Roadmap

Pegma ships component by component, each through its own phased plan, each gated by real consumers rather than dates. This page is the aggregate view.

Status lines below are compiled at build time (2026-09-07) from each repository's public docs/PROJECT_PLAN.md — 14 of 16 components carry a plan; the rest (and any fetch miss) fall back to a hand-written snapshot dated 2026-08-15. The repos win any disagreement.

Where things stand

Component	Status	Now
Spine	published	0.1.2 on npm; deliberately close to frozen.
Storage Core	published	0.4.0 on npm with the Azure Tables (0.4.0) and Cloudflare D1 (0.4.1) adapters; both adapters pass the same conformance suite.
Storage Blobs	published	Phase 6 complete. @pegma/[email protected] and the Azure Blob, Cloudflare R2, and S3 adapters publish at the same version with trusted-publisher provenance from signed annotated release tags. 0.2.0 adds an optional cacheControl on put, stored as native object state by every first-class backend and returned by head/get.
Cache Core	published	Phase 5 — Upstash Redis adapter, published 0.1.1. @pegma/cache-core, @pegma/cache-conformance, @pegma/cache-redis, @pegma/cache-azure-redis, @pegma/cache-elasticache, and @pegma/cache-upstash-redis are published at 0.1.1. The 0.x API is unstable.
Authorization Core	published	Phase 5 complete; Phase 6 integration feedback and stabilization next (the signed v0.1.0 release published the original seven packages through OIDC with provenance on 2026-07-27; synchronized v0.1.2 corrects the pre-publish v0.1.1 release-test failure and first advertises Identity as the eighth package; synchronized v0.1.3 resolves the 2026-07-29 security review; synchronized v0.1.4 first advertises Entra as the ninth package; synchronized v0.2.0 aligns @pegma/storage-core at 0.4.0 across the stack; synchronized v0.3.0 delivers the identity-link write and lifecycle listing from the first reference-consumer feedback; synchronized v0.4.0 is prepared, first advertising the Admin role-administration service as the tenth package; 0.x public API remains unstable)
Audit	published	Phase 1 complete; awaiting the first real consumer (0.1.1 published, public API unstable; 0.2.0 is prepared, aligning @pegma/storage-core at 0.4.0 across the stack)
Support Desk	published	The customer-facing Phase 1/2 application slice, staff detail and mutation services (Buildout Task 4), the staff queue repairable projection (Buildout Task 5), the host-neutral release candidate (Buildout Task 6), and the source portion of Phase 6 are implemented. Buildout Tasks 1–6 are complete; the exact 0.1.0 package set was published to the public npm registry on 2026-07-29 and released as the signed v0.1.0 tag. The 0.1.1 set is prepared, aligning @pegma/audit at 0.2.0, @pegma/authorization-core at 0.2.0, and @pegma/mail at 0.1.1 so the dependency tree resolves a single @pegma/[email protected]. Host deployments (Buildout Tasks 7–8) are unblocked.
Webhooks	published	Phases 1 through 4 are complete. @pegma/[email protected] is published from the protected signed v0.1.1 release through npm trusted-publisher OIDC with provenance (0.x, public API unstable)
Sessions	published	Phases 1–4 are complete. @pegma/[email protected] is published; RetireGolden is the first integrated consumer and pegma.dev is the second, live consumer. 0.2.0 is prepared, aligning @pegma/storage-core at 0.4.0 across the stack. The public API remains unstable.
Mail	published	Phases 1–3 are complete. @pegma/[email protected] is published and is composed by both Identity and Support Desk. The public API remains unstable.
Billing Core	published	Phase 4 — Stripe adapter in-tree. @pegma/billing-core and @pegma/billing-stripe are published at 0.1.1. The 0.x API is unstable. Phase 5 stays soak-gated.
Identity	published	Phases 1–4 are complete. @pegma/[email protected] is published and live in pegma.dev with @pegma/[email protected]. The public API remains unstable. 0.1.2 is prepared, aligning @pegma/rate-limit at 0.2.0 and @pegma/mail at 0.1.1 so the dependency tree resolves a single @pegma/[email protected]. 0.1.1 was a documentation-only patch over 0.1.0 that closed the operator-guidance findings from the 2026-07-28 security scan; it changed no runtime behavior and no public API.
Rate Limit	published	Phases 1, 2, and 4 are complete; Phase 3 has its first production consumer. @pegma/[email protected] is published, and pegma.dev composes the durable tier for its Identity surface. 0.2.0 is prepared, aligning @pegma/storage-core at 0.4.0 across the stack. The public API remains unstable.
Flags Core	published	Published 0.1.1 (2026-08-15). Public API unstable (0.x).
Logger Adapters	published	0.1.3 on npm (tee, Application Insights, Cloudflare, Datadog); trusted publishing configured; OIDC publish workflow in-repo. Public API unstable. Host tee wiring on RetireGolden and pegma.dev is the remaining consumer bar.
Health	published	0.1.2 on npm; trusted publishing configured. 0.2.0 is prepared, aligning @pegma/storage-core at 0.4.0 across the stack. Public API unstable.

What gates what

The dependencies that actually pace the work — none of them are dates:

Authorization Core → its consumers. Its public 0.x packages now exist, and this reference application composes the Identity claims adapter with first-party Identity and Sessions. Broader consumer migrations still determine when those contracts are stable enough for 1.0.
Webhooks is released; evidence continues. The signed 0.1.0 release follows real Stripe use in RetireGolden and GitHub release ingestion on this Cloudflare/D1 host. Same-host multi-source operation and additional provider-driven quarantine behavior remain post-release evidence, not stronger delivery guarantees.
Consumers pull components into existence. Support Desk supplied the first durable mail consumer; Identity supplied the second, triggering Mail's extraction and public release. Identity also pulled Rate Limit into production composition instead of leaving it as a speculative utility.
This site is a gate of its own. pegma.dev deploys on Cloudflare and now runs a real Identity consumer over the Cloudflare D1 adapter, which passes the same conformance suite as the Azure adapter. Two clouds, one suite — that is the portability claim, tested.

What 1.0 means

Nothing reaches 1.0 on ambition. The ecosystem rule is that breaking changes stay permitted until multiple real consumers complete adoption — a component earns stability by being used, not by being finished. Until then, every package is honestly 0.x.