Roadmap

Core principle: features auto-discover via conventions or activate via config. Users never change their ISharkEndpoint coding pattern, never implement new interfaces, and never call framework APIs in business code.

v0.4.0 — 2026-06-28 ✅

• Deprecate [SharkEndpoint] / [SharkMethod] / SharkHttpMethod and related reflection infrastructure (IDependencyReflectorFactory, DependencyReflectorFactory, Reflector, ReflectorExtension) — migrate to ISharkEndpoint
• Startup configuration self-check — ConfigurationValidator validates JWT, multi-tenant configs at AddShark() time
• Graceful shutdown — K8s-friendly SIGTERM handling: health check → 503, drain requests, then shutdown
• Audit trail batch/async write — Channel-based buffer + background flush (AsyncWrite, BatchSize, FlushInterval)
• Idempotency distributed store — IIdempotencyStore swappable via TryAddSingleton or IdempotencyStoreFactory
• Rate limiting distributed store — IDistributedRateLimitStore + SharkRateLimiterMiddleware, MemoryRateLimitStore default, RateLimitStoreFactory
• Sharkable.Cache.Redis NuGet plugin — Redis-backed IIdempotencyStore + IDistributedRateLimitStore, AddSharkableRedis()

---

Phase 1 — Existing feature hardening (zero-intrusion)

#	Feature	Value	Intrusion	Status
1	Startup configuration self-check — validate JWT, rate limiting, multi-tenant configs at AddShark() time with clear error messages	Prevent misconfiguration	Zero — auto-runs	✅ v0.4.0
2	Graceful shutdown — K8s-friendly SIGTERM handling: health check → 503, drain requests, then shutdown	Production necessity	Zero — K8s-native	✅ v0.4.0
3	Audit trail batch/async write — buffer + background flush instead of sync writes	Performance	Zero — internal mechanism only	✅ v0.4.0
4	Compile-time route conflict detection — Roslyn Analyzer that catches GET /api/orders/{id} registered twice before runtime	Quality assurance	Zero — ships with NuGet

Phase 2 — Observability

#	Feature	Value	Intrusion	Status
5	Built-in distributed tracing — ActivitySource + W3C traceparent propagation, ITracingExporter for OpenTelemetry plugins, auto X-Trace-Id header	Observability	Zero — ActivitySource	✅
6	Extensible health checks — structured JSON /healthz via HealthCheckService, HealthChecksConfigure for custom checks, auto JWT authority reachability, uptime + version	Operations	Config only	✅
7	Lightweight profiler panel — per-request latency, memory delta, slow-request TOP10, /_sharkable/profiler	Debugging	Config only	✅

Phase 3 — Distributed / cluster support

#	Feature	Value	Intrusion	Status
8	Idempotency distributed store interface — IIdempotencyStore + TryAddSingleton, MemoryIdempotencyStore default, users plug Redis/DB	Cluster HA	Config only	✅ v0.4.0
9	Multi-tenant data source isolation — ITenantDataSource scoped service, TenantOptions.ConfigureDataSource(), per-tenant connection string routing via DI scope	SaaS	Config only	✅
10	Rate limiting distributed store interface — IDistributedRateLimitStore + MemoryRateLimitStore default, SharkRateLimiterMiddleware, Sharkable.Cache.Redis plugin	Cluster HA	Config only	✅ v0.4.0
11	Adaptive rate limiting — EnableAdaptive, dynamically adjust permit limit based on CPU/GC metrics	Robustness	Config only	✅

Phase 4 — Developer experience & polish

#	Feature	Value	Intrusion
12	Auto ETag / conditional requests — SHA256 content hashing, 304 Not Modified for GET endpoints	Cache optimization	Zero — auto
13	Response compression — EnableResponseCompression, uses ASP.NET Core built-in middleware	Performance	Config only
14	OpenAPI example generation — infer realistic examples from type names + XML docs	DX	Zero — auto
15	Error message localization — Accept-Language driven IErrorLocalizer, ErrorLocalizerFactory, pluggable translator	i18n	Config only
16	AutoCrud AOT zero rd.xml — Source Generator emits typeof(T) references at compile time, user never touches it	AOT experience	Zero — Source Generator
17	Soft-delete global filter — entity implements ISoftDeletable, AutoCrud auto-filters IsDeleted = false + soft deletes	Data layer	Entity marker interface
18	BackgroundService enhancement — SharkBackgroundService with health reporting, retry policy, execution tracing	Background jobs	Zero — auto
19	ProblemDetails (RFC 7807) compatibility — UseProblemDetails flag, all error responses output standard format with type/title/status/detail/instance/traceId	Interop	Config only

Excluded (high-intrusion)

Feature	Reason
CQRS-lite (ICommand/IQuery)	Requires rewriting every endpoint class
Modular ISharkModule	Requires large restructure
Strongly-typed IDs (OrderId, UserId)	Requires changing all method signatures
Smart enums	Requires changing all enum definitions
Cache tag invalidation	Requires changing write endpoints
API test runner	Requires writing new test code
Lightweight gateway	Requires creating a new project
Source Generator SDK	Requires new package + client code