Inventory preview
Release roadmap
Generated inventory; do not edit this output.
Inventory preview pending owner classification. Bucket assignments are recorded facts; required/optional classification is not yet approved.
Source revision: ae727e4ff19d44d3d2b6328d1725251a59a0b4df.
Input digest (SHA-256): fb93ac5802487b6341950b4bfe32cf8d15a6beb9b7e23002c62c9686400bd79b.
Pending edits appear after commit and regeneration. Counts measure spec work items, including umbrella and child files separately. They do not measure effort, completion percentage, or release readiness.
Required work items: 213. Nice-to-have work items: 221. Total: 434.
Status breakdown
| Declared status | Work items |
|---|---|
| in-progress | 47 |
| verification | 1 |
| ready | 30 |
| design | 71 |
| skeleton | 268 |
| blocked | 14 |
| deferred | 3 |
Required before release
Operator-visible defects and missing behavior (145)
| Work item | Status | Updated | Phase | Dependencies | Diagnostics |
|---|---|---|---|---|---|
| the announce build key IS the builder's argument set (spec-announce-build-key-is-the-builder-argument-set) | in-progress | 2026-09-19 | - | - | |
| announce-grammar-stated-and-enforced (spec-announce-grammar-stated-and-enforced) | in-progress | 2026-09-19 | 5/6 | - | |
| bgp-as-migration -- RFC 7705 Section 4.2 Internal BGP AS Migration (spec-bgp-as-migration) | in-progress | 2026-09-14 | - | `plan/immediate/spec-bgp-local-as-options.md` | |
| bgp-local-as-options -- preserve the direction each option governs (spec-bgp-local-as-options) | in-progress | 2026-09-19 | 1/7 | - | |
| bmp-statistics-timeout-sends-no-report (spec-bmp-statistics-timeout-sends-no-report) | in-progress | 2026-09-19 | 3/3 | - | |
| a command that acknowledges what the operator typed never echoes a secret (spec-config-set-never-echoes-a-secret) | in-progress | 2026-09-19 | - | - | |
| connected and static reach the Loc-RIB (spec-connected-static-reach-the-locrib) | in-progress | 2026-09-19 | 6/7 | - | |
| eap-tls-certificate-revocation (spec-eap-tls-certificate-revocation) | in-progress | 2026-09-19 | - | spec-ipsec-rfc9190 | |
| fib-depth -- Routing Decision and FIB Programming Depth (spec-fib-depth) | in-progress | 2026-09-19 | - | spec-vrf-0-umbrella.md | |
| Redistribution chain drops every route silently (spec-fixit-redistribution-chain-drops-silently) | in-progress | 2026-09-19 | - | - | |
| generated-command-usage (spec-generated-command-usage) | in-progress | 2026-09-19 | - | - | |
| kernel-capability-gate (spec-kernel-capability-gate) | in-progress | 2026-09-19 | 6/6 | - | |
| lifecycle-invariants (spec-lifecycle-invariants) | in-progress | 2026-09-19 | 1/10 | - | |
| ospf-accept-lifetime-receive-window (spec-ospf-accept-lifetime-receive-window) | in-progress | 2026-09-19 | - | - | |
| ospf-rfc3101-nssa-defaults (spec-ospf-rfc3101-nssa-defaults) | in-progress | 2026-09-19 | - | - | |
| ppp-pap-reanswer-after-auth (spec-ppp-pap-reanswer-after-auth) | in-progress | 2026-09-21 | 1/1 | - | |
| pppoe-client-pap-retry (spec-pppoe-client-pap-retry) | in-progress | 2026-09-21 | 1/1 | - | |
| pppoe-lcp-option-reject (spec-pppoe-lcp-option-reject) | in-progress | 2026-09-21 | 1/1 | - | |
