What's done, what's next, what we're only thinking about.

Envelope and legacy store endpoints, all three DSN auth forms, unknown item types tolerated. Verified against the official PHP and Node SDKs.

Custom fingerprints, in-app frame signatures, exception type and value, parameterized messages. Regression detection on the write path.

Per-key fixed-window limiting with X-Sentry-Rate-Limits. Events in a range-partitioned table, so expiring a day is a partition drop.

Artifact upload with debug IDs, so minified frames resolve to your source. Alerts routed to email, Slack, Discord or a webhook.

Context bundles, the resumable fix-run state machine, confidence gating, draft PR post-back. Bring your own agent, your own keys, the CLI, or managed.

Transaction and span ingest with per-project sampling, error-to-trace linkage, and structured logs kept and searchable. A transaction list and per-trace span tree, not a waterfall, and no p95 aggregates yet.

HTTP uptime probes on an interval, and cron check-ins from your SDK. A missed, timed-out or failed run raises an ordinary issue, so alerting and the agent apply to it like any other.

Fix runs scored against a suite of real closed issues with known-good patches. Human per-cell verdicts and a comparison grid today; an automated pass rate is not published yet.

Three agents per review: one explores the diff, one writes findings, one fact-checks them before anything posts. Open production issues on the touched files ride along as context. It only comments; it never approves, blocks or merges.

Lockfile diffs checked against OSV and Packagist advisories, plus typosquat and tamper heuristics. Secrets are caught by local rules and never leave the server. Only certainty blocks: known malware or a critical advisory with a fix.

Browser journeys written as plain-language steps. A model resolves each step to selectors once; after that, replays are deterministic Chromium runs with zero model calls, and the cache heals when your markup drifts.

A failed flow files a first-class issue through the same pipeline as an exception, so alerts, the fixability scan and regression semantics all apply. A triage agent annotates it app_bug, flow_outdated, environment or unknown, but never gates: raw pass/fail decides, and a flaky failure gets a retry before it counts. Runs correlate with server-side errors in the same time window. The parsemend/qa GitHub check links every failed flow to its issue, and qa:verify-fix re-runs it against a fix PR's preview URL. A pass there never resolves the issue; only a deploy or scheduled run does.

Alert on aggregate behaviour (error volume, transaction failure rate, p95 latency), not only on individual issues. Static thresholds, percent-change against the prior window, and anomaly detection (rolling mean ± k·stddev, plain statistics, no ML), scoped per project and environment. A breach flows through the same email, Slack, Discord, and webhook rules, cooldowns, and audit trail as an issue alert. Crash-free rate is the one aggregate it does not cover, because that needs session ingestion we do not do.