GADNET roadmap: shipped, in progress, planned

What runs today, what is being built, and what is deliberately still on the horizon — in order, with the reasons.

Join the beta

Roadmap

What ships today, what's in progress, what's planned. Phases B and B+ are sequenced, not dated — the pace depends on funding, and we'll publish updates as work lands.

  • Shipped
  • In progress
  • Next up
  • Planned
Shipped

Phase A — available today

  • 5 built-in Zero Trust zones (Isolation, Trusted, IoT, Guest, Admin) + unlimited custom
  • Two-factor admin sign-in: device certificate + PIN on phones, passkey / FIDO2 key (WebAuthn AAL2) on computers; recovery phrase
  • Hybrid TLS 1.3 PQC (X25519MLKEM768 + SecP256r1MLKEM768)
  • Parallel ML-DSA-65 PKI (admin-pq.gadnet, opt-in)
  • RFC 8908 captive portal + vendor probes (Apple / Android / Windows / Firefox)
  • Multi-tier backup: LBU apkovl + snapshot by default, SSH and S3 optional — all signed
  • GDPR data export + erasure + consent management
  • PWA + service worker + local performance metrics (they stay on the router)
  • i18n: English + Polish (2,800+ strings)
  • SBOM CycloneDX 1.6 per artifact (Python / PWA / Alpine)
  • Web Push with encrypted payload (RFC 8291 + 8292) + allow-list of push providers
  • Active Fraud Shield: a second, DNS-independent detection path on SNI that tears down the live connection
  • Signed OTA updates from updates.gadnet.pl: SLH-DSA (FIPS 205) signatures checked against a key baked into the image, device identity so only GADNET routers are served, boot-time rollback recovery, CVE-to-SBOM view in the panel (units on 0.1.1 or older need a one-time reflash)
  • CVE auto-heal in the image build: packages with known vulnerabilities are upgraded before release
  • Cameras tab: discovery of cameras on the LAN and a live preview
  • Printing and Smart-home / mDNS tabs
  • Signed policy catalog: ready-made blocklists and rules you add in one click
In progress

Phase B — closed beta, in progress

  • Preparing the first stable release and publishing the source code (Apache 2.0)
  • Beta (closed, ~50 testers): bug reports and structured feedback shape the stable release
Next up

Phase B+ — after Phase B

  • Remote access to chosen devices and site-to-site VPN over WireGuard, with a hybrid post-quantum handshake (Rosenpass-style ML-KEM-768 on top of Noise IK); the admin panel stays LAN-only
  • IKEv2 / IPsec with RFC 9242 hybrid key exchange + RFC 9370 multiple key exchanges for enterprise interop
  • MASQUE (RFC 9298 CONNECT-UDP over QUIC) proxy mode for client devices behind the router
Planned

Phase C — public release and beyond

  • End-to-end messaging (Signal X3DH + Double Ratchet) — the cryptographic building blocks (ML-KEM-768, hybrid HKDF) are already in place
  • LUKS-encrypted root filesystem — the Pi 5 has no TPM, so hardware-backed key release needs an add-on module
  • MLS group messaging (RFC 9420 + PQ extensions)
  • Device + admin PQ mTLS certificates (revisit 2027-01-01 — awaiting browser trust stores)
  • Independent WCAG 2.1 AA accessibility audit
  • Public bug-bounty program, independently run