| pppoe-padt-ends-session (spec-pppoe-padt-ends-session) | in-progress | 2026-09-21 | 1/1 | - | |
| RSVP message validation and state matching rules (RFC 2205 Sections 3.1, 3.2, 3.10) (spec-rsvp-message-validation) | in-progress | 2026-09-23 | - | - | |
| RSVP-TE strict-hop adjacency and loose-hop expansion (RFC 3209 Sections 4.3.3.1, 4.3.4.2) (spec-rsvpte-ero-strict-loose-hops) | in-progress | 2026-09-23 | - | - | |
| static-route-tag-reaches-no-consumer (spec-static-route-tag-reaches-no-consumer) | in-progress | 2026-09-19 | - | - | |
| yang-rpc-declarations-with-no-handler (spec-yang-rpc-declarations-with-no-handler) | in-progress | 2026-09-13 | - | - | |
| BCP 194 umbrella -- follow RFC 7454 and RFC 8195 (spec-bcp194-0-umbrella) | ready | 2026-08-08 | - | - | |
| BCP 194 child 1 -- community handling (RFC 7454 §11 and RFC 8195) (spec-bcp194-1-communities) | ready | 2026-08-12 | 3b/6 | spec-bcp194-0-umbrella | |
| a removal takes the working-tree copy with it (spec-remove-takes-the-working-tree-copy) | ready | 2026-09-07 | - | `plan/spec-commit-stages-in-a-private-index.md` (product code recorded landed; shares `internal/le/commit/script.go`; proof and closure remain open) | |
| rfc4301-architecture-gaps (spec-rfc4301-architecture-gaps) | ready | 2026-09-06 | - | `plan/spec-ipsec-lifetime-volume.md` (owns the Section 4.4.2.1 byte-count SAD lifetime); `plan/pre-release/spec-rfcgate-6-supported-extraction-signoff.md` (owns the `rfc4301` extraction sign-off and the ledger scope set) | |
| test children run in the checkout root (spec-test-children-run-in-the-checkout-root) | ready | 2026-09-07 | - | - | |
| ADD-PATH limit becomes a send/receive container, with ingress enforcement (spec-add-path-limit-send-receive) | design | 2026-09-11 | - | - | |
| BGP filtered-route retention and a real routes_filtered (spec-bgp-filtered-route-storage) | design | 2026-07-16 | - | - | |
| bgp-ls-receiver-fault-management (spec-bgp-ls-receiver-fault-management) | design | 2026-08-26 | - | - | |
| spec-bgp-netns (title unavailable) (spec-bgp-netns) | design | 2026-07-16 | 0/N (research) | - (not blocked by any spec; this spec IS the fix for the shipped default, see "Why this is the default case" below) | title unavailable |
| BGP per-peer pre-policy received counter (spec-bgp-per-peer-received-counter) | design | 2026-08-08 | - | - | |
| config-bound-authority (spec-config-bound-authority) | design | 2026-09-08 | - | - | |
| firewall-dynamic-address-group (spec-firewall-dynamic-address-group) | design | 2026-07-04 | - | - | |
| fixit-ca-root-location (spec-fixit-ca-root-location) | design | 2026-09-04 | research complete, design complete, nothing implemented | - | |
| selector narrows through a pipe (spec-fixit-selector-narrows-through-a-pipe) | design | 2026-09-04 | - | - | |
| ipsec-remote-access (spec-ipsec-remote-access) | design | 2026-07-31 | - | - (was `spec-fixit-ipsec-verify-siblings`, closed 2026-08-03) | |
| lcp-restart-counters (spec-lcp-restart-counters) | design | 2026-09-05 | - | - | |
| give the looking glass and gNMI a per-user login (spec-login-identity-for-looking-glass-and-gnmi) | design | 2026-08-11 | - | `plan/spec-login-service-authorisation.md` | |
