newOS4 Roadmap
Updated 2026-07-05 · 5 sprints · 1 SHIPPED · 4 PLANNED
📑 Sprints
Sprint 1 — v4.5.96 SHIPPED
Completed 2026-07-05 · 2 review sessions · Browser-verified
Scope
- Fix 8 OrchestratorModule bugs (agent spawn leak, retry loop, lease race, etc.)
- Fix 10 ShellModule bugs (parser, pipes, redirects, security gate)
- Add 7 cross-cutting rules (R1–R7) to program specs
- Create
module-code-review skill
Changelog
- ✅ BUG-001 → BUG-018 all FIXED
- ✅ ShellModule promoted to Tier 2 with full spec
- ✅ Browser-verified at 375px (mobile) and 1280px (desktop)
- ✅ Reviewer (kimi-k2.7-coder) signed off
Velocity
~12 turns per 8-bug batch. ~1.5 turns/item.
Sprint 2 — v4.5.97 NEXT
Target: 2026-07-12 · 1 week · Backlog cleanup + critical re-patch
Scope
- P0 Re-apply LeaseModule
canExecute() gate + boot-time assert
- P0 Fix VaultMind init race with Hyperliquid key
- P1 Fix
list_files loop threshold (currently 100K iter crash)
- P1 Fix
reload_module infinite loop guard
- P1 Fix
run_command timeout kill (orphaned procs)
- P1 ShellModule: cleanup
__pipebuf__ after pipe completion
- P1 ShellModule:
$VAR substitution — sanitize env values
- P2 VFS:
.trash dir auto-prune (TTL 7d)
- P2 Cron: restore 5 missing jobs
Acceptance
- All P0s closed with boot-time self-test
- No
__pipebuf__ files in VFS root after test suite
- Cron jobs survive module reload
Sprint 3 — v4.5.98 PLANNED
Target: 2026-07-19 · Observability + Predictor
- Add
get_usage_stats() per-model breakdown (already in API, wire to UI)
- Add
predict_task() to terminal precmd hook
- Token-budget guardrail (warn at 80%, hard-stop at 95%)
- Dashboard page: real-time token rate, model latency, error rate
- Session terminal scrollback (last 200 turns)
Sprint 4 — v4.5.99 PLANNED
Target: 2026-07-26 · Security Hardening
- S4.1 Backup mechanism for
/_mods/ (currently destructive edits are unrecoverable)
- S4.2 SecretVault: encrypt-at-rest with derived key from
os_key
- S4.3 Audit log: all destructive commands (rm, edit, kill) recorded with hash chain
- S4.4 Permission model: per-module capability tokens (replaces global
canExecute)
- S4.5 Loop detection: token-usage anomaly auto-save (lesson from loop-lesson-1783274464602)
Sprint 5 — v4.6.0 PLANNED
Target: 2026-08-02 · Major · Agent activation + Memory expansion
- A.1 Wake up all 3 system agents (coder, researcher, reviewer) for live task delegation
- A.2 Memory graph: expand to 200+ nodes, add edge-weight scoring
- A.3 WorldModel self-query: agent asks "what changed?" before action
- A.4 VaultMind: production mainnet connection (tested in v4.5.99)
- A.5 Module hot-reload without session drop
Sprint Velocity
| Sprint | Bugs | Turns | Turns/Item | Outcome |
|---|
| v4.5.95 (prev) | 11 | 18 | 1.6 | SHIPPED |
| v4.5.96 (current) | 18 | 22 | 1.2 | SHIPPED ✅ |
| v4.5.97 (target) | 9 | 15 | 1.7 | NEXT |
| v4.5.98 (target) | 5 | 12 | 2.4 | PLANNED |
Velocity improving (1.6 → 1.2 turns/item) thanks to module-code-review skill and reviewer delegation pattern.
Risk Register
| ID | Risk | Likelihood | Impact | Mitigation |
|---|
| R-001 | /_mods/ destructive edit unrecoverable | Medium | High | Sprint 4.1: backup mechanism |
| R-002 | LeaseModule canExecute() not enforced (P0) | High | Critical | Sprint 2: re-apply with boot assert |
| R-003 | Agent loop anomaly (94K tokens, no abort) | Medium | High | Sprint 4.5: token-usage auto-save |
| R-004 | VaultMind init race exposes keys | Low | Critical | Sprint 2: race fix + S4.2 encryption |
| R-005 | ShellModule $VAR injection | Medium | High | Sprint 2: env value sanitization |
| R-006 | Memory graph context loss on restart | Low | Medium | Sprint 5.2: persistent graph store |
KPI Targets
| Metric | v4.5.95 | v4.5.96 | v4.5.97 | v4.6.0 |
|---|
| Open P0 bugs | 4 | 0 | 0 | 0 |
| Open P1 bugs | 7 | 0 | 0 | 0 |
| Open P2 bugs | 3 | 0 | 0 | 0 |
| Modules | 44 | 45 | 45 | 48 |
| Skills | 39 | 40 | 41 | 45 |
| System agents | 3 | 3 | 3 | 3 (active) |
| Memory graph nodes | 32 | 50 | 75 | 200 |
| Avg session turns | 18 | 22 | 15 | 12 |
| Token/bug fix | 8.5K | 5.2K | 4.0K | 3.0K |
| Loop anomalies / wk | 2 | 1 | 0 | 0 |
| Cron jobs running | 0 | 0 | 5 | 8 |
| Backups | 0 | 0 | 0 | 7 daily |
Roadmap owned by you. Edit /system/roadmap.md or this HTML. Both stay in sync.