Roadmap

Roadmap

Last Updated: May 29, 2026

---

Current Status

Quarter	Status	Key Milestone
FY26Q2	Complete	First public release (v1.0.20260501)
FY26Q3	Complete	ASOPB S4, sandbox hardening, CI DevSecOps
FY26Q4	Active	12-node mesh, Genesis SDL, egress controls

---

FY26Q4 Active Work (May-July 2026)

Priority Work Streams

1. Network Egress Controls -- IP whitelist for sandbox (license servers, HPC nodes)
2. CSP Headers -- Content Security Policy on nginx to block client-side exfiltration
3. 12-Node Federated Mesh -- A2A mesh across DOE facilities (10-12 weeks)
4. DOE Genesis Mission SDL -- Self-Driving Lab reference architecture (12-month funded plan)
5. nsjail Integration -- Kernel-level sandbox isolation (research phase)
6. SPIFFE/SPIRE Workload Identity -- Zero-trust cryptographic service identity
7. Globus Auth Integration -- Federated identity for DOE data facilities

---

FY26Q3 Completed (February-May 2026)

Release: v1.0.20260529 (ASPI 96.8, S4 Hardened -- PASS)

Major Deliverables

Deliverable	Key Outcome
Sandbox Security Hardening	Docker socket removed (P0), security validator enabled, privileged configurable
CI Gap Remediation	ASPI gate on publish, Critical CVE blocking, DevSecOps taxonomy labels
ASOPB 8-Domain Framework	Full pipeline scan (7 passes), ASPI scoring model, scanner image optimized
AWS Deployment	CDK provisioning + Ansible OS prep, E2E validated on EC2
Claude Code Connector	STDIO connector, MCP bridge, 179 tests, doctor command
Promptfoo Red-Team	CI advisory gate, 42 probes (80-86% pass rate), LLM-as-judge grading
27 Claude Code Skills	Full SDLC coverage, CI/CD integration

---

FY26Q2 Completed (January-April 2026)

Release: v1.0.20260501 (First Public Release)

Highlights

• Version unification: both packages to 1.0.YYYYMMDD
• ASOPB Pre-Release Scanner: 7-pass pipeline with ASPI scoring
• YAML Model Catalog: 14 LLM purposes, 23 role aliases
• Docker-free development: 7 host-mode targets
• Bio-Foundation MCP Server: de novo peptide sequencing, 210 tests
• AG-UI Protocol: real-time JSONL streaming, 13 event types, 74 tests
• A2A Peer JWKS Federation: cross-VM user token validation
• EC2 validation: 26 containers, 1,616 tests passing

---

Long-Term (FY26Q4+)

• 12-Node Federated Mesh -- A2A across DOE lab instances with JWKS federation
• DOE Genesis Mission SDL -- Self-Driving Laboratory reference architecture
• Cross-Facility IDP Federation (Phase 2) -- Federated identity across DOE labs
• GCP Terraform IaC + GKE Helm -- Third cloud provider support
• Performance Test Suite -- Load testing and scaling benchmarks
• Unit Test Coverage -- Push toward 80% (currently 7.75%)
• Plugin Marketplace -- Community MCP tool contributions
• Multi-Tenant Hardening -- Production deployment isolation