| mpls-9-rsvp-te-one-to-one-backup (spec-mpls-9-rsvp-te-one-to-one-backup) | design | 2026-09-05 | - | mpls-4-rsvp-te-fast-reroute (facility backup), mpls-3-rsvp-te (closed), mpls-1-kernel (closed) | |
| pki-show-private-key (spec-pki-show-private-key) | design | 2026-07-03 | - | - | |
| pppoe-subscribers-produce-no-accounting-or-telemetry (spec-pppoe-subscribers-produce-no-accounting-or-telemetry) | design | 2026-09-09 | - | - | |
| EventBus backpressure symmetry, async fan-out, and ordering (DESIGN-REVIEW finding 4) (spec-review-bus-async-fanout) | design | 2026-07-06 | - | spec-unify-buffer-lifetime (HARD ordering: async fan-out must not land first) (closed, learned 1077 -- ordering constraint satisfied) | |
| Redistribute orchestrator producer/consumer symmetry and dead skip machinery (DESIGN-REVIEW finding 5) (spec-review-redistribute-orchestrator) | design | 2026-07-06 | - | - | |
| Plugin protocol versioning and a real SDK boundary (DESIGN-REVIEW finding 7) (spec-review-sdk-boundary-versioning) | design | 2026-07-06 | - | - | |
| Typed config decode and BGP diff consumption (DESIGN-REVIEW finding 3) (spec-review-typed-config-decode) | design | 2026-07-06 | - | spec-unify-config-diff (map-diff dedup, adjacent; closed, learned 1079) | |
| rfc7947-adj-rib-in-accepts-filtered-updates (spec-rfc7947-adj-rib-in-accepts-filtered-updates) | design | 2026-08-30 | - | - | |
| rpki-invalid-accepted-and-state-policy (spec-rpki-invalid-accepted-and-state-policy) | design | 2026-08-30 | - | - | |
| srv6-bestpath-resolvability -- SRv6 Service SID Resolvability Before Best-Path (spec-srv6-bestpath-resolvability) | design | 2026-09-08 | - | - | |
| subscriber-utilisation-has-no-operator-view (spec-subscriber-utilisation-has-no-operator-view) | design | 2026-09-09 | - | plan/immediate/spec-pppoe-subscribers-produce-no-accounting-or-telemetry.md | |
| tombstone-forwarding-policy (spec-tombstone-forwarding-policy) | design | 2026-08-07 | - | - | |
| update block name is the list key (spec-update-block-name-is-the-list-key) | design | 2026-09-19 | - | - | |
| vpp-interface-in-use (spec-vpp-interface-in-use) | design | 2026-08-18 | - | - | |
| bound the VPP reply wait in iface, fib and static, and report a wedged dataplane (spec-vpp-reply-deadline-iface-fib-static) | design | 2026-08-11 | - | - | |
| BCP 194 child 2 -- peering role drives policy (spec-bcp194-2-role-policy) | skeleton | 2026-08-08 | - | spec-bcp194-0-umbrella | |
| BCP 194 child 3 -- speaker and session hardening (spec-bcp194-3-session) | skeleton | 2026-08-08 | - | spec-bcp194-0-umbrella | |
| BCP 194 child 4 -- prefix filtering defaults (spec-bcp194-4-prefix) | skeleton | 2026-08-08 | - | spec-bcp194-0-umbrella | |
| BCP 194 child 6 -- the remaining RFC 8195 functions (spec-bcp194-6-remaining-rfc8195-functions) | skeleton | 2026-09-05 | - | spec-bcp194-0-umbrella | |
| bfd-link-local-peer-zone (spec-bfd-link-local-peer-zone) | skeleton | 2026-09-11 | - | - | |
| bgp-graceful-restart-rfc-defects (spec-bgp-graceful-restart-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| bgp-link-local-only-next-hop (spec-bgp-link-local-only-next-hop) | skeleton | 2026-09-01 | - | - | |
