# Best-in-class agent maker — roadmap

This document tracks **shipped** building blocks versus **next** work for FreeAgentMaker.ai. It complements product UI (Founder outcome pack) and code comments.

## Shipped (Phase 1 bundle)

- **Automated run log purge (Postgres)** — Honors `preferences.dataLifecycle.runLogRetentionDays` (`30` / `90` / `180` / `365`); `0` or missing means retain. Periodic job (default **hourly**, overridable via `AGENT_RUN_LOG_PURGE_INTERVAL_MS`) deletes expired `agent_run_log` rows and related `agent_run_feedback` / `pending_actions` rows. Adds index `idx_agent_run_log_user_created` for efficient scans.
- **Embed parent `postMessage` contract v1** — Successful runs emit `protocolVersion: 1`, `ts`, and optional `runReceipt` (body or `X-FAM-Run-Receipt` header) for host pages to integrate safely. Tint query params unchanged (`primary`, `bg`, `text`).
- **Eval baseline gate for publish** — Blueprint flag `runtime.requireEvalBaselineForPublish` blocks `POST /publish` until a test baseline exists, unless the client sends `forcePublish: true` (UI confirms once).
- **Tool failure recovery hints** — Server can inject `recovery_hint` on failed tool JSON before the model sees the next turn.
- **Run detail API** — `GET /api/agents/:id/runs/:runId` includes token fields when stored; builder **Run debugger** loads this JSON.
- **Data lifecycle preference** — `runLogRetentionDays` (0, 30, 90, 180, 365) via preferences + usage API; **Postgres** deployments enforce retention with the periodic purge above (`0` = retain).
- **Thread pack** — Export/import JSON (turns + optional thread memory summary) for Test chat threads.
- **Embed** — Query tint params (`primary`, `bg`, `text`); parent `postMessage` on successful run uses **`protocolVersion: 1`** (`source: "fam_embed"`, `event: "run_complete"`, `ts`, optional `runReceipt`).
- **Short agent URL** — `/agent.html?id=…` redirects to `embed.html` with the same query (minus id keys).
- **Run debugger → trust shortcuts** — From **Run debugger**, operators can jump to **Runbooks**, **Pending actions**, **Test suite & baseline**, or **Compare to baseline** (Model & settings) for the run’s agent.
- **Trust Score breakdown → operator shortcuts** — Same quick links from the trust breakdown modal.
- **Run-completion webhook v2** — Outbound POST includes `webhookProtocolVersion: 2`, `runReceipt`, and (when applicable) `recoveryHints`, `pendingActionsCount`, or on errors `recoveryHint` plus existing `failureCategory` / `error`.
- **Embed postMessage doc** — **`docs/EMBED-POSTMESSAGE.md`** — strict `event.origin` checks, `targetOrigin` guidance, and optional **`parentOrigin`** / **`postMessageTarget`** query param to restrict embed `postMessage` targets.
- **Zapier / webhook v2 docs** — **`docs/ZAPIER.md`** (Catch Hook payload + Code snippet) and **`docs/ZAPIER-PRIORITY-FLOWS.md`** (Phase 1 checklist).
- **Teams: workspace governance** — `organizations.settings` (recommended retention & usage alert defaults, advisory org monthly spend cap), **`GET/PATCH /api/organizations/:id`**, **`GET .../usage-rollup`**; UI under **Team workspaces**.

## Next (prioritized)

1. **Trust dashboard** — Eval results deep-link from run debugger JSON; trust trend over time.
2. **Embeds** — Optional allowlist in `GET /api/agents/:id/public-urls` embed snippet for parent origins.
3. **API / Zapier** — Native Zapier app listing; richer trigger field metadata.
4. **Teams** — Opt-in auto-apply org retention defaults for new members; billing-owner alerts on org cap breach.

## Related docs

- [Production trust loop](./PRODUCTION-TRUST-LOOP.md)
- [Embed postMessage](./EMBED-POSTMESSAGE.md)
- [Teams & workspaces](./TEAMS-WORKSPACES.md)
- Usage and plan limits in-app under **Account → Usage**