it is. (10 tasks)
• Documentation site on Slipway — Move GitHub Pages from jekyll-theme-minimal to Slipway, so both projects dogfood each other, without breaking a single published URL. (10 tasks)
• A short README with reproducible demos — A visitor understands what Offing does in ten seconds and sees it work in a few more. (9 tasks)
• First run that just works — A new user goes from npx to a useful, explained finding in under two minutes, from the published package, on any supported OS. (9 tasks)
• Offing in agents' daily loop — Coding agents check a dependency with Offing before they add it, in every popular agent host. (9 tasks)
• Starter kits for common stacks — A copy-paste setup for the stacks people actually use, each backed by a live example repository with green CI. (10 tasks)
• Organization-wide rollout — One person enables Offing once and every repository in their organization is covered. (7 tasks)
• Offing in the maintainer's other projects — Run Offing where the maintainer already works, so every finding there is product feedback. (7 tasks)
• Pilot users and the v0.8.0 release — Five outside developers try Offing on their own repositories, and what they hit is fixed before the launch. Pilots start after the v0.8.0 release. (6 tasks)
• Presence where developers look — Get Offing listed and referenced in the curated places developers browse for tools. (7 tasks)
• Public growth metrics — Measure stars, contributors, and repeat use from public signals only, and publish them monthly. (6 tasks)
• A steady supply of good first issues — There are always ten or more small, fully specified issues a newcomer can finish in an evening. (8 tasks)
• Found in search — People searching "is X end of life" land on Offing's rule pages and can check their repository in one command. (10 tasks)

Phase 37 — Offing v1 hardening

2027-01-27 → 2027-02-23 · 12 tasks · milestone

When this phase is complete, Offing has:

• Contract and surface audit, compatibility guarantees, and v1 release notes
• Threat model, parser fuzzing, bounded parser input, and reproducible builds
• An enforced performance budget on a large-monorepo benchmark

Epics

• Lifecycle data importers (automated, reviewed rule generation) — Replace hand-written rules with importers that read authoritative machine-readable sources and open reviewable PRs. (15 tasks)
• Offing v1 release readiness and launch — Ship a stable v1 whose contracts, quality evidence, distribution, and maintenance policy are ready for broad adoption. (5 tasks)
• Agent, developer, and DevOps playbooks — Give each audience a tested path from discovery to verified migration. (11 tasks)
• Security and performance hardening for v1 — Prove Offing is safe on untrusted repositories and fast on large monorepos. (12 tasks)

After v1 — Future

after v1, unscheduled · 0 tasks · milestone

When this phase is complete, Offing has:

• A local, in-browser playground, shareable outputs and badges, and better feedback capture
• A Rule-a-thon contribution event, talks and podcasts, standards and upstream presence, and translated docs

Epics

• Local in-browser playground — Try Offing without installing anything: the scan runs in the browser and nothing is uploaded. (0 tasks)
• Outputs people share — Every user can show Offing to others. (0 tasks)
• Less friction, more feedback — Every time a user gets stuck, the project learns about it and fixes it. (0 tasks)
• Rule-a-thon contribution event — A two-week event where contributors add rules and fixtures. (0 tasks)
• Talks, podcasts, and meetups — Present Offing to real audiences. (0 tasks)
• Standards and upstream presence — Credibility through work with established projects. (0 tasks)
• Homebrew in homebrew-core — brew install offing with no tap. Start when the project meets homebrew-core's notability bar for a self-submitted formula (about 75 stars, 30 forks, 30 watchers and a repository older than 30 days; check the current Acceptable Formulae page first) and has a stable release. The formula installs the npm tarball, so it needs a brew test and an audit --new --strict pass. There is no tap and no deploy key before then. (0 tasks)
• Multilingual reach — Reach large non-English developer communities, with native-speaker review. (0 tasks)

Not in this roadmap

• A hosted service, accounts, or dashboards that require uploading source code.
• Telemetry in the core (see the privacy ADR in M6; any opt-in design is post-v1).
• Vulnerability scanning or CVE remediation.
• Lifecycle claims without an authoritative, versioned source.

Earlier roadmaps

• Three-month launch roadmap (completed)
• Post-launch notes