# OpenCodeHub Feature Audit & Implementation Plan
**Audit Date:** February 19, 2026
**Total Features Analyzed:** 125
**Status:** Reconciled summary updated to reflect latest implemented work through February 19, 2026.

## Feature Matrix Summary

| Category | Implemented | Partial | Missing | Total |
| :--- | :---: | :---: | :---: | :---: |
| **Repository & Git** | 9 | 4 | 0 | 13 |
| **Pull Requests** | 9 | 6 | 0 | 15 |
| **Code Review** | 9 | 1 | 0 | 10 |
| **Issues & Planning** | 10 | 0 | 0 | 10 |
| **CI/CD & Automation** | 7 | 1 | 0 | 8 |
| **Third-Party Integrations** | 22 | 0 | 0 | 22 |
| **Dependency & Impact Awareness** | 5 | 0 | 0 | 5 |
| **Security** | 12 | 0 | 0 | 12 |
| **Analytics & Insights** | 8 | 0 | 0 | 8 |
| **Notifications & Collaboration** | 8 | 0 | 0 | 8 |
| **Interfaces & Extensibility** | 7 | 0 | 0 | 7 |
| **Self-Hosted & Deployment** | 4 | 3 | 0 | 7 |
| **Total** | **110** | **15** | **0** | **125** |

---

## 1. Repository & Git
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Full Git protocol (SSH/HTTPS) | ✅ | `ssh.ts`, `git-server.ts` fully implemented |
| Repository hosting | ✅ | Multiple storage adapters (S3, R2, local, GDrive) |
| Repository mirroring | ⚠️ | Background sync cron plus repository mirror config/manual-sync APIs are implemented (`settings/mirror`, `settings/mirror/sync`) with derived health telemetry (`isHealthy`, `isStale`, `lastSyncAgeMinutes`); scheduled sync automation now supports stale-only windows, sync-interval/max-repo controls, and batch monitoring metrics (`eligible`, `skipped`, `stale`, `failedRepoIds`, `durationMs`) via `cron/mirror-sync`, while advanced alerting/runbook workflows remain partial |
| Forks & pull-based workflows | ✅ | `fork.ts` API, UI implemented |
| Monorepo support | ✅ | Advanced path scoping is implemented: repository settings CRUD APIs for path rules (`settings/path-permissions`), read/write enforcement across PR/review/comment/impact/template flows, and pre-receive push checks now use centralized permission-level evaluation (`checkPathPermissions`) for protected monorepo paths |
| Git LFS | ✅ | `lfs.ts` with batch API (upload/download) |
| Submodules | ✅ | Native Git support, no special handling needed |
| Branch protection rules | ✅ | Schema + UI + API in place |
| Repository templates | ✅ | Template creation/listing are implemented with access-aware discovery filters (`/repos/templates?q=&owner=&visibility=`) and dedicated governance controls via `settings/template` (publish/unpublish, visibility governance, private-template acknowledgment guardrail, archived/mirror safety checks, and policy introspection surfaced in repo settings UX) |
| Repository Wiki | ✅ | Implemented (Phase 8) |
| File-level permissions | ✅ | Path-scoped enforcement now covers PR comment create/edit/delete/list filtering, PR review list comment filtering, AI review suggestion read filtering, single-review inline comments, batch-review comment submission, suggestion-apply, partial file-approval create/revoke and read-filter flows, PR rewrite operations, PR impact scan execution/read filtering, PR template discovery path checks, PR merge operations (single merge, auto-merge enable/disable, bulk-merge), and push-time branch updates via centralized `checkPathPermissions` |
| Commit signing (GPG) | ✅ | GPG key management UI exists |
| Commit signing (SSH) | ✅ | SSH key management UI exists |

