A roadmap with no dates on it.

1.0.0 shipped HTTP(S) monitors, configurable interval from one minute to one hour, timeout, expected status code and degradation threshold, on a Postgres-backed worker with cron fan-out, per-monitor dedup, drift-corrected scheduling and 90-day check retention, plus SSRF hardening on every target. 1.5.0 added keyword assertions: require the body to contain a string, or in absent mode to not contain one, which catches the error page that still returns HTTP 200. 1.7.0 added TCP/port checks and TLS-certificate expiry, reporting degraded when fewer than the configured days remain. 1.10.0 put check types behind a registry and added four more, ping, DNS records, TLS expiry as a monitor in its own right, and domain-registration expiry, with no new dependencies. The same release made the failure threshold a duration rather than a count of checks, and made the interval a baseline the scheduler tightens on a suspicious target and relaxes on a steady one, down to a two-second floor.

1.0.0 shipped incidents that open themselves once a monitor has been failing for as long as you configured and resolve themselves on recovery, alongside manual incidents, severity levels, a strict lifecycle, immutable timelines and postmortems. 1.6.0 added internal notes. Badged, kept on the operator timeline, never sent to the public page and never fired at the organization webhook. 1.8.0 added acknowledgement: halt the escalation ladder without pretending the incident is over. 1.29.0 made an incident carry what was seen when it opened: the failing observation, the last successful one and the difference between them, the layer that broke and how that was established, and the other monitors failing for a signal it can name. Written once, at onset, because everything it is derived from is pruned or rewritten within weeks.

1.2.0 shipped the thing the product is built around: one saved endpoint per monitor, a fresh probe to confirm the failure is real, a signed recovery.execute POST, then another probe, so success is observed and never assumed. Attempts are bounded per incident with a cooldown; the regular check loop still owns resolution. 1.3.0 added alert holding with an exactly-once claim and a failsafe scheduled up front. 1.4.0 added the restart-loop guard and effectiveness stats; 1.4.1 a test trigger so you can verify your receiver before the first real incident; 1.4.2 closes attempts a killed worker left running.

1.0.0 shipped a public per-organization page with live component health, 90-day uptime history and an incrementally cached render. 1.6.0 made visibility a choice, public, private to signed-in members, or password-protected with a scrypt hash and a signed, page-scoped cookie. 1.9.0 added double opt-in email subscriptions: only confirmed addresses are ever mailed, every message carries a one-click unsubscribe, and internal notes and quietly self-healed incidents never reach subscribers. 1.10.1 fixed a page that published monitors the operator had deliberately left off it, a security fix if you run a page that is not everything you monitor.

1.1.0 taught the organization webhook to speak Slack and Discord, detected by exact host so nothing else is misclassified. 1.8.0 shipped on-call schedules, a named rotation advancing one shift every N days from a fixed anchor, and escalation policies: ordered steps, each firing a set delay after the incident opened, targeting the on-call person, all responders or one named person, over email, SMS or voice. SMS and voice run on your own Twilio credentials; without them those steps are a clean logged no-op and the rest of the ladder still runs.

1.0.0 shipped multi-tenant organizations, invitations and four roles enforced by a single permission matrix across server actions, API and UI, plus signed webhooks, email with a structured-log fallback, an audit trail, and an optional AI copilot on your own Anthropic key. The patch releases record real defects: 1.0.1 fixed a container that could not start and a Postgres volume that lost its data on docker compose down; 1.9.1 shipped the .env.example the ignore rule had been silently swallowing, so a fresh clone could finally follow its own setup instructions, and added backup, restore and troubleshooting docs; 1.9.2 fixed a cache key that left out the status-page slug, so a deployment publishing more than one status page could serve one client's page under another client's URL, found in an audit, reproduced, fixed, and covered by a test that fails without the fix. 1.9.3 removed a 100-member cap that came from a library default nobody had set, it silently truncated the members list as well as refusing invitations, and it contradicted the pricing page, which has always said unlimited seats. 1.30.0 separated process liveness from traffic readiness, made readiness verify the complete migration ledger on a bounded pool of its own, and shipped a Localtonet overlay for a host that cannot accept an inbound connection.

