Roadmap

Core principle: features auto-discover via conventions or activate via config. Users never change their ISharkEndpoint coding pattern, never implement new interfaces, and never call framework APIs in business code.

v0.4.0 — 2026-06-28 ✅

• Deprecate [SharkEndpoint] / [SharkMethod] / SharkHttpMethod and related reflection infrastructure (IDependencyReflectorFactory, DependencyReflectorFactory, Reflector, ReflectorExtension) — migrate to ISharkEndpoint
• Startup configuration self-check — ConfigurationValidator validates JWT, multi-tenant configs at AddShark() time
• Graceful shutdown — K8s-friendly SIGTERM handling: health check → 503, drain requests, then shutdown
• Audit trail batch/async write — Channel-based buffer + background flush (AsyncWrite, BatchSize, FlushInterval)
• Idempotency distributed store — IIdempotencyStore swappable via TryAddSingleton or IdempotencyStoreFactory
• Rate limiting distributed store — IDistributedRateLimitStore + SharkRateLimiterMiddleware, MemoryRateLimitStore default, RateLimitStoreFactory
• Sharkable.Cache.Redis NuGet plugin — Redis-backed IIdempotencyStore + IDistributedRateLimitStore, AddSharkableRedis()

---

Phase 1 — Existing feature hardening (zero-intrusion)

#	Feature	Value	Intrusion	Status
1	Startup configuration self-check — validate JWT, rate limiting, multi-tenant configs at AddShark() time with clear error messages	Prevent misconfiguration	Zero — auto-runs	✅ v0.4.0
2	Graceful shutdown — K8s-friendly SIGTERM handling: health check → 503, drain requests, then shutdown	Production necessity	Zero — K8s-native	✅ v0.4.0
3	Audit trail batch/async write — buffer + background flush instead of sync writes	Performance	Zero — internal mechanism only	✅ v0.4.0
4	Compile-time route conflict detection — Roslyn Analyzer that catches GET /api/orders/{id} registered twice before runtime	Quality assurance	Zero — ships with NuGet

Phase 2 — Observability

#	Feature	Value	Intrusion	Status
5	Built-in distributed tracing — ActivitySource + W3C traceparent propagation, ITracingExporter for OpenTelemetry plugins, auto X-Trace-Id header	Observability	Zero — ActivitySource	✅
6	Extensible health checks — structured JSON /healthz via HealthCheckService, HealthChecksConfigure for custom checks, auto JWT authority reachability, uptime + version	Operations	Config only	✅
7	Lightweight profiler panel — per-request latency, memory delta, slow-request TOP10, /_sharkable/profiler	Debugging	Config only	✅

Phase 3 — Distributed / cluster support

#	Feature	Value	Intrusion	Status
8	Idempotency distributed store interface — IIdempotencyStore + TryAddSingleton, MemoryIdempotencyStore default, users plug Redis/DB	Cluster HA	Config only	✅ v0.4.0
9	Multi-tenant data source isolation — ITenantDataSource scoped service, TenantOptions.ConfigureDataSource(), per-tenant connection string routing via DI scope	SaaS	Config only	✅
10	Rate limiting distributed store interface — IDistributedRateLimitStore + MemoryRateLimitStore default, SharkRateLimiterMiddleware, Sharkable.Cache.Redis plugin	Cluster HA	Config only	✅ v0.4.0
11	Adaptive rate limiting — EnableAdaptive, dynamically adjust permit limit based on CPU/GC metrics	Robustness	Config only	✅

Phase 4 — Developer experience & polish

#	Feature	Value	Intrusion
12	Auto ETag / conditional requests — SHA256 content hashing, 304 Not Modified for GET endpoints	Cache optimization	Zero — auto
13	Response compression — EnableResponseCompression, uses ASP.NET Core built-in middleware	Performance	Config only
14	OpenAPI example generation — infer realistic examples from type names + XML docs	DX	Zero — auto
15	Error message localization — Accept-Language driven IErrorLocalizer, ErrorLocalizerFactory, pluggable translator	i18n	Config only
16	AutoCrud AOT zero rd.xml — Source Generator emits typeof(T) references at compile time, user never touches it	AOT experience	Zero — Source Generator
17	Soft-delete global filter — entity implements ISoftDeletable, AutoCrud auto-filters IsDeleted = false + soft deletes	Data layer	Entity marker interface
18	BackgroundService enhancement — SharkBackgroundService with health reporting, retry policy, execution tracing	Background jobs	Zero — auto
19	ProblemDetails (RFC 7807) compatibility — UseProblemDetails flag, all error responses output standard format with type/title/status/detail/instance/traceId	Interop	Config only

Phase 5 — Lifecycle & startup integrity

#	Feature	Value	Intrusion
20	ConfigureOnStarted / ConfigureOnStopped callbacks — hooks for app-ready and shutdown cleanup (warm caches, close connections, flush buffers)	Startup/shutdown control	Config only
21	Separate liveness probe /livez — always-200 endpoint for k8s liveness, distinct from /healthz readiness	K8s-native ops	Zero — auto when health checks enabled
22	Startup readiness gate — /healthz returns 503 until all OnStarted callbacks complete, preventing traffic before initialization	Production safety	Zero — internal
23	Warmup / async initialization — IWarmupService interface + ConfigureWarmup(Func<IServiceProvider, CancellationToken, Task>[]), executed after app starts but before readiness probe turns green	Cold-start mitigation	Config only
24	Startup DI validation — optional ValidateOnStart flag that eagerly resolves all registered services to catch missing DI registrations at boot	Fail-fast	Config only
25	Startup banner — log framework version, enabled features, and key config values at UseShark() time	Operations	Zero — auto
26	Middleware pipeline injection points — app.UseShark(beforeAuth: mw => ..., afterAuth: mw => ...) for inserting custom middleware at precise pipeline positions	Pipeline control	Config only
27	Eager singleton activation — [SingletonService(Eager = true)] flag to pre-create singletons at startup instead of first-resolution	Cold-start mitigation	Attribute option

Excluded (high-intrusion)

Feature	Reason
CQRS-lite (ICommand/IQuery)	Requires rewriting every endpoint class
Modular ISharkModule	Requires large restructure
Strongly-typed IDs (OrderId, UserId)	Requires changing all method signatures
Smart enums	Requires changing all enum definitions
Cache tag invalidation	Requires changing write endpoints
API test runner	Requires writing new test code
Lightweight gateway	Requires creating a new project
Source Generator SDK	Requires new package + client code