# Future Roadmap

This document records planned or deferred work that is not part of the current
implementation. Current behavior is documented outside roadmap files in the
README, integration contracts, operations guide, troubleshooting guide, and
internal docs.

## Durability And Recovery

- Durable upload status persistence across process restarts.
- Durable idempotency records across server restarts.
- Database-backed upload queueing.
- Recovery semantics for queued or running uploads after a restart.
- Durable producer retry processing.

## Producer Client Workflows

- Durable client queues or background producer workers.
- `UploadAndWait` helper.
- Long-polling helper or equivalent wait workflow.

## Run Control APIs

- Run retry endpoints.
- Run cancellation endpoints.
- Run listing endpoints.

## Archive And Transport Protocols

- Zstandard-compressed tar archives.
- Additional content negotiation rules for future archive formats.
- Multipart upload support.
- Resumable upload support.
- Streaming upload protocols.

## Destination State Repair

- Unmanaged-file adoption workflow for destination state repair.
- Digest-audit mode for managed destination outputs.
- Explicit invalid-state repair workflow.
- Whole-config state repair command.

## Destination Retention And Pruning

- One-off retention overrides for `prune`.
- Automatic post-publish pruning.
- Path/date parsing retention policies.
- Group-level pruning by source publication.
- Removal of empty state files.

## Destination Backends

- GitHub Gist destination backend support.
- Authentication and secret handling for GitHub API tokens.
- Gist file mapping, update, replacement, and conflict semantics.
- Rate-limit handling and retry behavior for GitHub API responses.

## Docker Image Support

- Official container image build and release workflow.
- Runtime filesystem layout for config, secrets, staging, and local outputs.
- Container-oriented examples for `run` and `serve`.
- Image tagging, versioning, and upgrade guidance.

## Notifications And Hooks

- Email notification support for completed, failed, or partially failed
  distribution runs.
- SMTP configuration, authentication, secret handling, and recipient policy.
- ntfy notification support for completed, failed, or partially failed
  distribution runs.
- ntfy topic, server, token, priority, and action configuration.
- General post-distribution hook support.
- Hook payload contract that can pass run status, summaries, destination
  outcomes, output metadata, and public links to external tools.
- Local executable hook adapter with bounded arguments, environment, stdin,
  timeout, exit-code handling, and secret-redaction behavior.

## Authentication And Deployment Surface

- URL-token authentication for constrained clients.
- Additional token lifecycle tooling.
- Mutual TLS or other in-app identity mechanisms.
- In-app TLS.
- Public exposure defaults.
- In-app upload rate limiting.
- Browser UI.

## Boundaries

- `http_upload` remains source-only unless a future implementation changes that
  contract.
- Current upload status, queue, and idempotency state are memory-only.
- Producers submit complete tar or gzip-compressed tar source bundles today.
- Producers do not choose destination ids, destination paths, transforms, links,
  publish policy, transfer policy, storage backends, reconciliation mode, state
  mode, or retention policy through upload requests.
- Source manifests remain free of routing, destination, transform, credential,
  reconciliation, state, and retention data.
- Public access policy, TLS termination, and rate limiting belong outside
  `distributor` unless a future implementation changes that boundary.
- `distributor` is not a broad storage synchronization tool unless a future
  implementation explicitly changes that non-goal.