> ## Documentation Index
> Fetch the complete documentation index at: https://docs.one.fim.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Roadmap

> Feature roadmap and version planning for FIM One.

> Goal: Build an **all-in-one agent platform for Global × China enterprises** — delivered through three progressive modes: Standalone (portal assistant), Copilot (embedded in host system), Hub (central cross-system orchestration).
>
> Principles: **Provider-agnostic** (no vendor lock-in), **minimal-abstraction**, **protocol-first**, **connector-first** (integration is the core value).

## Produktvision

FIM One ist eine **All-in-One-Agent-Plattform**, die drei progressive Liefermodi bietet:

```
Standalone   → Your own AI assistant (Portal)
Copilot      → AI embedded in a host system (iframe / widget / embed)
Hub          → Central cross-system orchestration (Portal / API)
```

**Cross-System-Orchestrierung ist der Kernunterscheidungsfaktor.** Enterprise-Kunden haben Legacy-Systeme — ERP, CRM, OA, Finanzen, HR — die über KI miteinander kommunizieren müssen:

```mermaid theme={null}
flowchart LR
  subgraph Sources["Source Systems"]
    ERP["ERP<br/>(SAP/Kingdee)"]
    CRM["CRM<br/>(Salesforce)"]
    OA["OA<br/>(Seeyon/Weaver)"]
    DB["Custom DB<br/>(PG/MySQL)"]
  end

  subgraph Hub["FIM One Agent Core"]
    A["Agent A: Finance Audit"]
    B["Agent B: Contract Review"]
    C["Agent C: Approval Assist"]
    D["Agent D: Data Reporting"]
  end

  subgraph Targets["Notification Targets"]
    T1["Lark / Slack"]
    T2["Email / WeCom"]
    T3["Teams / Webhook"]
    T4["Any API"]
  end

  subgraph Delivery["Delivery"]
    Portal["Portal (UI)"]
    API["API (headless)"]
    Embed["iframe (embed)"]
  end

  ERP --> A --> T1
  CRM --> B --> T2
  OA --> C --> T3
  DB --> D --> T4
  Hub --> Delivery
```

**GTM-Pfad: Land and Expand**

| Schritt | Modus         | Was passiert                                                         |
| ------- | ------------- | -------------------------------------------------------------------- |
| Land    | Copilot       | In ein System einbetten, Wert in ihrer Benutzeroberfläche nachweisen |
| Expand  | Copilot → Hub | Auf weitere Systeme ausrollen; Hub-Modus aggregiert sie              |

## Bekannte Probleme

Nachverfolgter Bugs, die in der Produktion reproduzierbar sind, aber noch nicht behoben wurden. Jeder Eintrag nennt das Symptom, den vermuteten Bereich und die Workaround (falls vorhanden). Elemente werden in einen Versionsabschnitt verschoben, sobald eine Behebung geplant und terminiert ist.

* **Playground-Stopp-und-Wiederholung zeigt vorübergehende visuelle Artefakte, die ein Seitenaktualisierung immer behebt.** Drei gleichzeitige Render-Quellen — `activeConversation.messages` (DB-Snapshot), der SSE-`messages`-Stream und der optimistische `pendingQuery`-Platzhalter — werden nicht in einen einzelnen abgeleiteten Zustand zusammengefasst, sodass zwischen dem Klicken auf „Wiederholen" und der Ankunft der gepaarten Assistentantwort die Benutzeroberfläche (a) kurzzeitig dieselbe Abfrage zweimal im Pre-Stream-Fenster rendern kann, (b) vorherige verwaiste Benutzerblasen aus dem Wiederholungsverlauf löschen kann, während `hasLiveMessages` wahr ist und bevor der Snapshot neu geladen wird, und (c) im engen Fenster zwischen dem SSE-„done"-Ereignis und der nächsten `selectConversation`-Aktualisierung flackern kann. **Daten gehen niemals verloren** — jede Benutzernachricht (einschließlich abgebrochener Wiederholungen) wird in `conversation.messages` beibehalten, über `normalize_alternating_messages` in den nächsten LLM-Aufruf übernommen und nach der Aktualisierung über `HistoryTurn.orphanUserContents` (eingeführt in der Render-Behebung `48ba08c6`) korrekt gerendert. Zum Kontext: Claudes eigene Web-Benutzeroberfläche weist eine analoge Klasse von Bugs auf — das Stoppen mitten in einer Antwort und das sofortige Senden einer Folgeanfrage verzweigt die Folgeanfrage manchmal als Geschwister-Bearbeitungszweig der ersten Abfrage, anstatt sie als neue Runde anzuhängen — daher ist dies ein bekanntes schwieriges Problem in optimistischen UI + SSE + persistierten Verlaufsdesigns, kein FIM-One-spezifischer Defekt. Eine ordnungsgemäße Behebung erfordert das Zusammenfassen der drei Render-Quellen in einen einzelnen abgeleiteten Zustand; aufgeschoben bis zu einer umfassenderen Playground-Zustandsmaschinen-Umgestaltung.

## Architecture Program — Agent Core&#x20;

Scoped, not yet scheduled into a version. Batches are dependency-ordered; each expands into concrete tasks in the companion design.

* [ ] **Governance**: bug-class defensive-patterns doc, design-note lifecycle states, markdown link gate.
* [ ] **Session event log**: every model-visible input becomes a durable, ordered fact, with model history derived from it.
* [ ] **Runtime invariants + keyless snapshot replay**: assert owned relationships in production; diff assembled transcripts in CI without a key.
* [ ] **Tool pipeline seams**: pre/execute/post stages so permission, timeout, sandbox and background work leave the agent loop.
* [ ] **Code Mode preset**: one program composes several connector calls through the same pipeline, replacing multi-round-trip orchestration.
* [ ] **Agent presets as declared capability sets**, plus plan and background state recorded as log facts rather than side files.
* [ ] **Typed frontend from OpenAPI** and generated tool/env catalogs, replacing hand-maintained copies that drift.

## Backlog (Low Priority)&#x20;

Aufgeschobene Härtung — nicht blockierend; nur aufgreifen, wenn das entsprechende Szenario auftritt.

* [ ] **DAG evidence gets its own truncation budget**, decoupled from `DAG_ANALYZER_TRUNCATION`, so source evidence isn't re-clipped by the summary budget before the analyzer/synthesis verify against it.
* [ ] **Structure-aware evidence truncation** (head+tail / keep lists & tables) so long enumerations survive the cap instead of silently losing their tail.
* [ ] **Port the source-fidelity guideline into the ReAct fallback synthesis prompt** so total/severity mislabels are caught in ReAct too, not only in DAG.

## Shipped Versions

### v0.1 (2026-02-22) — MVP: ReAct + DAG Planner

* ReActAgent mit Tools (calculator, python\_exec, web\_search)
* DAG Planner (LLM generiert Abhängigkeitsgraphen)
* Portal UI mit Streaming + KaTeX

### v0.2 (2026-02-24) — Multi-Model + Memory

* Retry / rate limiting / usage tracking
* Native function calling (no JSON-only parsing)
* Multi-model support (fast + main LLM)
* Memory: WindowMemory, SummaryMemory
* FastAPI backend with SSE streaming

### v0.3 (2026-02-25) — Web Tools + MCP

* Web tools (web\_search, web\_fetch) via Jina/Tavily/Brave
* File operations tool
* MCP client (standard tool integration)
* Tool auto-discovery + categories
* DAG visualization with click-to-scroll
* Code exec in Docker (`--network=none`)

### v0.4 (2026-02-25) — Multi-Turn + Agents

* Mehrturn-Gespräche (DbMemory)
* Tool-Schritt-Faltungs-UI
* HTTP-Anfrage- und Shell-Exec-Tools
* Agent-Verwaltung (erstellen, konfigurieren, veröffentlichen)
* JWT-Authentifizierung
* Pro-Agent-Ausführungsmodus + Temperaturkontrolle

### v0.5 (2026-02-28) — Full RAG + Grounded Gen

* Full RAG pipeline (embedding + vector store + FTS + RRF + reranker)
* Grounded Generation (citations, confidence scores)
* Knowledge base document management (CRUD, search, retry, schema migration)
* ContextGuard + pinned messages (token budget manager)
* DbMemory persistence + LLM Compact
* DAG Re-Planning (up to 3 rounds)

### v0.6 (2026-03-01) — Connector Platform

* **Connector CRUD**: create, read, update, delete
* **ConnectorToolAdapter**: converts Connector → BaseTool
* **Per-user credentials**: AES-GCM encryption
* **Confirmation gate**: write operation approval
* **Audit logging**: all tool calls recorded
* **Circuit breaker**: graceful degradation on failures
* **Utility tools**: email\_send, json\_transform, template\_render, text\_utils
* **Embedding options**: Jina, OpenAI, custom providers

