Roadmap

Evergreen H1 — Coverage & Proof · 2026-10-15 → 2027-04-15 · six phases, each its own milestone, run in order · project board

This file is generated from planning/roadmap/ by node planning/roadmap/roadmap-md.mjs. Edit the data, not this file. Scope changes still require an explicit decision recorded in docs/decisions/.

Direction

Evergreen’s engineering is ahead of its data and its evidence. For the next six months the order is:

1. Content before new surfaces. Lifecycle rules are generated from authoritative machine-readable sources and reviewed, not hand-written one by one.
2. Independent proof. Accuracy is measured against ground truth Evergreen did not write: real migration commits, upstream changelogs, and differential testing.
3. Agent-native by default. Agents check dependencies as they add them, and every push can run Evergreen through hooks.
4. Standards, not a new format. Rules are keyed by PURL and VERS and exported as CLE (ECMA-428) and CycloneDX lifecycle data.
5. Grow inside existing workflows. Evergreen ships into pipelines people already run and launches every phase, not once.

The long-term goal is for Evergreen to be the first lifecycle reference agents and DevOps teams reach for. This roadmap builds the foundation: open evidence, standard formats, and presence in every common pipeline.

v1 targets (2027-04-15)

Measure	Today	Target
Ecosystems and platforms detected	4	25+ (12 stable, the rest experimental)
Lifecycle signals imported with evidence	0	3,000+
Curated rules with migration packets	15	300+
Symbol-level API deprecation rules	0	100+
Independent ground-truth corpus	20 repositories, self-defined	300 repositories, ground truth not authored by Evergreen
Precision per stable detector	1.0 against own rules	≥ 0.95 against independent ground truth
Data freshness	tied to package releases	≤ 7 days through a signed data channel
Distribution	npm, skills.sh	+ MCP Registry, GitHub Marketplace, GitLab Catalog, Docker, Homebrew, pre-commit, MegaLinter, VS Code, Claude, Codex
External contributors with merged PRs	0	15+

Phases

Each phase is a GitHub milestone. A phase starts when the previous one is complete, and no task depends on a later phase.

Phase	Window	Issues
Phase 20 — Ready for contributors and real data	2026-10-15 → 2026-11-15	81
Phase 21 — Fresh data and agent guardrails	2026-11-16 → 2026-12-15	86
Phase 22 — Backend, cloud, and Kubernetes coverage	2026-12-16 → 2027-01-15	100
Phase 23 — Standards and precise code analysis	2027-01-16 → 2027-02-15	78
Phase 24 — Community ecosystems and open data	2027-02-16 → 2027-03-15	98
Phase 25 — Evergreen v1	2027-03-16 → 2027-04-15	30

How work is organized

Every roadmap issue belongs to one phase milestone and is small enough for one pull request. Labels say who it suits:

Label	Meaning
lane: strong-agent	Codex or Claude (or an experienced contributor)
lane: free-agent	Freebuff, Kilo Code, or any contributor
lane: maintainer	Maintainer only (accounts, submissions, releases, outreach)
size: XS / S / M	Under an hour / a few hours / about a day
good first issue	A complete brief, isolated change, and fixtures — a good first contribution
type: epic	Tracking issue that lists its tasks

Pick any open task whose dependencies are closed. Each task includes an agent brief with files, steps, commands, and a done-check. See CONTRIBUTING.md.

Phase 20 — Ready for contributors and real data

2026-10-15 → 2026-11-15 · 72 tasks · milestone

When this phase is complete, Evergreen has:

• AGENTS.md, issue forms, PR template, CODEOWNERS, dev container, and a 30-minute first-contribution path
• Lifecycle rule format v2 keyed by PURL and VERS, with provenance and freshness; all bundled registries migrated
• SHA-pinned GitHub Actions classified instead of silently ignored
• Importer framework plus importers for Node.js, Python, npm, PyPI, GitHub Actions runtimes, and runner images
• Independent ground truth from real migration commits; 10 new GitHub Actions corpus repositories; weekly corpus runs
• Shared detector conformance suite run by every built-in detector
• CI on Linux, Windows, and macOS with Node 22 and 24; npm trusted publishing with provenance
• 40+ new curated npm, Python, and GitHub Actions rules; weekly adoption measurement