| Long-Lived Graceful Restart Configured per AFI/SAFI (spec-bgp-llgr-per-family-config) | skeleton | 2026-10-02 | - | - | |
| bgp-ls-receiver-accept-and-limit-controls (spec-bgp-ls-receiver-accept-and-limit-controls) | skeleton | 2026-09-05 | - | spec-bgp-ls-receiver-fault-management | |
| bgp-next-hop-auto-rewrites-for-ebgp (spec-bgp-next-hop-auto-rewrites-for-ebgp) | skeleton | 2026-10-03 | - | - | |
| bgp-open-session-rfc-defects (spec-bgp-open-session-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| bgp-prefix-sid-rfc-defects (spec-bgp-prefix-sid-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| bgp-reload-rich-peer-no-bounce (spec-bgp-reload-rich-peer-no-bounce) | skeleton | 2026-10-03 | - | - | |
| bgp-rib-state-subtree-has-no-producer (spec-bgp-rib-state-subtree-has-no-producer) | skeleton | 2026-09-06 | - | spec-improve-2-gnmi-state | |
| Route Server Sends the Replacement Route on Withdrawal (spec-bgp-rs-replacement-on-withdrawal) | skeleton | 2026-10-01 | - | - | |
| bgp-sr-policy-rfc-defects (spec-bgp-sr-policy-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| bgp-update-propagation-rfc-defects (spec-bgp-update-propagation-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| withdraw only the routes a peer was sent (spec-bgp-withdraw-only-exported-routes) | skeleton | 2026-10-04 | - | - | |
| bmp-route-action-redistribute-acts-as-monitor (spec-bmp-route-action-redistribute-acts-as-monitor) | skeleton | 2026-09-06 | - | - | |
| bmp-sflow-export-rfc-defects (spec-bmp-sflow-export-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| bridge-member-removal-never-detaches-port (spec-bridge-member-removal-never-detaches-port) | skeleton | 2026-10-03 | - | - | |
| cli-question-mark-cannot-be-typed (spec-cli-question-mark-cannot-be-typed) | skeleton | 2026-10-03 | - | - | |
| config-fmt preserves operator information (spec-config-fmt-preserves-operator-information) | skeleton | 2026-09-19 | - | - | |
| config-leaf-consumption-gate (spec-config-leaf-consumption-gate) | skeleton | 2026-09-06 | - | - | |
| config-verify-rejects-unknown-keys (spec-config-verify-rejects-unknown-keys) | skeleton | 2026-09-19 | - | - | |
| dataplane-seams-0 -- Backend Neutrality at the Control-Plane / Dataplane Boundary (Umbrella) (spec-dataplane-seams-0-umbrella) | skeleton | 2026-08-07 | - | - | |
| ddos-baseline-warmup-maturity (spec-ddos-baseline-warmup-maturity) | skeleton | 2026-08-15 | - | - | |
| ddos-blind-detector-diagnostic (spec-ddos-blind-detector-diagnostic) | skeleton | 2026-08-15 | - | - | |
| ddos-direction-allowlist-deferred-flowspec-withdraw -- withdraw on late exemption (spec-ddos-direction-allowlist-deferred-flowspec-withdraw) | skeleton | 2026-07-16 | - | - | |
| declared commands take values their command nodes do not declare (spec-declared-commands-without-leaves) | skeleton | 2026-09-05 | - | - | |
| dhcpv4-client-drops-lease-every-period (spec-dhcpv4-client-drops-lease-every-period) | skeleton | 2026-10-03 | - | - | |
| dhcpv6-client-never-requests-a-delegated-prefix (spec-dhcpv6-client-never-requests-a-delegated-prefix) | skeleton | 2026-09-06 | - | - | |
| eap-tls-identity-authorization (spec-eap-tls-identity-authorization) | skeleton | 2026-09-21 | - | - | |
