Epic: SOTA mayrun roadmap (phases A→D)

[akovari]

Goal

Single tracking issue for the state-of-the-art mayrun roadmap.

Phases

Phase A — Traction

• P0: mayrun shell-hook / PATH wrap (gate any agent that shells out) #13 shell-hook
• P0: mayrun init --detect (auto-select packs from repo signals) #14 init --detect
• P0: One-command agent setup (Cursor, Claude Code, OpenCode) #15 agent setup
• P0: Open-data pack corpus + public scoreboard (GTFOBins, bash-datasets, Atomic) #16 open-data scoreboard
• Docs: SOTA architecture — policy vs sandbox vs MCP proxy #23 architecture docs
• Dogfood mayrun MCP daily in Cursor (mayrun + one personal repo) #1–Keep tier-2 agent e2e green (opencode + cursor-agent) #4 dogfood / UX / e2e
• Ship multi-OS release binaries (cargo-dist or equivalent) #5–List mayrun in MCP directories and relevant awesome lists #7 binaries / demo / listings

Phase B — Strength

• P1: mayrun run --sandbox (Seatbelt / bubblewrap after policy Allow) #17 --sandbox
• P1: Map policy capabilities to sandbox profiles (fs/net) #18 capability → sandbox profile
• P1: Network / exfil-aware pack coverage (metadata IPs, curl|sh, cloud IMDS) #19 network/exfil packs
• P1: Secret-safe receipts (redact tokens/env values in logs) #20 secret-safe receipts

Phase C — Mediation + Pro

• P2: Thin MCP stdio proxy — gate tools/call with policy + receipts #21 MCP proxy
• P2: Policy rules for MCP tool names/args (proxy matchers) #22 MCP tool matchers
• Build mayrun-ci GitHub Action (policy + receipt gate for PRs) #8–Launch: Show HN and agent-community posts #11 CI Pro + Stripe + launch

Phase D — Learn

• Day-90 learn-or-pivot checkpoint #12 day-90 checkpoint

Adjacent (thin)

• P1 (thin): Receipt-derived governance metrics — not full agent APM #25 receipt-derived governance metrics (not full agent APM)

Product invariant

Only deterministic rules + human approve can Allow.

[akovari]

Epic update after Phase A–C ship on main (04f4f21): 04f4f21

Closed (implemented): #2, #3, #4, #5, #6, #8, #9, #10, #13, #14, #15, #16, #17, #18, #19, #20, #21, #22, #23, #25

Still open (process/GTM/tracking):

• Dogfood mayrun MCP daily in Cursor (mayrun + one personal repo) #1 dogfood
• List mayrun in MCP directories and relevant awesome lists #7 listings / distribution
• Launch: Show HN and agent-community posts #11 Show HN / launch posts
• Day-90 learn-or-pivot checkpoint #12 day-90 checkpoint
• Epic: SOTA mayrun roadmap (phases A→D) #24 this epic (left open as tracker)

Operator gaps (not separate issues): Stripe Payment Link placeholder; rotate dogfood license signing key before live charges; sandbox soft-fallback without bubblewrap/Seatbelt.