roadmap

Where strop is going. Order is priority: editing safety first, new surface area last. The load-bearing detail lives in the repo's plans/ — this page is the public summary.

Remote workspaces — delivered and next

v0.16: read-only SSH/SFTP snapshots, the independent strop-remote crate and strict host-key/authentication policy.

v0.17: byte ranges, bounded tail/follow with content-based resets; non-authenticating completion and negotiated homes; shared owned SFTP connections; read-only directory buffers; supervised execution for remote LSP and read-oriented Git. Document, endpoint, repository and request identities stay separate. Rust, real SSH/terminal/replay and bounded protocol gates cover the delivered boundaries.

v0.18: in-editor host choice, truthful directory metadata, structural indentation rails, worker-owned ranking/search/syntax and indexed Git display data. Static coverage includes CMake, Markdown and 21 other languages.

v0.19 — RW4 delivered: explicit :remote edit, conditional :w/:wq, protected atomic staging and :remote verify. Read-only remains the default; cooperative exclusion does not claim CAS against nonparticipating writers. The write contract records metadata, cancellation, path and ownership guarantees and their limits.

v0.31.1: shared local/SSH Directory buffers, checked creation, rename/move, explicit stored/buffer copy and removal, modal filename drafts and read-only SSH Search-here. Receipts retain partial and unconfirmed outcomes; verification never retries a mutation.

Later: remote Trash, recursive/cross-namespace transfers, credentials/MFA and elevation, additional transports, archives and encrypted resources. The full TRAMP-style capability inventory records dependencies and acceptance rather than a blanket parity promise.

Dev Containers complement remote access

A container transport accesses a running container; Dev Containers provisions and configures a workspace from devcontainer.json. The researched Dev Containers plan keeps those layers separate while reusing filesystem, process, workspace identity, LSP and Git semantics. Builds, Features, mounts and lifecycle hooks require explicit trust. Running-container browsing and language/Git services are available; Dev Container provisioning remains separate planned work.

Next: terminal, architecture, then whole-core verification

1. Embedded terminal, TUI-first: local terminals shipped in 0.32.0 (Ghostty VT, PTY helper, terminal buffers, privacy, replay); remaining TUI polish tracks real usage, and every GUI surface stays deferred until the TUI is complete and bug-hardened.
2. Architecture prerequisites: readonly rendering, admitted APIs, private draft recovery, bounded ownership, real UI protocol and verified installation/release boundaries.
3. Whole-core verification: production correspondence, native evidence, calibrated models and proofs before more editor features.
4. Then the shared native worker, completion and debugger. All GUI implementation is deferred until the desired functionality and bug-hardening are complete.