| every-binder-root-stops-and-starts-around-an-address-move (spec-every-binder-root-stops-and-starts-around-an-address-move) | skeleton | 2026-09-12 | - | - | |
| fib-vpp-enabled-and-batching-leaves (spec-fib-vpp-enabled-and-batching-leaves) | skeleton | 2026-09-06 | - | - | |
| a persisted DDoS baseline of any age restores as fully mature (spec-fixit-ddos-baseline-restore-staleness) | skeleton | 2026-09-05 | - | - | |
| fixit-ddos-frag-flood-family (spec-fixit-ddos-frag-flood-family) | skeleton | 2026-09-05 | - | - | |
| fixit-ddos-incident-heartbeat-wiring (spec-fixit-ddos-incident-heartbeat-wiring) | skeleton | 2026-09-05 | - | - | |
| an open DDoS incident is never resolved on teardown (spec-fixit-ddos-incident-lifecycle-on-teardown) | skeleton | 2026-09-05 | - | - | |
| one failed incident open discards the whole DDoS incident (spec-fixit-ddos-incident-outbound-durability) | skeleton | 2026-09-05 | - | - | |
| fixit-vpp-vlan-promiscuous (spec-fixit-vpp-vlan-promiscuous) | skeleton | 2026-08-01 | - | - | |
| fleet-6 -- Config Freeze, Emergency Disable, and Reconnect Safety (spec-fleet-6-config-freeze) | skeleton | 2026-06-26 | - | - | |
| gnu-option-syntax-across-every-program (spec-gnu-option-syntax-across-every-program) | skeleton | 2026-09-12 | - | - | |
| iface-delete-parent-before-vlan-rolls-back (spec-iface-delete-parent-before-vlan-rolls-back) | skeleton | 2026-10-03 | - | - | |
| ike-dpd-demand-driven (spec-ike-dpd-demand-driven) | skeleton | 2026-08-07 | - | - | |
| ike-eap-rfc-defects (spec-ike-eap-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| ike-fragmentation-rfc7383 (spec-ike-fragmentation-rfc7383) | skeleton | 2026-09-16 | - | - | |
| ike-responder-eap-preserves-state-on-unauthenticated-input (spec-ike-responder-eap-preserves-state-on-unauthenticated-input) | skeleton | 2026-09-19 | - | - | |
| ike-responder-refuses-esn-in-ike-sa-proposal (spec-ike-responder-refuses-esn-in-ike-sa-proposal) | skeleton | 2026-10-03 | - | - | |
| ike-virtual-ip-assignment (spec-ike-virtual-ip-assignment) | skeleton | 2026-08-31 | - | - | |
| improve-2 -- Operational-State Providers for gNMI Get (spec-improve-2-gnmi-state) | skeleton | 2026-07-08 | - | - | |
| improve-5 -- Panic Containment at Network-Input Task Boundaries (spec-improve-5-panic-boundaries) | skeleton | 2026-07-08 | - | - | |
| interface-monitor-container-names-no-behavior (spec-interface-monitor-container-names-no-behavior) | skeleton | 2026-09-06 | - | - | |
| ipsec-close-action-and-dpd-action-select-nothing (spec-ipsec-close-action-and-dpd-action-select-nothing) | skeleton | 2026-09-06 | - | - | |
| ipsec-key-exchange-ikev1-runs-ikev2 (spec-ipsec-key-exchange-ikev1-runs-ikev2) | skeleton | 2026-09-06 | - | - | |
| ipsec-vti-bind-installs-if-id-zero (spec-ipsec-vti-bind-installs-if-id-zero) | skeleton | 2026-09-06 | - | - | |
| ldp-keepalive-expiry-notification (spec-ldp-keepalive-expiry-notification) | skeleton | 2026-09-19 | - | - | |
| mcp-protected-resource-metadata-path (spec-mcp-protected-resource-metadata-path) | skeleton | 2026-09-27 | - | - | |
| ospf-max-metric-startup-shutdown-windows (spec-ospf-max-metric-startup-shutdown-windows) | skeleton | 2026-09-06 | - | - | |