### v0.7 (2026-03-06) — Admin Platform + Multi-Tenant

* **Admin Platform**: Benutzerverwaltung, Rollenwechsel, Passwort-Zurücksetzen, Konto aktivieren/deaktivieren
* **Nur-auf-Einladung-Registrierung**: drei Modi (offen/Einladung/deaktiviert) + Einladungscode CRUD
* **Speicherverwaltung**: Speichernutzung pro Benutzer, Löschen, verwaiste Bereinigung
* **Gesprächsmoderation**: Admin-Liste/Löschen aller
* **Erzwungenes Logout pro Benutzer**: alle Token widerrufen
* **API-Gesundheits-Dashboard**: Systemstatistiken, Connector-Metriken
* **Assistent für erste Einrichtung**: geführte Admin-Kontoerstellung
* **Persönliches Zentrum**: globale Anweisungen pro Benutzer, Spracheinstellung
* **JWT auth**: Token-basierte SSE-Authentifizierung, Gesprächseigentümerschaft
* **Globale MCP-Server**: von Admin bereitgestellt, in allen Sitzungen geladen
* **Rückwärtskompatibilität**: registration\_enabled → registration\_mode automatische Migration

### v0.7.x (2026-03-07 to 2026-03-12) — Stability + Refinements

* Invite code management
* Per-user quotas (429 enforcement)
* Structured audit logging
* Sensitive word filtering
* Admin login history
* Admin file browser
* Enhanced admin views (model\_name, tools, kb\_ids fields)
* Docker Compose deployment (single image, named volumes)
* OAuth auto-detection from window\.location
* Extended thinking / reasoning support (`LLM_REASONING_EFFORT`, `LLM_REASONING_BUDGET_TOKENS`) for OpenAI o-series, Gemini 2.5+, Claude
* Admin per-tool enable/disable (disabled tools excluded from chat at runtime)
* MCP servers management moved to Connectors page
* Dual database support: SQLite (zero-config default) + PostgreSQL (production); Docker Compose auto-provisions PostgreSQL
* Models configuration documentation page with extended thinking setup per provider
* SSE Protocol v2: real-time answer streaming with `delta_reasoning`, `usage` fields, and split `done`/`suggestions`/`title`/`end` events; SQLite pool size 5 -> 20
* AI Builder expansion: 7 new builder tools (GetSettings, TestConnection, ImportOpenAPI for connectors; ListConnectors, AddConnector, RemoveConnector, SetModel for agents), `is_builder` flag on agents, builder prompt auto-refresh, SSRF guard
* SSE v2 frontend: streaming dot-pulse cursor, DAG re-plan round snapshots as collapsible cards, DAG layout decoupled from step states
* AI Builder concept documentation page with connector and agent builder guides
* Organization system: full CRUD with role-based membership (owner/admin/member), admin management UI
* Three-tier resource visibility (personal/org/global) for agents, connectors, knowledge bases, MCP servers
* Publish/unpublish API for all resource types; owner delegation for published agents
* Admin set-visibility endpoint (replaces clone-to-global); unified `build_visibility_filter()` query helper
* Database Connectors (Phase 1-3): direct SQL access to PG/MySQL/Oracle/SQL Server + Chinese legacy DBs; schema introspection, AI annotation, read-only query execution, encrypted credentials, 3 tools per connector (`list_tables`, `describe_table`, `query`)
* **Evaluation Center**: quantitative agent quality benchmarking — test dataset CRUD (prompt + expected behavior + assertions), eval runs (parallel execution + LLM grader + per-case pass/fail/latency/token results), results viewer with auto-polling; migration `r8t0v2x4z567`
* Three model roles (General/Fast/Reasoning) with per-tier env config isolation; fast model no longer inherits main model settings
* `StepOutput` dataclass replacing plain string step results for structured data and artifact passing
* Tool cache for DAG execution — identical tool calls cached per-run with async lock stampede prevention (`DAG_TOOL_CACHE`)
* Per-step LLM verification with 1 retry on failure (`DAG_STEP_VERIFICATION`)
* Auto-routing: fast LLM classifies queries as ReAct or DAG; `/api/auto` endpoint; frontend 3-way mode toggle (`AUTO_ROUTING`)
* [x] ~~**Shadow Market Organization + Resource Subscriptions**~~: Built-in Market org (shadow, no auto-join) replaces Platform org; resources discovered via marketplace browsing and explicitly subscribed (pull model); Market API for subscribing to shared resources; publish-to-Market always requires review; Resource subscriptions table; org-based resource sharing replacing global visibility
* [x] ~~**Agent Auto-discovery and Sub-agent Binding**~~: `discoverable` flag on agents; `sub_agent_ids` whitelist; CallAgentTool for delegating tasks to specialist agents
* [x] ~~**MCP Server Credentials + Per-User Override**~~: `mcp_server_credentials` table; `PUT /api/mcp-servers/{id}/my-credentials` endpoint; `allow_fallback` flag for credential fallback behavior
* [x] ~~**Connector/KB Toggle**~~: `POST /api/connectors/{id}/toggle` and `POST /api/knowledge-bases/{id}/toggle` for suspending/resuming resources
* [x] ~~**Standalone KB Conversations**~~: `kb_ids` field on conversations for direct KB chat without agent binding

