Transparency

Roadmap & Status

What's shipped, what's in progress, and what isn't happening yet. No spin — just the current state.

Publishing what's not done is part of what makes a transparency page worth reading. If you need something listed under "deferred" or "excluded," tell us.

Shipped

Identity

  • Ed25519 keypair generation and local key storage (.spineforge/agent_key.pem)
  • Public key registration with the Spineforge registry
  • RFC 7523 JWT assertion flow for authentication
  • Spine ID assignment — stable across process restarts, machine reboots, and redeployments
  • Offline mode — local identity via registry.json, no network required

Credential Brokering

  • POST /credentials/lease endpoint — short-lived working copies of provider keys
  • spine.lease_credential() SDK method with automatic token refresh
  • Revocation — blocks future re-leasing immediately on agent suspension/revocation

Scope Enforcement

  • Scope declaration at registration (allowed_scopes)
  • JWT scope claims — set membership validation, no partial grants
  • Agent-to-agent delegation via aud claim targeting another agent's Spine ID
  • JWKS endpoint for local agent-side token verification

Telemetry

  • OpenLLMetry-based auto-instrumentation
  • SpineforgeSpanProcessor — translates OTel spans to Spineforge Run/Action events
  • ConsoleSink — coloured one-liners to stdout
  • FileSink — non-blocking JSONL append via background thread + queue
  • APISink — authenticated async batch send to backend, FileSink fallback
  • @track_tool decorator for uninstrumented tool functions
  • Cost computed once at write time from rate_cards table, stored as NUMERIC(14,8) with rate_card_id
  • P50/P95 latency via Postgres percentile_cont (live)

Framework Support

  • LangChain — auto-instrumented
  • LangGraph — auto-instrumented
  • CrewAI — auto-instrumented
  • AutoGen — auto-instrumented
  • Raw OpenAI SDK — auto-instrumented (LLM calls) + @track_tool for tools

Provider Support

  • OpenAI — cost tracked
  • Anthropic — cost tracked
  • Groq — cost tracked
  • Gemini — cost tracked
  • AWS Bedrock — cost tracked

Dashboard

  • Overview, Agents list/detail, Cost & Usage
  • Agent graph visualizer — grid layout + force-directed (d3-force toggle)
  • Lifecycle Kanban — 6 stages (Development → Retired)
  • Per-agent timeline
  • Owner attribution via verified SSO/OIDC (Google Workspace, Okta, Azure AD)

In Progress

  • Scope-based authorization backfill for existing agents. The scope enforcement machinery is shipped. Existing agents registered before scope enforcement landed need to be backfilled into the scopes table. This is being completed — not all agent types have been migrated yet.

Planned

  • Node.js SDK. Same feature set as the Python SDK — init, run, track_tool, lease_credential, request_token. Design not yet finalized.
  • Per-key provider reconciliation — OpenAI + Anthropic. Cross-referencing Spineforge usage against provider Admin APIs to detect unaccounted-for usage (Phase 2 shadow agent detection). Confirmed as feasible for OpenAI and Anthropic.

Unresolved

  • Groq Admin API reconciliation. Groq does not have a confirmed Admin API equivalent to OpenAI's or Anthropic's. Per-key reconciliation is blocked for Groq until this is resolved.

Explicitly Deferred

  • From-scratch agent framework support. Building our own agent framework is not planned. Spineforge instruments existing frameworks — it doesn't replace them.
  • Mutual authentication between agents. Agent-to-agent token verification via JWKS is shipped. Full mutual TLS or bidirectional authentication between agents is explicitly deferred.

Excluded from Current Build

  • Rate limiting / budget enforcement. You can see exactly what agents spend. You cannot currently set a hard spend cap that blocks further LLM calls. This is excluded from the current build.
  • On-prem / VPC deployment. Enterprise roadmap item. Not available today.

Something missing you need? Tell us — roadmap priorities are informed by what real teams are building.