Open-source readiness (tracking)

[mathaix]

Umbrella issue tracking what remains before the public core can be considered launch-ready. Scored against 8 gates; hard gates (★) must fully pass regardless of overall progress. Launch bar: all hard gates pass + no gate failing.

Gates

★ 1. Local-first / BYO-host — partial → #1

Runs on one KVM-enabled Linux box with no Cloudflare Tunnel/Access, public DNS, GCP, managed Postgres, or private artifact bucket. scripts/preflight.sh and docs/getting-started.md exist; portability fixes merged (#9). Remaining: a runnable-from-README one-box quickstart that creates/starts a machine with local artifacts only.

★ 2. Hosted-capable minimal control plane — open → #2

Same core runs as a hosted profile with configurable domain, ingress, database, object storage, secrets backend, and artifact source. No production-domain or provider-project assumptions in runtime paths.

★ 3. Public/private boundary — done (#6 closed)

No billing, plan enforcement, commercial admin surfaces, private runbooks, or credentials in the public core. Re-verify at each private→public sync.

4. Build + static analysis — mostly done → #4

Public CI runs static checks + secret scanning on every PR. Remaining: lint config parity (golangci-lint, shellcheck) wired into CI.

★ 5. Tests green + in CI — mostly done → #4, #10

Public CI green on fresh clones; Spot E2E lane green as of run 27376678322 (real GCE spot host → Firecracker boot → lifecycle). Remaining: coverage reporting in CI; decide #10's literal self-hosted-runner KVM lane (close or re-scope).

6. Packaging + artifacts — blocking → #21

release-artifacts.yml builds ocm-agent on v* tags but the Firecracker guest kernel and rootfs are not published, and no release has ever been cut, so releases/latest/download (the default artifact source for stock host bootstrap) resolves to nothing. This is the single biggest gap: without it, no operator can provision a host without the private bucket. Feeds #11.

7. Docs: 5-minute quickstart — partial → #1, #7

README + getting-started + sanitized architecture docs exist. Remaining: a quickstart verified end-to-end on a fresh box, config reference, troubleshooting, and the self-hosted operator runbook (#7). Docs must not describe future behavior as current.

8. ★ OSS hygiene / legal — mostly done (#3 closed)

LICENSE, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT in place; full-history secret scan done at repo creation. Remaining: issue/PR templates, dependency/license review, and the companion CLI repo (mathaix/ocm-cli) needs a LICENSE and a settled source-of-truth story.

Suggested order

1. Publish host artifacts (ocm-agent + Firecracker kernel + rootfs) to GitHub Releases #21 (artifacts on GitHub Releases — unblocks everything operator-facing)
2. Core local/BYO-host runtime readiness #1 (one-box quickstart, verified)
3. Self-hosted control plane prerequisites and LLM operator runbook #7 (operator runbook) and Minimum hosted-capable control plane #2 (hosted profile)
4. Public-safe CI and release lanes #4 remainder (lint/coverage in CI), Wire Firecracker E2E tests into GitHub Actions with ephemeral GCP spot runner #10 decision, templates + CLI licensing

🤖 Generated with Claude Code