Roadmap: follow the APM Project

[Daniel Meppiel (danielmeppiel)]

Roadmap

The active roadmap is the APM Project, with issue-backed Now / Next / Later priorities. Release planning uses issue milestones. Roadmap placement is not implementation approval or a delivery guarantee; scope and review contacts remain on the issues.

See Governance for the planning cadence and contribution rules.

This discussion is closed and retained only as a pointer. It does not maintain a separate roadmap.

[Oren Me (OrenMe)]

This looks awesome!
How does this compare to the new plugin marketplace? I see there are many things here that improve workflows but there is some ambiguity

Would love to hear your thoughts

[Daniel Meppiel (danielmeppiel)]

Oren Me (@OrenMe) My point of view is that the plugin reference is a packaging standard. To APM that's just another packaging format for agent primitives. Current thinking is that "apm install" should work with plugins too, and add them as dependencies in the manifest.

[Oren Me (OrenMe)]

Thanks for the explanation Daniel Meppiel (@danielmeppiel)
Makes a lot of sense although I assume it will be challenging to support multiple packaging formats

I really love this project challenge - I see strange governance models hacks emerging due to lack of such a tool
Example:

1. Creating single repo with all tools and pulling it as git sub module - and then needing to re wire the path settings cause it is not standard for copilot in vscode and cli
2. Creating single repo with all tools and then creating a vscode workspace and pulling there the products/apps repos and the tools repo and then re wiring the copilot paths as well - and this is even worse IMO then option 1 cause the workspace config cannot be git managed

So this project really allows governance, distribution and versioning management

[Daniel Meppiel (danielmeppiel)]

Roadmap refreshed — 19th March 2026

Major update to reflect where APM stands today after six releases (v0.7.7 → v0.8.2):

Now: Org-level policy engine (apm audit --ci --policy), multi-org authorization, security hardening.

New in Next (shaped by community feedback): semver pin ranges, auto-install on clone, auto-create target directories, container image distribution.

Recently shipped: Cursor + OpenCode native integration, content security scanning with Glassworm detection, diff-aware install, Windows native support, JFrog Artifactory, and more — see the updated list above.

As always, 👍 issues to signal demand. New ideas welcome as Issues.

[Sridhar Ratnakumar (srid)]

• Auto-install on clone — post-clone hook / git template integration
• Auto-create target directories on install (.cursor/, .opencode/, etc.)

I'd love to read more about this. Is there an issue or PR I can look at?

I maintain a custom justfile for this, but it'd be nice if there was single CLI I can use to get going.

---

Also a related question: is it recommended to vendor generated (.claude/, etc.) files in Git alongside the apm single-source-of-truth?

[Daniel Meppiel (danielmeppiel)]

Roadmap now organized around three mega-themes

The roadmap above has been refactored to match the three promises from the README:

• Portable by manifest -- multi-target deploy, marketplace federation, packaging, install channels
• Secure by default -- content scanning, lockfile integrity, MCP trust boundaries
• Governed by policy -- apm-policy, audit, enterprise rollout, air-gapped story

Same items, same links, sharper grouping. No roadmap content was dropped.

Alongside the rewrite, issue and PR labels are migrating to a five-axis taxonomy: theme/<portability|security|governance>, area/<surface>, type/<kind>, status/<state>, priority/<level>. Old single-word labels (security, policy, marketplace, cli, ...) are kept as deprecated redirects for 30 days, then removed in milestone 0.10.0. New filters that compose cleanly:

• is:open label:"good first issue" label:theme/portability -- contributor on-ramp by theme
• is:open label:theme/security label:priority/high -- what to ship next on the security side
• is:open label:theme/governance label:area/audit-policy -- where policy work is happening

This refactor went through the apm-review-panel (Python Architect, DevX UX Expert, Supply Chain Security Expert, OSS Growth Hacker, APM CEO; CLI Logging Expert recorded as not applicable for a non-code change). Full panel verdict on the orchestrating issue.

Feedback welcome -- if a roadmap item feels mis-themed or a label is missing, comment here or open an issue.

[Daniel Meppiel (danielmeppiel)]

Tracked end-to-end under epic #916 -- includes the label taxonomy, this discussion refactor, the apm-triage-panel skill PR #915, and the 10-issue live triage cohort. Read it for the full what/why/how, before/after for triagers + roadmap readers + maintainers, and the explicit out-of-scope list.