Shield Development Roadmap

This document is the ordered engineering backlog for Shield. A checked item means that its implementation and required validation gate are complete. A platform or capability is never promoted based on compilation alone.

Platform qualification

• Ubuntu 26.04 LTS x86_64: Rust, Node binding, Viewer CI, and unrestricted real-host filesystem validation.
• Debian 13 x86_64: agent/CLI, Node binding, and Viewer CI; then unrestricted watcher and package smoke tests.
• Windows 11 ARM64: Rust/CLI, Node binding, Viewer, strict recovery, and unsigned real-device installer qualification.
• Build and install Store-shaped x64/ARM64 MSIX packages in CI with an ephemeral qualification identity, keeping the temporary certificate out of release artifacts and user trust stores.
• Promote Windows 11 ARM64 only after retaining an exact-commit installer smoke with a trusted Authenticode signature or Microsoft Store signature.
• Fedora 44, Rocky Linux 9.8, and AlmaLinux 9.8: pinned CI images, native RPM builds, and retained full-VM systemd/watcher/package smoke evidence.
• RHEL 9.8 x86_64: native RPM, systemd, watcher, and signed-audit qualification passed on a licensed real host. Run 31889088368 retained exact-commit evidence for public commit c21c79a; UBI remains separate ABI-compatible container evidence and is not accepted as a RHEL host.

Interactive terminal interface

• Build a full-screen, read-only TUI for headless Linux using ratatui and crossterm while retaining the current non-interactive dashboard --once output for scripts and support captures.
• Provide stable Overview, Scopes, Events, Files, Witnesses, and Notifications views with keyboard navigation and accessible no-color mode.
• Show absolute changed paths and bounded, digest-verified text diffs without reading unverified or oversized content into the terminal.
• Keep policy activation, break-glass, baseline replacement, and destructive operations outside the first TUI delivery. Control actions require a separate threat model, confirmation design, and authorization boundary.
• Add terminal-size, resize, malformed-event, high-volume-event, and non-interactive regression tests.

Active response

• Implement Windows quarantine and rollback only after owners, DACLs, SACLs, integrity labels, alternate data streams, timestamps, and relevant attributes can be captured and restored atomically without weakening access control.
• Add crash recovery, power-loss, locked-file, junction/reparse-point, and cross-volume rollback tests on real Windows hosts. The strict gate in WINDOWS_RECOVERY_QUALIFICATION.md passes on Windows Server 2022/2025 x86_64 and Windows 11 ARM64 with retained host, privilege, volume, and test-log evidence.

Container integrity

• Add live containerd and Docker event monitoring to the host agent.
• Add a sidecar integration with an explicitly lower assurance label than host-level monitoring.
• Add a Kubernetes admission controller that verifies signed image evidence before admission and fails closed under a bounded, documented policy.

Database integrity

• Implement PostgreSQL and MySQL adapters using consistent read-only snapshots and the existing canonical record-source contract. Disposable TLS baseline/match/drift evidence is recorded in DATABASE_QUALIFICATION.md.
• Add optional db-guard enhanced context through an explicit versioned adapter; standalone Shield DB behavior must remain independent.
• Qualify the commercial PostgreSQL backend against a disposable, TLS 1.3 staging database without publishing private implementation code. The private commit and job evidence are recorded in DATABASE_QUALIFICATION.md.

Release and operations

• Build, attest, install, verify, and remove native packages for every promoted Linux distribution and Windows architecture in the release gate.
• Fail release publication closed on missing trusted Authenticode or pinned detached-GPG signing credentials, and smoke-test detached signing with an ephemeral CI key.
• Configure the maintainer-controlled production GPG identity and either a trusted Authenticode certificate or the production Microsoft Store identity, then retain the first exact-commit signed release evidence. Signing secrets must never be generated in or committed to CI.
• Add upgrade, downgrade-rejection, state migration, backup restoration, and break-glass recovery drills to release evidence. The named cross-platform and Unix vault drills are required by both CI and the release workflow; see RELEASE_OPERATIONS.md.
• Add long-running watcher resource and notification-delivery soak tests. Every change runs a bounded smoke; releases require five minutes, and the scheduled/manual workflow runs fifteen minutes while bounding RSS and file descriptor growth and verifying log, webhook, IPC, and signed audit delivery.
• Define deprecation windows for operating systems, protocol versions, and package formats before removing support.