OpenCodeHub Feature Audit & Implementation Plan
Audit Date: February 19, 2026
Total Features Analyzed: 125
Status: Reconciled summary updated to reflect latest implemented work through February 19, 2026.
Feature Matrix Summary
| Category | Implemented | Partial | Missing | Total |
|---|---|---|---|---|
| Repository & Git | 9 | 4 | 0 | 13 |
| Pull Requests | 9 | 6 | 0 | 15 |
| Code Review | 9 | 1 | 0 | 10 |
| Issues & Planning | 10 | 0 | 0 | 10 |
| CI/CD & Automation | 7 | 1 | 0 | 8 |
| Third-Party Integrations | 22 | 0 | 0 | 22 |
| Dependency & Impact Awareness | 5 | 0 | 0 | 5 |
| Security | 12 | 0 | 0 | 12 |
| Analytics & Insights | 8 | 0 | 0 | 8 |
| Notifications & Collaboration | 8 | 0 | 0 | 8 |
| Interfaces & Extensibility | 7 | 0 | 0 | 7 |
| Self-Hosted & Deployment | 4 | 3 | 0 | 7 |
| Total | 110 | 15 | 0 | 125 |
1. Repository & Git
| Feature | Status | Implementation Notes |
|---|---|---|
| Full Git protocol (SSH/HTTPS) | ✅ | ssh.ts, git-server.ts fully implemented |
| Repository hosting | ✅ | Multiple storage adapters (S3, R2, local, GDrive) |
| Repository mirroring | ⚠️ | Background sync cron plus repository mirror config/manual-sync APIs are implemented (settings/mirror, settings/mirror/sync) with derived health telemetry (isHealthy, isStale, lastSyncAgeMinutes); scheduled sync automation now supports stale-only windows, sync-interval/max-repo controls, and batch monitoring metrics (eligible, skipped, stale, failedRepoIds, durationMs) via cron/mirror-sync, while advanced alerting/runbook workflows remain partial |
| Forks & pull-based workflows | ✅ | fork.ts API, UI implemented |
| Monorepo support | ✅ | Advanced path scoping is implemented: repository settings CRUD APIs for path rules (settings/path-permissions), read/write enforcement across PR/review/comment/impact/template flows, and pre-receive push checks now use centralized permission-level evaluation (checkPathPermissions) for protected monorepo paths |
| Git LFS | ✅ | lfs.ts with batch API (upload/download) |
| Submodules | ✅ | Native Git support, no special handling needed |
| Branch protection rules | ✅ | Schema + UI + API in place |
| Repository templates | ✅ | Template creation/listing are implemented with access-aware discovery filters (/repos/templates?q=&owner=&visibility=) and dedicated governance controls via settings/template (publish/unpublish, visibility governance, private-template acknowledgment guardrail, archived/mirror safety checks, and policy introspection surfaced in repo settings UX) |
| Repository Wiki | ✅ | Implemented (Phase 8) |
| File-level permissions | ✅ | Path-scoped enforcement now covers PR comment create/edit/delete/list filtering, PR review list comment filtering, AI review suggestion read filtering, single-review inline comments, batch-review comment submission, suggestion-apply, partial file-approval create/revoke and read-filter flows, PR rewrite operations, PR impact scan execution/read filtering, PR template discovery path checks, PR merge operations (single merge, auto-merge enable/disable, bulk-merge), and push-time branch updates via centralized checkPathPermissions |
| Commit signing (GPG) | ✅ | GPG key management UI exists |
| Commit signing (SSH) | ✅ | SSH key management UI exists |
2. Pull Requests
| Feature | Status | Implementation Notes |
|---|---|---|
| Native stacked PRs | ✅ | stacks.ts - create, add, reorder, visualize |
| PR dependency graphs (DAG) | ✅ | getStackVisualization() implemented |
| Cross-PR dependency detection | ✅ | Automatic branch/file dependency graph API (pulls/dependencies) plus stack-order suggestion/apply API (POST/PUT pulls/stack-order) are implemented, and PR list UI now provides dependency analysis, selection-based order suggestion, and one-click stack creation workflow for detected dependency sets |
| Stack rebase & auto-update | ✅ | Stack rebase/auto-update endpoints now expose both status and execution workflows (GET/POST stacks/[stackId]/auto-update, stacks/[stackId]/rebase), and PR stack UI includes guided maintenance actions (live behind-status checks, one-click auto-update, manual rebase fallback, and actionable success/conflict feedback) |