Epics

• Make the repository agent- and contributor-ready — Let four coding agents and new contributors work in parallel safely, one small issue per PR. (9 tasks)
• Lifecycle rule format v2 (PURL, VERS, provenance, freshness) — Key every lifecycle rule by PURL and VERS with auditable provenance so rules can be imported, exported as CLE, and checked for freshness. (16 tasks)
• Classify SHA-pinned GitHub Actions — Security-focused teams pin actions to commit SHAs; today those references are silently unclassified. Classify them deterministically. (5 tasks)
• Lifecycle data importers (automated, reviewed rule generation) — Replace hand-written rules with importers that read authoritative machine-readable sources and open reviewable PRs. (13 tasks)
• Independent ground truth and the public benchmark corpus — Make accuracy claims independent of Evergreen’s own rule set: ground truth comes from real migration commits, upstream changelogs, CI failures, and differential testing. (16 tasks)
• Shared detector contract, conformance suite, and maturity levels — Apply one quality bar to every built-in and external detector, and expose detector maturity. (11 tasks)
• Cross-platform CI and safe release automation — Run on every supported platform and release without long-lived credentials. (7 tasks)
• Deepen JavaScript, Python, and GitHub Actions coverage — Grow the four shipped ecosystems from 15 rules to hundreds before expanding further. (10 tasks)

• Growth and distribution loops — Put Evergreen inside the pipelines and agent workflows people already run, and grow through predictable launch moments instead of one launch at the end. (18 tasks)

  Also in this phase, from epics listed in other phases:

  • Package and publish the Evergreen plugin for Claude
  • Prepare and submit the Evergreen Codex plugin for public distribution

Phase 21 — Fresh data and agent guardrails

2026-11-16 → 2026-12-15 · 78 tasks · milestone

When this phase is complete, Evergreen has:

• Signed lifecycle data bundle with evergreen data update and evergreen data status; scans stay offline
• Agent guardrail: evergreen check, the check_dependency MCP tool, and hooks for Claude Code and Codex, with setups for Cursor, Gemini CLI, Copilot, and Kilo Code
• MCP resources, prompts, and typed outputs; listing in the official MCP Registry; llms.txt
• evergreen init --agents --hooks with a git pre-push hook and a pre-commit hook
• SARIF output and GitHub Code Scanning upload
• Detector scaffolding generator; Go and container base-image detection
• Scheduled importers opening data PRs; differential testing against Renovate and xeol; 50-repository corpus
• First public launch: the agent dependency guardrail

Epics

• Detector scaffolding generator — Reduce a new ecosystem detector to one command and a predictable, reviewable structure. (5 tasks)
• Signed lifecycle data channel — Ship lifecycle data independently of code releases so freshness no longer depends on upgrading Evergreen. (10 tasks)
• Agent guardrail: check dependencies as agents add them — Coding agents often choose deprecated packages from training data. Check every dependency an agent adds, at the moment it adds it. (10 tasks)
• Richer MCP surface: resources, prompts, structured outputs — Expose rules and findings as MCP resources, migrations as prompts, and typed outputs for every tool. (5 tasks)
• Auto-discoverability for agents and humans — Make Evergreen findable wherever agents and developers look: MCP Registry, llms.txt, agent instruction files, marketplaces. (7 tasks)
• SARIF and native CI reporting — Expose findings through code-scanning interfaces without losing the canonical JSON report. (5 tasks)
• Go lifecycle detection — Detect evidence-backed Go lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks)

• Container base images lifecycle detection — Detect evidence-backed Container base images lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (10 tasks)

  Also in this phase, from epics listed in other phases:

  • Schedule importers to open data PRs
  • Importer: endoflife.date adapter with mandatory vendor sources
  • Differential testing against Renovate deprecation output
  • Differential testing against xeol
  • Generate the differential comparison report
  • Grow the independent corpus to 50 repositories
  • Separate checkout time from scan time in benchmark results
  • Add 10 curated npm package lifecycle rules (batch 3)
  • Add 10 curated npm package lifecycle rules (batch 4)
  • Add 10 curated Python package lifecycle rules (batch 3)
  • Bounded monorepo discovery across workspaces
  • Install a git pre-push hook with evergreen init --hooks
  • Ship a pre-commit framework hook
  • List Evergreen on the pre-commit hooks directory
  • Generate an EOL event calendar from the registry
  • Write the first three “Is your repo affected?” EOL posts
  • Mini-launch 1: the agent dependency guardrail

