OpenCodeHub Feature Audit & Implementation Plan
Audit Date: February 19, 2026
Total Features Analyzed: 125
Status: Reconciled summary updated to reflect latest implemented work through February 19, 2026.
Feature Matrix Summary
| Category | Implemented | Partial | Missing | Total |
|---|---|---|---|---|
| Repository & Git | 9 | 4 | 0 | 13 |
| Pull Requests | 9 | 6 | 0 | 15 |
| Code Review | 9 | 1 | 0 | 10 |
| Issues & Planning | 10 | 0 | 0 | 10 |
| CI/CD & Automation | 5 | 3 | 0 | 8 |
| Third-Party Integrations | 4 | 18 | 0 | 22 |
| Dependency & Impact Awareness | 1 | 4 | 0 | 5 |
| Security | 9 | 3 | 0 | 12 |
| Analytics & Insights | 6 | 2 | 0 | 8 |
| Notifications & Collaboration | 5 | 3 | 0 | 8 |
| Interfaces & Extensibility | 5 | 2 | 0 | 7 |
| Self-Hosted & Deployment | 4 | 3 | 0 | 7 |
| Total | 76 | 49 | 0 | 125 |
1. Repository & Git
| Feature | Status | Implementation Notes |
|---|---|---|
| Full Git protocol (SSH/HTTPS) | ✅ | ssh.ts, git-server.ts fully implemented |
| Repository hosting | ✅ | Multiple storage adapters (S3, R2, local, GDrive) |
| Repository mirroring | ⚠️ | Background sync cron plus repository mirror config/manual-sync APIs are implemented (settings/mirror, settings/mirror/sync) with derived health telemetry (isHealthy, isStale, lastSyncAgeMinutes); scheduled sync automation now supports stale-only windows, sync-interval/max-repo controls, and batch monitoring metrics (eligible, skipped, stale, failedRepoIds, durationMs) via cron/mirror-sync, while advanced alerting/runbook workflows remain partial |
| Forks & pull-based workflows | ✅ | fork.ts API, UI implemented |
| Monorepo support | ✅ | Advanced path scoping is implemented: repository settings CRUD APIs for path rules (settings/path-permissions), read/write enforcement across PR/review/comment/impact/template flows, and pre-receive push checks now use centralized permission-level evaluation (checkPathPermissions) for protected monorepo paths |
| Git LFS | ✅ | lfs.ts with batch API (upload/download) |
| Submodules | ✅ | Native Git support, no special handling needed |
| Branch protection rules | ✅ | Schema + UI + API in place |
| Repository templates | ✅ | Template creation/listing are implemented with access-aware discovery filters (/repos/templates?q=&owner=&visibility=) and dedicated governance controls via settings/template (publish/unpublish, visibility governance, private-template acknowledgment guardrail, archived/mirror safety checks, and policy introspection surfaced in repo settings UX) |
| Repository Wiki | ✅ | Implemented (Phase 8) |
| File-level permissions | ✅ | Path-scoped enforcement now covers PR comment create/edit/delete/list filtering, PR review list comment filtering, AI review suggestion read filtering, single-review inline comments, batch-review comment submission, suggestion-apply, partial file-approval create/revoke and read-filter flows, PR rewrite operations, PR impact scan execution/read filtering, PR template discovery path checks, PR merge operations (single merge, auto-merge enable/disable, bulk-merge), and push-time branch updates via centralized checkPathPermissions |
| Commit signing (GPG) | ✅ | GPG key management UI exists |
| Commit signing (SSH) | ✅ | SSH key management UI exists |
2. Pull Requests
| Feature | Status | Implementation Notes |
|---|---|---|
| Native stacked PRs | ✅ | stacks.ts - create, add, reorder, visualize |
| PR dependency graphs (DAG) | ✅ | getStackVisualization() implemented |
| Cross-PR dependency detection | ✅ | Automatic branch/file dependency graph API (pulls/dependencies) plus stack-order suggestion/apply API (POST/PUT pulls/stack-order) are implemented, and PR list UI now provides dependency analysis, selection-based order suggestion, and one-click stack creation workflow for detected dependency sets |
| Stack rebase & auto-update | ✅ | Stack rebase/auto-update endpoints now expose both status and execution workflows (GET/POST stacks/[stackId]/auto-update, stacks/[stackId]/rebase), and PR stack UI includes guided maintenance actions (live behind-status checks, one-click auto-update, manual rebase fallback, and actionable success/conflict feedback) |