| ospf-nssa-translator-reachability (spec-ospf-nssa-translator-reachability) | skeleton | 2026-09-27 | - | - | |
| peer-deactivate-and-bulk-route-purge (spec-peer-deactivate-and-bulk-route-purge) | skeleton | 2026-09-06 | - | - | |
| peer-leaves-the-peer-parser-never-reads (spec-peer-leaves-the-peer-parser-never-reads) | skeleton | 2026-09-06 | - | - | |
| ppp-ipv6-link-local-never-assigned (spec-ppp-ipv6-link-local-never-assigned) | skeleton | 2026-10-03 | - | - | |
| radius-rfc-defects (spec-radius-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| reactor-tuning-leaves-reach-no-reader (spec-reactor-tuning-leaves-reach-no-reader) | skeleton | 2026-09-06 | - | - | |
| a restore path that does more than the create path (spec-restore-path-exceeds-create-path) | skeleton | 2026-08-18 | - | - | |
| the relayed RFC 2545 next hop, and three more relay gaps (spec-rfc2545-next-hop-truncated-to-sixteen-bytes) | skeleton | 2026-09-05 | - | - | |
| an RFC 2545 condition flip leaves the peer with a next hop it cannot resolve (spec-rfc2545-readvertise-on-condition-flip) | skeleton | 2026-09-05 | - | - | |
| RFC 5176 residual CoA atomicity and session matching (spec-rfc5176-remaining-defect-classes) | skeleton | 2026-09-05 | - | `plan/immediate/spec-lifecycle-invariants.md` (applied-result contract, AC-3/AC-4; shared design boundary) | |
| route-source-attribute (spec-route-source-attribute) | skeleton | 2026-09-06 | - | - | |
| rpc-published-name-does-not-reach-its-handler (spec-rpc-published-name-does-not-reach-its-handler) | skeleton | 2026-09-06 | - | - | |
| rpki-cache-preference-and-source-marking (spec-rpki-cache-preference-and-source-marking) | skeleton | 2026-09-06 | - | - | |
| rsvpte-frr-link-protection-fallback (spec-rsvpte-frr-link-protection-fallback) | skeleton | 2026-09-27 | - | - | |
| show bgp decode and show bgp encode answer text, so no operator chain reaches them (spec-show-bgp-decode-encode-answer-structured-data) | skeleton | 2026-09-05 | - | - | |
| show-bgp-one-name-for-the-peer-address (spec-show-bgp-one-name-for-the-peer-address) | skeleton | 2026-09-05 | - | - | |
| resolve and origin over rows keyed by identity (spec-show-bgp-operators-over-identity-keyed-rows) | skeleton | 2026-09-05 | - | spec-cli-show-bgp-answer-shapes | |
| show bgp rib best and show bgp rib describe one route differently (spec-show-bgp-rib-best-row-top-level-fields) | skeleton | 2026-09-05 | - | - | |
| software-version-mode-implements-two-of-four (spec-software-version-mode-implements-two-of-four) | skeleton | 2026-09-06 | - | - | |
| srv6-evpn-label-width -- EVPN Label Storage Width for SRv6 Transposition (spec-srv6-evpn-label-width) | skeleton | 2026-06-16 | - | - | |
| startup-deferred-reapply-idempotency (spec-startup-deferred-reapply-idempotency) | skeleton | 2026-07-16 | - | - | |
| static routes take the BGP group shape (spec-static-routes-take-the-bgp-group-shape) | skeleton | 2026-09-06 | - | spec-connected-static-reach-the-locrib (owns the arbitration point the new distance leaf needs) | |
| vrrp-owner-arp-rfc-defects (spec-vrrp-owner-arp-rfc-defects) | skeleton | 2026-09-27 | - | - | |