Phase 22 — Backend, cloud, and Kubernetes coverage

2026-12-16 → 2027-01-15 · 91 tasks · milestone

When this phase is complete, Evergreen has:

• Rust, Java and Kotlin, .NET, Kubernetes API, and serverless runtime (AWS Lambda, Azure Functions, Google Cloud) detection
• Polished one-step GitHub Action published in GitHub Marketplace; container image on GHCR; Homebrew tap; README badge
• Expiring, machine-readable suppression reasons
• Detector maturity levels and a generated coverage matrix; 100-repository corpus with regression thresholds
• Public reference page for every lifecycle rule, with JSON-LD and a sitemap
• Integrations: GitHub starter workflow, MegaLinter, reviewdog, and trunk
• Second public launch: Kubernetes and serverless checks for DevOps teams

Epics

• One-step GitHub Action and Marketplace — One Evergreen step after checkout with safe defaults, published in GitHub Marketplace. (6 tasks)
• Expiring, machine-readable suppression reasons — Prevent baselines from becoming permanent invisible debt. (5 tasks)
• More installation channels — Install Evergreen where people already work: container image, Homebrew, and a README badge. (3 tasks)
• Canonical lifecycle reference pages — Make Evergreen evidence useful as a public reference before anyone installs the CLI. (4 tasks)
• Rust lifecycle detection — Detect evidence-backed Rust lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (12 tasks)
• Java and Kotlin (JVM) lifecycle detection — Detect evidence-backed Java and Kotlin (JVM) lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (13 tasks)
• .NET lifecycle detection — Detect evidence-backed .NET lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (13 tasks)
• Kubernetes APIs lifecycle detection — Detect evidence-backed Kubernetes APIs lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks)

• Serverless runtimes lifecycle detection — Detect evidence-backed Serverless runtimes lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks)

  Also in this phase, from epics listed in other phases:

  • Differential testing against Pluto for Kubernetes
  • Grow the independent corpus to 100 repositories
  • Generate an ecosystem coverage matrix
  • Enforce per-detector regression thresholds
  • Add detector maturity levels to the capability manifest
  • Define promotion gates between maturity levels
  • Submit an Evergreen starter workflow to GitHub
  • Emit reviewdog diagnostic format (rdjson)
  • Contribute an Evergreen descriptor to MegaLinter
  • Add an Evergreen plugin for trunk check
  • Add “Scanned by Evergreen” attribution to Action summaries and badges
  • Mini-launch 2: Kubernetes and serverless runtime checks
  • Write three more EOL posts from the calendar

Phase 23 — Standards and precise code analysis

2027-01-16 → 2027-02-15 · 70 tasks · milestone

When this phase is complete, Evergreen has:

• tree-sitter usage analysis for JavaScript, TypeScript, and Python, replacing regex matching
• Symbol-level API deprecation rules for Node.js and Python
• CLE (ECMA-428) export, CycloneDX lifecycle enrichment, and CycloneDX/SPDX SBOM input
• Agent migration benchmark with published results
• Terraform and Android detection; community-led Dart/Flutter and Swift detection
• Lifecycle rules for Django, Angular, Vue, React Native, Next.js, and Spring Boot
• Third public launch: lifecycle data in SBOMs

Epics

• Parser-backed usage analysis and symbol-level rules — Replace regex usage analysis with tree-sitter (WASM, offline) and add API-level deprecation rules. (9 tasks)
• Lifecycle standards: CLE (ECMA-428), CycloneDX, SPDX — Become the reference implementation of existing lifecycle standards rather than inventing a new one. (7 tasks)
• Agent migration benchmark — Prove that Evergreen migration packets help agents complete real migrations. (4 tasks)
• Framework lifecycle coverage — Cover the frameworks teams actually upgrade: Django, Angular, Vue, React Native, Next.js, Spring Boot, Rails, Laravel. (8 tasks)
• Terraform lifecycle detection — Detect evidence-backed Terraform lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks)
• Android lifecycle detection — Detect evidence-backed Android lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (9 tasks) (community-led; may slip without blocking v1)
• Dart and Flutter lifecycle detection — Detect evidence-backed Dart and Flutter lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks) (community-led; may slip without blocking v1)