| Stack-level approvals | ✅ | Stack approvals now include end-to-end orchestration: readiness/blocker context + per-PR summary APIs (stacks/[stackId]/approvals), recommended reviewer derivation, dry-run reviewer eligibility previews, and PR stack UI actions for previewing eligibility, requesting recommended reviewers, and requesting custom reviewer batches with live blocker/status feedback |
| Bulk merge (merge stacks) | ✅ | Explicit stack and selected-PR bulk merge APIs are implemented (stacks/[stackId]/merge, pulls/bulk-merge) with orchestration UX in PR surfaces: stack merge readiness/blocker checks + merge-method controls on PR stack panel, and selected-PR bulk-merge controls on the PR list workflow panel |
| Custom PR states | ✅ | State definitions and transition APIs are fully wired (workflow/states, pulls/{number}/state), PR detail UI now provides guided state transitions with inline policy hints and blocker feedback, and new PR creation auto-applies repository default custom state when configured (pulls/index) |
| Required reviewers per state | ✅ | State reviewer requirements are enforced during transitions, and required-reviewer introspection now supports state-policy preview mode (pulls/{number}/required-reviewers?stateId=) including team/user requirement progress; PR state UI surfaces live per-state reviewer policy guidance before applying transitions |
| PR merge queues | ✅ | merge-queue.ts (590+ lines) |
| Conflict detection before merge | ✅ | mergeable field in PR schema |
| Auto-merge rules | ✅ | Auto-merge rules engine plus explicit PR auto-merge control/status APIs are fully wired (pulls/{number}/auto-merge), including policy summary and per-rule introspection in status responses (policySummary, ruleEvaluations) and PR detail UI controls for enable/disable, method selection, blockers, and live rule evaluation visibility |
| Draft PRs | ✅ | Schema supports isDraft field |
| PR labels | ✅ | Full implementation with schema |
| PR assignees | ✅ | Full implementation with schema |
| PR checks | ✅ | PR check ingestion now supports provider-aware webhook payload normalization (normalized/GitHub Actions/GitLab/CircleCI/Buildkite/Jenkins) via external-ci/checks, PR check summary/read APIs remain in pulls/{number}/checks, PR detail UI now surfaces live check summary/list refresh, and external-CI settings provide provider-specific setup payload presets |
3. Code Review
| Feature | Status | Implementation Notes |
|---|---|---|
| Inline code comments | ✅ | pullRequestComments schema with line/position |
| Threaded discussions | ✅ | Reply threading via replyToId |
| Suggested changes | ✅ | Suggestion creation + apply endpoints implemented (pulls/[pullNumber]/suggestions/apply.ts) |
| Batch comments | ✅ | Atomic batch review submission endpoint + PR conversation UI integration (reviews/batch) |
| Code owner enforcement | ✅ | Enforced in PR state transitions and merge queue (pr-codeowner.ts), with dedicated PR policy introspection endpoint (pulls/{number}/codeowner-enforcement) and PR UI visibility for active rule source, blockers, and per-file CODEOWNERS approval status |
| Review templates | ✅ | UI + API + defaults implemented (review-templates) |
| Required approval policies | ✅ | Via branch protection rules |
| Partial file approvals | ✅ | Implemented via API + PR UI (partial-file-approvals, file-approvals.ts) |
| Multi-reviewer rules | ⚠️ | Merge gates now enforce explicit required-reviewer approvals; broader state/rule UX still maturing |
| AI code review | ✅ | Multi-provider adapters (OpenAI/Anthropic/Groq/Bytez/OpenRouter/Together/Google/Local-Ollama) + external-agent async callback flow |
4. Issues & Planning
| Feature | Status | Implementation Notes |
|---|---|---|
| Issue tracking | ✅ | Full schema + UI for issues |
| Epics and sub-tasks | ✅ | Implemented (Phase 8) |