| watchdog-withdraw-read-by-presence (spec-watchdog-withdraw-read-by-presence) | skeleton | 2026-09-06 | - | - | |
| managed-server-hardening (spec-managed-server-hardening) | blocked | 2026-09-19 | - | - | |
| RFC 4271 MED Removal Before IBGP Readvertisement (spec-rfc4271-med-ibgp-readvertisement) | blocked | 2026-08-17 | 5/5 | - | |
| rfcgate-1b-rfc7296-pilot-deferred-eap-identifier (spec-rfcgate-1b-rfc7296-pilot-deferred-eap-identifier) | blocked | 2026-08-05 | - | - | |
| rfcgate-1b-rfc7296-pilot-deferred-ike-source-address (spec-rfcgate-1b-rfc7296-pilot-deferred-ike-source-address) | blocked | 2026-08-02 | - | - | |
| traffic-vpp-deferred-reply-timeout (spec-traffic-vpp-deferred-reply-timeout) | blocked | 2026-09-19 | 6/6 | - | |
| fib-p4-leaves-reach-a-noop-backend (spec-fib-p4-leaves-reach-a-noop-backend) | deferred | 2026-09-06 | - | - | |
| tunnel-outer-ttl-on-the-vpp-backend (spec-tunnel-outer-ttl-on-the-vpp-backend) | deferred | 2026-09-06 | - | - |
Other release obligations (68)
| Work item | Status | Updated | Phase | Dependencies | Diagnostics |
|---|---|---|---|---|---|
| release-evidence-gate (spec-release-evidence-gate) | in-progress | 2026-09-19 | - | - | |
| rfc-verdict-test-fix-pass (spec-rfc-verdict-test-fix-pass) | in-progress | 2026-09-28 | - | `spec-rfc-requirement-quote-hand-backfill` (closed 2026-09-27, `f265152e15`) | |
| RSVP refresh timing: immediate forward on change, jitter, lifetime and slew (RFC 2205 Sections 2.1, 3.7) (spec-rsvp-refresh-timing) | in-progress | 2026-09-23 | - | - | |
| RSVP ResvErr, ResvTear and per-descriptor error reporting (RFC 2205) (spec-rsvp-resv-error-tear) | in-progress | 2026-09-23 | - | - | |
| RSVP routing and interface integration (RFC 2205 Sections 2.8, 3.8, 3.9, 3.10, 3.11) (spec-rsvp-routing-and-interface-integration) | in-progress | 2026-09-23 | - | - | |
| RSVP-TE fast reroute backup-path signaling and merge point (RFC 4090 Sections 6.1, 6.4.3, 6.4.4, 7.1.1) (spec-rsvpte-frr-backup-path-signaling) | in-progress | 2026-09-23 | - | - | |
| site renderers in Go (spec-site-renderers-in-go) | in-progress | 2026-09-19 | 10/10 | - | |
| release-build (spec-release-build) | ready | 2026-09-28 | - | - | |
| Clause-scoped RFC proof without whole-requirement credit (spec-rfc-clause-scoped-proof) | ready | 2026-10-02 | implementation | - | |
| rfc-verdict-fix-access (spec-rfc-verdict-fix-access) | ready | 2026-09-28 | - | `plan/pre-release/spec-rfc-verdict-test-fix-pass.md` (the parent: its `audit-stamp` `mode rejudge` phase before any re-judge here, and its narrowing-audit output for the access group before any row edit, parent R-11) | |
| rfc-verdict-fix-bfd (spec-rfc-verdict-fix-bfd) | ready | 2026-09-28 | - | `plan/pre-release/spec-rfc-verdict-test-fix-pass.md` (the parent: its `audit-stamp` `mode rejudge` phase before any re-judge here, and its narrowing-audit output for the BFD group before any row edit, parent R-11) | |
| rfc-verdict-fix-bgp (spec-rfc-verdict-fix-bgp) | ready | 2026-09-28 | - | `plan/pre-release/spec-rfc-verdict-test-fix-pass.md` (the parent: its `audit-stamp` `mode rejudge` phase before any re-judge here, and its narrowing-audit output for the BGP group before any row edit, parent R-11) | |