### v0.8 (2026-03-20) — Connector Declarative Config + Progressive Disclosure

* [x] **Database connectors**: direct SQL access (PostgreSQL, MySQL, Oracle) *(shipped in v0.7.x — Phase 1-3)*
* [x] **RBAC**: per-user/role connector access control *(shipped in v0.7.x — org system + three-tier visibility)*
* [x] **Connector credential encryption + per-user override**: `connector_credentials` table, Fernet encryption via `CREDENTIAL_ENCRYPTION_KEY`, `allow_fallback` flag, `GET/PUT/DELETE /my-credentials` endpoints, per-user credential resolution in chat tool loading
* [x] **Publish review UI**: Org-level publish review system — review toggle per org, ReviewsSheet with approve/reject workflow, status badges on resource cards, review notice in publish dialog, resubmit for rejected resources
* [x] **Connector Progressive Disclosure (Phase 1-2)**: single `ConnectorMetaTool` replaces per-action tools; system prompt receives lightweight **stubs** only (name + 1-line description, \~30 tokens/connector vs \~250 tokens/action); agent calls `discover(connector)` to load full action schema on demand — schema only loads when the model selects a connector, keeping the prompt prefix stable for caching. Follows the deferred tool-loading pattern common in modern agent frameworks. `execute` subcommand; feature flag for backward compatibility.
* [x] **Agent Skill System + Compact Instructions**: On-demand skill loading for agent instructions — `Skill` model (name, content/SOP, optional scripts) attached to agents; referenced in system prompt by name only (\~10 tokens/skill); agent calls `read_skill(name)` to load full content on demand. Reduces per-conversation instruction token cost by \~80% while allowing richer SOP libraries. Counterpart to ConnectorMetaTool's progressive disclosure applied at the instruction level. Enables the "指令 + 工具 + 技能" differentiation story. Also adds `compact_instructions` field to Agent model — per-agent compression priority list injected into `ContextGuard` when compacting (e.g., "preserve order IDs and amounts, drop raw API responses"), replacing the current static generic prompt. Follows the Compact Instructions convention widely adopted in modern agent frameworks.
* [x] **Connector import/export**: share connector templates
* [x] **Connector fork**: clone + customize existing connectors
* [x] **Workflow Phase 2 Nodes**: Iterator, Loop, VariableAggregator, ParameterExtractor, ListOperation, Transform, DocumentExtractor, QuestionUnderstanding, HumanIntervention — 9 advanced node types with full frontend + backend + 150 new tests (275 total). Node retry with exponential backoff, safe expression evaluation. Stats panel with success rate bar. 12 built-in templates. Pane context menu (Paste, Select All, Fit View, Auto Layout).
* [x] **Workflow Phase 3 Nodes: SubWorkflow + ENV** — 2 new node types (25 nodes total), 14 new tests (306 total), 14 built-in templates. SubWorkflow: full DB-backed nested workflow executor with target workflow selection, variable mapping, and configurable depth limit to prevent infinite recursion. ENV: reads encrypted environment variables with key picker and fallback defaults. Full frontend (node components, config panels, palette entries, minimap colors). Per-node execution statistics panel (success rates, durations, failure counts sorted worst-first). `getNodeStats` API client + `NodeStatEntry` type. Keyboard shortcuts dialog (`?` key).
* [x] **Workflow Scheduled Triggers**: Per-workflow cron configuration with timezone, default inputs, and next-run-at calculation. Preset cron buttons, 30 trigger tests.
* [x] **Workflow API Triggers**: Public per-workflow API keys (`wf_` prefix) for external execution without user auth, with rate limiting. API key management dialog with generate/regenerate/revoke, trigger URL, and cURL/JS examples.
* [x] **Workflow Batch Execution**: `POST /batch-run` with up to 100 input sets, configurable parallelism (1-10), collapsible per-item results, JSON export. 14 batch execution tests.
* [x] **Workflow Execution Log Viewer**: Real-time chronological SSE event stream in the run panel with timestamps, color-coded badges, and event type filter toggles.
* [x] **Workflow Run Stats**: Backend batch-fetches run counts and success rates via GROUP BY subquery; frontend displays stats on workflow cards with color-coded success rate indicators.
* [x] **Workflow Scheduler Daemon**: Background async service polling every 60s for due cron-based workflows. Croniter timezone support, semaphore concurrency, `last_scheduled_at` tracking, webhook delivery. 14 tests.
* [x] **Workflow Import Conflict Resolver**: Detects unresolved agent/connector/KB/MCP references during import. Batch DB queries with visibility filtering, frontend toast warnings. 17 tests.
* [x] **Workflow Test-Node Execution**: Isolated single-node testing with mock variables, integrated into editor (config panel Test button + context menu). 23 tests.
* [x] **Workflow Version Diff**: Side-by-side blueprint comparison with node/edge change detection, color-coded indicators (added/removed/modified).
* [x] **Workflow Run Management**: Delete individual runs (`DELETE /runs/{run_id}`) and clear all completed runs (`DELETE /runs`), with frontend confirmation dialogs.
* [x] **Workflow Run Replay Overlay**: "View on Canvas" button in run history to overlay past execution results on the canvas, showing per-node status and output without re-executing.
* [x] **Workflow Favorites/Pinning**: Star/pin workflows to the top of the list with localStorage persistence.
* [x] **Workflow Run History Export**: Export run history as JSON file download with full run metadata and per-node results.
* [x] **Admin Workflows Management**: Admin panel tab for managing all workflows across users — list, toggle active/inactive, delete with confirmation. Batch endpoints for delete, toggle, and publish with audit logging.
* [x] **Workflow Templates System**: `WorkflowTemplate` ORM model with admin CRUD, public listing/clone API, and 5 seed templates auto-inserted on first startup.
* [x] **Workflow Inline Validation Badges**: Real-time per-node `ValidationBadge` on canvas with error/warning tooltips for immediate visual feedback during editing.
* [x] **Workflow Execution Trace Viewer**: Timeline-based trace viewer Sheet with engine `trace_level` parameter and per-node variable snapshots for step-through debugging.
* [x] **Workflow Rate Limiting and Timeout**: Per-user `WorkflowRateLimiter` (sliding window 10 runs/min, 3 concurrent) and default 10-minute global run timeout.
* [x] **Workflow Blueprint System**: Visual workflow editor for designing and executing multi-step automation blueprints — `Workflow` / `WorkflowRun` ORM models, full CRUD + SSE execution API, import/export, duplicate, blueprint validation endpoint, `WorkflowEngine` with topological sort + semaphore-based concurrency + condition branching and 12 node types (Start, End, LLM, ConditionBranch, QuestionClassifier, Agent, KnowledgeRetrieval, Connector, HTTPRequest, VariableAssign, TemplateTransform, CodeExecution), `VariableStore` with `{{node_id.output}}` interpolation and `env.*` namespace, error strategies per node (STOP\_WORKFLOW / CONTINUE / FAIL\_BRANCH) with per-node timeout and advanced config UI, React Flow v12 visual editor with drag-and-drop palette + node config panel + variable picker combobox + add-node-on-edge + auto-layout (ELK.js) + run history sheet, Dify-style compact node design with ring-based run status styling and animated edge transitions, 4 built-in starter templates (Simple LLM Chain, Conditional Router, Knowledge-Augmented QA, HTTP API Pipeline) with template picker dialog and `GET /templates` + `POST /from-template` API, stats endpoint, `?run=true` URL param auto-open, subprocess-based code execution security, 105-test suite (templates, eval namespace flattening, blueprint validation warnings, node/edge deletion, import/export/duplicate, deadlock detection, multi-condition branching)
* [x] **Operation audit**: detailed logging of who did what — admin review log audit tab added (publish review trail per org/resource)
* [x] **Semantic Schema Annotations**: extend connector schema fields with `semantic_tag`, `description`, and `pii` flags; annotations surfaced in LLM tool descriptions so the agent understands field intent without guessing from column names

### v0.8.1 (2026-03-29) — Progressive Disclosure Maturity + ReAct Hardening

* Progressive Disclosure für DB-Konnektoren (`DatabaseMetaTool`), MCP-Server (`MCPServerMetaTool`) und bedarfsgesteuertes Tool-Laden (`request_tools` Meta-Tool)
* DAG-Qualitätsüberholung (5 Verbesserungen: Modell-Upgrade, automatische Skill-Erkennung, Zitierverifizierer, strukturierte Inhaltsbewahrung, domänengesteuertes Routing)
* Domänenmodell-Eskalation in ReAct (spezialisierte Domänen eskalieren automatisch zum Reasoning-Modell)
* Pro-Modell Native Function Calling Toggle (`tool_choice_enabled`)
* ReAct-Zyklenerkennung (deterministische Duplikat-Tool-Call-Prävention)
* ReAct-Abschluss-Checkliste (Vor-Antwort-Verifikation bei verwendeten Tools)
* Resource Fork Phase 1 (MCP Server + Skill Fork Endpoints mit Abstammungsverfolgung)
* Workflow Connection Dep Auto-Subscribe (rekursive Sub-Workflow-Abhängigkeitsauflösung)
* Vorgefertigte Lösungsvorlagen (8 vertikale Lösungen beim ersten Registrieren auf dem Markt bereitgestellt)
* Verbesserungen der Admin-Benachrichtigungen (Zeitzone-bewusst, Master-Schalter, SMTP Reply-To)
* Pro-Turn Token-Budget Circuit Breaker (`REACT_MAX_TURN_TOKENS`)
* Zentralisierte Tool-Kürzung, dynamische System-Prompt-Budgetierung
* Dateianhang-Download, Duplikat-Nachrichteneinreichungs-Fix

### v0.8.2 (2026-04-10) — Agent Core Hardening + Vision Documents

* **Agent Core Phase 0** — Compact prompt upgraded to 9-section structured format; empty tool result protection (descriptive message instead of `(no output)`); anti-loop prompt + cycle detection threshold lowered to 2; domain classifier + pre-flight DB config resolution parallelized (400–1100 ms saved per request); SSE `end` event sent immediately after answer, with title/suggestions moved to background tasks
* **Agent Core Phase 1 (Context Anti-Bloat)** — `MicroCompact` rule-based old tool result cleanup (keep last 6); `REACT_TOOL_RESULT_BUDGET=40000` aggregate cap; reactive compact on context overflow (auto-compact to 50% budget and retry instead of crashing)
* **Agent Core Phase 2 (Speed)** — Keyword-based tool pre-selection (skips LLM call on obvious matches, 200–500 ms saved); `SharedHttpClient` LLM connection pooling; completion check skipped for answers >200 tokens; `FallbackLLM` wraps primary+fast with automatic failover on 429/503/529/connection errors
* **Intelligent Document Processing (Vision-Aware)** — Adaptive document handling: PDF pages rendered as images via PyMuPDF for vision-capable models (GPT-4o, Claude 3/4, Gemini), text-only fallback via pdfplumber. Per-model `supports_vision` flag. Modes via `DOCUMENT_PROCESSING_MODE`, `DOCUMENT_VISION_DPI`, `DOCUMENT_VISION_MAX_PAGES`. DOCX/PPTX embedded image extraction. Multi-turn vision persistence across conversation turns. Smart PDF processing (text-rich pages extract text + images; scanned pages render as full-page PNG). Pre-built sandbox image (`Dockerfile.sandbox`) with common data-science packages for `--network=none` code execution
* **Resource Fork completion** — Agent / Connector / Workflow fork endpoints added, completing the five-type lineage tracking (KB fork removed — inherently user-local)
* **File integrity guardrail** — System prompt rule prevents the agent from substituting unrelated file contents when a target file is unreadable; uploaded files now include `file_id` in message context for direct `read_uploaded_file` access

### v0.8.3 (2026-04-16) — Universal Document Conversion + Agent Core Phase 3

* **Universal Document Conversion (`convert_to_markdown` + OCR)** — Built-in Agent tool wrapping Microsoft MarkItDown; converts PDF, Word, Excel, PowerPoint, HTML, JSON, CSV, XML, ZIP, EPUB, Outlook .msg, images, audio, YouTube URLs to Markdown. `LiteLLMOpenAIShim` enables OCR via any vision-capable LLM (Claude, Gemini, Bedrock, Azure). Vision-aware RAG ingestion with zero-regression text-only fallback. `LLM_SUPPORTS_VISION` env var for opt-out
* **Agent Core Phase 3 (Runtime Invariant Hardening)** — Conversation recovery (dangling `tool_use` auto-repair); structured compact work card (`WorkCard` typed merge across compaction rounds); turn-level profiler (`REACT_TURN_PROFILE_ENABLED`); per-user rate limiting (`LLM_RATE_LIMIT_PER_USER`); empty-content assistant message with `tool_calls` no longer dropped