| Custom issue fields | ✅ | Library + issue integration + settings API (settings/fields) now implemented |
| Issue workflows | ✅ | Repository issue statuses workflow endpoints implemented |
| Milestones & roadmaps | ✅ | milestones schema + UI |
| Kanban boards | ✅ | Implemented |
| PR ↔ Issue linking | ✅ | Explicit link/unlink APIs + UI + auto-link parsing (including scoped refs like owner/repo#123) |
| Cross-repo issues | ✅ | Cross-repo link parsing/storage/API implemented |
| Labels | ✅ | Full implementation |
| Assignees | ✅ | Full implementation |
5. CI/CD & Automation
| Feature | Status | Implementation Notes |
|---|---|---|
| Native CI pipeline support | ✅ | pipeline.ts - 1066 lines, GitHub Actions compatible |
| External CI integration | ⚠️ | Provider-aware integration APIs and normalized status ingestion are implemented, with repo-level integration health/status + token rotate/disable APIs (external-ci, external-ci/checks); provider-specific setup UX still maturing |
| Self-hosted runners | ✅ | runner/ with Docker executor |
| Secrets management | ✅ | Schema + UI for repo/org secrets |
| Merge checks & gates | ✅ | Required status checks + external CI gate readiness are enforced, with explicit PR gate introspection via pulls/{number}/merge-readiness now including policy reports (failedByType, recommendations, pass/fail counts), active label/review/custom gate evaluation in ci-gates.ts with gate-type metadata, repository-level gate policy management/reporting APIs (/repos/{owner}/{repo}/merge-gates, /repos/{owner}/{repo}/merge-gates/{id}), and PR detail merge-gate policy UX for live blockers/breakdowns/remediation guidance |
| Automation rules engine | ⚠️ | Conditions/actions active with retry + dead-letter audit logging; advanced orchestration still maturing |
| Webhooks | ✅ | Full implementation with UI |
| Workflow templates | ⚠️ | Template library plus repo-level listing/apply APIs are now implemented (workflow/templates); broader UX/workflow adoption still maturing |
6. Third-Party Integrations
6.1 Code Quality & Coverage
| Feature | Status | Notes |
|---|---|---|
| Codecov | ⚠️ | Coverage webhook processing + API configuration implemented; deeper workflow/UI automation is still partial |
| Coveralls | ⚠️ | Coverage webhook processing + API configuration implemented; deeper workflow/UI automation is still partial |
| SonarQube | ⚠️ | Integration and quality-gate ingestion implemented, enterprise-depth coverage still partial |
| Snyk | ⚠️ | Trivy-based scanning exists |
6.2 CI Providers
| Feature | Status | Notes |
|---|---|---|
| GitHub Actions | ✅ | Compatible workflow format |
| GitLab CI | ⚠️ | External CI provider mapping + status normalization + repo integration APIs implemented |
| CircleCI | ⚠️ | External CI provider mapping + status normalization + repo integration APIs implemented |
| Buildkite | ⚠️ | External CI provider mapping + status normalization + repo integration APIs implemented |
| Jenkins | ⚠️ | External CI provider mapping + status normalization + repo integration APIs implemented |
6.3 Issue Tracking
| Feature | Status | Notes |
|---|---|---|
| Jira | ⚠️ | Basic integration implemented (jira.ts) |
| Linear | ⚠️ | Provider integration + repo config/webhook APIs implemented; workflow/UI depth can expand |
| Trello | ⚠️ | Provider integration + repo config/webhook APIs implemented; workflow/UI depth can expand |
| ClickUp | ⚠️ | Provider integration + repo config/webhook APIs implemented; workflow/UI depth can expand |
6.4 Chat & Notifications
| Feature | Status | Notes |
|---|---|---|
| Slack | ✅ | slack-notifications.ts + schema |
| Microsoft Teams | ✅ | Teams webhook integration implemented (integrations/teams.ts) |
| Discord | ✅ | Discord webhook integration implemented (integrations/discord.ts) |
| Email notifications | ⚠️ | Email delivery test API is now available via POST /user/email/test (dry-run + explicit destination + SMTP-config visibility); advanced template/routing/analytics depth remains partial |
