v1.5 Release Roadmap — sequencing, waves & critical path (provisional)

[VijitSingh97]

Single source of truth for the v1.5 release plan — same format as the v1.3 #364 and v1.4 roadmaps. Open and in progress (v1.4 is being cut — 2026-07-11). The 2026-07 audit left a spec-gap assessment on every issue below; several need a decision or rescope before implementation (Wave 0).

Branch strategy (freeze workaround, live since 2026-07-11): develop is the frozen v1.4 release candidate — v1.5 code must not touch it. So v1.5 work integrates on develop-v1.5 (branched from the develop tip, same 15-check + 1-review protection). Feature branches (claude/v15-*) PR into develop-v1.5 with full CI + review + hand-unioned CHANGELOG, exactly like develop. When v1.4 cuts and back-merges to develop, develop-v1.5 merges to develop in ONE PR (reconcile CHANGELOG: the v1.4 entries are already in [1.4.0] on develop, so keep only the v1.5 entries under [Unreleased]), then delete develop-v1.5 and resume normal develop flow. Net: zero idle dev time, zero v1.5 leakage into the v1.4 cut.

The theme: v1.4 gives the operator hands on the stack; v1.5 extends them across the fleet. The spine is the RigForge integration: the enriched worker feed (rigforge#99) consumed by the dashboard (#235), per-worker configuration (#172 → #185), and remote control from Telegram (#338). Around it: net-profit economics (#260), on-chain payout confirmation (#381), alert transports beyond Telegram (#380), and the fleet e2e suite (#209).

---

Critical path

   Wave 0 — DECISIONS & RESCOPES (no code until these close)
   #172  rescope: per-worker {name,host,port,token} descriptor   (body half-mooted)
   #249  rewrite: define "backup stack" + what syncs             (five-line wish today)
   rigforge#99 schema freeze                                     (producer contract for #235)
                 │
                 ▼
   Wave 1 — FLEET SPINE
   #172  worker ports & per-worker overrides
     └─► #235  consume the enriched feed (badge + health/power chips)   [hard dep: rigforge#99]
            ├─► #185  Worker Inspect page (read/edit config + history)  [producer: rigforge#236]
            └─► #260  energy & profit calculator                        [also feeds on #117/#118 from v1.3]
                 │
   Wave 2 — CONTROL & CONFIRMATION
   #338  Telegram two-way control       [thin client of v1.4's #33 contract]
   #381  payout confirmation (view-only wallet)
                 ▼
              SHIP 1.5

  independent, off the critical path:
    #380  alert sinks: generic webhook + ntfy (Tor-routed like Telegram)
    #209  integration tests: RigForge worker ↔ xmrig-proxy   [needs the 3-mode auth matrix rewrite]
    #249  primary/backup stack sync                          [after its Wave 0 rewrite; may slip]

• Wave 0 is real work — three issues have stale bodies (pre-feat(#171,#172): one config-driven worker-API probe, default no-auth #315 Bearer <rig name> auth contract, shipped workers.api_port, closed Dashboard: config to read workers that use a custom XMRig API token #171). The gap-assessment comments on Configurable worker ports & endpoints: non-standard stratum/API ports + per-worker host/port/token overrides (later) #172/Warm the backup stack's XvB donation state so a failover doesn't cold-start the split #249/Integration tests: RigForge worker ↔ Pithead xmrig-proxy (end-to-end flows) #209 list exactly what to rewrite. Freeze the rigforge#99 JSON schema before [Feature] Dashboard: consume RigForge's enriched feed (rigforge#99) — update badge + per-worker health / power / tune / firmware #235 parses it.
• Cross-repo: [Feature] Dashboard: consume RigForge's enriched feed (rigforge#99) — update badge + per-worker health / power / tune / firmware #235/Integration tests: RigForge worker ↔ Pithead xmrig-proxy (end-to-end flows) #209/Configurable worker ports & endpoints: non-standard stratum/API ports + per-worker host/port/token overrides (later) #172/Dashboard: energy & profit calculator — net profit (earnings − power cost), from RigForge's power telemetry #260/Dashboard: Worker Inspect page — read/edit each miner's XMRig config over its API, with versioned config history + per-config hashrate stats #185/Telegram two-way control commands (restart / apply) with access control #338 all need matching RigForge work — file the rigforge trackers when this cycle opens (the Dashboard: Worker Inspect page — read/edit each miner's XMRig config over its API, with versioned config history + per-config hashrate stats #185 writable-API mode now has rigforge#236 (2026-07-11)).
• Telegram two-way control commands (restart / apply) with access control #338 depends on v1.4's Stack config editor: change any setting from the dashboard, applied via pithead (incl. P2Pool mode hot-swap) #33 (per-action approval + the control channel) — it must not grow its own host-mutation path.