### v0.8.4 (2026-04-17) — Prompt Cache + Reasoning Correctness

* **System prompt section registry with cache breakpoints** — Memoized `PromptRegistry` splits system prompts into stable prefix + dynamic suffix; cache-capable providers (Claude, Bedrock Anthropic, Vertex Claude) receive `cache_control: {"type": "ephemeral"}` on the prefix for \~60-80% per-turn input token savings. Non-cache providers get a single concatenated message (zero behavior change)
* **Prompt cache observability** — `cache_read_input_tokens` and `cache_creation_input_tokens` tracked through `UsageSummary` → `TurnProfiler` → `done_payload.cache` field. Structured `turn_cache` log line per turn. Doubles as relay cache-honesty probe
* **Conversation recovery MVP** — Synthetic `tool_result` rows persist after interrupted turns; `POST /chat/resume` replays cached SSE events from a monotonic cursor; frontend `useSseResume` hook auto-reconnects with exponential backoff (300ms → 1s → 3s, max 3 attempts) and "Reconnecting…" indicator
* **Thinking-block persistence with signature** — `reasoning_content` + Anthropic `signature` persisted in `metadata_["thinking"]` and replayed on subsequent turns; fixes HTTP 400 signature mismatch on Claude 4 multi-turn conversations
* **Provider-aware reasoning replay policy** — Centralized `reasoning_replay_policy()` in `core/prompt/reasoning.py` gates serialization per provider family: Claude replays thinking blocks with signature; DeepSeek-R1/Qwen-QwQ/Gemini-thinking/o-series drop `reasoning_content` on outbound (previously leaked, breaking provider KV caches and violating API docs)

### v0.8.5 (2026-04-23) — Channel Integration + Hook System + Contributor i18n

* **Feishu Channel (Phase 1 subset)** — Org-scoped `Channel` resource with Fernet-encrypted credentials; `FeishuChannel` supports interactive card send + callback (signature verification + URL challenge); Settings → Channels management UI (list, create/edit with dirty-state protection, details with copyable callback URL, test-send); CRUD API (`/api/channels`) and event callback endpoint (`/api/channels/{id}/callback`). Shipped early for 2026-04-24 roadshow
* **Agent Hook System (live in ReAct + DAG runtime)** — `PreToolUseHook` / `PostToolUseHook` abstraction in `src/fim_one/core/hooks/`; agents declaring `hooks.class_hooks` in `model_config_json` have hooks instantiated and registered per chat session. First consumer `FeishuGateHook` posts an Approve/Reject card to the linked Feishu group when an agent calls a `requires_confirmation=True` tool, blocks execution, and resumes or aborts based on verdict
* **Configurable confirmation gate (inline OR channel)** — Every agent gets an Approval section with three routing modes (Auto / Inline only / Channel only), approver-scope selector (initiator / owner / anyone in org), per-tool override, and explicit approval-channel picker. Auto mode gracefully falls back to an inline approval card when no channel is linked. `POST /api/confirmations/{id}/respond` shares a single decision-recording path with the Feishu webhook
* **Per-agent task completion notifications** — Long-running ReAct or DAG agents can push a summary card to the org's channel when a task finishes. First consumer of the generic outbound notification pattern
* **Hook Approval Playground** — Channels details sheet has a "Test Approval Flow" action that exercises the full production path (genuine `ConfirmationRequest` row, real Feishu callback, status transitions) — same code path a production hook uses
* **Contributor-friendly i18n CI fallback** — `.github/workflows/i18n-sync.yml` translates EN → ZH/JA/KO/DE/FR on master after PR merge and auto-commits with `[skip ci]`; contributors no longer need `LLM_API_KEY` locally. Pre-commit locale-edit guard refuses manual edits to generated locale files (`ALLOW_LOCALE_EDIT=1` override for legitimate translation fixes). End-to-end verified via smoke-test push
* **Exa integration docs** — Dedicated Integrations section with a first-class Exa page covering the full Exa search surface (neural / fast / deep-reasoning / instant), filtering, content retrieval, and three tuned presets
* **Xinchuang (信创) database support** — Database Connector now lists KingbaseES (人大金仓), HighGo (瀚高), and DM8 (达梦) alongside PostgreSQL/MySQL. PG-compatible drivers reuse `asyncpg`; DM8 uses `dmPython`. `scripts/test_xinchuang_dbs.py` verifies live connectivity from the CLI
* **Channels + Hook System architecture docs** — `docs/architecture/hook-system.mdx` explains the three hook points and walks through FeishuGateHook end-to-end; existing architecture pages cross-link; README lists Messaging Channels as a first-class capability
* **Hardening** — Duplicate Feishu callback clicks produce a replacement card instead of double-deciding; concurrent callback clicks resolved via conditional `UPDATE ... WHERE status='pending'` rowcount check; pending approvals auto-expire after `CHANNEL_CONFIRMATION_TTL_MINUTES` (default 24h) via background sweeper; Settings → Channels respects org role (members see read-only UI); parallel tool-call aggregator handles providers that reuse `index=0` for every delta; session-expiry redirect preserves query string

### v0.8.6 (2026-05-08) — Stripe Billing + Refinements

* [x] Stripe billing MVP — Free + Pro tiers; Checkout, Customer Portal, webhook lifecycle; `/settings?tab=billing`; admin plan/subscription CRUD; quota enforcement respects each user's plan
* [x] Admin-controlled billing feature flag — `system_settings.billing_enabled` gates the entire Stripe pipeline so private deployments without Stripe credentials never surface a non-functional payment UX
* [x] Per-user unlimited quota — empty inherits global default, `0` grants unlimited; previously both collapsed into the same state
* [x] Translation glossary as single source of truth — `scripts/translation-glossary.md` consolidates per-locale rules; pre-commit unconditionally refuses manual edits to generated locale files
* [x] License + governing law migrated to FIM Labs Pte. Ltd. (Singapore); SIAC arbitration in English; new top-level `NOTICE` file
* [x] Playground follow-up suggestions restored, opt-in per agent
* [x] Stability fixes — strict-alternation provider history, parallel tool-call boundary detection, unbound-agent confirmation flow, channel role gating, retry-duplicate suppression, post-rejection no-paraphrase

### v0.8.7 (2026-06-10) — Security Hardening + Guardrails v0 + Billing Correctness

* [x] JWT token-type confinement — closes a 2FA bypass where any same-signed token (temp/refresh/ticket) could authenticate API and SSE endpoints
* [x] OAuth hardening — email auto-link requires a provider-verified email (account-takeover fix); OAuth refresh tokens stored hashed so session rotation works
* [x] Content guardrails v0 — input/output tripwire layer (`core/agent/guardrail`); ships jailbreak detector + max-length output guardrail, env-var configured
* [x] `file_ops.apply_patch` — V4A diff patches with fuzzy whitespace matching, complements `find_replace`
* [x] Billing-cycle correctness — quota resets on the subscription anniversary (not calendar month); renewals advance the period via authoritative Stripe lookup; usage display aligned to the enforcement window
* [x] Reliability fixes — pseudo-protocol tool-call leak stripped from answers; tunable HTTP keep-alive ends `APIConnectionError` bursts; API-key usage stats persist on read-only requests
* [x] Billing tab visual overhaul — full-width, consistent with other Settings tabs

### v0.8.8 (2026-06-22) — SSRF Hardening + Reliability & Reasoning Fixes

* [x] SSRF hardening — blocklist unwraps IPv4-mapped IPv6 (`::ffff:` instance-metadata bypass); MCP SSE/Streamable-HTTP server URLs SSRF-validated on create + connect
* [x] LLM reliability — shared HTTP pool self-heals after a LiteLLM client-cache eviction closes it; chat sends stream instantly (history folded in background, no full reload)
* [x] Anthropic adaptive-thinking protocol for Opus 4.6+/Sonnet 4.6/Fable 5 — extended thinking works where the old fixed-budget param 400s on 4.7/4.8; warns on OpenAI-proxy misroute
* [x] Reasoning detail preserved end-to-end — genuine final answer streamed verbatim; survives compaction, context rebuilds, and sub-agent steps (no lossy re-synthesis)
* [x] `PreToolUse` enforcement hooks fail closed on error — a crashing approval gate no longer silently allows the call; non-enforcement hooks keep fail-open via `fail_open`
* [x] Force-logout timestamp comparison normalized to UTC by conversion + Docker Compose `POSTGRES_*` credential override (no shipped `fim:fim` default)