| Stack-level approvals | ✅ | Stack approvals now include end-to-end orchestration: readiness/blocker context + per-PR summary APIs (stacks/[stackId]/approvals), recommended reviewer derivation, dry-run reviewer eligibility previews, and PR stack UI actions for previewing eligibility, requesting recommended reviewers, and requesting custom reviewer batches with live blocker/status feedback |
| Bulk merge (merge stacks) | ✅ | Explicit stack and selected-PR bulk merge APIs are implemented (stacks/[stackId]/merge, pulls/bulk-merge) with orchestration UX in PR surfaces: stack merge readiness/blocker checks + merge-method controls on PR stack panel, and selected-PR bulk-merge controls on the PR list workflow panel |
| Custom PR states | ✅ | State definitions and transition APIs are fully wired (workflow/states, pulls/{number}/state), PR detail UI now provides guided state transitions with inline policy hints and blocker feedback, and new PR creation auto-applies repository default custom state when configured (pulls/index) |
| Required reviewers per state | ✅ | State reviewer requirements are enforced during transitions, and required-reviewer introspection now supports state-policy preview mode (pulls/{number}/required-reviewers?stateId=) including team/user requirement progress; PR state UI surfaces live per-state reviewer policy guidance before applying transitions |
| PR merge queues | ✅ | merge-queue.ts (590+ lines) |
| Conflict detection before merge | ✅ | mergeable field in PR schema |
| Auto-merge rules | ✅ | Auto-merge rules engine plus explicit PR auto-merge control/status APIs are fully wired (pulls/{number}/auto-merge), including policy summary and per-rule introspection in status responses (policySummary, ruleEvaluations) and PR detail UI controls for enable/disable, method selection, blockers, and live rule evaluation visibility |
| Draft PRs | ✅ | Schema supports isDraft field |
| PR labels | ✅ | Full implementation with schema |
| PR assignees | ✅ | Full implementation with schema |
| PR checks | ✅ | PR check ingestion now supports provider-aware webhook payload normalization (normalized/GitHub Actions/GitLab/CircleCI/Buildkite/Jenkins) via external-ci/checks, PR check summary/read APIs remain in pulls/{number}/checks, PR detail UI now surfaces live check summary/list refresh, and external-CI settings provide provider-specific setup payload presets |
3. Code Review
| Feature | Status | Implementation Notes |
|---|---|---|
| Inline code comments | ✅ | pullRequestComments schema with line/position |
| Threaded discussions | ✅ | Reply threading via replyToId |
| Suggested changes | ✅ | Suggestion creation + apply endpoints implemented (pulls/[pullNumber]/suggestions/apply.ts) |
| Batch comments | ✅ | Atomic batch review submission endpoint + PR conversation UI integration (reviews/batch) |
| Code owner enforcement | ✅ | Enforced in PR state transitions and merge queue (pr-codeowner.ts), with dedicated PR policy introspection endpoint (pulls/{number}/codeowner-enforcement) and PR UI visibility for active rule source, blockers, and per-file CODEOWNERS approval status |
| Review templates | ✅ | UI + API + defaults implemented (review-templates) |
| Required approval policies | ✅ | Via branch protection rules |
| Partial file approvals | ✅ | Implemented via API + PR UI (partial-file-approvals, file-approvals.ts) |
| Multi-reviewer rules | ⚠️ | Merge gates now enforce explicit required-reviewer approvals; broader state/rule UX still maturing |
| AI code review | ✅ | Multi-provider adapters (OpenAI/Anthropic/Groq/Bytez/OpenRouter/Together/Google/Local-Ollama) + external-agent async callback flow |
4. Issues & Planning
| Feature | Status | Implementation Notes |
|---|---|---|
| Issue tracking | ✅ | Full schema + UI for issues |
| Epics and sub-tasks | ✅ | Implemented (Phase 8) |
| Custom issue fields | ✅ | Library + issue integration + settings API (settings/fields) now implemented |
| Issue workflows | ✅ | Repository issue statuses workflow endpoints implemented |
| Milestones & roadmaps | ✅ | milestones schema + UI |
| Kanban boards | ✅ | Implemented |
| PR ↔ Issue linking | ✅ | Explicit link/unlink APIs + UI + auto-link parsing (including scoped refs like owner/repo#123) |
| Cross-repo issues | ✅ | Cross-repo link parsing/storage/API implemented |
| Labels | ✅ | Full implementation |
| Assignees | ✅ | Full implementation |
5. CI/CD & Automation
