Roadmap: ship Owen Alpha and complete the Rust production vertical after #214

[PhysShell]

Status

Master roadmap after the completion of P-022 step 4 in #214 / PR #249.

Two independent outcomes must now be delivered:

1. Owen Alpha is actually published and verified from clean external consumers.
2. Rust participates in the real C# → OwnIR → verdict path, first in shadow mode and then through an explicit cutover gate.

The release track must not wait for the full Rust migration. The Rust track must not use the release as permission to weaken parity.

Current baseline

Completed:

• Owen public facade: Owen.Cli, owen, Owen Action/SARIF identity (feat(owen): public facade rebrand for the CLI, Action, and SARIF identity #246).
• Protected NuGet release workflow and cross-platform packed-artifact smoke tests (feat(owen-cli): release-readiness pipeline, rebuilt against the Owen facade (P-013) #247).
• Marketplace-readiness workflow and protected major-tag movement (feat(action): Marketplace-readiness pipeline, rebuilt against the Owen facade (P-013 gate B) #248).
• Five-repository precision remeasure: −51 findings, 0 added, 0 unexplained (docs: full 5-repo oracle remeasure after the complete #218-#240 batch #243).
• Rust crates: own-ir, own-syntax, own-cfg, own-diagnostics data types, own-analysis.
• Rust analysis heart: generic worklist solver + ownership/lifetime/buffer/effect/DI with layered Python parity (P-022 step 4: port own-analysis (worklist solver + ownership/lifetime/effect/DI) with layered diagnostic parity #214/feat(rust): P-022 step 4 — port own-analysis (worklist solver + ownership/lifetime/effect/DI) with layered parity (#214) #249).

Still missing:

• repository license and real release-owner configuration;
• first public Owen.Cli and Action releases;
• diagnostic message/Evidence parity;
• report/SARIF parity;
• Rust own-codegen;
• formalized and ported own-bridge;
• dual-engine shadow mode;
• Rust CLI parity and default-engine cutover;
• IDE/LSP verticals.

Non-negotiable migration rules

• Python remains the oracle until a separate cutover decision.
• A Rust/Python divergence is a Rust bug unless behavior changes in a separate Python-first PR.
• Migration PRs do not add diagnostic rules, change severity, broaden Roslyn heuristics, or weaken fixtures.
• Every layer owns a frozen Python-authored parity surface; steady-state Rust tests run with zero Python.
• Production crate edges remain CI-enforced.
• own-codegen remains independent of own-analysis and own-diagnostics.
• own-bridge feeds facts and maps verdicts; it must not duplicate analysis algorithms.
• Owen Alpha publication does not depend on Rust-default cutover.

Child issues and execution order

A. Owen Alpha release

• Owen Alpha gate: choose license, configure protected release environments, and approve version #252 — owner gate: license, version, protected Environments and NuGet secret.
• Owen Alpha release: publish and externally verify the first Owen.Cli package #253 — publish and externally verify the first Owen.Cli alpha. Blocked by Owen Alpha gate: choose license, configure protected release environments, and approve version #252.
• Owen Action release: immutable tag, external consumer verification, and protected major tag #254 — immutable Action tag, external consumer repository and protected major-tag move. Blocked by Owen Alpha gate: choose license, configure protected release environments, and approve version #252.

Release DAG:

#252
 ├─> #253
 └─> #254

The release track is independent of the Rust-default cutover.

B. P-022 Rust production vertical

• P-022 maintenance: reconcile the roadmap and crate status after #214 #251 — reconcile P-022 roadmap and live crate status.
• P-022 step 5a: port diagnostic messages and ordered Evidence with Python parity #255 — diagnostic messages + ordered Evidence parity. Depends on P-022 maintenance: reconcile the roadmap and crate status after #214 #251.
• P-022 step 5b: port .ownreport.json and SARIF projection with canonical parity #256 — .ownreport.json + SARIF canonical parity. Blocked by P-022 step 5a: port diagnostic messages and ordered Evidence with Python parity #255.
• P-022 step 5c: port own-codegen as an analysis-independent Rust sibling #257 — analysis-independent Rust own-codegen. Depends on P-022 maintenance: reconcile the roadmap and crate status after #214 #251; can run in parallel with P-022 step 5a: port diagnostic messages and ordered Evidence with Python parity #255/P-022 step 5b: port .ownreport.json and SARIF projection with canonical parity #256.
• P-022 step 6a: formalize OwnIR bridge semantics before the Rust port #258 — formalize OwnIR bridge semantics. Depends on P-022 maintenance: reconcile the roadmap and crate status after #214 #251.
• P-022 step 6b: implement Rust own-bridge with layered OwnIR parity #259 — implement Rust own-bridge. Blocked by P-022 step 6a: formalize OwnIR bridge semantics before the Rust port #258; preferably after P-022 step 5a: port diagnostic messages and ordered Evidence with Python parity #255/P-022 step 5b: port .ownreport.json and SARIF projection with canonical parity #256.
• P-022 step 7a: add dual-engine shadow mode and zero-diff reproduction artifacts #260 — dual-engine shadow mode with same-input invariant and reproduction artifacts. Blocked by P-022 step 6b: implement Rust own-bridge with layered OwnIR parity #259; preferably after P-022 step 5b: port .ownreport.json and SARIF projection with canonical parity #256.
• P-022 step 7b: implement Rust own-cli with command, output, and exit-code parity #261 — Rust own-cli command/output/exit-code parity. Blocked by P-022 step 6b: implement Rust own-bridge with layered OwnIR parity #259; preferably after P-022 step 5b: port .ownreport.json and SARIF projection with canonical parity #256; integrates with P-022 step 7a: add dual-engine shadow mode and zero-diff reproduction artifacts #260.
• P-022 step 8: Rust-default cutover, rollback gate, and Python distribution removal #262 — Rust-default cutover, rollback gate and later Python distribution removal. Blocked by P-022 step 7a: add dual-engine shadow mode and zero-diff reproduction artifacts #260 and P-022 step 7b: implement Rust own-cli with command, output, and exit-code parity #261; also depends on P-022 step 5b: port .ownreport.json and SARIF projection with canonical parity #256/P-022 step 6b: implement Rust own-bridge with layered OwnIR parity #259.

