# Roadmap

Ideas that are agreed but not scheduled. Newest first.

## Multiple names per machine

Today one machine has exactly one name: `machine:` on the agent, and the
`name:` of its peer entry on the hub, which is the name the tablet shows.

Wanted: a machine can have more than one name. Two cases:

1. **Aliases / display names.** The same machine is known as `otx-box` on the
   hub, "OTX bench (Gnome Box)" on the tablet, and `fedora` by hostname. The
   peer entry gets an optional `label` (shown) and `aliases` (accepted
   and matched), while `name` stays the stable key for state and logs.
2. **Several DSH instances on one machine.** For example the OTX console and a
   general `dsh web` both run inside the same Box, and each pushes as its own
   tile (`otx-box/console`, `otx-box/web`). Options:
   - one push peer per instance, each with its own token. This works today,
     but means one secret per instance;
   - one token per machine plus an `instances: [console, web]` allowlist on the
     hub. The pusher then sends an instance name, and the hub accepts only
     names from that list.

Rules to keep:

- The identity the hub stores still comes from the hub's config. A payload
  may only *select* from names that config allows, never introduce one, so a
  machine still can't pose as another.
- Names and aliases are unique across all peers; a duplicate is a config
  error, as duplicate peer names are now.
- Old configs (a single `name`) keep working unchanged.

Tests: an alias resolves to the same peer; an instance outside the allowlist
gets a 401; a duplicate alias is rejected at config time; the page shows the
label and falls back to the name.