| Feature | Status | Implementation Notes |
|---|---|---|
| Native CI pipeline support | ✅ | pipeline.ts - 1066 lines, GitHub Actions compatible |
| External CI integration | ✅ | Provider-aware integration APIs and normalized status ingestion are implemented, with repo-level integration health/status + token rotate/disable APIs (external-ci, external-ci/checks) plus provider-specific configuration/summary APIs and settings UX for GitLab/CircleCI/Buildkite/Jenkins (integrations/external-ci) including setup fields, webhook secret visibility, and recent build surfacing |
| Self-hosted runners | ✅ | runner/ with Docker executor |
| Secrets management | ✅ | Schema + UI for repo/org secrets |
| Merge checks & gates | ✅ | Required status checks + external CI gate readiness are enforced, with explicit PR gate introspection via pulls/{number}/merge-readiness now including policy reports (failedByType, recommendations, pass/fail counts), active label/review/custom gate evaluation in ci-gates.ts with gate-type metadata, repository-level gate policy management/reporting APIs (/repos/{owner}/{repo}/merge-gates, /repos/{owner}/{repo}/merge-gates/{id}), and PR detail merge-gate policy UX for live blockers/breakdowns/remediation guidance |
| Automation rules engine | ⚠️ | Conditions/actions active with retry + dead-letter audit logging; advanced orchestration still maturing |
| Webhooks | ✅ | Full implementation with UI |
| Workflow templates | ✅ | Template library plus repo-level listing/apply APIs are implemented (workflow/templates), and repository Actions settings now include workflow template discovery/adoption UX with category/language filters, direct apply flow, and applied-workflow visibility |
6. Third-Party Integrations
6.1 Code Quality & Coverage
| Feature | Status | Notes |
|---|---|---|
| Codecov | ✅ | Coverage webhook processing + API configuration are implemented, and repository settings now provide Codecov automation UX (config save/update, gating controls, webhook endpoint/secret visibility, and recent coverage report surfacing) using integrations/code-quality APIs |
| Coveralls | ✅ | Coverage webhook processing + API configuration are implemented, with repository settings automation UX for gating/reporting controls, webhook endpoint/secret visibility, and recent Coveralls report surfacing; PR coverage checks now auto-update when webhook payload includes PR number |
| SonarQube | ✅ | Integration and quality-gate ingestion are implemented, with repository settings automation UX for server URL/token/project configuration, webhook endpoint/secret visibility, and recent SonarQube issue surfacing |
| Snyk | ✅ | Security scanning integration is implemented (including Trivy baseline support), and repository settings automation UX now provides Snyk provider configuration, webhook endpoint/secret visibility, and recent issue surfacing for workflow adoption |
6.2 CI Providers
| Feature | Status | Notes |
|---|---|---|
| GitHub Actions | ✅ | Compatible workflow format |
| GitLab CI | ✅ | Provider mapping + status normalization are implemented, and repo settings now support GitLab config save/update (baseUrl, projectId, token, sync toggles), webhook secret visibility, and recent build surfacing via integrations/external-ci |
| CircleCI | ✅ | Provider mapping + status normalization are implemented, and repo settings now support CircleCI config save/update (baseUrl, projectId, token, sync toggles), webhook secret visibility, and recent build surfacing via integrations/external-ci |
| Buildkite | ✅ | Provider mapping + status normalization are implemented, and repo settings now support Buildkite config save/update (baseUrl, projectId, token, sync toggles), webhook secret visibility, and recent build surfacing via integrations/external-ci |
| Jenkins | ✅ | Provider mapping + status normalization are implemented, and repo settings now support Jenkins config save/update (baseUrl, projectId, token, sync toggles), webhook secret visibility, and recent build surfacing via integrations/external-ci |
6.3 Issue Tracking
| Feature | Status | Notes |
|---|---|---|
| Jira | ✅ | Provider integration, repo config CRUD/webhook APIs, and repository settings automation UX are implemented (integrations/issue-trackers, settings/issue-trackers) with Jira-specific API URL/project/token controls, webhook secret visibility, and recent sync-link surfacing |