6.5 Cloud & Infrastructure
| Feature | Status | Notes |
|---|---|---|
| AWS | ⚠️ | Provider integration and deploy hooks implemented; broader service coverage can expand |
| Google Cloud | ⚠️ | Cloud Run deployment integration and hooks implemented |
| Microsoft Azure | ⚠️ | App Service deployment integration and hooks implemented |
| Kubernetes-native | ⚠️ | Baseline Helm chart added (deploy/helm/opencodehub); operator-grade lifecycle management remains |
| Terraform/IaC hooks | ⚠️ | Terraform hook triggering implemented via automation + repository API; broader IaC providers can be expanded |
7. Dependency & Impact Awareness
| Feature | Status | Implementation Notes |
|---|---|---|
| PR dependency visualization | ✅ | Stack visualization in stacks.ts |
| Cross-repo change sets | ⚠️ | Implemented via change-set schema/library and API endpoints; UI workflow still limited |
| Breaking-change detection | ⚠️ | Implemented with PR diff/file heuristics + persistence; semantic precision can be improved |
| Database migration detection | ⚠️ | Implemented from changed-file pattern detection + persistence; deeper SQL semantic analysis pending |
| API change awareness | ⚠️ | AI review can detect, no dedicated system |
8. Security
| Feature | Status | Implementation Notes |
|---|---|---|
| Role-based access control (RBAC) | ⚠️ | Custom roles (custom_roles table) added, UI pending |
| Organization & team management | ✅ | Schema + UI implemented |
| SSO (OIDC / SAML) | ✅ | oidc.ts implements OIDC fully, SAML missing |
| MFA | ✅ | TOTP implemented (src/pages/api/user/settings/2fa.ts) |
| Secret scanning | ⚠️ | Scan trigger + result APIs implemented with paginated vulnerabilities endpoint; policy workflows still limited |
| Dependency vulnerability scanning | ✅ | Trivy integration in security.ts |
| License compliance scanning | ⚠️ | Trivy license checks integrated in security.ts; policy/allowlist workflows still limited |
| Audit logs | ✅ | audit.astro + schema |
| Session management | ✅ | JWT + session handling |
| Rate limiting | ✅ | Implemented with Redis backend (src/middleware/rate-limit.ts) |
| CSRF protection | ✅ | Implemented |
| Input validation | ✅ | Zod schemas throughout |
9. Analytics & Insights
| Feature | Status | Implementation Notes |
|---|---|---|
| PR cycle time analytics | ✅ | developer-metrics.ts |
| Review latency tracking | ✅ | Metrics schema exists |
| Merge frequency metrics | ⚠️ | Time-series merge frequency API now available via GET /repos/{owner}/{repo}/analytics/merge-frequency (daily/weekly buckets); higher-level dashboarding/forecasting remains partial |
| Developer workload insights | ⚠️ | Repository workload insights API now available via GET /repos/{owner}/{repo}/analytics/workload with scored contributor summaries; deeper trend intelligence/recommendation UX remains partial |
| Hotspot file detection | ✅ | Implemented in analytics library + repository API endpoint |
| Delivery performance dashboards | ✅ | insights.astro pages |
| Export metrics | ✅ | JSON/CSV/Prometheus export implemented (analytics/export.ts) |
| Custom dashboards | ✅ | Dashboard CRUD + widget APIs implemented (api/analytics/dashboards) |
10. Notifications & Collaboration
| Feature | Status | Implementation Notes |
|---|---|---|
| Smart notifications | ⚠️ | API now supports smart priority scoring/sorting via GET /notifications?prioritize=true; deeper ML personalization and channel-level routing remain partial |
| Blocking alerts | ⚠️ | Blocking-focused notification feed + summary APIs are available (GET /notifications?filter=blocking, GET /notifications/blocking/summary); automated escalation/routing depth remains partial |
| Daily/weekly digests | ⚠️ | Scheduler is timezone-aware with cron endpoint/tests, user-scoped digest test API (/user/notification-digests/test), and bounded retry/observability metrics (maxRetries, retried, recovered); provider-level delivery analytics and dead-letter tooling remain partial |
| Mentions & subscriptions | ✅ | Implemented |