Rust DAG:

#251
 ├─> #255 ─> #256 ───────────────┐
 ├─> #257                         │
 └─> #258 ─> #259 ─> #260 ──────┼─> #262
                    └─> #261 ────┘

C. IDE/incremental path

• IDE foundation: establish cold/warm/incremental latency and memory baselines #263 — cold/warm/incremental latency and memory baselines.
• IDE MVP: ship a Rust .own LSP with broken-code tolerance and cancellation #264 — .own Rust LSP MVP with broken-code tolerance and cancellation. Depends on P-022 step 5a: port diagnostic messages and ordered Evidence with Python parity #255, preferably P-022 step 5b: port .ownreport.json and SARIF projection with canonical parity #256; informed by IDE foundation: establish cold/warm/incremental latency and memory baselines #263.
• IDE vertical: hybrid C# host with Roslyn semantic extraction and Rust core #265 — hybrid C# host: Roslyn semantic extraction → OwnIR → Rust core. Blocked by P-022 step 6b: implement Rust own-bridge with layered OwnIR parity #259/P-022 step 7a: add dual-engine shadow mode and zero-diff reproduction artifacts #260; informed by IDE foundation: establish cold/warm/incremental latency and memory baselines #263 and lessons from IDE MVP: ship a Rust .own LSP with broken-code tolerance and cancellation #264.

IDE DAG:

#263 ──────────────┬─> #264
                  └─> #265
#255/#256 ───────────> #264
#259/#260 ───────────> #265

D. P-034

• P-034 follow-up: verify opt-in runtime disposal-guard coverage and offer source-visible fixes #241 — existing opt-in runtime disposal-guard contract-completeness follow-up.

Production implementation remains blocked until the runtime marker/helper/escape-hatch contract is finalized. Do not duplicate call-site use-after-dispose rules.

Recommended agent allocation

Strong agent

#255 -> #256 -> #258 -> #259

Do not run own-bridge implementation before #258 independent review.

Separate strong or medium-strong agent

#257

Keep codegen isolated from analysis.

Medium agent

#251
#252 verification packet
#253/#254 release evidence and external checks

Local/corpus-capable agent

#263 measurements
#260 five-repository compare sweeps and reproduction artifacts

Global PR acceptance packet

Every substantive child PR must state:

Scope:
Explicit non-goals:
Python source of truth:
Frozen fixture:
Fixture regeneration command:
Steady-state test command:
Production dependency changes:
Behavior changes:
Acceptance changes:
Local commands:
GitHub Actions links:
Known deferred cases:

Migration PRs additionally report:

Python-only verdict count:
Rust-only verdict count:
Changed verdict count:
Ordering-only difference count:
Unexplained difference count:

The final value must be 0.

Stop conditions

Stop and redesign the child scope if any of these occur:

1. A fixture or acceptance must be weakened to make parity green.
2. Rust intentionally differs without a separate Python-first change.
3. own-bridge reimplements ownership/lifetime/effect/DI algorithms.
4. own-codegen starts consuming analysis verdicts.
5. Release smoke tests use project references/rebuilds instead of the packed .nupkg.
6. Python and Rust receive different OwnIR bytes in compare mode.
7. SARIF normalization deletes semantic fields merely to remove a diff.
8. Performance work begins without a baseline/profile.
9. A new abstraction layer has no vertical consumer.
10. Schema, semantics, output and packaging are mixed into one supposedly small PR.

Milestone completion

This roadmap reaches its next major milestone when all are true:

Owen Alpha

• installable from nuget.org on a clean machine;
• owen check works on Windows and Linux;
• immutable GitHub Action tag works from an external repository;
• SARIF is accepted by GitHub Code Scanning.

Rust vertical

• message/Evidence parity;
• report/SARIF parity;
• OwnIR bridge parity;
• dual-engine shadow mode reports zero unexplained difference;
• Rust CLI is ready for an explicit default-engine decision.

IDE foundation

• measured latency/memory budgets exist;
• .own LSP proves cancellation and stale-result correctness;
• the C# hybrid host has an approved protocol/ADR and a working full-snapshot vertical before delta optimization.