## 2. Pull Requests
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Native stacked PRs | ✅ | `stacks.ts` - create, add, reorder, visualize |
| PR dependency graphs (DAG) | ✅ | `getStackVisualization()` implemented |
| Cross-PR dependency detection | ✅ | Automatic branch/file dependency graph API (`pulls/dependencies`) plus stack-order suggestion/apply API (`POST/PUT pulls/stack-order`) are implemented, and PR list UI now provides dependency analysis, selection-based order suggestion, and one-click stack creation workflow for detected dependency sets |
| Stack rebase & auto-update | ✅ | Stack rebase/auto-update endpoints now expose both status and execution workflows (`GET/POST stacks/[stackId]/auto-update`, `stacks/[stackId]/rebase`), and PR stack UI includes guided maintenance actions (live behind-status checks, one-click auto-update, manual rebase fallback, and actionable success/conflict feedback) |
| Stack-level approvals | ✅ | Stack approvals now include end-to-end orchestration: readiness/blocker context + per-PR summary APIs (`stacks/[stackId]/approvals`), recommended reviewer derivation, dry-run reviewer eligibility previews, and PR stack UI actions for previewing eligibility, requesting recommended reviewers, and requesting custom reviewer batches with live blocker/status feedback |
| Bulk merge (merge stacks) | ✅ | Explicit stack and selected-PR bulk merge APIs are implemented (`stacks/[stackId]/merge`, `pulls/bulk-merge`) with orchestration UX in PR surfaces: stack merge readiness/blocker checks + merge-method controls on PR stack panel, and selected-PR bulk-merge controls on the PR list workflow panel |
| Custom PR states | ✅ | State definitions and transition APIs are fully wired (`workflow/states`, `pulls/{number}/state`), PR detail UI now provides guided state transitions with inline policy hints and blocker feedback, and new PR creation auto-applies repository default custom state when configured (`pulls/index`) |
| Required reviewers per state | ✅ | State reviewer requirements are enforced during transitions, and required-reviewer introspection now supports state-policy preview mode (`pulls/{number}/required-reviewers?stateId=`) including team/user requirement progress; PR state UI surfaces live per-state reviewer policy guidance before applying transitions |
| PR merge queues | ✅ | `merge-queue.ts` (590+ lines) |
| Conflict detection before merge | ✅ | `mergeable` field in PR schema |
| Auto-merge rules | ✅ | Auto-merge rules engine plus explicit PR auto-merge control/status APIs are fully wired (`pulls/{number}/auto-merge`), including policy summary and per-rule introspection in status responses (`policySummary`, `ruleEvaluations`) and PR detail UI controls for enable/disable, method selection, blockers, and live rule evaluation visibility |
| Draft PRs | ✅ | Schema supports `isDraft` field |
| PR labels | ✅ | Full implementation with schema |
| PR assignees | ✅ | Full implementation with schema |
| PR checks | ✅ | PR check ingestion now supports provider-aware webhook payload normalization (normalized/GitHub Actions/GitLab/CircleCI/Buildkite/Jenkins) via `external-ci/checks`, PR check summary/read APIs remain in `pulls/{number}/checks`, PR detail UI now surfaces live check summary/list refresh, and external-CI settings provide provider-specific setup payload presets |

## 3. Code Review
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Inline code comments | ✅ | `pullRequestComments` schema with line/position |
| Threaded discussions | ✅ | Reply threading via `replyToId` |
| Suggested changes | ✅ | Suggestion creation + apply endpoints implemented (`pulls/[pullNumber]/suggestions/apply.ts`) |
| Batch comments | ✅ | Atomic batch review submission endpoint + PR conversation UI integration (`reviews/batch`) |
| Code owner enforcement | ✅ | Enforced in PR state transitions and merge queue (`pr-codeowner.ts`), with dedicated PR policy introspection endpoint (`pulls/{number}/codeowner-enforcement`) and PR UI visibility for active rule source, blockers, and per-file CODEOWNERS approval status |
| Review templates | ✅ | UI + API + defaults implemented (`review-templates`) |
| Required approval policies | ✅ | Via branch protection rules |
| Partial file approvals | ✅ | Implemented via API + PR UI (`partial-file-approvals`, `file-approvals.ts`) |
| Multi-reviewer rules | ⚠️ | Merge gates now enforce explicit required-reviewer approvals; broader state/rule UX still maturing |
| AI code review | ✅ | Multi-provider adapters (OpenAI/Anthropic/Groq/Bytez/OpenRouter/Together/Google/Local-Ollama) + external-agent async callback flow |

## 4. Issues & Planning
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Issue tracking | ✅ | Full schema + UI for issues |
| Epics and sub-tasks | ✅ | Implemented (Phase 8) |
| Custom issue fields | ✅ | Library + issue integration + settings API (`settings/fields`) now implemented |
| Issue workflows | ✅ | Repository issue statuses workflow endpoints implemented |
| Milestones & roadmaps | ✅ | `milestones` schema + UI |
| Kanban boards | ✅ | Implemented |
| PR ↔ Issue linking | ✅ | Explicit link/unlink APIs + UI + auto-link parsing (including scoped refs like `owner/repo#123`) |
| Cross-repo issues | ✅ | Cross-repo link parsing/storage/API implemented |
| Labels | ✅ | Full implementation |
| Assignees | ✅ | Full implementation |

