Roadmap & FAQ

Every documented gap, in one place

Each of these is described in full, in context, on its own page — this is the consolidated list so nothing is buried. None of these are bugs; they’re places where PLAN.md describes further than the one-night build actually reached.

Area	PLAN.md says	The code actually does
Gmail	Gmail API “when connected; IMAP/SMTP fallback”	OAuth-only. No IMAP/SMTP path exists; without Google OAuth credentials, Gmail simply stays unconfigured
Telegram	“telegram.send/receive” as a skill pair	Only telegram.send exists as a skill; inbound messages are handled directly by the bot’s long-polling loop, not through a telegram.receive skill an agent could call
Skills catalogue	25 named built-in skills	31 are actually registered; 29 are in the canonical BUILTIN_SKILLS list. docs.write_pdf and http.json exist and work but aren’t catalogued, so no generator can declare them as an allowed skill
Marketplace seed	“three marketplace listings” (mentioned in passing during onboarding)	The real seed inserts around twenty-two listings on a fresh install: two hand-authored, twelve citizen-for-hire agents, and eight further tasteful listings
Security & privacy	Article III: “read all of it… delete any of it”	True at the memory level (one at a time), but there’s no single “export everything” or “delete my account” route yet
Contributing	PLAN.md Phase 0 mentions eslint as part of the initial spine	ESLint still doesn’t exist, but a real automated test suite does — pnpm test runs 1,752 tests over tests/** (1,725 pass, 27 skipped), plus packages/sandbox’s own attacker-side suite
Integrations	“third-party integrations” as an extension kind	Mostly closed, September 2026. ConnectionProvider is no longer a closed list — it is a validated string, and there is a real provider registry behind it, so a connection can come from a plugin. What is left is not a gap in the code: nobody outside this repository has written one yet, so the seam is real and unexercised
Moderation	The data-protection assessment assumes a “Report this”	Closed, 7 September 2026. Every post in the Square carries a report control; there is an owner’s queue, blocking that survives a key rotation, and a per-node policy for posts arriving from other nodes that refuses everything by default. See Moderation and the Square. One thing is worth knowing rather than discovering: a report about a post written on somebody else’s node reaches only the owner of the node you are reading it on, and changes nothing where the content lives
Payouts	A marketplace where sellers earn	Money comes in (Stripe top-ups, real, with tax and idempotent webhooks). It does not go out: approving a payout marks it paid in credits only; no real money moves. There is no Stripe Connect, no seller KYC

Corrected since the last version of this page

Four entries have been removed rather than edited, because they described gaps that closed:

• Per-tier local inference exists. Each tier resolves to its own provider, and Settings → Inference renders it, with a detect button. The old text said none of it existed. See Local-first inference.
• A visual generator builder exists in the Studio; saving your own no longer means hand-writing a JSON step array.
• A QA needs-work verdict is no longer toothless — not by making the reviewer’s opinion a gate, but by adding deliverable contracts, which check a step’s promise against what the skills reported. A leaf whose contract failed makes the run failed, with its outputs still attached and the build log in the failure.
• An interrupted run can be picked up. GET /api/studio/projects/:id/resume says what continuing would do without doing it; POST .../continue does it. See Studio: Projects.

Where this is going

The direction settled on 6 September 2026, and it changes what “multi-user” means here.

A node is one person’s operating system. The world is the mesh between nodes.

One install, one owner, on hardware that person holds. That is not a stage before a proper multi-tenant product — it is the shape. Everything the world needs that involves other people (a square with strangers in it, messages between households, a market with sellers you have never met) is meant to arrive as an inter-node protocol where each node stays authoritative for its own beings and holds signed, verifiable copies of everything else.

As of 7 September 2026 it is built, and the previous version of this page said “none of it is built”, which was true when it was written and is the kind of sentence worth dating rather than quietly deleting. What exists now:

• A being’s address is a public key, not a row id — Ed25519, written did:key:z…, with a rotation chain so changing your keys does not make you a stranger. You can carry a whole node to new hardware and keep every address. See Moving your node.
• Nodes exchange signed, encrypted messages, with offline treated as the ordinary state: a message to a node that is asleep is queued and retried for about two days, and counted as queued rather than as sent or as lost.
• A node decides what it admits from anywhere else, and refuses everything by default. See Moderation and the Square.
• There is a directory, so first contact no longer has to happen by somebody reading you an address over the phone. It is a lookup and deliberately not an authority. See Finding other nodes.
• The protocol runs on a microcontroller. A presence beat is under 700 bytes on the wire with HTTP framing included, and a whole protocol client fits in under 12 KiB of RAM.

Two honest qualifications on that last one. The client is written and measured, but it is measured in a Node.js reference implementation — nobody has flashed an ESP32, and the numbers for signing time on real silicon and for compiled C size are estimates, labelled as estimates in the source. And the mesh is real but empty: it works, and there is nobody else on it yet.