| PR-level discussions | ✅ | Full threaded comments |
| Activity feeds | ✅ | Dashboard activity feed |
| Inbox sections | ✅ | inbox-sections.ts |
| Real-time updates | ✅ | realtime.ts with SSE |
11. Interfaces & Extensibility
| Feature | Status | Implementation Notes |
|---|---|---|
| Web UI | ✅ | Astro + React, full implementation |
| REST API | ✅ | Extensive API under /api/ |
| GraphQL API | ✅ | graphql.ts exists (Yoga based) |
| CLI | ✅ | cli/ package - 21+ commands |
| Plugin/extension system | ⚠️ | plugins.ts infrastructure exists, but basic |
| Webhook events | ✅ | Full implementation |
| API documentation | ⚠️ | OpenAPI coverage now includes AI callback and AI review trigger/read routes, PR create/detail/update/template routes, review/comment flows (including path-scoped comment visibility metadata), stack approvals/rebase/auto-update/merge routes, PR bulk-merge/auto-merge/checks/merge/impact/rewrite routes, PR issue-links and file-approvals routes, merge-gate reporting metadata, notifications/email test endpoints, and analytics merge-frequency/workload routes, plus parity guard tests for pulls/* route documentation; broader endpoint parity still incomplete |
12. Self-Hosted & Deployment
| Feature | Status | Implementation Notes |
|---|---|---|
| Docker deployment | ✅ | Dockerfile + docker-compose |
| Kubernetes deployment | ⚠️ | Official baseline Helm chart now included under deploy/helm/opencodehub |
| Horizontal scaling | ⚠️ | Production now requires Redis for distributed locks/rate-limit; broader queue/load validation still pending |
| Backup & restore tools | ✅ | Backup script + admin sync/restore endpoints exist |
| Config-as-code | ✅ | Environment variables |
| Offline/air-gapped mode | ⚠️ | Runtime guardrails + env flag + docs implemented; full offline integration test matrix still pending |
| Multi-tenant mode | ✅ | Organization-based multi-tenancy |
Implementation Plan
Phase 1: Critical Security & Stability (Weeks 1-4)
CAUTION: These issues must be fixed before any production use
| Task | Priority | Effort | Files Involved |
|---|---|---|---|
| Fix runner auth bypass | 🔴 Critical | 2h | runner-auth.ts |
| Add executor resource limits & timeouts | 🔴 Critical | 4h | executor.ts |
| Distributed rate limiting (Redis) | 🔴 Critical | 8h | New middleware |
| Distributed merge queue locks | 🔴 Critical | 8h | merge-queue.ts |
| Complete TODO items | 🟠 High | 16h | Multiple files |
Phase 2: Core Feature Completion (Weeks 5-12)
| Task | Priority | Effort | Dependencies |
|---|---|---|---|
| SSO (OIDC) integration | 🔴 Critical | 24h | None |
| MFA/2FA implementation | 🔴 Critical | 16h | TOTP via otplib |
| CODEOWNERS enforcement | 🟠 High | 16h | automations.ts |
| Suggested changes in reviews | 🟠 High | 12h | PR comments |
| Kanban board UI | 🟡 Medium | 20h | Issues system |
| PR auto-merge rules | 🟡 Medium | 12h | automations.ts |
| Custom PR states | 🟡 Medium | 8h | Schema + UI |
| Required reviewers per state | 🟡 Medium | 8h | Branch protection |
Phase 3: Integrations & Extensions (Weeks 13-20)
| Task | Priority | Effort | Dependencies |
|---|---|---|---|
| GraphQL API layer | 🟠 High | 40h | REST API |
| Microsoft Teams integration | 🟡 Medium | 16h | Slack pattern |
| Discord integration | 🟡 Medium | 12h | Slack pattern |
| Jira integration | 🟡 Medium | 24h | Webhooks |
| API documentation (OpenAPI) | 🟡 Medium | 16h | REST endpoints |
| Plugin system enhancement | 🟡 Medium | 24h | plugins.ts |
Phase 4: Advanced Features (Weeks 21-32)
| Task | Priority | Effort | Dependencies |
|---|---|---|---|
| Epics & sub-tasks | 🟡 Medium | 24h | Issues |
| Custom issue fields | 🟡 Medium | 20h | Schema |
| Issue workflows | 🟡 Medium | 32h | State machine |
| Cross-repo support | 🟡 Medium | 40h | Architecture |
| License compliance scanning | 🟡 Medium | 16h | Security scan |
| Kubernetes Helm chart | 🟡 Medium | 16h | Docker |
| Backup & restore tools | 🟡 Medium | 24h | DB operations |
| API breaking change detection | 🔵 Low | 40h | AI/AST analysis |