Project Roadmap & contributing

Docs Project

Roadmap and contributing

Constle ships in milestones, not on a calendar. Each milestone is scoped narrowly enough to land as working, tested software rather than accumulate half-finished features.

On this page

RoadmapLink to this section

ShippedLink to this section

  • Sandboxed execution: Firecracker microVM and Docker backends, network egress allowlisting via a proxy the agent cannot bypass.
  • Cryptographic identity: W3C did:key (Ed25519), signed and hash-chained audit logs.
  • Human gate policies: enforced at the MCP gate proxy layer, with a safe abort-on-timeout default.
  • Spending enforcement: hard per-run and per-day limits enforced by the runtime, metered per priced MCP server.
  • Agent-to-agent communication: signed messaging restricted to declared peers.
  • CLI: run, validate, ps, stop, init, identity, audit verify, webhook-keygen.

In progressLink to this section

Moving from "the runtime works" to "the runtime is trustworthy at a glance": deeper conformance testing, a field-by-field specification of what each manifest key actually enforces versus declares, and hardening the paths that touch real infrastructure.

ExploringLink to this section

Once identity and spending enforcement are solid, agent-to-agent commerce becomes possible: agents discovering and paying each other for work. This is a direction, not a scheduled milestone.

To propose a change in priority, open an RFC issue. ROADMAP.md changes as the project does, and PRs to it are welcome.

ContributingLink to this section

Constle is early and maintained by one person right now, so response times won't always be fast, but every issue and PR gets read.

git clone https://github.com/constle/constle
cd constle
go build ./...
go test ./...

What's most useful right now:

  • Bug reports with clear reproduction steps (a failing test is even better)
  • A gVisor sandbox backend, alongside the existing Firecracker and Docker ones
  • More example agents in examples/
  • Gaps between spec/agent-manifest.md and what the parser actually accepts
  • Anything that closes one of the Known limitations

Open an issue first for anything beyond a small fix: it is a quick way to confirm the approach before you spend time on it. Keep PRs scoped to one change. Code and comments are in English, formatted with gofmt and checked with go vet, and new behaviour needs a test. The full guide is CONTRIBUTING.md.

Reporting a vulnerabilityLink to this section

Please do not open a public GitHub issue for security vulnerabilities. Report them privately through GitHub Security Advisories. You don't need a working exploit; if you are unsure whether something is a security issue, report it privately.

Event Target
Acknowledgement within 48 hours
Initial triage and severity assessment within 7 days
Fix or mitigation, critical / high within 30 days
Fix or mitigation, medium within 90 days
Low / informational best effort

Disclosure is coordinated, with a default embargo of 90 days from the initial report, and reporters are credited in the advisory unless they prefer otherwise. During the pre-1.0 phase only the latest release receives security fixes. The full policy, including scope and safe harbor, is SECURITY.md.

LicenseLink to this section

Apache 2.0. The Agentfile format is an open, independently auditable standard.

Something wrong or unclear? Open an issue. The specifications on these pages are copies of spec/ in constle/constle.