# OSVx Project Roadmap

This document tracks the high-level goals and future development milestones for the OSVx platform.

## Phase 0: TYR Policy Engine
- [x] Scaffold TYR repo structure.
- [x] Commit & deploy initial default-deny policy bundle.

## Phase 1: TYR Service Identity (SPIFFE/SVID)
- [x] Deploy step-ca
- [x] Bootstrap SPIRE
- [x] Establish Binary Authorization Infrastructure

## Phase 2: Network Hardening & Perimeter Defense
- [x] Establish GCP VPC Service Controls (VPC-SC) perimeter.
- [x] Configure Private Service Connect (PSC) for all Google APIs.
- [x] Deploy Cloud Armor WAF policy.
- [x] Enforce IAP-only SSH and restrict Cloud Run ingress.

## Phase 3: Runtime Enforcers & Workload Security
- [x] Draft Gatekeeper container security policy.
- [x] Secure Ollama model inference behind mTLS via SPIRE SVIDs.
- [x] Audit and sandbox execution environments using eBPF/Falco.

## Phase 4: Data, Secret & CMEK Governance
- [x] Transition secrets to GCP Secret Manager
- [x] Enforce Customer-Managed Encryption Keys (CMEK) for Artifact Registry, Storage Buckets, and Cloud Run.
- [x] Configure BigQuery real-time audit log streaming and setup `query_tyr_audit` MCP tool.

## Phase 5: OISSU Loop & Custom MCP Security Tools
- [x] Build OISSU forecast and anomaly detection tools.
- [x] Build `eval_tyr_identity` and `get_tyr_user_risk` tools.
- [ ] 5.2 Build `eval_tyr_identity` and `get_tyr_user_risk` tools.
- [ ] 5.3 Build `scan_tyr_surface` and `attest_tyr_supply_chain` tools.
- [ ] 5.4 Build `run_tyr_response` tool for automated threat containment.