| Linear | ✅ | Provider integration, repo config CRUD/webhook APIs, and repository settings automation UX are implemented (integrations/issue-trackers, settings/issue-trackers) with team/token controls, webhook secret visibility, and recent sync-link surfacing |
| Trello | ✅ | Provider integration, repo config CRUD/webhook APIs, and repository settings automation UX are implemented (integrations/issue-trackers, settings/issue-trackers) with board/list + key:token controls, webhook secret visibility, and recent sync-link surfacing |
| ClickUp | ✅ | Provider integration, repo config CRUD/webhook APIs, and repository settings automation UX are implemented (integrations/issue-trackers, settings/issue-trackers) with list/token controls, webhook secret visibility, and recent sync-link surfacing |
6.4 Chat & Notifications
| Feature | Status | Notes |
|---|---|---|
| Slack | ✅ | slack-notifications.ts + schema |
| Microsoft Teams | ✅ | Teams webhook integration implemented (integrations/teams.ts) |
| Discord | ✅ | Discord webhook integration implemented (integrations/discord.ts) |
| Email notifications | ✅ | Email delivery test API is available via POST /user/email/test (dry-run + explicit destination + SMTP-config visibility), and advanced email capabilities now include template catalog + preview APIs (/user/email/templates), event-level routing management APIs (/user/email/routing), and delivery/routing analytics APIs (/user/email/analytics) |
6.5 Cloud & Infrastructure
| Feature | Status | Notes |
|---|---|---|
| AWS | ✅ | Provider integration and deploy hooks are implemented with repository-level cloud config CRUD/summary APIs (integrations/cloud), settings UX (settings/cloud-infra), and manual deploy trigger orchestration (cloud/deploy) including deployment-history surfacing |
| Google Cloud | ✅ | Cloud Run deployment integration and hooks are implemented with repository-level cloud config CRUD/summary APIs (integrations/cloud), settings UX (settings/cloud-infra), and manual deploy trigger orchestration (cloud/deploy) including deployment-history surfacing |
| Microsoft Azure | ✅ | App Service deployment integration and hooks are implemented with repository-level cloud config CRUD/summary APIs (integrations/cloud), settings UX (settings/cloud-infra), and manual deploy trigger orchestration (cloud/deploy) including deployment-history surfacing |
| Kubernetes-native | ✅ | Baseline Helm chart is included (deploy/helm/opencodehub) and Kubernetes deploy orchestration now includes repository-level config CRUD/summary APIs (integrations/cloud), dedicated settings UX (settings/cloud-infra), and manual deployment trigger flows (cloud/deploy) with deployment-history surfacing |
| Terraform/IaC hooks | ✅ | Terraform hook triggering is implemented via automation + repository APIs, and now includes repository-level Terraform config CRUD/summary APIs (integrations/cloud), dedicated settings UX (settings/cloud-infra), and manual plan/apply orchestration (iac/hooks) |
7. Dependency & Impact Awareness
| Feature | Status | Implementation Notes |
|---|---|---|
| PR dependency visualization | ✅ | Stack visualization in stacks.ts |
| Cross-repo change sets | ✅ | Change-set schema/library and APIs are implemented, and dedicated UI workflow is now available via src/pages/change-sets.astro (create/list/detail cross-repo sets with linked PR ordering context) |
| Breaking-change detection | ✅ | PR diff/file heuristics + persistence are implemented with improved semantic precision (deduplicated detections, source-file aware export/public API change signals, destructive schema/dependency removal scoring) |
| Database migration detection | ✅ | Migration detection now combines changed-file pattern matching with SQL/content semantics (destructive operation classification, reversibility signal extraction, downtime inference, and persisted explanatory notes) |
| API change awareness | ✅ | Dedicated API-awareness system is implemented with persisted api_change_detections, PR scan/read endpoints (pulls/{number}/api-changes), impact scan integration, and breaking API change propagation into merge-impact risk scoring |
8. Security
| Feature | Status | Implementation Notes |