Wave 0 — Decisions & rescopes

• Configurable worker ports & endpoints: non-standard stratum/API ports + per-worker host/port/token overrides (later) #172 — rescope ✓ done 2026-07-11 — to p2pool.stratum_port + a from-scratch per-worker {name, host, port, token} descriptor with an explicit merge rule (per-worker > fleet default > inherit).
• Warm the backup stack's XvB donation state so a failover doesn't cold-start the split #249 — rewrite ✓ done 2026-07-11 — the body: scope to syncing the XvB swap-algo/credited state (the stated pain) unless a real case for DB/config sync emerges.
• rigforge#99 — freeze the enriched-feed schema ✓ effectively frozen 2026-07-11 — the [Feature] Dashboard: consume RigForge's enriched feed (rigforge#99) — update badge + per-worker health / power / tune / firmware #235 consumer merged against rigforge v1.7.0's shipped enriched feed (rigforge#99); Pithead parses what shipped.

Wave 1 — Fleet spine

UNBLOCKED (2026-07-11, maintainer gave the word): RigForge merged its release with the writable PUT worker-config API (rigforge#236) — the spine's producer dependency. #235/#185/#260/#209 may now proceed on develop-v1.5. First step: verify the shipped RigForge contract (the PUT endpoint/method/payload from rigforge#236 + the rigforge#99 enriched-feed JSON schema) and implement the pithead consumer against what actually shipped, not the pre-freeze sketch.

• Configurable worker ports & endpoints: non-standard stratum/API ports + per-worker host/port/token overrides (later) #172 — Configurable worker ports ✓ merged 2026-07-11 (PR feat(workers): configurable stratum port + per-worker endpoints (#172) #466 → develop-v1.5; Control channel: move the config merge host-side so the container never mounts plaintext config.json #440 host-side-masking semantic merge resolved — per-worker tokens now mask/restore in pithead's jq, container control_service.py verbatim; dashboard.workers changes stay host-CLI-only via the approval gate). Configurable p2pool.stratum_port + per-worker {name,host,port,token} overrides.
• [Feature] Dashboard: consume RigForge's enriched feed (rigforge#99) — update badge + per-worker health / power / tune / firmware #235 — Dashboard: consume RigForge's enriched feed ✓ merged 2026-07-11 (PR feat(dashboard): consume RigForge enriched worker feed (#235) #475 → develop-v1.5): update badge + per-worker health / power / tune / firmware chips, parsed against the shipped rigforge#99 enriched-feed schema.
• Dashboard: Worker Inspect page — read/edit each miner's XMRig config over its API, with versioned config history + per-config hashrate stats #185 — Worker Inspect page (read/edit XMRig config over the worker API, versioned history; write path fail-closed unless dashboard.auth is enabled).
• Dashboard: energy & profit calculator — net profit (earnings − power cost), from RigForge's power telemetry #260 — Energy & profit calculator ✓ merged 2026-07-12 (PR feat(dashboard): energy & profit calculator (#260) #487 → develop-v1.5): Energy tab on the earnings card — fleet watts/efficiency/kWh, and (once cost_per_kwh + xmr_price set) net profit after power. Manual-watts fallback on the dashboard.workers[] descriptor; no price feed (operator-supplied, privacy). Net is P2Pool XMR only.