Shipped

• 0.32.4 — interned frame rows: rows repeating within a terminal frame travel once, referenced by index runs (unique rows stay inline) — the same flooded session records ~0.7 MB instead of ~2.4 MB, still complete and replayable, with every earlier trace still decoding.
• 0.32.3 — tenth-size terminal captures: rows stop shipping their trailing padding (the frame geometry re-derives it) and per-action checks witness document text by digest instead of serializing it — the same flooded session records ~2.4 MB instead of ~20 MB, still complete and replayable.
• 0.32.2 — honest captures through terminal floods: sustained terminal output no longer breaks the opt-in forensic trace — frames serialize as cell runs with the projection derived on decode, diagnostic records carry bounded excerpts instead of whole buffers, and a degraded capture reports itself in the file instead of failing the editor's exit.
• 0.32.1 — picker previews and terminal navigation: preparation admits the preview read and syntax analysis the readonly-rendering split orphaned (find-file loading forever, grep/symbols without highlighting); terminal input gains Vim's Ctrl-W window grammar; terminals list in the buffers picker with their live phase and record jumps.
• 0.32.0 — embedded local terminals: a real PTY-backed shell in the editor over the pinned static Ghostty VT engine; terminal buffers, splits, paste consent, trace privacy and full replay; full-screen picker workspace with preview line numbers and grep hit markers; folder-view polish and the readonly rendering split.
• 0.31.1 — one filesystem workspace: local/SSH Directory buffers, checked operations, modal filename drafts, source-preview gutters and retained operation/recovery evidence.
• 0.30.0 — one Search workspace: retained source investigation, optional replacement, owned review and explicit Apply/Save.
• 0.20–0.29: reviewed changes, editable collections, engine extraction, shared query language and editor polish. See the release-by-release changelog.
• 0.19.0 — explicit remote editing and saving: per-document authority, content/metadata conflicts, private staging, durable receipt verification, and qualified safety backed by model, filesystem, real SSH and replay checks.
• 0.18.0 — remote browsing, responsiveness and syntax: explicit host opening, directory attributes, structural guides, asynchronous workspace ranking and analysis, and 23 statically linked detected languages.
• 0.17.0 — read-only SSH workspaces: ranges and log following, completion, shared connection lifecycle, directory browsing, remote language services and native Git, with source-owned coordinates and protocol release gates.
• 0.16.0 — trustworthy failures and SSH log buffers: full permalink hosts/aliases, visible LSP configuration/startup errors, CLI line locations, and owned read-only remote transport with model/runtime verification.
• 0.15.0 / 0.15.1 — correctness and presentation: the P1/P2 correctness program and separately shipped modeline/Git polish.
• 0.10.2 — backtracking-safe incremental parse: the rope-chunk callback is random-access (tree-sitter backtracks on error recovery; the forward-only assumption crashed).
• 0.13.0 — PathBuf paths + the split wave (0026): non-UTF-8 filenames open/highlight/save end to end (args_os, Path APIs, no display() roundtrips); over-ceiling files split by responsibility (strop-core, resolve, strop-git, strop-lsp, picker, editor tests) with public APIs unchanged.
• 0.12.0 — the 1.0 perf gate (0025): strop --bench measures 1/10/100MB buffers, 100k-line navigation, 1k cursors, and p50/p95/p99 input-to-frame on the production path (docker compose run bench). Baseline: p99 input-to-frame 1.5ms, edits flat to 80MB — no measured pain, no rewrite. Plus: gd/gr and picker hits now record the jumplist (ctrl-o works after an LSP jump), dead-buffer jump entries are skipped safely.
• 0.11.0 — the transaction gateway, verified (0024): one validated apply() for atomic edits (replace, git discard) on the same commit seam as typing; the editor protocol is model-checked in TLC (specs/EditorProtocol.tla, mutant caught) and a model-based conformance harness drives generated streams through the production path.
• 0.10.1 — incremental tree-sitter + nucleo (0022): the parse tree tracks every edit transaction (InputEdits at commit, reparse from rope chunks against the old tree); the picker scores with nucleo-matcher, adopted on bench numbers.
• 0.10.0 — document identity (0021): the gutter never diffs on the render path (revision-keyed snapshots, workers own the diff); every interactive LSP reply is stale-droppable by construction; Buffer.path is PathBuf (non-UTF-8 filenames work); DocumentSource (file/scratch/surface/output) makes readonly and save-refusal derived facts, not conventions.
• 0.9.1/0.9.2 — contracts, not callers (0020): overwrite-safe :w {path}, streaming pickers tagged by generation, byte-exact replace past Unicode, composition previews from the typed plan, revision-keyed syntax cache, LSP answers checked against the server's own clock, git discard as one undo unit, unopened-file replaces as real buffers, anchor mapping through every transaction, and a trust gate on project-supplied executables.
• 0.9.0 — revision-native git + services (0018): byte-precise diffs, structured index mutation (no patch text anywhere), GitRevision spans head/index/worktree/commit/merge-base, and one app event channel — async results paint the instant they land; per-workspace languages.toml; stale-answer guards on hover and diagnostics.
• 0.8.0 — text & terminal correctness (0017): LineLayout owns the byte↔cell seam; grapheme-honest rendering, unicode */#, char-counted r, visual block (ctrl-v) on cell columns, bracketed paste, pane-exact caret.
• 0.7.0 — one input machine (0016): every key event traverses one typed state machine; the table IS the trie; macros (q/@); semantic aliases; the generated compat report (strop --dump-compat).
• 0.6.1 — the trust release (plan 0015): every exit respects dirty documents (ctrl-c warns once, then forces); a pathless :w errors instead of lying; a failed shell filter never touches the source; :wq closes the window, not the shared document; edit cascades can't stack phantom cursors; d0, count-capped accumulation, and count-aware arrows restore vim canon; session undo histories carry a content identity and never replay against changed disk text; didClose completes the LSP lifecycle.
• 0.6.0 — the input layer: a key-event walker with typed parser state (counts/registers/operators/prefixes); one command table with stable ids drives dispatch, Space ?, and which-key; panes own their selections and scroll; coordinate newtypes guard the Buffer/LSP seams.
• 0.5.0 — the restructure: generational document ids (the index-alias bug class is dead), one SelectionSet for cursor/visual/multicursor, MotionShape, char-honest grammar args (f é works), an LSP server pool, the leaf command registry, semantic dot-repeat, ActionPlan (preview and execute share one object), and the nvim differential harness in the CI gate.
• Git as a data model: HEAD → index → worktree → live are four real states; the gutter tints staged lines; verbs name their edge (stage Space g s, unstage Space g S, discard-unstaged Space g u); permalinks pin the surface's commit; visual Space g h is git log -L on the selection.
• Operator-pending previews such as d/pattern share the execution resolver; completed object chords execute at their completing key.
• Multicursor (Q toggle, Space c stack), mirrored edits, one undo unit per cascade.
• Git surfaces as real buffers: commit browser, file history, blame gutter + card, hunk stage/undo/preview, permalinks — all readonly, yankable, searchable text.
• LSP: hover, goto-definition, diagnostics gutter + picker, clangd's source↔header switch (gs), layered languages.toml (project over user over embedded).
• Pickers with streaming rg, file/line previews, and modal input fields (Esc → vim normal mode on the query itself).
• Global replace (Space R) with row/file exclusion and a full-frame apply preview.
• The 0.3.9/0.4.0 hardening: unicode-honest word motions, arrow keys everywhere, atomic saves with external-change refusal, readonly enforced at the mutation boundary, honest LSP versions + position encoding.