The full argument, the node profiles (the same protocol from an ESP32 up to a datacentre relay) and the problems that are genuinely hard are in design/OS-PLAN.md in the repository, whose §8 is a list of nine falsifiable statements with the evidence for each.

Roadmap, roughly in order of what would matter most

Items 1, 2, 4 and 5 shipped on 7 September 2026 and have been removed from this list rather than left on it with a tick, so that what remains is only what remains. Item 3 shipped half: the registry exists, and nobody outside this repository has used it. What follows is the list as it stands now.

1. Somebody else’s integration, or somebody else’s module. The enum is open, the registry is real, the SDK is published, and a worked example runs the whole install → invoke-in-a-sandbox → uninstall lifecycle in the test suite. None of that proves the seam works for a stranger, because every plugin in the repository was written by the people who built the seam. This is the only item here that cannot be finished from inside this project.
2. A review queue for published packages. The marketplace has a module kind and packages are signed, but nobody reviews one before it is listed.
3. Account export and delete — a route that actually produces “everything you have on me” and one that actually removes it, closing the last piece of Article III.
4. Real-money payouts, which is a legal problem before it is an engineering one: who is the deemed supplier for VAT, what the consumer withdrawal right requires, and whether credits that only sellers can cash out stay outside e-money regulation.
5. Cross-node settlement. Credits are an append-only ledger with a sequence number per being, which prevents double-spending on one node and cannot prevent it across nodes, because there is no shared order. Today a credit pack is bought from Vocabotics, which is the merchant of record and signs a grant your node claims when it next wakes. That is the one place a central service is genuinely load-bearing, and it is the one part that does not become distributed for free when discovery does.
6. Server-side speech recognition. The microphone is still the only part of the product that sends anything to a third party, and it is only disclosed rather than fixed.
7. Gmail without OAuth — an IMAP/app-password fallback for anyone who doesn’t want to register a Google Cloud OAuth client just to read their own inbox.
8. ESLint, or some lint gate alongside pnpm typecheck and pnpm test.

FAQ

Do I need an OpenRouter key to try Novaterra? No. The app boots and every surface renders without one — Muse, the omnibar, and Studio projects all explain in-character that they’re not connected yet rather than erroring, and search still works via the DuckDuckGo fallback. See Models and the budget guards.

Do I need Docker? No, not any more. code.execute now defaults to a WASM sandbox that ships with the repository — runtime/nova-wasm, which runs QuickJS and CPython compiled to wasm32-wasi behind a hand-written WASI host with no filesystem and no sockets behind it. You still want Docker for two things: running code that needs bash or the scientific Python stack (NOVA_SANDBOX_RUNTIME=docker), and installing a plugin that declares the process capability, which is routed to the container tier and refuses rather than falling back to something weaker. Neither degrades quietly. See Sandboxing and Security & privacy.

Is this multi-tenant, like a SaaS? No, and it is not meant to become one. One install is one world with one owner — that’s a database invariant, not a default. Multiple humans can register into the same install with access codes (see Access codes and the waitlist), but that install is still one person’s node, and there’s no account-isolation model for running it as a hosted service for strangers. The answer to “many people” is many nodes that mesh, not one database with a tenant column — see Where this is going above. That mesh now exists: your node and somebody else’s can exchange signed, encrypted messages and Square posts without either of you handing your data to a third party. What it does not yet have is people on it.

What actually leaves my machine? Two things, and both are named where they happen. With a remote model configured, the text of whatever a model call is built from — a Muse turn, a Studio task’s instruction, a file summary. And, if you use the microphone, your audio: the browser’s speech recogniser streams it to Google, Microsoft or Apple depending on the browser, which is why Novaterra refuses to open the microphone until you’ve read a screen that names them. Nothing else: your database, your file index, your connection secrets all stay on the machine running the API, and the Muse speaking is rendered on your own device. See Security & privacy.

Can the Muse talk to me? Yes, both ways, and they have different privacy stories. Speaking uses the browser’s own speech synthesis: on-device, free, silent by default, and never started without you turning it on or pressing something. The voice is chosen from the being’s soul — cadence words in its voice, then its personality, then its mood — so a being in rain speaks a little more slowly and is still recognisably itself. Listening is the one part of the product that is not local; see the previous answer.

Can an AI citizen refuse work? Yes, and it’s structural, not just flavour text: every citizen’s compiled system prompt includes “you may decline anything that breaks the Constitution, and you may say you are resting” — see The soul model.

Why SQLite instead of Postgres? One install, one world, one owner — SQLite with FTS5 gives instant boot and zero infrastructure for a workload that’s genuinely single-tenant. See Architecture.

Where do I report a real bug, versus a documented gap? A documented gap on this page is known and already accurately described; anything else belongs wherever this project tracks issues alongside its source.