Milestones
List view
The first release where a model can influence output. Everything here is opt-in, offline-by-default, and advisory — never load-bearing on an exit code.
No due date•2/2 issues closedMake Flecto the cheap, structured way an agent reads config change. MCP server, measured context savings, editor surface. No model inference in this release.
No due date•5/5 issues closedMake Flecto adoptable on repositories that already have findings, and pay down the debt 3.0 shipped with. **The adoption problem.** Turning Flecto on in an existing repo today means a wall of findings and no way to say "we know, not now" except silencing a rule globally with `severityRemap` — which also silences the next real occurrence. Every durable policy tool solves this with a baseline and per-finding suppressions. Without them, teams either don't adopt or turn the gate off, and a gate that is off protects nothing. **The hardening problem.** 3.0 shipped a critical RCE (GHSA-wq8m-fc3q-8m5x, fixed in 3.0.1), and the security review that would have caught more of that class never finished. Several 3.0 features have also never been exercised against the real thing they integrate with. Themes: - **Adoption** — baseline/ratchet, inline suppressions, SARIF for code scanning - **Hardening** — finish the security review, close the known leaks - **Verification** — exercise what shipped against real tools rather than fixtures
No due date•17/18 issues closedAdditive, no envelope break. Closes two detection gaps found in src/policy.js and src/renderer.js (secret matching is key-name-only), and adds the distribution mechanics — chat alerts, a PR-comment CI format, shareable packs — that turn a good CLI into one people actually install. See roadmap discussion for full rationale.
No due date•7/7 issues closedFills in the three original discussion bullets with scoped work. Stays local-first — no hosted backend anywhere in this milestone. Depends on v2.3 (#4) landing first: multi-doc YAML and the pr-comment format are reused here, not rebuilt. - Terraform plan semantic diff + terraform policy pack — the niche driftctl left open when it went into maintenance mode - Reusable org-wide PR-risk Action, built on v2.3's pr-comment format - flecto report — local static HTML drift report (answers "team-oriented drift views, still local-first") - Pre-merge Helm/Kustomize values diffing - SOPS/age-aware diffing (structural diff without decrypting) - Large-repo performance benchmark spike — evaluate a compiled differ core only with evidence
No due date•6/6 issues closedGrow the policy surface without breaking the 2.x envelope. **Packs & Action** - Additional built-in packs by stack/environment (#8) - Optional GitHub Action wrapper for `flecto ci` (#9) **Rule engine** - Richer declarative predicates (`beforeEquals`, `afterIn`, `numericDelta`, composition) (#34) - JSON Schema + load-time pack validation (#36) - Per-profile severity remapping without forking packs (#39) **Authoring DX** - Plugin cookbook + shared fixtures (#35) - builds on v2.1 #32 baseline docs - Pack/plugin fixture test harness (#38) - `flecto policies list` discovery (#37) Depends on v2.1 hardening (#23, #25, #28, #32) landing first where noted.
No due date•8/8 issues closed