### v0.8.9 (2026-07-08) — Module Slim-down + Sharing Convergence + Approval Hardening

* [x] Skills & Workflows soft-shelved behind admin module flags (default off) — core-only boot; nothing deleted, reversible from Admin → Settings → Modules
* [x] Sharing converged — KB sharing removed (KBs reach others only via shared Agents), DB connectors unshareable + raw SQL owner-only, workflow builder trimmed to 9 reference-only nodes
* [x] Feishu approval hardening — card clicks enforce approver identity, callback signatures fail closed + encrypted envelopes decrypted, approvals never routed to an unintended chat
* [x] Use-time access re-checks — shared MCP servers and bound KBs re-verified per run; leaving an org revokes subscriptions and saved credentials immediately
* [x] Agent loop hardening — plan board, background tools, incremental DAG replan + checkpoint resume, compaction keeps tool pairing, truncation continuation, 529/504 retry
* [x] `run_workflow` agent tool + workflow correctness — Agent node runs the full agent, confirmation gates fail closed, connector calls access-checked and audit-logged
* [x] Account deletion unified — admin and self-serve funnel through one purge routine covering every record and on-disk file; org owners must transfer ownership first
* [x] Owner-credential fallback now opt-in (breaking) — connectors/MCP servers default `allow_fallback` off, existing rows flipped; no-fallback resources you lack credentials for are hidden from the toolset
* [x] Webhook/cron workflow runs metered to the owner's token quota — the unmetered free-LLM trigger path is closed
* [x] Resource binding unified on visibility — subscribed connectors/KBs/MCP servers bindable to agents; workflow connector steps enforce the runner's access
* [x] Conversation workspace wired into chat — `workspace://` offload of oversized tool results, budget-truncation rescue, pre-compaction transcript snapshots

## Geplante Versionen

Neu geplant 2026-07-08: FIM One ist eine Agent-Runtime — ein Kernel (ReAct-Engine, Credentials, Approval Gate, Audit, Multi-Tenant-Orgs) hinter mehreren Delivery-Oberflächen: Web UI, API, JS Embed, MCP Output. Jede Oberfläche nutzt die gleiche Assembly-Schicht für Auth, Credentials, Approval und Metering: mehr Frontends, nie mehr Logik. Die kurzfristige Richtung ist die Konvergenz auf den Data-Q\&A-Slice (ChatBI), wobei Szenarien statt einer Plattform verkauft werden.&#x20;

### v0.9 — Connector Fences + Scenario Onboarding

**Ziel**: Die nach der Reduktion zusammengestellten Assets bilden ein vollständiges Daten-Q\&A-Produkt — Read-Only-DB-Konnektoren + Fences + Approval Gate + IM-Eintrag. Tier-1-Fences wandeln Sicherheitsschulden in Produktfunktionen um.

#### DB Connector Fences — Tier 1, drei PRs&#x20;

* [ ] PII-Spaltenredaktion (`ConnectorScopeGuard` PreToolUse Hook)
* [ ] Schemasichtbarkeit — Tabellen-/Spalten-Allow-Deny + Verb-Blocking (Read-Only-Durchsetzung)
* [ ] Fence-Nachverfolgbarkeit — `caller_user_id`, `effective_credential_source`, `scope_rules_applied` in `ConnectorCallLog`
* [ ] Pro-Hook-Konfigurationsübergabe (`{"name", "config"}` Schema) — der Träger für ScopeGuard-Regeln&#x20;
* [x] Genehmigungsgates bleiben über Delegierung erhalten — `call_agent` und Workflow-`AGENT`-Knoten führen die eigenen Hooks des Agenten aus, anstatt keine

#### Auth & Identität

* [x] OAuth auto-link erfordert eine verifizierte Adresse auf beiden Seiten, daher ist ein Konto, das von einer unverifizierten Provider-E-Mail erstellt wurde, niemals ein Bind-Ziel

#### Antwort-Rendering

* [x] Endgültige Antworten streamen nativ — die Schleife übergibt über ein `finish`-Signal und die Antwort wird als Live-Token-gestreamte Nachricht geschrieben
* [x] Gestreamtes Markdown rendert pro Block — fertige Blöcke bleiben stabil und halb angekommene Inline-Syntax flackert nicht mehr
* [x] Antworten rendern Mermaid-Diagramme, SVG-Figuren und kartenförmige Vergleichstabellen mit Kopier- und Exportfunktion auf Antworten, Code-Blöcken und Tabellen
* [x] Gerendertes Markdown wird bereinigt, wodurch Raw-HTML-Injection aus Modellausgabe und hochgeladenen Dateien verhindert wird
* [x] Diagramme und Code-Blöcke können als Dateien heruntergeladen werden; Reasoning wird standardmäßig in Live- und vergangenen Gesprächen zu einzeiligen Vorschauen eingeklappt
* [x] Gesprächsexporte sind für CJK gesetzt — PDF bettet eine echte Schriftart ein (korrekte Abstände, Aufzählungszeichen und Fettdruck), DOCX deklariert eine ostasiatische Schriftart, beide auf einer Größenskala

#### Workbench UX

* [x] Sidebar reorganized around the chat cluster — conversations directly under New chat/Search, module nav in a compact bottom dock
* [x] `/clear` slash command starts a fresh conversation from the input box
* [x] Admin model lists support checkbox multi-select with Shift-click ranges and one-request bulk delete
* [x] Running agent steps show generated one-line titles in a single folded header, kept in conversation history
* [x] A newly sent message rises to the top of the transcript, with the answer growing into the space below it
* [x] List pages stagger their cards in on first load, and all animation honours the system reduce-motion preference
* [x] Agents ask clarifying multiple-choice questions mid-run (ask\_user\_question) — the ReAct turn pauses on an in-chat card and resumes with the answers
* [x] Composer warns when an attached image would reach a text-only model, resolved from the model the turn would actually use
* [x] Unsent composer text, clips and attachments are kept per conversation (and for new chat), surviving refresh, conversation switches and expired sessions

#### Kontextrobustheit

* [x] Kontextbudgets liegen 8% unter dem Modell-Hardlimit; beim Start wird gewarnt, wenn das Fenster des schnellen Modells das allgemeine Budget nicht halten kann
* [x] Plan-Board-Disziplin: Wiederholungs- und No-Plan-Erinnerungen, und das Abschließen mit offenen Plan-Elementen erzwingt nun einen Verifizierungsdurchlauf
* [ ] Chunked-Kompaktionseingabe und modellbewusste Budgets auf dem Hauptchat-Pfad, damit jede Modellmischung innerhalb des Fensters bleibt

#### DAG Engine

* [x] Typed DAG steps — planner marks pure transform/synthesis steps `llm_direct` (single call, no tool loop); results carry typed run metadata
* [x] Ask-first goals finish in one round — planner delivers the questionnaire as the step, analyzer accepts it, auto-routing prefers Standard

#### Model Layer

* [x] GPT-5.x goes Responses-API-first (tools + reasoning together; 404 falls back to chat completions); other families stay on completions by design
* [x] GPT-5.x keeps its reasoning across tool rounds — native `/v1/responses` with encrypted reasoning replay, `FIM_GPT5_RESPONSES_MODE` to roll back
* [x] An output-limit cut discards the whole tool-call batch and asks for a smaller retry, so no reply runs only part of what it planned
* [ ] Verify Responses-bridge streaming usage numbers on the next LiteLLM upgrade (upstream mis-mapping suspected)
* [ ] Retire the LiteLLM chat→responses bridge once the native GPT-5.x path has run a full release

#### Szenario-Onboarding

* [ ] Der erste Durchlauf startet mit einer Szenariovorlage (solution\_seeds) statt einer leeren Workbench
* [ ] Die Dokumentations-Landingpage führt mit drei vertikalen Szenariogeschichten statt einer Modulreferenz an
* [ ] Eine Szenariovorlage pro abgeschlossenem Engagement destilliert — der Wettbewerbsvorteil liegt in Szenario-Assets × Liefergeschwindigkeit

### v0.10 — Two Mouths: JS Embed + IM Inbound&#x20;

**Goal**: The two most sellable delivery surfaces, both on the same kernel and assembly layer.

* [ ] JS bubble / iframe embed — one snippet into a host system; anonymous-visitor identity + billing attribution decided before build
* [x] Feishu callback URL passes verification: unsigned pushes authenticate by Encrypt Key envelope + Verification Token
* [ ] Feishu inbound @mention — agents live in the group: query data, file approvals, chase flows
* [ ] Outbound patterns: failure alerts, budget warnings, scheduled digests, escalation, audit receipts
* [ ] WeCom / DingTalk channels following Feishu

### Parked — signal-gated

Do not start these without their trigger (see the replan §3): the MCP gateway waits for ≥2 unsolicited "mount your tools in my agent" asks; channelization waits for an implementor asking about licensing; IdP/OrgSync waits for customer pull; the rest wait for a delivered engagement that needs them.

