Skip to content

Roadmap

This page records candidate work and unresolved decisions for maintainer review. Every item is TODO — maintainer review. Nothing here is a delivery promise, timeline, support commitment, or statement that an implementation has begun.

Current baseline

Witness is pre-1.0, unaudited, and not Byzantine-fault-tolerant. Current known gaps are documented in the threat model and release notes. The present system includes threshold-signed attestations, RFC 9162 log proofs, optional federation and external anchors, the CLI/client verification path, and optional Freebird admission control; see the architecture overview.

Candidate assurance work

  • TODO — maintainer review: independent security and protocol audit. Decide scope, threat-model coverage, review artifacts, and how findings would be published.
  • TODO — maintainer review: CI quality gates. Decide whether formatting, clippy, workspace tests, release builds, SDK checks, and integration scenarios become required gates.
  • TODO — maintainer review: signed release artifacts and image provenance. Decide keyless versus key-backed signing, verification instructions, and provenance policy. Current release documentation records checksums and open signing gaps.

Candidate protocol and interoperability work

  • TODO — maintainer review: public API schemas and versioned test vectors. Decide which routes, proof forms, and compatibility guarantees are stable enough to publish.
  • TODO — maintainer review: Freebird compatibility coverage. Decide the supported V4/V5 verifier matrix and maintain end-to-end tests against the current verifier flows.
  • TODO — maintainer review: federation operations. Decide and document a supported token-rotation procedure, peer configuration lifecycle, and failure expectations.
  • TODO — maintainer review: SDK publication names and compatibility policy. The release notes identify publication plans and unresolved crate naming; maintainers must confirm them before treating publication as a commitment.

Candidate operator and product decisions

  • TODO — maintainer review: supported deployment profiles. Decide which witness counts, thresholds, failure assumptions, storage layouts, and anchor combinations can be documented as supported rather than examples.
  • TODO — maintainer review: privacy wording and metadata guidance. Decide what operational measurements and proxy configurations should be documented without implying anonymity that the threat model does not provide.
  • TODO — maintainer review: external-anchor support policy. Decide which providers receive compatibility guarantees, how outages are represented, and what evidence is sufficient for an anchor to be considered independently durable.
  • TODO — maintainer review: stable-release criteria. Decide audit, compatibility, migration, and incident-response requirements before changing the pre-1.0 status.

Unknowns to resolve

  • TODO — maintainer review: Which trust anchors should clients pin by default, and how should configuration changes be distributed safely?
  • TODO — maintainer review: What level of independent federation is required for each advertised durability level?
  • TODO — maintainer review: Which historical and third-party integrations should remain in the supported documentation set?