roadmap · updated 3 September 2026
The actual plan, by tier.
Features are grouped the way we build them: finish what’s claimed first, then messaging table stakes, then groups, with calls deliberately last. Every line carries its task id. Green is shipped with tests and live evidence. Nothing here is rounded up.
Shipped
- T-01
Validation spike
Synapse stood up, multi-device encryption exercised end to end with a database-level check that the server stores only ciphertext, Application Service round-trips in both directions, licensing re-verified.
- T-02 · T-03
Scripted infrastructure and homeserver deploy
The whole environment as numbered scripts. The original cloud dev environment was torn down in August for cost, and a local Docker stack now backs every verification run; re-provisioning is a rerun of the same scripts.
- T-04 – T-09
The platform server
Phone-first accounts, messaging with receipts, multi-device encryption sync, background jobs, the media pipeline, and the push fan-out backend.
- T-10 · T-11 · T-12
Application Service skeleton, test client, white-label layer
The bridge skeleton the spike prototyped, a throwaway CLI for driving the server, and the typed brand config with Xoyo as the reference brand.
- T-13 · T-14
Web and mobile clients
React web app and React Native mobile app with the core messaging UI, trust labeling, devices, media and location.
- BR-01 – BR-27
The Glific bridge
Twenty-seven tasks from the pipeline scripts to the full bridge: send and template APIs, signed webhooks, session window and consent, interactive rendering, pacing, identity mapping, encryption termination, health, golden-fixture contract tests, review and acceptance. Verified live against a Glific instance.
- P0-1 · P0-4 · F-109 · F-130
September fixes
Mobile composer no longer hidden by the keyboard, dark-mode contrast on outgoing bubbles, a dedicated dev port, and a real cross-signing trust status in the bridge health endpoint. The last two were built, reviewed and verified by the project’s own autonomous pipeline.
Now — Tier 0, finish what’s claimed
These block everything below them. Roughly three weeks of work.
Client defects and gaps
in progress- Web layout below tablet width (P0-2)
- Web read receipts and session resume (P0-3, F-117)
- Identity legibility and tick semantics on both clients
- Dev-port and web default clean-up (XF-009)
Mobile device encryption
next, needs an architecture decision- Encrypt and decrypt on the phone via the Matrix Rust SDK (F-104)
- Cross-sign every bot and service device (F-122, partly shipped)
Live push
waiting on production push credentials- Wire the shipped push backend into web and mobile (T-16)
- Self-hosted over-the-air updates for mobile (T-15)
Next — Tier 1, messaging table stakes
Two to three months. Almost all of it is standard Matrix, which is why it’s fast.
Conversation features
Tier 1- Reactions
- Reply quoting
- Edit and delete for everyone
- Forwarding with limits
- Typing indicators and presence
- Voice notes
- Threads
- Formatting and link previews
- Mentions
- Pinned and starred messages
- Stickers and GIFs
- Contact cards
- Live location
- Local search
- Polls
- Broadcast lists
Then — Tier 2, groups
Group conversations
Tier 2 · six to eight weeks- Group rooms and the create flow
- Admin powers and announcement mode
- Invite links and QR
- Join approval
- Group encryption
- Group polls and events
Channels and communities
after groups- Channels as read-only rooms
- Communities as Matrix Spaces
Continuous — trust and portability
Tier 5
ongoing- Key backup and recovery
- Message export
- Usernames
- Chat and app lock
- Multiple accounts
- Encrypted history sharing for new devices
Later, and on purpose
Calls: a fast-follower, not launch scope
Voice and video on Matrix’s real-time calling stack. The endpoints it needs are still unstable upstream, so we schedule calls after groups and pin versions when we do.
Things we intend not to build
Stories and status feeds, view-once and disappearing messages that would only be emulated, payments, an app platform inside the messenger. We’d rather say so than ship a pretence. This is a recommendation awaiting formal ratification.
How this list stays honest
Every task above lives in a ledger with a testable close condition. The project runs an autonomous pipeline: a task is built by an agent, checked, reviewed against a written checklist, and verified by a live smoke run before it is marked done. The pipeline parks a task after two failures and files a follow-up automatically. Two of the September fixes above went through it end to end.