|---|---|---|
| Role-based access control (RBAC) | ✅ | Custom role APIs are fully wired with organization RBAC management UI (/orgs/{org}/roles) covering role create/edit/delete and per-member custom-role assignment workflows (api/orgs/[org]/roles, api/orgs/[org]/members) |
| Organization & team management | ✅ | Schema + UI implemented |
| SSO (OIDC / SAML) | ✅ | oidc.ts implements OIDC fully, SAML missing |
| MFA | ✅ | TOTP implemented (src/pages/api/user/settings/2fa.ts) |
| Secret scanning | ✅ | Secret scanning workflow is fully operational: scan trigger/results (security/secret-scan), per-finding status transitions (security/secret-scan/{id} resolve/false-positive), policy evaluation API (security/policy-evaluation), and repository security UI actions for resolving/triaging findings with live policy impact visibility |
| Dependency vulnerability scanning | ✅ | Trivy integration in security.ts |
| License compliance scanning | ✅ | License checks are integrated with enforceable policy workflows: policy CRUD (security/policies), quick allow/block actions (security/policy-actions for allowed types and blocked licenses), policy evaluation/reporting (security/policy-evaluation), and repository security UI controls for allowlist/blocklist-driven governance |
| Audit logs | ✅ | audit.astro + schema |
| Session management | ✅ | JWT + session handling |
| Rate limiting | ✅ | Implemented with Redis backend (src/middleware/rate-limit.ts) |
| CSRF protection | ✅ | Implemented |
| Input validation | ✅ | Zod schemas throughout |
9. Analytics & Insights
| Feature | Status | Implementation Notes |
|---|---|---|
| PR cycle time analytics | ✅ | developer-metrics.ts |
| Review latency tracking | ✅ | Metrics schema exists |
| Merge frequency metrics | ✅ | Merge-frequency analytics now include repository insights dashboarding + trend forecasting: API supports bucketed time-series with forecast horizons (GET /repos/{owner}/{repo}/analytics/merge-frequency?bucket=&days=&forecastPoints=), and repository Insights UI now visualizes historical merge cadence plus short-range forecast (MergeFrequencyPanel) |
| Developer workload insights | ✅ | Workload insights now include trend intelligence and recommendation workflows: API returns contributor scores plus distribution/concentration/percentile signals and actionable recommendations (GET /repos/{owner}/{repo}/analytics/workload), and repository Insights UI now surfaces recommendation cards and workload leaderboards (DeveloperWorkloadPanel) |
| Hotspot file detection | ✅ | Implemented in analytics library + repository API endpoint |
| Delivery performance dashboards | ✅ | insights.astro pages |
| Export metrics | ✅ | JSON/CSV/Prometheus export implemented (analytics/export.ts) |
| Custom dashboards | ✅ | Dashboard CRUD + widget APIs implemented (api/analytics/dashboards) |
10. Notifications & Collaboration
| Feature | Status | Implementation Notes |
|---|---|---|
| Smart notifications | ✅ | Notification feed now supports smart priority sorting + user-level personalization and channel-aware routing controls via `GET /notifications?prioritize=true&personalize=true&channel=in_app |
| Blocking alerts | ✅ | Blocking notifications now include routing-aware summaries (/notifications/blocking/summary with stale counts/channel breakdown) and automated escalation workflows (GET/POST /notifications/blocking/escalations) that generate auditable escalation records |
| Daily/weekly digests | ✅ | Digest delivery now includes provider-level observability and dead-letter tooling: delivery/retry/dead-letter audit events, analytics endpoint (GET /user/notification-digests/analytics), dead-letter listing (GET /user/notification-digests/dead-letter), and explicit retry workflow (POST /user/notification-digests/dead-letter/retry) |
| Mentions & subscriptions | ✅ | Implemented |
| PR-level discussions | ✅ | Full threaded comments |
| Activity feeds | ✅ | Dashboard activity feed |
| Inbox sections | ✅ | inbox-sections.ts |
| Real-time updates | ✅ | realtime.ts with SSE |
11. Interfaces & Extensibility
| Feature | Status | Implementation Notes |
|---|---|---|
| Web UI | ✅ | Astro + React, full implementation |
| REST API | ✅ | Extensive API under /api/ |
| GraphQL API | ✅ | graphql.ts exists (Yoga based) |
