Roadmap

What's actually in the tree today — not aspirations. Statuses match the 📋/🚧/✅ convention used throughout the docs.

✅ Shipped

App CRD (cd.wardn.space/v1alpha1) — source union, destination, syncPolicy, operation contract
Git source — shallow clone + render Raw/Kustomize/Auto
Image source — registry-driven deploys with tag policies (Pin/Follow), registryRef, pullSecretRef
Server-side apply (wardn-operator field manager, forced) + label-driven prune
Health checks — Deployment/StatefulSet/DaemonSet/Job/Pod + aggregate
Multi-cluster — destination.cluster resolves kubeconfigs from the server at reconcile
Operations — spec.operation contract (Sync/Deploy/Rollback/Restart/Approve) + operationState
Approval gates — requiresApproval stages changes as Held; POST /approve releases
Freeze — spec.freeze skips all applies
GitHub webhook receiver — patches Sync ops on matching apps
Slack notifications on sync success/failure

REST API — apps, teams, clusters, audit, secret-stores, registries, webhooks, incidents, remediations
Better Auth session validation + wrd_ API keys with role/scope ceilings
Org + scoped role bindings (role_bindings — org/cluster/deployment × admin/sync/read)
POST /auth/can-i permission checks; MCP JSON-RPC endpoint with per-key tool scoping
Audit log; tag poller (WARDN_TAG_POLL_INTERVAL); incident webhooks (HMAC-signed outbound)
Sealed credentials — kubeconfigs and store secrets → enc:v1: AES-256-GCM
Cluster shell pods — POST /clusters/{name}/shell with view/admin SA pick
POST /apps/preview (image-source digest resolution)

Platform app — apps dashboard, app detail (status/resources/ops), cluster + store + registry + webhook + team management
Org/team flows via Better Auth; API token management
Agents → Remediations approval queue
Cluster terminal (shell pods)

Feature	State
GitHub webhooks	Push works; `X-Hub-Signature-256` not verified, no rate limit
GitLab webhooks	Endpoint accepts `200`, parses nothing
Health checks	5 kinds have logic; ExternalSecret/Ingress/CRDs default to `Healthy`
CLI	`clusters`/`status`/`can-i`/`mcp`/`whoami`/`version` — no `app`/`cluster`/`deployment` write commands
Secrets	`env.store` works on image sources; SOPS store exists without decrypt-at-apply; vault fetch is image-env only
Notifications	Slack only; `onHealthDegraded` unwired
ESO health	`ExternalSecret` objects get default `Healthy`, no condition parsing

Webhook signature validation + rate limiting
GitLab push parsing
Additional notification channels (Teams, Email, Discord, generic webhook) + templates + onHealthDegraded
SOPS decrypt-at-apply; KMS/GCP/PGP/vault-transit providers
Kind-aware health — ExternalSecret Ready conditions, CRDs, custom checks
Custom wardn_* Prometheus metrics
ArgoCD → App migration tooling; ApplicationSets
OIDC group → org-role mapping

Semantic Versioning — 0.x: CRD/API schemas may change between minors. Pin versions in production; read release notes before upgrading.