Chris Christiansen
9fcb9c354a
Some checks are pending
Check Python Version Consistency / Check Python Version (push) Waiting to run
44 lines
2.0 KiB
Markdown
44 lines
2.0 KiB
Markdown
# OSVx Project Roadmap
|
|
|
|
This document tracks the high-level goals and future development milestones for the OSVx platform.
|
|
|
|
## Phase 0: TYR Policy Engine
|
|
- [x] Scaffold TYR repo structure.
|
|
- [x] Commit & deploy initial default-deny policy bundle.
|
|
|
|
## Phase 1: TYR Service Identity (SPIFFE/SVID)
|
|
- [x] Deploy step-ca
|
|
- [x] Bootstrap SPIRE
|
|
- [x] Establish Binary Authorization Infrastructure
|
|
|
|
## Phase 2: Network Hardening & Perimeter Defense
|
|
- [x] Establish GCP VPC Service Controls (VPC-SC) perimeter.
|
|
- [x] Configure Private Service Connect (PSC) for all Google APIs.
|
|
- [x] Deploy Cloud Armor WAF policy.
|
|
- [x] Enforce IAP-only SSH and restrict Cloud Run ingress.
|
|
|
|
## Phase 3: Runtime Enforcers & Workload Security
|
|
- [x] Draft Gatekeeper container security policy.
|
|
- [x] Secure Ollama model inference behind mTLS via SPIRE SVIDs.
|
|
- [x] Audit and sandbox execution environments using eBPF/Falco.
|
|
|
|
## Phase 4: Data, Secret & CMEK Governance
|
|
- [x] Transition secrets to GCP Secret Manager
|
|
- [x] Enforce Customer-Managed Encryption Keys (CMEK) for Artifact Registry, Storage Buckets, and Cloud Run.
|
|
- [x] Configure BigQuery real-time audit log streaming and setup `query_tyr_audit` MCP tool.
|
|
|
|
## Phase 5: OISSU Loop & Custom MCP Security Tools
|
|
- [x] Build OISSU forecast and anomaly detection tools.
|
|
- [x] Build `eval_tyr_identity` and `get_tyr_user_risk` tools.
|
|
- [x] Build `attest_tyr_supply_chain` tool.
|
|
- [x] Build `run_tyr_response` tool for automated threat containment.
|
|
|
|
## Phase 6: Continuous Integration & Deployment Security Gates
|
|
- [x] Add cloudbuild security gate configuration!
|
|
- [x] Final System Verification and Master Plan Sign-Off
|
|
- [x] Verified: BigQuery wildcard query fix and Secret Manager 30-day rotation policies are applied.
|
|
|
|
## Phase 7: Antagonist Protocol & Continuous Self-Healing
|
|
- [x] Scaffold `tyr-antagonist` Cloud Run Job running on a 6-hour cron schedule.
|
|
- [x] Implement 7-step loop: Red-Team Synthesis (Jason) → Shadow Execution → Gap Mapping → Auto-Patching (Emma) → Canary Deploy → Rule Promotion → Knowledge Distillation.
|