1.11.0 ended the split: Core is generated from this tree by deleting the commercial code, in a required build job, so both editions are cut from one commit and carry one version number, 1.11.1 fixed the lockfile that still named the commercial license inside the Apache-2.0 mirror. 1.12.0 added eight more check types and white-label status pages. 1.13.0 is the migration and trust release: twenty-six more types to forty, an Uptime Kuma 2.4.0 importer that maps all 31 of its selectable monitor types and reports what it cannot carry, uptime weighted by duration rather than by how many stored rows agree, a durable outbox so a crash between deciding to alert and sending one delivers late instead of never, and a separate data plane for checks that run every half second. What that plane was measured doing, including where it stops holding cadence, is published with the raw results rather than summarised. 1.30.0 removed the commercial Twilio escalation environment from Core while keeping Core’s database-configured Twilio notification providers.

A monitor can be executed by probe agents you run on your own machines, with a quorum deciding the verdict: any, majority, all or K-of-N, plus a floor on how many fresh responders it takes to have an opinion at all. A probe that does not answer is never counted as a failure, and one incident opens per aggregate transition rather than one per probe. Vigil ships the agent and operates nothing.

1.15.0 put ten providers behind one channel editor and one delivery pipeline; 1.16.0 removed the cap on how many channels a workspace may have; 1.17.0 took it to 25 native provider types plus a bridge to an Apprise server you run, which is counted as a bridge and never as a twenty-sixth integration. 1.18.x is the delivery engine underneath: retries out to six hours, lease fencing, an append-only record of every attempt, and fair draining so one noisy tenant cannot own the queue.

1.19.0 shipped the migration system: fifteen sources, fourteen over their own API plus an Uptime Kuma database file, with a preview that is a real import rolled back rather than an estimate. 1.20.0 added maintenance windows, in a real IANA time zone so a weekly window keeps its local hour when the clocks change, and alert routing policies, so why did nobody get a message is answerable from the product rather than from a log.

1.21.0 started as high availability and the measurements turned it into something narrower and truer: the control plane was already arbitrated by Postgres, and what was actually broken was a scheduler that could not feed more than 500 monitors a minute and a fleet page that could not say the worker had died. Both fixed, with the numbers published. 1.22.x is the dark scheme, in Vigil's own palette rather than a borrowed one.

1.23.0 added scripted synthetics: multi-step API and browser journeys that watch a sequence rather than an endpoint, as typed steps with no scripting surface at all. 1.24.0 added objectives with error budgets and multi-window burn-rate alerts that fire while the budget is going rather than reporting that it went. 1.25.0 added runbooks, the automation you would otherwise perform by hand, with immutable published versions, approvals and resource leases. 1.26.0 added operations tasks, the human half of the same engine, and a measured pass over memory and queue retention.

By default Vigil checks from the single host you run it on, and a monitor going down means your Vigil host could not reach it. Since 1.14.0 you can assign a monitor to remote probe agents and require a quorum, which confirms a failure from several vantage points. You place those agents in the regions you control and you run the machines. Vigil operates no region, no relay and nothing to subscribe to. Running probes worldwide forever is an operations business, and this is a codebase you buy once. If you need a failure confirmed from several continents with no ops of your own, Better Stack and Pingdom do that; buy one of them. Either way, run Vigil outside the blast radius of what it watches.

Vigil answers whether an endpoint responded, and what the runtime did about it when it did not. It does not trace requests, profile code or index logs, and it is not growing into something that does, that needs a different storage model and an agent inside your application, and Vigil installs no agents. When a check fails and the next question is why, inside the process, that is a real APM's job and you should own one.

No key check on startup, no phone home, not even the anonymous kind. Nothing stops working when a payment lapses, because there is no subscription to lapse and nothing in the software reads a date. The cost is real and it is ours: we genuinely do not know how many people run Vigil, so this roadmap cannot be ranked by usage data. It is ranked by what people say to us instead, which is the next section.