chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity
ebf0fc0c04
OSVauco/project/roadmap.md

1.4 KiB
Raw Blame History

OSVx Project Roadmap

This document tracks the high-level goals and future development milestones for the OSVx platform.

Phase 0: TYR Policy Engine

  • Scaffold TYR repo structure.
  • Commit & deploy initial default-deny policy bundle.

Phase 1: TYR Service Identity (SPIFFE/SVID)

  • Deploy step-ca
  • Bootstrap SPIRE
  • Establish Binary Authorization Infrastructure

Phase 2: Network Hardening & Perimeter Defense

  • Establish GCP VPC Service Controls (VPC-SC) perimeter.
  • Configure Private Service Connect (PSC) for all Google APIs.
  • Deploy Cloud Armor WAF policy.
  • Enforce IAP-only SSH and restrict Cloud Run ingress.

Phase 3: Runtime Enforcers & Workload Security

  • Draft Gatekeeper container security policy.
  • Secure Ollama model inference behind mTLS via SPIRE SVIDs.
  • Audit and sandbox execution environments using eBPF/Falco.

Phase 3: Memory Bank & Project Management

  • Implement read_memory_bank and write_memory_bank MCP tools.
  • Implement build_and_deploy_service MCP tool.
  • Implement get_project_status and append_project_task MCP tools.

Phase 4: Data, Secret & CMEK Governance

  • Transition secrets to GCP Secret Manager.
  • Enforce Customer-Managed Encryption Keys (CMEK) for Artifact Registry, Storage Buckets, and Cloud Run.
  • Configure BigQuery real-time audit log streaming and setup query_tyr_audit MCP tool.