Roadmap
What OrkStage plans next while it is in alpha, starting with read only AI mini agents attached to templates.
OrkStage is in alpha: features ship gradually, and anything on this page is pending, not available yet. Dates are not promised.
AI mini agents
PendingSmall, single purpose AI agents that a template attaches like sidecars. They run around a deployment, read what OrkStage already knows, and report findings next to the plan and the deployment. Each one is a module you turn on per template:
| Module | Before a deployment | After a deployment |
|---|---|---|
| Security | Reviews the plan for exposure: public endpoints, open security groups, missing encryption, secrets in variables | Checks the running resources against the plan and the policies |
| FinOps | Explains the cost estimate and suggests cheaper sizes or placements | Compares spend signals with the estimate and flags waste |
| Insights | Summarizes what the change does and its risk in plain words | Reads health, metrics and logs and explains incidents and trends |
How they are meant to work:
- Read only. An agent can read the plan, the template, policy results, resource outputs, health, metrics and logs. It cannot deploy, change, approve or destroy anything, and it never receives cloud credentials or secret values. Its output is advice: comments on the plan and on the deployment, and notifications.
- Your own model provider. You bring an API key for Anthropic, OpenAI or Google Gemini, stored
as a secret reference like any other credential (
env://, a secret manager), never in the database. No data goes to a provider you did not configure. - Opt in, per template. A template lists the agents it wants and when they run (before the plan is approved, after the deployment, or both). Policies stay the source of truth: an agent can point out a problem, but only a policy can block a deployment.
- Audited. Every agent run is recorded with what it read and what it said.
Until this ships, the policies and metric alerts cover the checks that must hold, without AI.
Also on the way
- Live validation of the preview providers (Azure, Google Cloud, OCI and others) on real accounts.
- Backups in the console and a disaster recovery guide.
- A runner that does not need the Docker socket, and the remaining items of the public backlog.