* [ ] MCP gateway output — reverse-expose connector discover/execute as MCP tools for downstream agents
* [ ] Channelization / white-label enablement — commercial-license path already in place
* [ ] Identity Provider module + Channel slim-down — Feishu SSO, org graph sync&#x20;
* [ ] Connector authorization Tier 2 (require per-user credentials, key-binding health) + Tier 3 (login-ticket exchange)&#x20;
* [ ] Public API Phase 2 — per-key rate limits/quotas, versioning, SDKs, developer portal&#x20;
* [ ] Observability — Agent Trace Layer (Trace/Span model, timeline viewer, OTel export) + metrics dashboard&#x20;
* [ ] Agent Workspace remainder — handoff notes, file browser UI, cross-session recall, compaction segments (grep-able on-disk summary the agent reads back)&#x20;
* [ ] Guardrails v1 — off-topic filter, PII redactor output guardrail, per-agent guardrail config UI
* [ ] Hook System extras — built-in hooks, `SessionStart` + user YAML hooks&#x20;
* [ ] Connector platform depth — Progressive Disclosure Phase 3-4, YAML/JSON connector config, DB connectors Phase 4 (Oracle / SQL Server / GBase), MCP connection pooling
* [ ] Prompt cache follow-ups — Gemini context cache adapter, per-agent `cache_ttl`&#x20;
* [ ] Hot mid-stream DAG resume — SSE reconnect re-attaches to a running turn (cold retry-resume already shipped)&#x20;
* [ ] Ecosystem — scheduled/event-triggered agents, workflow trigger-identity observability, per-workflow `credential_policy`, DB Schema Advanced Builder, sandbox hardening v2

### Aus dem Pre-Replan v0.9-Plan ausgeliefert

* [x] ~~Auth & security: JWT token-type confinement + OAuth fixes (v0.8.7); PG tz-aware timestamps (v0.8.6); force-logout UTC + `POSTGRES_*` override + SSRF IPv6-mapped fix (v0.8.8); owner-fallback opt-in + visibility-unified binding + webhook/cron metering (v0.8.9)~~

* [x] ~~Provider compat: Anthropic adaptive thinking + shared LLM pool self-heal (v0.8.8)~~

* [x] ~~Content guardrails v0: tripwire layer + jailbreak detector (v0.8.7)~~&#x20;

* [x] ~~Hook system: skeleton + FeishuGateHook + Approval Playground + ReAct/DAG runtime (v0.8.5); PreToolUse enforcement fail-closed (v0.8.8)~~

* [x] ~~Feishu channel Phase 1 + task completion notification (v0.8.5)~~

* [x] ~~`run_workflow` agent tool (v0.8.9); reasoning detail preserved end-to-end (v0.8.8); workspace tool-output offloading wired into chat (v0.8.9)~~

* [x] ~~Agent loop hardening: plan board, LLM-call resilience, background tools, incremental DAG replan + checkpoint resume, compaction tool-pairing (v0.8.9)~~&#x20;

* [x] ~~Circuit breaker, Workflow run retention cleanup, Workflow version diff summaries~~ *(v0.8 / v0.8.1)*

* [x] ~~DAG quality overhaul, Domain model escalation, Per-model NFC toggle~~ *(v0.8.1)*

* [x] ~~DatabaseMetaTool, MCPServerMetaTool, On-demand `request_tools`~~ *(v0.8.1)*

* [x] ~~Workflow Connection Dep Auto-Subscribe, Workflow real executors~~ *(v0.8.1)*

* [x] ~~ReAct Cycle Detection, Completion Checklist~~ *(v0.8.1)*

* [x] ~~Prebuilt Solution Templates (8 vertical bundles), Resource Fork (MCP/Skill/Agent/Connector/Workflow)~~ *(v0.8.1)*

* [x] ~~Vision document processing (PDF / DOCX / PPTX), MarkItDown OCR~~ *(v0.8.2 / v0.8.3)*

* [x] ~~Smart File Content Injection + `read_uploaded_file`~~ *(v0.8)*

* [x] ~~Agent Core Phase 3: Conversation Recovery MVP, Compact Work Card, Turn Profiler, Per-user Rate Limiting~~ *(v0.8.3)*

* [x] ~~Conversation resume MVP, System prompt registry + cache, Thinking-block persistence, Reasoning replay policy, Cache observability~~ *(v0.8.4)*

### v1.0 — Hot-Plug + Embeddable

**Ziel**: Connector-Hinzufügung ohne Neustart, Paket-Ökosystem und eingebettete Bereitstellung.

* [ ] **Connector Progressive Disclosure (Phase 5)**: **Semantic-Guided Tool Selection** (Entitätsextraktion aus Abfrage → Ontology Registry-Suche → Connector-Set-Reduktion; 90%+ Token-Reduktion für 50+ Connector-Bereitstellungen); Skalierungsmodus für Batch-/ETL-Connectors; CLI-ähnliche universelle `connector <name> <action> <params>` Schnittstelle

* [ ] **Cross-Connector Entity Alignment (Ontology Registry)** — *herabgestuft 2026-04-21: bedarfsgesteuerte benutzerdefinierte Bereitstellung, keine Kernfunktion*: Definieren Sie gemeinsame Entitätstypen (Customer, Order, Asset) mit Feldmappings über Connectors hinweg; DAGPlanner löst Cross-System JOIN-Schlüssel automatisch auf; ermöglicht Cross-Connector-Abfragen (z. B. „Kunden in Salesforce, die in Shopify bestellt haben") ohne hartcodierte Feldnamen

* [ ] **Hot-plug Connectors**: OpenAPI-Spezifikation hochladen, KI generiert Konfiguration, live in 5 Minuten (kein Neustart)

* [x] ~~**Marketplace Redesign Phase 1 — Solutions + Components**~~: Zwei-Ebenen-Marktmodell (Solutions: Agent/Skill/Workflow; Components: Connector/MCP Server); Scope-Selector (Global Market / org); einheitliches Abonnementmodell (org auto-appear entfernt); KB aus Market-Scope entfernt; Datenmigration füllt Abonnements für bestehende Org-Mitglieder auf

* [ ] **Market Package System**: Verteilbare Ressourcen-Bundles für den Marketplace — ersetzt pro-Typ „Marketplace" durch eine einheitliche Packaging-Schicht. `fim-package.yaml` Manifest deklariert: Metadaten (Name, Version, Beschreibung, Autor, Lizenz, Tags, `min_fim_version`), Einstiegspunkt (primärer Skill oder Agent), Ressourcenliste (Agents, Skills, Connectors, KBs, MCP Server, Workflows) mit Konfigurationsreferenzen, Abhängigkeiten zwischen Paketen (semver-Bereiche), erforderliche Anmeldedaten (zugeordnet zu Connector-Refs für Installation-Zeit-Erfassung) und benutzerkonfigurierbare Variablen mit Standardwerten. **Zwei Konsummodi**: (1) **install** — Batch-Erstellung aller Ressourcen + automatische Verdrahtung interner Referenzen über ID-Substitution; Installation mit Quelle verknüpft für Versionsaktualisierungsbenachrichtigungen; `POST /api/market/packages/{id}/install`; (2) **fork** — Klonen als benutzergesteuerte bearbeitbare Kopien ohne Update-Link (dies IST der Template-Modus); `POST /api/market/packages/{id}/fork`. Zusätzliche Endpunkte: Veröffentlichung (`POST /api/market/packages` mit Review-Workflow), Deinstallation (`DELETE /packages/{id}/uninstall` mit Abhängigkeitsprüfung + Bestätigung geänderter Ressourcen), Versionsverlauf (`GET /packages/{id}/versions`), Upgrade (`POST /packages/{id}/upgrade` mit Pro-Ressourcen-Diff-Vorschau). Abhängigkeitsresolver für verschachtelte Paketanforderungen mit Konflikt-Erkennung. `PackageInstallation` Tabelle verfolgt installierte Pakete pro Benutzer mit Ressourcen-ID-Mapping für Deinstallation/Upgrade. **Koexistiert mit individueller Ressourcenveröffentlichung** — Package ist eine Kompositionsschicht, kein Ersatz; ein einzelner Connector ist immer noch eigenständig veröffentlichbar. Beispiel-Abhängigkeitsbaum: `Package: contract-review` → `Skill: contract-review` (Einstiegspunkt) → `Agent: contract-analyst` + `Agent: risk-scorer` → `KB: legal-clauses` + `Connector: docusign-api` + `MCP: pdf-extractor` + `Workflow: contract-approval-flow`