Other later work

The terminal/architecture/verification sequence above is the current priority. Other directions retain their own design and verification gates.

• Bounded forensic evidence: capacity failures remain explicit; whole-core verification checks record/replay correspondence rather than promising unbounded capture.
• GUI deferred: retain the TUI and share editor/workspace semantics. Native Windows rendering with WSL execution still requires real GPU, IME, accessibility and packaging evidence. The GUI contract owns that later gate; it is not part of the current release.
• 1.0 hardening — perf gate shipped (0.12.0); the suite is the standing regression surface. What remains for 1.0: DocumentSource (0021) and PathBuf paths (0026) are done — 1.0 is now hardening plus whatever the bench numbers surface as usage grows.
• Debugger (0019, researched — deliberately later) — DAP over three toolchains only (Rust/C/C++ via lldb-dap, Python via debugpy), zero-config scenario discovery, and .vscode/launch.json read-compat behind a .strop/debug.json primary. UI is editor-native: gutter breakpoints and the instruction arrow on the real document, stack and variables as readonly tree buffers in a split, stepping as Space D motions. This is a later P3 subsystem, not implied by remote LSP or Git support.
• The differential gate grows teeth — every fix so far became a corpus case; next is property-generated command streams and register/mark/jumplist comparison. Cheap, and it compounds: every future grammar change is free to land.
• Tree-sitter text objects — daf, yic, argument/call objects through the same operator resolver and preview. The grammar's object layer exists; these are new resolvers on typed syntax, with lexical fallbacks.
• Git archaeology depth — symbol history, changed-symbol navigation, branch review as a file sequence. The dive chain + log -L already cover the common case; these are the power layers on top, and they ride SourceLocation.
• A plugin boundary — post-registry-maturity: stable command ids and typed events first; a sandboxed process/WASM edge later. Freezing unstable internals into a public contract is the failure mode.

North star

A reader-first, git-native editor in which every consequential operation is inspectable before it becomes real — vim's grammar, exactly, with git history as a navigable dimension of the document.