Skip to content

Plans index

This page summarises every planning document in chronological order. Master plans decompose work into numbered phases, each with its own detailed plan file. Standalone plans track issues, follow-ups, or design decisions that do not require phased execution.

New plans should follow the structure in PLAN-TEMPLATE.md at the repo root. For pre-push audits of our own work see PUSH-TEMPLATE.md.

Master plans

Date Plan Intent Status Phases
2026-06-02 Automated SPICE test harness End-to-end SPICE test harness driving Uncalibrated Sextant via Ryll's control socket, with assertions against the visual digest and serial drain; replaces the OpenStack-dependent integration tests with a direct qemu/KVM lane Complete phase 1 (done), phase 2 (done), phase 3 (done), phase 4 (done), phase 5 (done), phase 6 (done), phase 7 (done), phase 8 (done)
2026-07-04 Rust SPICE proxy (kerbside-proxy) Replace the Python SPICE proxy with a Rust kerbside-proxy that talks tonic/gRPC over a UDS to the Python daemon, reuses ryll's shakenfist-spice-protocol crate, enforces L0+L1 firewall policy from day one, and ships inside the kerbside pip install via a maturin bin wheel Complete phase 1 (done), phase 2 (done), phase 3 (done), phase 4 (done), phase 5 (done), phase 6 (done), phase 7 (done), phase 8 (done)
2026-07-17 Backend host_subject enforcement Restore hypervisor certificate subject pinning on the proxy's backend TLS leg, lost in the Rust proxy cutover: enforce spice-common host-subject matching semantics in ryll's shakenfist-spice-protocol verifier, adopt it in kerbside, and prove both accept and refuse paths in the direct-qemu CI lane Complete phase 1 (done, ryll PR #166), phase 2 (done, kerbside PR #114)

Standalone plans

Date Plan Intent Status
2026-07-16 Consistency audit deferred work Track items from the PROJECT-CONSISTENCY-AUDITS.md review that need manual GitHub UI action: security settings and repository merge settings In progress

📝 Report an issue with this page