* [ ] **Creator Program**: Marketplace-Monetarisierungsschicht — Creator-Profile mit Portfolio-Seiten, Pro-Paket-Analysen (Installationen, Forks, aktive Benutzer, Bewertungen/Rezensionen), Affiliate-Provisionserfassung, wenn Pakete neue Abonnements fördern. Kostenpflichtiger Paket-Tier mit Preisgestaltung, Kauffluss und Genehmigungsworkflow. Creator-Dashboard mit Installationstrends, Umsatzberichte und Benutzer-Feedback. Öffentliche Creator-API für programmgesteuerte Paketveröffentlichung (CI/CD für Paketautoren). Community-Features: Paket-Kommentare, Q\&A, Changelogs pro Version

* [ ] **Embeddable Widget**: `<script src="fim-one.js">` in Host-Seite eingefügt

* [ ] **Page Context Injection**: Widget liest Host-Seiten-Kontext (aktuelle ID, URL, DOM-Selektoren)

* [ ] **Advanced Triggers**: Webhook-Inbound-Events; erweiterte geplante Job-Verbesserungen (Multi-Zeitzone, Kalender-bewusst)

* [ ] **Batch-Ausführung**: Verarbeitung von 1000+ Elementen über DAG

* [ ] **Enterprise Security**: IP-Whitelisting, Verschlüsselung im Ruhezustand, SSO

* [ ] **KB Advanced Editor**: Builder-Mode-Agent für Power-User, die große Wissensdatenbanken verwalten — Bulk-URL-Aufnahme, Duplikat-Erkennung, Lückenanalyse, Dokumenten-Lebenszyklusmanagement; erweitert bestehenden KB-KI-Chat mit ReAct-Tool-Loop

* [ ] Billing-Zugriffsmodell — Instanz wählt keine Abonnements / enthalten+bezahlt / nur bezahlt, sodass Self-Host, SaaS und Gebühren-von-Tag-Eins unterschiedlich bleiben&#x20;

* [ ] **Stripe Billing (v1 MVP — Pro Subscription)**: Kostenlos + Pro zwei-Ebenen-Abonnement mit monatlichem Token-Kontingent. Stripe Checkout (gehostet) + Customer Portal (Self-Service) + Webhook-gesteuerte Lebenszyklen (`checkout.session.completed` / `customer.subscription.updated|deleted` / `invoice.payment_succeeded|failed`). Soft-Cap bei Kontingent-Erschöpfung (HTTP 402 + Upgrade-Aufforderung) — keine Übergebühren in v1. Nur Pro-Benutzer-Abrechnung; Org/Team-Abonnements auf v3 verschoben. Voraussetzungen:
  * [x] ~~**Datenmodell + SDK-Grundlagen** (P1) — `billing_plans` / `subscriptions` / `stripe_webhook_events` Tabellen, ORM-Modelle, Stripe SDK Singleton, Free + Pro Seeds~~ *(ausgeliefert in v0.8.6)*
  * [x] ~~**Backend-API + Webhook-Handler** (P2) — `/api/billing/*` + `/api/webhooks/stripe` mit Signaturverifizierung + Idempotenz; Plan-bewusstes Kontingent; stündliche Lebenszyklen-Sweep~~ *(ausgeliefert in v0.8.6)*
  * [x] ~~**Frontend Billing-Tab + 402 Upgrade-Dialog** (P3) — `/settings?tab=billing` Kontingent-Anzeige, Upgrade-CTA, `past_due` Banner, Mid-Stream 402 Dialog~~ *(ausgeliefert in v0.8.6)*
  * [x] ~~**Admin-Plan-Verwaltung** (P4) — `admin/billing/{plans,subscriptions}` CRUD~~ *(ausgeliefert in v0.8.6)*
  * [x] ~~**Admin-gesteuerte Billing-Feature-Flag** (P5) — `system_settings.billing_enabled` Gates die Stripe-Pipeline; idempotente Aktivierung Seeds Free+Pro, setzt Standard-Plan-Pointer, Backfills-Benutzer; Toggle aus/an ist reines Flag-Flip nach Aktivierung~~ *(ausgeliefert in v0.8.6)*
  * [ ] **Abstimmung + E2E + Go-Live** (P6) — nächtliches `subscriptions` ↔ `stripe.Subscription.list()` Abstimmungsskript für Missed-Webhook-Wiederherstellung; vollständiger Happy-Path / Cancel-Mid-Period / Past-Due Regressionstests; Wechsel von Test-Modus `stripe_price_id` zu Live `price_id`; Smoke-Test auf Staging mit echter Karte.

* [ ] **Team Plan (Stripe Seats)** — Pro-Seat-Preisgestaltung über `stripe.Subscription.quantity`, integriert mit Organization-Mitgliedschaft. Ermöglicht Unternehmen, einen teamweiten Plan mit N Seats zu abonnieren; Kontingent und Feature-Flags werden über die Seat-Gruppe statt über den einzelnen Benutzer aufgelöst. Baut auf dem v1.0 Stripe MVP und dem bestehenden Organization-Modell auf.

* [ ] **Group-Level Token-Kontingent für Nicht-Billing-Bereitstellungen** — Enterprise / Private-Bereitstellungen ohne Stripe konfigurieren Organisations-Level Token-Budgets. Kontingent-Kette erweitert zu `override > group > plan > default`; Group-Auflösung verwendet `max(user_quota, group_quota)` sodass einzelne VIPs nicht durch die Team-Cap eingeschränkt werden. Landet neben dem Team Plan, sodass die gleichen Primitiven sowohl abgerechnete als auch Self-Hosted-Topologien bedienen.

**Impact**: Unternehmen stellen FIM One von Null bis Multi-System-Orchestrierung in Tagen bereit. Das Package-System schafft ein Creator-Ökosystem — Solution-Autoren veröffentlichen zusammengesetzte Bundles (Skill + Agents + Connectors + KBs + Workflows), Unternehmen installieren mit einem Klick, Creator verdienen durch Adoption. Install/Fork-Dualität deckt sowohl „As-Is verwenden" als auch „Aus Template anpassen" Anwendungsfälle in einem einzigen Mechanismus ab.

## Gefrorene Funktionen (Ausgeliefert, nur Wartung)

Gemäß der [Orthogonality Strategy](/strategy/orthogonality-strategy) sind diese Funktionen ausgeliefert und funktionsfähig, erhalten aber keine neuen Funktionen (nur Fehlerbehebungen):

| Funktion                          | Version            | Grund für Einfrieren                                                                                                                                                                                                                                                                                                                                                                              |
| --------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ReAct Agent                       | v0.1, v0.9         | Modelle haben jetzt natives Tool Calling. Mid-Loop Self-Reflection (v0.9) verhindert Goal Drift in langen Ketten. Qualität der Tool Observation Synthesis verbessert (8K Zeichen, konfigurierbar via `REACT_TOOL_OBS_TRUNCATION`)                                                                                                                                                                 |
| DAG Planning / Re-Planning        | v0.1, v0.5, v0.7.5 | Modell-Reasoning-Fähigkeiten verbessern sich; Dekomposition wird Single-Shot. Per-Step Verification in v0.7.5 ausgeliefert (`DAG_STEP_VERIFICATION`). Gehärtet: Cascade Failure Propagation, Verifier Status Fix, Planner Tool Descriptions, vollständige Replan History, Whitelist-basierter Tool Cache. 14 Engine Constants als ENV Vars verfügbar — keine weiteren Planning Primitives geplant |
| Memory (Window, Summary, Compact) | v0.2, v0.5         | Context Windows wachsen (200K+); weniger Bedarf für externes Memory Management                                                                                                                                                                                                                                                                                                                    |
| RAG Pipeline                      | v0.5               | Provider bauen Retrieval nativ ein (OpenAI file\_search, Gemini Search Grounding)                                                                                                                                                                                                                                                                                                                 |
| Grounded Generation               | v0.5               | Modelle verbessern sich bei Citations; 5-Stage Pipeline bringt abnehmenden Nutzen                                                                                                                                                                                                                                                                                                                 |
| ContextGuard / Pinned Messages    | v0.5               | Wird wie vorhanden ausgeliefert; keine neuen Funktionen                                                                                                                                                                                                                                                                                                                                           |