## 5. CI/CD & Automation
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Native CI pipeline support | ✅ | `pipeline.ts` - 1066 lines, GitHub Actions compatible |
| External CI integration | ✅ | Provider-aware integration APIs and normalized status ingestion are implemented, with repo-level integration health/status + token rotate/disable APIs (`external-ci`, `external-ci/checks`) plus provider-specific configuration/summary APIs and settings UX for GitLab/CircleCI/Buildkite/Jenkins (`integrations/external-ci`) including setup fields, webhook secret visibility, and recent build surfacing |
| Self-hosted runners | ✅ | `runner/` with Docker executor |
| Secrets management | ✅ | Schema + UI for repo/org secrets |
| Merge checks & gates | ✅ | Required status checks + external CI gate readiness are enforced, with explicit PR gate introspection via `pulls/{number}/merge-readiness` now including policy reports (`failedByType`, recommendations, pass/fail counts), active label/review/custom gate evaluation in `ci-gates.ts` with gate-type metadata, repository-level gate policy management/reporting APIs (`/repos/{owner}/{repo}/merge-gates`, `/repos/{owner}/{repo}/merge-gates/{id}`), and PR detail merge-gate policy UX for live blockers/breakdowns/remediation guidance |
| Automation rules engine | ⚠️ | Conditions/actions active with retry + dead-letter audit logging; advanced orchestration still maturing |
| Webhooks | ✅ | Full implementation with UI |
| Workflow templates | ✅ | Template library plus repo-level listing/apply APIs are implemented (`workflow/templates`), and repository Actions settings now include workflow template discovery/adoption UX with category/language filters, direct apply flow, and applied-workflow visibility |

## 6. Third-Party Integrations
### 6.1 Code Quality & Coverage
| Feature | Status | Notes |
| :--- | :---: | :--- |
| Codecov | ✅ | Coverage webhook processing + API configuration are implemented, and repository settings now provide Codecov automation UX (config save/update, gating controls, webhook endpoint/secret visibility, and recent coverage report surfacing) using `integrations/code-quality` APIs |
| Coveralls | ✅ | Coverage webhook processing + API configuration are implemented, with repository settings automation UX for gating/reporting controls, webhook endpoint/secret visibility, and recent Coveralls report surfacing; PR coverage checks now auto-update when webhook payload includes PR number |
| SonarQube | ✅ | Integration and quality-gate ingestion are implemented, with repository settings automation UX for server URL/token/project configuration, webhook endpoint/secret visibility, and recent SonarQube issue surfacing |
| Snyk | ✅ | Security scanning integration is implemented (including Trivy baseline support), and repository settings automation UX now provides Snyk provider configuration, webhook endpoint/secret visibility, and recent issue surfacing for workflow adoption |

### 6.2 CI Providers
| Feature | Status | Notes |
| :--- | :---: | :--- |
| GitHub Actions | ✅ | Compatible workflow format |
| GitLab CI | ✅ | Provider mapping + status normalization are implemented, and repo settings now support GitLab config save/update (`baseUrl`, `projectId`, token, sync toggles), webhook secret visibility, and recent build surfacing via `integrations/external-ci` |
| CircleCI | ✅ | Provider mapping + status normalization are implemented, and repo settings now support CircleCI config save/update (`baseUrl`, `projectId`, token, sync toggles), webhook secret visibility, and recent build surfacing via `integrations/external-ci` |
| Buildkite | ✅ | Provider mapping + status normalization are implemented, and repo settings now support Buildkite config save/update (`baseUrl`, `projectId`, token, sync toggles), webhook secret visibility, and recent build surfacing via `integrations/external-ci` |
| Jenkins | ✅ | Provider mapping + status normalization are implemented, and repo settings now support Jenkins config save/update (`baseUrl`, `projectId`, token, sync toggles), webhook secret visibility, and recent build surfacing via `integrations/external-ci` |