Wave 2 — Control & confirmation

• Telegram two-way control commands (restart / apply) with access control #338 — Telegram two-way control commands ✓ merged 2026-07-11 (PR feat(telegram): two-way control commands /restart + /apply (#338) #469 → develop-v1.5): /restart + /apply gated by numeric allowed_ids + one-shot owner-bound confirm button (deny-on-timeout); rides the Stack config editor: change any setting from the dashboard, applied via pithead (incl. P2Pool mode hot-swap) #33 spool with fixed-verb host-side dispatch (no request byte reaches a command). Security-reviewed clean; two non-blocking nits filed as Telegram control (#338) follow-ups: per-operator rate-limit + ControlGate docstring accuracy #470.
• Confirm payouts on-chain with a view-only wallet (monero-wallet-rpc against the local node) #381 — Confirm payouts on-chain with a view-only wallet ✓ merged 2026-07-11 (PR feat(payouts): confirm payouts on-chain with a view-only wallet (#381) #471 → develop-v1.5): view-only monero-wallet-rpc on the local node (loopback, non-root, read-only rootfs, password-auth); view key handled like node_password (tmpfs file never on argv, masked, off the editable allowlist, scoped to the wallet-rpc container only — dashboard never receives it), local-node-only. payouts (chain,txid) table + payout_confirmed alert. Security-reviewed clean; poller hardened against malformed RPC fields.
• Confirm Tari payouts on-chain with a view-only minotari wallet (sibling of #381) #462 — Confirm Tari payouts on-chain with a view-only minotari wallet ✓ merged 2026-07-11 (PR Confirm Tari payouts on-chain with a view-only minotari wallet (#462) #472 → develop-v1.5). Sibling of Confirm payouts on-chain with a view-only wallet (monero-wallet-rpc against the local node) #381; reuses the shared payouts (chain,txid) table + payout_confirmed alert with chain="tari". View-only minotari_console_wallet v5.3.1 (digest-pinned), created non-interactively via --view-private-key/--spend-key/--non-interactive-mode; loopback-only gRPC 127.0.0.1:18143, non-root, read-only rootfs. Secrets delivered via a Docker secrets: tmpfs mount (NOT environment:) so the view key stays out of docker inspect; masked, off the Stack config editor: change any setting from the dashboard, applied via pithead (incl. P2Pool mode hot-swap) #33 editable allowlist, local-node-only. Security-reviewed clean (8/8 controls hold). Tier-4 gates for the next gouda run: (1) does the merge-mine coinbase surface via GetCompletedTransactions vs GetBalance (documented fallback, one-method swap); (2) the host-rendered 0600 secret file must be readable by the uid-1000 container — confirm the wallet actually starts on the appliance (fails closed if not; fix ownership then, with live observation of the /run/secrets perms); (3) --birthday bounds the scan (no genesis rescan) + restart replays nothing.

Off critical path

• Alert sinks beyond Telegram: generic JSON webhook + ntfy #380 — Alert sinks beyond Telegram: generic JSON webhook + ntfy (Tor-routed by default, same discipline as the Telegram notifier).
• Integration tests: RigForge worker ↔ Pithead xmrig-proxy (end-to-end flows) #209 — Integration tests: RigForge worker ↔ Pithead xmrig-proxy (rewrite the stats flows as the none/name/token auth matrix first).
• Warm the backup stack's XvB donation state so a failover doesn't cold-start the split #249 — Sync primary + backup stacks (post-rewrite; smallest honest scope).

v1.4 debt & follow-ups (filed during the v1.4 cycle; off critical path)

• Control channel: move the config merge host-side so the container never mounts plaintext config.json #440 — Control channel: merge config host-side so the container never mounts plaintext config.json (the one accepted residual from the Stack config editor: change any setting from the dashboard, applied via pithead (incl. P2Pool mode hot-swap) #33 security reviews; closes the last secret-exposure of that feature).
• cosign: close the verify-then-pull TOCTOU on the image path (#376 follow-up) #451 — cosign: close the verify-then-pull TOCTOU ✓ merged 2026-07-11 (PR fix(cosign): bind image verify to the pulled digest + verify on first install (#451, #452) #468): verify_release_images now cosign-verifies the @sha256 digest read from the bundled compose (the exact bytes docker pulls, release: digest-pin bundle images + make cosign opt-in (#376) #461), not the mutable tag; key-present + un-pinned image aborts.
• cosign: verify image signatures on first install, not just upgrade (#376 follow-up) #452 — cosign: verify signatures on first install ✓ merged 2026-07-11 (PR fix(cosign): bind image verify to the pulled digest + verify on first install (#451, #452) #468): stack_up gates the first-install pull with the same fail-closed check upgrade uses.
• Post-publish release smoke test: real cosign verify + real dashboard upgrade against the published bundle (#376/#59) #459 — Post-publish release smoke test: real cosign verify + real dashboard upgrade against the published bundle (can't be pre-merge tested — scripted into the release runbook).
• e2e.sh: untracked-file collisions abort provisioning; failed restore brings up CANONICAL_DIR even when the live stack runs from a bundle dir #454 — e2e.sh robustness ✓ merged 2026-07-11 (PR test(e2e): force-clean provisioning + restore the live stack's real dir (#454) #467 → develop-v1.5): force-clean provisioning (checkout -f + clean -qfdx -e /results -e /backups -e /data, config.json/.env re-seeded from canonical) + RESTORE_DIR derived from the live compose project's working_dir label (refuses to adopt E2E_DIR; falls back to CANONICAL_DIR). Tier-4 live-validated on the next gouda run.
• Standardize the deploy-box layout: upgrade maintains a symlink; dashboard data joins the shared data root #455 — Standardize the deploy-box layout: upgrade maintains the current -> symlink; dashboard data joins the shared data root (docs the canonical layout, replaces the hand-written per-box READMEs).

---

Release status — cycle not open

Gates when it opens: Wave 0 rescopes merged into the issue bodies · rigforge trackers filed · core arc merged to develop · gouda regression pass incl. a real RigForge rig · CHANGELOG · cut per the standard process.