| CLI | ✅ | cli/ package - 21+ commands |
| Plugin/extension system | ✅ | Plugin platform now includes runtime state/health tracking, enable/disable/reload/unload controls, dependency validation, hook timeout/failure telemetry, allowlist-aware directory loading, runtime config overrides, command execution, and admin management APIs (/admin/plugins, /admin/plugins/{name}) |
| Webhook events | ✅ | Full implementation |
| API documentation | ✅ | OpenAPI now covers expanded notification/digest/blocking escalation operations and admin plugin management routes (/notifications/blocking/escalations, /user/notification-digests/analytics, /user/notification-digests/dead-letter, /user/notification-digests/dead-letter/retry, /admin/plugins, /admin/plugins/{name}), with parity guard tests extended beyond pull routes (openapi-notifications-parity.test.ts) |
12. Self-Hosted & Deployment
| Feature | Status | Implementation Notes |
|---|---|---|
| Docker deployment | ✅ | Dockerfile + docker-compose |
| Kubernetes deployment | ✅ | Helm chart under deploy/helm/opencodehub is now production-hardened with security contexts, startup/liveness/readiness probes, service account and optional network policy templates, configurable scheduling controls (affinity/tolerations/topology spread), optional existing-secret wiring, and optional dedicated worker deployment/HPA |
| Horizontal scaling | ✅ | Scaling readiness is now explicitly validated and reported via GET /api/health (checks.scaling for distributed lock/rate-limit/queue-worker safety + Redis requirements), and merge-queue worker processing now uses per-repository distributed locks to avoid multi-instance double-processing |
| Backup & restore tools | ✅ | Backup script + admin sync/restore endpoints exist |
| Config-as-code | ✅ | Environment variables |
| Offline/air-gapped mode | ✅ | Offline guardrails now cover both webhook and integration configuration APIs for external CI, issue trackers, and code quality providers; integration matrix coverage is validated by tests/integration/air-gapped-api.test.ts with explicit AIR_GAPPED_MODE enforcement assertions |
| Multi-tenant mode | ✅ | Organization-based multi-tenancy |
Implementation Plan
Phase 1: Critical Security & Stability (Weeks 1-4)
CAUTION: These issues must be fixed before any production use
| Task | Priority | Effort | Files Involved |
|---|---|---|---|
| Fix runner auth bypass | 🔴 Critical | 2h | runner-auth.ts |
| Add executor resource limits & timeouts | 🔴 Critical | 4h | executor.ts |
| Distributed rate limiting (Redis) | 🔴 Critical | 8h | New middleware |
| Distributed merge queue locks | 🔴 Critical | 8h | merge-queue.ts |
| Complete TODO items | 🟠 High | 16h | Multiple files |
Phase 2: Core Feature Completion (Weeks 5-12)
| Task | Priority | Effort | Dependencies |
|---|---|---|---|
| SSO (OIDC) integration | 🔴 Critical | 24h | None |
| MFA/2FA implementation | 🔴 Critical | 16h | TOTP via otplib |
| CODEOWNERS enforcement | 🟠 High | 16h | automations.ts |
| Suggested changes in reviews | 🟠 High | 12h | PR comments |
| Kanban board UI | 🟡 Medium | 20h | Issues system |
| PR auto-merge rules | 🟡 Medium | 12h | automations.ts |
| Custom PR states | 🟡 Medium | 8h | Schema + UI |
| Required reviewers per state | 🟡 Medium | 8h | Branch protection |
Phase 3: Integrations & Extensions (Weeks 13-20)
| Task | Priority | Effort | Dependencies |
|---|---|---|---|
| GraphQL API layer | 🟠 High | 40h | REST API |
| Microsoft Teams integration | 🟡 Medium | 16h | Slack pattern |
| Discord integration | 🟡 Medium | 12h | Slack pattern |
| Jira integration | 🟡 Medium | 24h | Webhooks |
| API documentation (OpenAPI) | 🟡 Medium | 16h | REST endpoints |
| Plugin system enhancement | 🟡 Medium | 24h | plugins.ts |
Phase 4: Advanced Features (Weeks 21-32)
| Task | Priority | Effort | Dependencies |
|---|---|---|---|
| Epics & sub-tasks | 🟡 Medium | 24h | Issues |
| Custom issue fields | 🟡 Medium | 20h | Schema |
| Issue workflows | 🟡 Medium | 32h | State machine |
| Cross-repo support | 🟡 Medium | 40h | Architecture |
| License compliance scanning | 🟡 Medium | 16h | Security scan |
| Kubernetes Helm chart | 🟡 Medium | 16h | Docker |
| Backup & restore tools | 🟡 Medium | 24h | DB operations |
| API breaking change detection | 🔵 Low | 40h | AI/AST analysis |