### 6.3 Issue Tracking
| Feature | Status | Notes |
| :--- | :---: | :--- |
| Jira | ✅ | Provider integration, repo config CRUD/webhook APIs, and repository settings automation UX are implemented (`integrations/issue-trackers`, `settings/issue-trackers`) with Jira-specific API URL/project/token controls, webhook secret visibility, and recent sync-link surfacing |
| Linear | ✅ | Provider integration, repo config CRUD/webhook APIs, and repository settings automation UX are implemented (`integrations/issue-trackers`, `settings/issue-trackers`) with team/token controls, webhook secret visibility, and recent sync-link surfacing |
| Trello | ✅ | Provider integration, repo config CRUD/webhook APIs, and repository settings automation UX are implemented (`integrations/issue-trackers`, `settings/issue-trackers`) with board/list + `key:token` controls, webhook secret visibility, and recent sync-link surfacing |
| ClickUp | ✅ | Provider integration, repo config CRUD/webhook APIs, and repository settings automation UX are implemented (`integrations/issue-trackers`, `settings/issue-trackers`) with list/token controls, webhook secret visibility, and recent sync-link surfacing |

### 6.4 Chat & Notifications
| Feature | Status | Notes |
| :--- | :---: | :--- |
| Slack | ✅ | `slack-notifications.ts` + schema |
| Microsoft Teams | ✅ | Teams webhook integration implemented (`integrations/teams.ts`) |
| Discord | ✅ | Discord webhook integration implemented (`integrations/discord.ts`) |
| Email notifications | ✅ | Email delivery test API is available via `POST /user/email/test` (dry-run + explicit destination + SMTP-config visibility), and advanced email capabilities now include template catalog + preview APIs (`/user/email/templates`), event-level routing management APIs (`/user/email/routing`), and delivery/routing analytics APIs (`/user/email/analytics`) |

### 6.5 Cloud & Infrastructure
| Feature | Status | Notes |
| :--- | :---: | :--- |
| AWS | ✅ | Provider integration and deploy hooks are implemented with repository-level cloud config CRUD/summary APIs (`integrations/cloud`), settings UX (`settings/cloud-infra`), and manual deploy trigger orchestration (`cloud/deploy`) including deployment-history surfacing |
| Google Cloud | ✅ | Cloud Run deployment integration and hooks are implemented with repository-level cloud config CRUD/summary APIs (`integrations/cloud`), settings UX (`settings/cloud-infra`), and manual deploy trigger orchestration (`cloud/deploy`) including deployment-history surfacing |
| Microsoft Azure | ✅ | App Service deployment integration and hooks are implemented with repository-level cloud config CRUD/summary APIs (`integrations/cloud`), settings UX (`settings/cloud-infra`), and manual deploy trigger orchestration (`cloud/deploy`) including deployment-history surfacing |
| Kubernetes-native | ✅ | Baseline Helm chart is included (`deploy/helm/opencodehub`) and Kubernetes deploy orchestration now includes repository-level config CRUD/summary APIs (`integrations/cloud`), dedicated settings UX (`settings/cloud-infra`), and manual deployment trigger flows (`cloud/deploy`) with deployment-history surfacing |
| Terraform/IaC hooks | ✅ | Terraform hook triggering is implemented via automation + repository APIs, and now includes repository-level Terraform config CRUD/summary APIs (`integrations/cloud`), dedicated settings UX (`settings/cloud-infra`), and manual plan/apply orchestration (`iac/hooks`) |

## 7. Dependency & Impact Awareness
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| PR dependency visualization | ✅ | Stack visualization in `stacks.ts` |
| Cross-repo change sets | ✅ | Change-set schema/library and APIs are implemented, and dedicated UI workflow is now available via `src/pages/change-sets.astro` (create/list/detail cross-repo sets with linked PR ordering context) |
| Breaking-change detection | ✅ | PR diff/file heuristics + persistence are implemented with improved semantic precision (deduplicated detections, source-file aware export/public API change signals, destructive schema/dependency removal scoring) |
| Database migration detection | ✅ | Migration detection now combines changed-file pattern matching with SQL/content semantics (destructive operation classification, reversibility signal extraction, downtime inference, and persisted explanatory notes) |
| API change awareness | ✅ | Dedicated API-awareness system is implemented with persisted `api_change_detections`, PR scan/read endpoints (`pulls/{number}/api-changes`), impact scan integration, and breaking API change propagation into merge-impact risk scoring |

