v0.4 Roadmap — the "Trustworthy Intermesh" Release¶
Status: approved scope, 2026-08-18 · Theme: hardening, proving, packaging — no new protocols.
Shaped by an external architecture review (2026-08-18). The review's verdict: the core design is good enough; the highest return now is making the fabric trustworthy and deployable, not adding features. v0.4 freezes protocol additions and ships the following cycles, ordered by risk-reduction per unit of effort.
Cycles¶
| Cycle | Content | Outcome |
|---|---|---|
| A — Truth & gates | Docs truth-pass (one feature-status source of truth; fix README/architecture/security staleness) + mandatory CI: cargo fmt --check, clippy -D warnings, workspace tests, Python suites, golden IPC vectors, cargo deny + cargo audit, container build |
No doc contradicts the code; no PR merges red |
| B — Plugin isolation | Per-plugin UIDs, plugin-specific sockets + SO_PEERCRED, daemon keys/admin socket inaccessible to plugins, Landlock/seccomp, device & network allowlists, hardened systemd units |
A compromised plugin cannot read sealed keys, reach admin.sock, or impersonate another plugin |
| C — Interop proof | Interoperability matrix for LXMF, Meshtastic, MeshCore, MQTT, Signal: inbound, outbound, replies, attachments, reconnect, dedup, offline queue, restart recovery, max payload, failure injection — real hardware/infra where current docs admit gaps (MeshCore hardware, Signal live) | Published matrix; five adapters undeniably production-quality |
| D — Ship it | Release automation on tags: signed x86-64/aarch64 binaries, GHCR images with semver tags, .deb, checksums/attestations, Raspberry Pi path |
Operators deploy without compiling |
| E — UI auth | Passkeys/WebAuthn + scoped roles (viewer/operator/route-admin/identity-admin/security-admin/administrator) in relayfabric-ui; the daemon admin socket stays filesystem-only (standing decision — RBAC lives in the UI service) |
Remote management is safe to encourage |
| F — SDK as product | Publish relayfabric-ipc + relayfabric-sdk (crates.io / PyPI; note: upstream relay-core crate name is taken — publish under relayfabric-*), 30-line echo plugin, switchyardctl plugin test conformance runner, language-neutral golden vectors |
Third parties can build plugins without us |
| G — Public fabric | Federation deployment playbook + a live public federation of 2–3 self-run nodes (dx.pe infrastructure) with different protocol mixes | Meshtastic → node A → federation → node B → LXMF demonstrable in public |
Deferred to v0.5¶
- Companion client / client SDK (review item 6): same arc as
transport-class Phase 2 — core extraction →
PlatformTransport→ client library → Android edge node. Doing it inside v0.4 would double the release. - Licensed ham radio, items 1–3 (proposal, added
2026-08-19): the
licensed_hamcompliance transport class (encryption refusal + automatic station ID), route-level callsign identity mode, and an APRS plugin. Items 4–6 (Winlink via Pat, JS8Call, Meshtastic ham mode) land beyond v0.5. - SimpleX Chat plugin (proposal, added 2026-08-20, slotted v0.6+): the strongest philosophical fit yet (no identifiers, PQ double ratchet) via the signal-cli sidecar precedent — AGPL stays out-of-process; E2EE-BRIDGED labeling is non-negotiable.
- Telegram plugin (proposal, added 2026-08-20, backlog behind SimpleX): reach play, cheapest plugin in the fleet (Bot API, stdlib HTTP) — bluntly labeled PLAINTEXT-PLATFORM, never in the default story; pseudonyms are the point of bridging it at all.
- Formal conformance suite (review item 10): grows out of cycle F's
golden vectors and conformance runner; formal
RF-PLUGIN-1/RF-FED-1numbering waits until a second implementation is plausible. - Symbiont agent plugin (proposal, added 2026-08-20, v0.6+): a policy-governed AI agent as a mesh endpoint, over IPC behind a plugin — the one integration that creates capability neither project has alone. No Cedar/identity merge into RelayFabric.
- Tamper-evident audit journal (proposal, added 2026-08-20, public-node hardening v0.5+): a hash-chained Ed25519-signed record of routing/federation DECISIONS (never content), so a public node can prove it routed within policy. Native, informed by Symbiont's journal design; pairs with cycle G.
Already addressed before this roadmap (2026-08-18)¶
- v0.3.0 GitHub release exists (tag + notes; binaries arrive in cycle D).
- Whole-repo simplification pass (−713 lines) landed ahead of the isolation work in cycle B.
- crates.io naming checked:
relayfabric,relayfabric-core,relayfabric-ipcfree; upstreamrelay-coretaken.
Positioning note (from the review, adopted)¶
RelayFabric is not another chat bridge. The defensible position is a policy-controlled interoperability fabric for heterogeneous communications networks — where Internet, radio, delay-tolerant, privacy-oriented, and disconnected systems meet. Federation, transport-awareness, and the privacy model are the product; protocol count is not.