• Swift and Apple toolchains lifecycle detection — Detect evidence-backed Swift and Apple toolchains lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (11 tasks) (community-led; may slip without blocking v1)

  Also in this phase, from epics listed in other phases:

  • Submit Evergreen to relevant awesome lists
  • Mini-launch 3: CLE (ECMA-428) and SBOM lifecycle enrichment

Phase 24 — Community ecosystems and open data

2027-02-16 → 2027-03-15 · 88 tasks · milestone

When this phase is complete, Evergreen has:

• Community-led PHP, Ruby, C/C++, Shell/PowerShell, database, and CI runner-image detection
• Lifecycle rules for Rails and Laravel
• GitLab CI/CD component published in the GitLab CI/CD Catalog
• Open lifecycle dataset with a static JSON API, and maintainer-declared lifecycle read from CLE files
• Public governance, RFC process, detector owners, and Code of Conduct
• VS Code extension with inline diagnostics

Epics

• GitLab CI/CD component and Catalog — Give GitLab users the same scan, baseline, gate, and report workflow as GitHub users. (5 tasks)
• Open lifecycle dataset and maintainer-declared lifecycle — Publish Evergreen’s evidence as an open dataset and let maintainers declare lifecycle in their own repositories. (6 tasks)
• Governance, ownership, and community — Let Evergreen scale beyond one maintainer without weakening evidence standards. (7 tasks)
• VS Code extension — Show lifecycle findings inline in the editor using the local CLI. (3 tasks)
• PHP lifecycle detection — Detect evidence-backed PHP lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (12 tasks) (community-led; may slip without blocking v1)
• Ruby lifecycle detection — Detect evidence-backed Ruby lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (12 tasks) (community-led; may slip without blocking v1)
• C and C++ lifecycle detection — Detect evidence-backed C and C++ lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (10 tasks) (community-led; may slip without blocking v1)
• Shell and PowerShell lifecycle detection — Detect evidence-backed Shell and PowerShell lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (9 tasks) (community-led; may slip without blocking v1)
• Database runtimes lifecycle detection — Detect evidence-backed Database runtimes lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (10 tasks) (community-led; may slip without blocking v1)

• CI runner images (GitLab, CircleCI, Azure Pipelines) lifecycle detection — Detect evidence-backed CI runner images (GitLab, CircleCI, Azure Pipelines) lifecycle risks at exact locations and produce migration packets, built from small independent tasks. (10 tasks) (community-led; may slip without blocking v1)

  Also in this phase, from epics listed in other phases:

  • Ruby on Rails: curated lifecycle rules, fixtures, and migration packets
  • Laravel: curated lifecycle rules, fixtures, and migration packets
  • Write three more EOL posts from the calendar
  • Add adoption metrics to the monthly progress report

Phase 25 — Evergreen v1

2027-03-16 → 2027-04-15 · 25 tasks · milestone

When this phase is complete, Evergreen has:

• Evergreen v1 with published compatibility guarantees and release notes
• Public accuracy and performance dashboard; 300-repository independent corpus
• Tested playbooks for CLI, agents, GitHub, and GitLab
• Threat model, parser fuzzing, SLSA provenance, and a 100k-file monorepo benchmark
• Persian README and quickstart
• Demo video, case studies, and the v1 launch

Epics

• Evergreen v1 release readiness and launch — Ship a stable v1 whose contracts, quality evidence, distribution, and maintenance policy are ready for broad adoption. (6 tasks)
• Reproducible accuracy and performance dashboard — Make quality claims inspectable rather than promotional. (3 tasks)
• Agent, developer, and DevOps playbooks — Give each audience a tested path from discovery to verified migration. (5 tasks)
• Security and performance hardening for v1 — Prove Evergreen is safe on untrusted repositories and fast on large monorepos. (4 tasks)

• Launch and adoption — Turn v1 into real usage through a strong demo, case studies, and community outreach. (6 tasks)

  Also in this phase, from epics listed in other phases:

  • Grow the independent corpus to 300 repositories

Not in this roadmap

• A hosted service, accounts, or dashboards that require uploading source code.
• Telemetry in the core (see the privacy ADR in M6; any opt-in design is post-v1).
• Vulnerability scanning or CVE remediation.
• Lifecycle claims without an authoritative, versioned source.

Earlier roadmaps

• Three-month launch roadmap (completed)
• Post-launch notes