## 8. Security
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Role-based access control (RBAC) | ✅ | Custom role APIs are fully wired with organization RBAC management UI (`/orgs/{org}/roles`) covering role create/edit/delete and per-member custom-role assignment workflows (`api/orgs/[org]/roles`, `api/orgs/[org]/members`) |
| Organization & team management | ✅ | Schema + UI implemented |
| SSO (OIDC / SAML) | ✅ | `oidc.ts` implements OIDC fully, SAML missing |
| MFA | ✅ | TOTP implemented (`src/pages/api/user/settings/2fa.ts`) |
| Secret scanning | ✅ | Secret scanning workflow is fully operational: scan trigger/results (`security/secret-scan`), per-finding status transitions (`security/secret-scan/{id}` resolve/false-positive), policy evaluation API (`security/policy-evaluation`), and repository security UI actions for resolving/triaging findings with live policy impact visibility |
| Dependency vulnerability scanning | ✅ | Trivy integration in `security.ts` |
| License compliance scanning | ✅ | License checks are integrated with enforceable policy workflows: policy CRUD (`security/policies`), quick allow/block actions (`security/policy-actions` for allowed types and blocked licenses), policy evaluation/reporting (`security/policy-evaluation`), and repository security UI controls for allowlist/blocklist-driven governance |
| Audit logs | ✅ | `audit.astro` + schema |
| Session management | ✅ | JWT + session handling |
| Rate limiting | ✅ | Implemented with Redis backend (`src/middleware/rate-limit.ts`) |
| CSRF protection | ✅ | Implemented |
| Input validation | ✅ | Zod schemas throughout |

## 9. Analytics & Insights
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| PR cycle time analytics | ✅ | `developer-metrics.ts` |
| Review latency tracking | ✅ | Metrics schema exists |
| Merge frequency metrics | ✅ | Merge-frequency analytics now include repository insights dashboarding + trend forecasting: API supports bucketed time-series with forecast horizons (`GET /repos/{owner}/{repo}/analytics/merge-frequency?bucket=&days=&forecastPoints=`), and repository Insights UI now visualizes historical merge cadence plus short-range forecast (`MergeFrequencyPanel`) |
| Developer workload insights | ✅ | Workload insights now include trend intelligence and recommendation workflows: API returns contributor scores plus distribution/concentration/percentile signals and actionable recommendations (`GET /repos/{owner}/{repo}/analytics/workload`), and repository Insights UI now surfaces recommendation cards and workload leaderboards (`DeveloperWorkloadPanel`) |
| Hotspot file detection | ✅ | Implemented in analytics library + repository API endpoint |
| Delivery performance dashboards | ✅ | `insights.astro` pages |
| Export metrics | ✅ | JSON/CSV/Prometheus export implemented (`analytics/export.ts`) |
| Custom dashboards | ✅ | Dashboard CRUD + widget APIs implemented (`api/analytics/dashboards`) |

## 10. Notifications & Collaboration
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Smart notifications | ✅ | Notification feed now supports smart priority sorting + user-level personalization and channel-aware routing controls via `GET /notifications?prioritize=true&personalize=true&channel=in_app|email|slack|browser_push`, with per-item routing metadata (`routeChannels`, `primaryRouteChannel`) |
| Blocking alerts | ✅ | Blocking notifications now include routing-aware summaries (`/notifications/blocking/summary` with stale counts/channel breakdown) and automated escalation workflows (`GET/POST /notifications/blocking/escalations`) that generate auditable escalation records |
| Daily/weekly digests | ✅ | Digest delivery now includes provider-level observability and dead-letter tooling: delivery/retry/dead-letter audit events, analytics endpoint (`GET /user/notification-digests/analytics`), dead-letter listing (`GET /user/notification-digests/dead-letter`), and explicit retry workflow (`POST /user/notification-digests/dead-letter/retry`) |
| Mentions & subscriptions | ✅ | Implemented |
| PR-level discussions | ✅ | Full threaded comments |
| Activity feeds | ✅ | Dashboard activity feed |
| Inbox sections | ✅ | `inbox-sections.ts` |
| Real-time updates | ✅ | `realtime.ts` with SSE |

## 11. Interfaces & Extensibility
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Web UI | ✅ | Astro + React, full implementation |
| REST API | ✅ | Extensive API under `/api/` |
| GraphQL API | ✅ | `graphql.ts` exists (Yoga based) |
| CLI | ✅ | `cli/` package - 21+ commands |
| Plugin/extension system | ✅ | Plugin platform now includes runtime state/health tracking, enable/disable/reload/unload controls, dependency validation, hook timeout/failure telemetry, allowlist-aware directory loading, runtime config overrides, command execution, and admin management APIs (`/admin/plugins`, `/admin/plugins/{name}`) |
| Webhook events | ✅ | Full implementation |
| API documentation | ✅ | OpenAPI now covers expanded notification/digest/blocking escalation operations and admin plugin management routes (`/notifications/blocking/escalations`, `/user/notification-digests/analytics`, `/user/notification-digests/dead-letter`, `/user/notification-digests/dead-letter/retry`, `/admin/plugins`, `/admin/plugins/{name}`), with parity guard tests extended beyond pull routes (`openapi-notifications-parity.test.ts`) |

