A working list of the ideas and features we still want. Items graduate into design records and code as they land — and finished items get deleted, not ticked. Git history remembers.
Six items closed before 1.0, each landing with its adversarial tests. The theme: what was consented is what runs.
Every plugin verb runs in the same bubblewrap jail as builds — read-only checkout, declared read-roots, network denied unless declared.
One chokepoint: every secrets realm must be a bare token before it joins the path. Traversal, absolute and separator realms fail closed.
A new or changed remote tap pin can't be accepted until its exact-revision manifest is cached — consent needs content.
Content hashes are recomputed and compared before a fetch result becomes ledger truth; a well-formed lie fails the whole fetch.
Path pins on remoted KBs refused; cached checkout cleanliness and binary digests verified before a built tap is reused.
Evidence loads lazily with declarative namespaces; changed-query previews are lazy and row-capped — a big proposal renders without executing anything.
Plugin taps · milestone 5 and hardening, plus the review surface at real scale.
A host-side HTTP CONNECT proxy so Allow([host…]) keeps a plugin in an isolated network namespace while enforcing the consented host/port allowlist. PID, CPU/memory, output and deadline limits in every network mode. Build-identity receipts that record source, lockfile, toolchain and binary digests and refuse a mutated cached binary.
Cache the decoded KB and title map by HEAD instead of rebuilding per request; make record-detail lookup O(1) in proposal size; move Git, diff and query work off the async workers with spawn_blocking.
A declarative RON-native Schema IR — kinds, fields, enums, storage paths, links — generating registry, validation, MCP schemas, forms and query proxies. Rust stays the escape hatch for cross-record invariants.
Generated field proxies and typed edge-follows; saved visual queries staged as proposals with repair diagnostics; backend escalation to Polars/DataFusion only when volume proves it's needed.
Recipe-scoped evaluations driven by proposal events; the full derivation chain in receipts; a backup story for the irreplaceable local source ledgers.
Cached accepted validator so daily data-only use needs no rustc; a schema-change impact report at review; cargo test on schema-touching proposals; a committed stable kb_id.
A settings page (appearance, density, date formats, default landing); facts filter with URL state; schema-page hover edges; responsive breakpoints; a multi-KB switcher.
Component-model validators remove the runtime Rust toolchain and OS sandbox entirely — the wasm runtime is the sandbox, identically on every platform. The strategic exit that unblocks macOS and trivial packaging.
Prebuilt artifacts over cargo install. Every package guarantees three runtime dependencies on the host — a Rust toolchain, bubblewrap, and git — until WASM validators collapse that.
On a version tag, CI cross-builds Linux (gnu + musl) and macOS binaries, plus a Homebrew formula and a curl | sh installer.
A tap repo ships bottles so brew install kyyn is instant. macOS support gated on the sandbox story below.
A hand-maintained kyyn-bin PKGBUILD repackages the release tarball, depending on bubblewrap, git and rust.
dist can emit .deb and .rpm; nixpkgs expresses the rust + bwrap + git runtime closure precisely. Deferred until there is demand.
No bwrap on macOS, so a Mac build would run unsandboxed — throwing away containment. macOS waits on a Seatbelt backend or, better, the WASM-validator direction that removes OS sandboxing entirely. We won't advertise macOS until one lands.