The Warp Roadmap

Where we stand — locked, not up for review

What last night settled. Everything below is built on these four.

This week — five builds, in order

The journey: the fleet cleans up after itself, seats stop dying, cards stop lying, flash closes, and it all assembles into the next release.

1. Cleanup with receipts + disk headroom check. The machine deletes its own banked leftovers and refuses new work when disk is low — receipts always. Three measured emergencies in one night are the case file.
   ↘ go deeper — the ratified spec

   Three reap classes (banked run debris, merged worktrees, superseded staging bundles), each with unique-bytes teeth: nothing is deleted unless its bytes provably exist elsewhere. Every reap writes a ledger row. A mandatory red proof — a deliberate should-refuse case — ships with the build. The emergencies: 48G on one box, ~100G on this Mac in an afternoon, and a box that hit literal zero mid-run and stranded finished work. Your words ratifying it: “Yes that’s fine and if there’s a way to manage this without me needing to paste that would be ideal.”
2. The seat launcher. One word opens a terminal signed in as any subscription seat; seats run side by side, so an account switch stops killing working sessions — last night’s switch killed two mid-arc, including the one that wrote the handoff.
   ↘ go deeper — the design and its one trap

   Per-seat config folders (CLAUDE_CONFIG_DIR per Claude seat, CODEX_HOME per Codex seat) — sign in once each, tokens refresh themselves. seat <name> launches; seat ls reads each seat’s credential state honestly: signed-in / expiring / UNKNOWN, never guessed. The trap that bites silently: session memory and history live INSIDE each config folder, so keeper memory must be shared across seats deliberately — a one-time wiring decision in the build, not an afterthought. Extends the existing conversational connect flow for “connect my second claude/codex”. Afternoon-sized.
3. Engine cards can never silently resolve empty. Setup either resolves an engine with its real home on the path, or refuses loudly when disk and card disagree. The class fix for last night’s blank-card incident.
   ↘ go deeper — the incident

   A routine fleet card refresh resolved binaries without the engine’s home directory on PATH, found nothing, and wrote blank cards to all four boxes. The queue was held before the fix, so zero runs were lost — but only because someone noticed. The cure lands in setup itself: resolution runs with engine homes on PATH, and a disk-vs-card disagreement is a loud refusal, never a blank write.
4. Flash’s last rung — blocked on the starred decision. The cheap-capacity lane is one receipt from proven. Six failure rungs were named and cured one by one; the seventh needs your egress ruling (the starred decision below). The closing run is staged and fires on your word.
   ↘ go deeper — the six-rung ladder, each rung named by its own receipt

   r5 wrong runtime version (cured: the runtime contract, deploys #356–#357) → r6 package registry needed at boot (cured by design: baked at build time) → r7 installer writing to a read-only home (cured: cache and logs into run scratch, #358 — the installer’s own log landed next run) → r8 disk too small, measured 2.6G (cured: bigger tier, #359 — proven 6.4G next run) → r10 the crash’s witness log wasn’t the one captured (cured: ALL logs travel home, oldest first, #360–#361) → r11 named the real blocker: no network path to the package registry from inside the sealed container — hundreds of verbatim DNS-failure lines, while github access worked all night. Production already proved the runtime half on a customer workload. None of the rungs was guessed; every cure was deployed full-green and probed before anyone was told to trust it.
5. 0.6.145 assembly. Everything above, plus two standing debts: dispatch briefs brought under the size cap (that debt cost two review legs and a proof run in a single night), and the nine-item definitions batch from the night’s filed findings.
   ↘ go deeper — the nine-item batch

   Scrubber false-positive class (three sightings) · path-identity verdict gating · nested-spawn permission error · a vacuous changed-files check · brief-class vs report-only custody · escort reliability (three distinct classes) · the honest-clock family: the card’s default time ceiling plus the ~1-hour engine session ceiling that currently shows up as a bare hard-stop — minimum cure is naming the cut in the record.

Next — the reliability arc

The baseline is measured, not felt: runs dispatched to the fleet boxes finish clean roughly 80–90% of the time; runs on this Mac, roughly 43%. The single biggest loss is runs that vanish without leaving a report — nobody has read that pile yet.

The moves, each already receipted as a real failure class:

1. Check the seat before dispatching. An expired seat fails its first job and heals on the second — the door should catch it before the job dies.
2. Refuse impossible jobs out loud. A job that cannot succeed gets a typed refusal at the door, not a silent death an hour later.
3. One reachable path to dispatch. The supervised lane becomes the only way work leaves — no side doors that skip the belts.
4. Every cut is named. When a vendor-side limit kills a run, the record says so — today the ~1-hour session ceiling shows up as a bare stop with no cause.

Horizon — team and 0.7

Sequenced after this week’s builds; each has a named precondition, none is speculative.

Your decision pile — the red-pen targets

One starred decision blocks a live run today. The rest are filed with receipts and can wait for your pace.

Honest risks

Named plainly — we design for these, not around them.