## 12. Self-Hosted & Deployment
| Feature | Status | Implementation Notes |
| :--- | :---: | :--- |
| Docker deployment | ✅ | Dockerfile + docker-compose |
| Kubernetes deployment | ✅ | Helm chart under `deploy/helm/opencodehub` is now production-hardened with security contexts, startup/liveness/readiness probes, service account and optional network policy templates, configurable scheduling controls (affinity/tolerations/topology spread), optional existing-secret wiring, and optional dedicated worker deployment/HPA |
| Horizontal scaling | ✅ | Scaling readiness is now explicitly validated and reported via `GET /api/health` (`checks.scaling` for distributed lock/rate-limit/queue-worker safety + Redis requirements), and merge-queue worker processing now uses per-repository distributed locks to avoid multi-instance double-processing |
| Backup & restore tools | ✅ | Backup script + admin sync/restore endpoints exist |
| Config-as-code | ✅ | Environment variables |
| Offline/air-gapped mode | ✅ | Offline guardrails now cover both webhook and integration configuration APIs for external CI, issue trackers, and code quality providers; integration matrix coverage is validated by `tests/integration/air-gapped-api.test.ts` with explicit `AIR_GAPPED_MODE` enforcement assertions |
| Multi-tenant mode | ✅ | Organization-based multi-tenancy |

---

# Implementation Plan

## Phase 1: Critical Security & Stability (Weeks 1-4)
> **CAUTION**: These issues must be fixed before any production use

| Task | Priority | Effort | Files Involved |
| :--- | :--- | :--- | :--- |
| **Fix runner auth bypass** | 🔴 Critical | 2h | `runner-auth.ts` |
| **Add executor resource limits & timeouts** | 🔴 Critical | 4h | `executor.ts` |
| **Distributed rate limiting (Redis)** | 🔴 Critical | 8h | New middleware |
| **Distributed merge queue locks** | 🔴 Critical | 8h | `merge-queue.ts` |
| **Complete TODO items** | 🟠 High | 16h | Multiple files |

## Phase 2: Core Feature Completion (Weeks 5-12)
| Task | Priority | Effort | Dependencies |
| :--- | :--- | :--- | :--- |
| **SSO (OIDC) integration** | 🔴 Critical | 24h | None |
| **MFA/2FA implementation** | 🔴 Critical | 16h | TOTP via otplib |
| **CODEOWNERS enforcement** | 🟠 High | 16h | `automations.ts` |
| **Suggested changes in reviews** | 🟠 High | 12h | PR comments |
| **Kanban board UI** | 🟡 Medium | 20h | Issues system |
| **PR auto-merge rules** | 🟡 Medium | 12h | `automations.ts` |
| **Custom PR states** | 🟡 Medium | 8h | Schema + UI |
| **Required reviewers per state** | 🟡 Medium | 8h | Branch protection |

## Phase 3: Integrations & Extensions (Weeks 13-20)
| Task | Priority | Effort | Dependencies |
| :--- | :--- | :--- | :--- |
| **GraphQL API layer** | 🟠 High | 40h | REST API |
| **Microsoft Teams integration** | 🟡 Medium | 16h | Slack pattern |
| **Discord integration** | 🟡 Medium | 12h | Slack pattern |
| **Jira integration** | 🟡 Medium | 24h | Webhooks |
| **API documentation (OpenAPI)** | 🟡 Medium | 16h | REST endpoints |
| **Plugin system enhancement** | 🟡 Medium | 24h | `plugins.ts` |

## Phase 4: Advanced Features (Weeks 21-32)
| Task | Priority | Effort | Dependencies |
| :--- | :--- | :--- | :--- |
| **Epics & sub-tasks** | 🟡 Medium | 24h | Issues |
| **Custom issue fields** | 🟡 Medium | 20h | Schema |
| **Issue workflows** | 🟡 Medium | 32h | State machine |
| **Cross-repo support** | 🟡 Medium | 40h | Architecture |
| **License compliance scanning** | 🟡 Medium | 16h | Security scan |
| **Kubernetes Helm chart** | 🟡 Medium | 16h | Docker |
| **Backup & restore tools** | 🟡 Medium | 24h | DB operations |
| **API breaking change detection** | 🔵 Low | 40h | AI/AST analysis |