Roadmap

What's delivered and what's coming next to MicroCoreOS.

Delivered Milestones

✅ PyPI Package (microcoreos) — Install via pip install microcoreos or uv add microcoreos.
✅ Scaffolding CLI — microcoreos new my_app provisions a complete project with initial migrations and domain structure.
✅ Plan Inspector & Status — microcoreos status and microcoreos plan validate for offline validation.

✅ 100% Mutation Score — microcoreos/ core kernel logic has 0 survived mutants under mutmut.
✅ 83%+ Tool Test Coverage — Complete unit suites covering TelemetryTool (100%), RegistryTool (100%), StateTool (99%), EventBusTool (96%), ContextTool (92%), and HttpPipeline (85%).

✅ microcoreos[postgres] — Drop-in PostgreSQL Tool replacing SQLite with schema parity.
✅ microcoreos[redis] — Redis Tool for state caching and Redis Streams event bus.
✅ microcoreos[kafka] & microcoreos[rabbitmq] — Enterprise message brokers verified by 13 canonical parity tests.
✅ microcoreos[auth] — Pre-built JWT & Session Auth Tool with Anti-CSRF protection (X-Requested-With).

✅ Domain Isolation Linter — Prevents cross-domain imports at build/CI time.
✅ Event Contract Linter — Validates event publisher/subscriber payload compatibility.
✅ Table Ownership Linter — Enforces single-domain table write ownership.
✅ Route Collision Linter — Prevents duplicate HTTP route registrations.
✅ Field Divergence & Tool Doc Drift — Enforces schema alignment and prevents interface documentation drift.

✅ Unified Architecture CI Gate (microcoreos check) — Runs all 7 architecture linters offline in milliseconds using AST (discovery_naming, domain_isolation, event_contracts, field_divergence, route_collisions, table_ownership, tool_doc_drift) with --strict, --format=json, and --checker filters.
✅ HTTP Trusted Proxy Traversal — Explicit right-to-left traversal of X-Forwarded-For with CIDR and IP trust checking (HTTP_TRUSTED_PROXIES), wildcard * for local dev, and generic HTTP_CUSTOM_CLIENT_IP_HEADER for upstream CDNs (context.client_ip).
✅ WebSocket Origin Policy (CSWSH Guard) — Configurable WebSocket origin validation (HTTP_WS_ORIGIN_POLICY=off|allowlist, HTTP_WS_ORIGINS) closing unauthorized handshakes immediately with code 1008 (Policy Violation).
✅ Fail-Safe Tool Setup Teardown — Guaranteed cleanup and reverse-order shutdown() of acquired resources if any tool fails or is cancelled during setup(), preventing socket/connection leaks.
✅ Canonical Tool Signatures — Automatic inspection of raw tool public methods in AI_CONTEXT.md (**Public Signatures:**), keeping AI agents informed of exact method signatures and parameter types.
✅ Plan Pipeline CLI — Complete offline plan toolchain (microcoreos status, microcoreos plan validate, microcoreos plan sync, microcoreos plan probe, microcoreos migrate, microcoreos schema).

✅ Stand-Alone Bench Suite — 797 tests covering chaos injection, fault simulation, and crash recovery (kill -9).
✅ Soak Testing — Sustained traffic load monitoring memory leaks via tracemalloc.
✅ Stress-to-Knee Testing — Automated user ramp-up finding the exact breaking point where p99 latency or error rates breach thresholds.

Distributed Tracing Spans — Exporting OpenTelemetry trace context across gRPC and external HTTP service boundaries.
Event Schema Registry — Central schema registry for event payload deprecations.

WASM Plugin Runtime — Polyglot capabilities to execute WebAssembly plugins alongside Python plugins.