Skip to main content

Roadmap

The goal is a complete, isolated, fully functional open-source auth plane that stays provider-neutral, locally verifiable, and useful without mandatory hosted services. This page summarizes what is done and what is planned.

Done (selected highlights)​

  • Local TrustPlane-native issuer, local verifier, issue/verify/demo CLI
  • passport-v1, proof-profile, and federation drafts
  • TrustPlane bundle document key resolver; protected-service + brownfield-adapter examples
  • Atomic in-memory and Redis JTI replay consume-on-accept; multi-replica Redis wiring
  • transcript-v1 runtime generation + enforcement; route key-binding policy
  • Local policy bundle build + freshness schema/evaluator
  • Route allowed_sources multi-issuer/multi-trust-domain authorization (no API keys)
  • Provenance/context policy hooks
  • Local broker MVP (software Ed25519) + same-host peer provenance stub + abuse regressions
  • SPIFFE/SPIRE on Kubernetes attested_workload path with X.509-SVID verification
  • Provider/gateway protected-service example; adapter request route-policy mode
  • OSS CLI boundary decision; Auth v0.1 local release boundary + make v01-acceptance
  • OSS Auth Helm release plan and deployment packaging boundary
  • Policy-based-acceptance semantics; EC2/non-Kubernetes software source boundary
  • Trust-anchor source-tier matrix
  • Adapter + broker container artifact planning with immutable image posture
  • Example deployment and bundle-refresh workflows; multi-route + key-lifecycle smokes

v0.2 (planned)​

  • Provider/gateway command ergonomics after trustplane up
  • Verify-headers flow for gateway/API middleware
  • Nonce replay store abstraction
  • Public key distribution via JWKS + bundle refresh
  • OIDC/JWT identity provider
  • Additional SPIFFE/SPIRE ergonomics beyond the v0.1 workload source
  • Conformance test suite; gateway middleware examples
  • SDK shape for Go, TypeScript, Python (extraction is later)
  • MCP, n8n, and workflow integration design

v0.3 (planned)​

  • Kubernetes CRDs
  • Envoy integration
  • OPA examples
  • Helm chart hardening and broader deployment examples

Later​

  • SDK extraction; MCP/n8n integrations after API stabilization
  • Local Kubernetes demo environment
  • Optional cloud integration test harness

What stays out (by design)​

TrustPlane Auth will not become a service mesh, a CA replacement, an OAuth replacement, a payment network, or a marketplace. Managed governance — persistent principals, approvals, hosted bundle distribution, revocation feeds, RBAC, compliance, and tenant isolation — is out of scope for this runtime. TrustPlane Auth stays the local, provider-neutral verifier.