Roadmap

What is designed but not built. This page is for deciding whether to wait for something or work around it.

Designs, not features

Everything under “Coming later” and “Outstanding designs” is a design, not a feature, except where a row says which part has shipped. Designs are kept in the repository under docs/proposals/; each one states its own status and the commit its file:line anchors were verified against, because those anchors drift. A design whose work ships in full is deleted rather than kept: the reasoning stays in the commits that implemented it, and the page on this site becomes the reference. For what exists today, see How it works.

Coming later

• Certificate lifetime policy rework – untangling source-address pinning from the lifetime rule, which today welds two unrelated policy questions onto one list (design).
• Source-address restrictions – approver-chosen pinning and a retrieval allowlist, superseding pin_source_address (design).
• Service retrieval anomaly policy – alerting on, and locking, an enrollment code redeemed from too many source networks (design).
• Config coordination – detecting and reporting configuration divergence between instances sharing a database and a NATS cluster (design).
• Approval from a GUI SSH client – VS Code Remote-SSH, JetBrains, a Finder-mounted SSHFS: clients with no terminal for the approval URL to be printed to. The hardening the flow made newly relevant has shipped – an approval URL is now claimed by the first browser that opens it – but the five client-side changes have not (design).
• Cloud KMS signing, behind the same key-source interface the config, key-file, ssh-agent and PKCS#11 backends use today (design).
• Push approval to a registered device, deferred rather than rejected: request creation is unauthenticated, so an opt-in, per-target-user rate limit has to come first.
• Host certificates, only if a secure host-verification mechanism (something like an ACME challenge) makes hostname claims provable – see Decisions.

Outstanding designs

Nothing below has been built, except where a row says which part has. A design whose work ships in full is removed rather than kept: the page on this site becomes the record.

Design	What it covers
source-address-restrictions.md	Approver-chosen source-address pinning and a retrieval allowlist
service-retrieval-anomaly-policy.md	Alerting and locking an enrollment code redeemed from too many source networks
config-coordination.md	Detecting and reporting configuration divergence between instances
gui-client-approval-flow.md	Approving for a GUI SSH client, which has no terminal to print the URL to. Section 6, the approval-URL claim, has shipped; sections 1-5 have not
certificate-lifetime-policy-rework.md	Untangling source-address pinning from the lifetime rule, and runtime-editable policy. Partly overtaken: see the doc
hsm-cloud-readiness.md	What a cloud HSM/KMS backend needs, and what the SoftHSM simulation can and cannot rehearse. Partly built: the ssh-agent CA key source and the static/PKCS#11 release split are in
ldap-gssapi-bind.md	Binding to the directory with a Kerberos keytab instead of a static password
admin-elevation.md	Admin mode: re-authenticating before admin, SOC or audit work
client-policy-assertions.md	Bounding what an approver may grant by the requesting machine’s administrative policy. Partly built: the client reports the extensions its policy forbids, and the approval page names them; nothing yet bounds the approval by them
enhancements.md	Small feature modifications logged for later, each too small for its own doc