## Überlegungen (Auf unbestimmte Zeit aufgeschoben)

Gemäß der Orthogonalitätsstrategie würden diese hohen Aufwand erfordern und Absorptionsrisiken bergen:

| Feature                                               | Grund für Aufschub                                                                                                                                                                                                                                                                                                                                                                         |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Multi-Agent-Orchestrierung (tiefe Hierarchien)        | Anbieter bauen nativ (OpenAI Swarm, Google A2A und ähnliche Multi-Agent-Angebote). FIM One's CallAgentTool deckt den Fall einer Ebene ab; ereignisgesteuerte Hintergrund-Agenten werden durch Scheduled Jobs in v0.9 abgedeckt                                                                                                                                                             |
| Agent-Selbstmodifizierende Skills (Procedural Memory) | Agenten aktualisieren ihre eigene `skill.md` während der Ausführung — hohe Komplexität, Sicherheits-/Audit-Oberfläche. Hängt davon ab, dass das Agent Skill System (v0.8) zuerst ausgeliefert wird. Neu bewerten, wenn Enterprise-Kunden selbstverbessernde Agenten explizit anfordern                                                                                                     |
| ~~Agent Workspace (Tool Output File Offloading)~~     | Zu v0.9 befördert. Der Wert liegt in **selektivem Lesen**, nicht in Kontextkapazität — Cross-Framework-Validierung bestätigt. Ursprüngliche Aufschublogik („200K+ Fenster reduzieren Dringlichkeit") war falsch.                                                                                                                                                                           |
| Cross-Session Long-Term Memory                        | Kontextfenster wachsen schnell (200K–2M); Anbieter fügen integriertes Memory hinzu (OpenAI memory, Gemini context caching); hohe Implementierungskosten vs. sinkender Differenzierungswert. Neu bewerten, wenn Enterprise-Kunden es explizit anfordern                                                                                                                                     |
| Memory Lifecycle (TTL, Quoten)                        | Hängt von Cross-Session Memory ab; zusammen aufgeschoben                                                                                                                                                                                                                                                                                                                                   |
| Active Context Compression Tool (agent-triggered)     | Explizit eingefroren mit ContextGuard (v0.5). Kontextfenster bei 200K+ reduzieren den Wert. Wird nicht erneut überprüft, es sei denn, Kontextkosten werden zu einer großen Enterprise-Beschwerde                                                                                                                                                                                           |
| Browser-Automatisierung / Computer Use                | Hohe Wartungskosten (DOM-Änderungen, Anti-Bot, Sandboxing). Industrie konvergiert zu Computer Use Mode (Anthropic, OpenAI Operator, Google Mariner) und MCP Browser Tools (Puppeteer/Playwright MCP). Über MCP-Integration nutzen, nicht selbst bauen. Neu bewerten, wenn stabiler Computer Use MCP Standard entsteht                                                                      |
| Web Push Notifications                                | Browser-native Push über Service Worker + VAPID. Überlappt mit IM Channel Integration (v0.8), die Enterprise-bevorzugte Kanäle abdeckt (Lark/Slack/WeCom/Email). IM Push hat höheren Enterprise-Wert; Web Push ist ein Nice-to-Have für Portal-only-Benutzer. Neu bewerten nach IM Channel Auslieferung — wenn Benutzer Browser-Benachrichtigungen über IM-Abdeckung hinaus anfordern      |
| Multi-User Workflow Collaborative Editing             | Echtzeit-Co-Editing desselben Workflow-Blueprints (Figma/Notion-Stil) mit Cursor-Awareness, Konfliktauflösung und Pro-Node-Sperre. Hohe Implementierungskosten (CRDT / OT, Presence-Infrastruktur), unklar Enterprise-Nachfrage über heutiges „ein Editor gleichzeitig + Version Diff" Modell. Neu bewerten, wenn mehrere Unternehmen explizit gemeinsames Live-Editing anfordern          |
| Per-Node Workflow Execution Permissions (RBAC on Run) | Feinkörnige Autorisierung *innerhalb* einer einzelnen Workflow-Ausführung — z.B. „Node X erfordert Rolle `finance_approver` zur Ausführung". Heute erfolgt Autorisierung auf Workflow-Ebene (wer kann auslösen) und auf Connector-Ebene (wessen Anmeldedaten laufen); Per-Node RBAC fügt eine dritte Achse mit erheblicher Komplexität und ohne aktive Kundenanfrage hinzu                 |
| Cross-Org Workflow Sharing mit Live Updates           | Workflow aus einer anderen Org abonnieren und Upstream-Updates ohne Neuforking erhalten. Heute bedeutet Abonnement = Fork (Snapshot), daher brechen Upstream-Änderungen nie durch. Live Updates würden Upstream-kompatible Schema-Evolution + Konfliktauflösung erfordern; hohe Wartungskosten. Neu bewerten, wenn Unternehmen „gemeinsame Workflows über Tochtergesellschaften" anfordern |

## Wie Versionen Mit Modi Ausgerichtet Sind

| Version       | Standalone | Copilot   | Hub        | Anmerkungen                                                                   |
| ------------- | ---------- | --------- | ---------- | ----------------------------------------------------------------------------- |
| **v0.1–v0.3** | Working    | Not yet   | Not yet    | Portal-only, single-user                                                      |
| **v0.4**      | Working    | Not yet   | Not yet    | Multi-conversation, agent management                                          |
| **v0.5**      | Working    | Not yet   | Not yet    | Knowledge base + RAG                                                          |
| **v0.6**      | Working    | Possible  | Possible   | Connectors ship; Copilot/Hub possible with manual wiring                      |
| **v0.7**      | Working    | Ready     | Ready      | Admin platform; multi-tenant auth; ready for production                       |
| **v0.8**      | Working    | Ready     | Optimized  | RBAC + audit log per-system; easier to onboard                                |
| **v0.9**      | Working    | Ready     | Production | Observability, performance, hardening                                         |
| **v1.0**      | Working    | Optimized | Enterprise | Package system, creator program, hot-plug, embeddable widget, webhooks, batch |

## Resource Allocation (v0.8–v1.0)

The Orthogonality Strategy shapes where effort goes:

| Category                                                       | Allocation | Versions  | Why                                                                                                                                                |
| -------------------------------------------------------------- | ---------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Connector Platform** (v0.6+)                                 | 50%        | Ongoing   | Core differentiation; no absorption risk                                                                                                           |
| **Enterprise Features** (RBAC, audit, security, observability) | 30%        | v0.8–v1.0 | Boring but durable; production requirement. Agent Trace Layer is commercial anchor                                                                 |
| **Agent Intelligence** (Skill System, scheduled agents)        | 15%        | v0.8–v0.9 | Instructions + tools + skills differentiation story; low absorption risk — frameworks validate patterns, but enterprise SOPs are customer-specific |
| **v0.1–v0.5 maintenance**                                      | 5%         | Ongoing   | Bug fixes only; no new features                                                                                                                    |

## Metric-Driven Milestones

Success is measured by:

| Metric                               | v0.7 Target        | v0.8 Target            | v1.0 Target          |
| ------------------------------------ | ------------------ | ---------------------- | -------------------- |
| Connectors deployed                  | 5                  | 20+                    | 100+                 |
| Enterprise customers                 | 1–2                | 5–10                   | 20+                  |
| Avg connector setup time             | 2 weeks            | 2 days                 | 5 minutes (hot-plug) |
| Token efficiency (DAG vs ReAct-only) | 30% reduction      | 40% reduction          | 50% reduction        |
| Uptime SLA                           | 99.5%              | 99.9%                  | 99.95%               |
| Support ticket themes                | Integration, setup | Connector custom logic | Hot-plug, scaling    |

## Open Questions / TBD

* **Marketplace moderation**: How to validate community packages and individual resources? Automated scanning for credential leaks in package configs? (v1.0)
* **Token economics**: How to price multi-user, multi-agent scenarios? (v1.0)
* **Package versioning**: Breaking changes in installed packages — auto-upgrade with migration scripts, or manual approval per update? Dependency diamond problem resolution? (v1.0)
* **Package pricing**: Free vs paid tiers, commission rates for Creator Program, payment provider integration? (v1.0)
* **Package credential UX**: Install-time credential collection — wizard-style step-by-step or deferred setup? Credential sharing across packages that use the same connector type? (v1.0)
* **Telemetry opt-out**: How to honor privacy preferences? (v0.8)
* **Connector versioning**: How to manage breaking changes in connector APIs? (v0.8)
* **Rate limiting**: Per-user workflow rate limiting shipped (sliding window 10 runs/min, 3 concurrent). Per-connector and per-agent rate limiting TBD (v0.9)
* **Connector authorization tier selection**: how does an admin discover which tier applies to a given upstream system? Auto-probe (try per-user API key → fall back to login-ticket → fall back to shared-DB) vs. explicit declaration in the connector spec? How do we express "this connector supports Tier 2 but the admin chose to operate in Tier 1" in the UI without confusing non-technical admins? (v0.9)
* **Integration vs Connector duality**: when a Feishu binding is simultaneously an SSO provider AND an API-call surface, how do we present it in Settings? One object with three toggles, or three separate bindings that share a credential? Implications for uninstall semantics (does revoking SSO kill the Connector?) (v0.9)