| rfc-verdict-fix-ike-eap (spec-rfc-verdict-fix-ike-eap) | ready | 2026-09-28 | - | `plan/pre-release/spec-rfc-verdict-test-fix-pass.md` (the parent: its `audit-stamp` `mode rejudge` phase before any re-judge here, and its narrowing-audit output for the IKE/EAP group before any row edit, parent R-11) | |
| rfc-verdict-fix-ospf (spec-rfc-verdict-fix-ospf) | ready | 2026-09-28 | - | `plan/pre-release/spec-rfc-verdict-test-fix-pass.md` (the parent: its `audit-stamp` `mode rejudge` phase before any re-judge here, and its narrowing-audit output for the OSPF group before any row edit, parent R-11) | |
| rfc-verdict-fix-routing (spec-rfc-verdict-fix-routing) | ready | 2026-09-28 | - | `plan/pre-release/spec-rfc-verdict-test-fix-pass.md` (the parent: its `audit-stamp` `mode rejudge` phase before any re-judge here, and its narrowing-audit output for the routing group before any row edit, parent R-11) | |
| rfc-verdict-fix-services (spec-rfc-verdict-fix-services) | ready | 2026-09-28 | - | `plan/pre-release/spec-rfc-verdict-test-fix-pass.md` (the parent: its `audit-stamp` `mode rejudge` phase before any re-judge here, and its narrowing-audit output for the services group before any row edit, parent R-11) | |
| rfcgate-2-deferred-unrun-interop-trees (spec-rfcgate-2-deferred-unrun-interop-trees) | ready | 2026-08-01 | - | - | |
| a gate reports the population it judged (spec-a-gate-reports-the-population-it-judged) | design | 2026-09-05 | - | - | |
| bgp-ls-origination-and-the-scheduled-marker (spec-bgp-ls-origination-and-the-scheduled-marker) | design | 2026-08-26 | - | - | |
| release-audit-0-umbrella (spec-release-audit-0-umbrella) | design | 2026-05-24 | - | spec-release-evidence-gate.md | |
| release-audit-1-surface-inventory (spec-release-audit-1-surface-inventory) | design | 2026-05-24 | - | spec-release-audit-0-umbrella.md | |
| release-audit-2-bgp-protocol (spec-release-audit-2-bgp-protocol) | design | 2026-05-25 | - | spec-release-audit-1-surface-inventory.md | |
| release-audit-8-docs-onboarding (spec-release-audit-8-docs-onboarding) | design | 2026-05-25 | - | spec-release-audit-1-surface-inventory.md | |
| release-distribution (spec-release-distribution) | design | 2026-07-10 | - | `spec-release-evidence-gate.md`, `spec-release-audit-0-umbrella.md` | |
| rfc-evidence-deferred-unbootable-suite-musts (spec-rfc-evidence-deferred-unbootable-suite-musts) | design | 2026-09-19 | - | - | |
| RFC evidence strength umbrella -- targeted proofs, owed MUSTs, second walks, black-box conformance (spec-rfc-evidence-strength-0-umbrella) | design | 2026-09-24 | - | - | |
| RFC evidence strength 1 -- a ratchet from revert proofs to targeted mutant proofs (spec-rfc-evidence-strength-1-targeted-mutant-ratchet) | design | 2026-09-24 | - | `plan/pre-release/spec-rfc-evidence-strength-0-umbrella.md` (decisions D-2, D-3, D-4); the committed `killedByTheBreak` package-init fix in `internal/le/rfc/discriminate_observe.go` (concurrent session, 2026-09-24) | |
| RFC evidence strength 3 -- close the owed MUST rows and tell the truth about enrolment (spec-rfc-evidence-strength-3-owed-musts-and-enrolment) | design | 2026-09-24 | - | `plan/pre-release/spec-rfc-evidence-strength-0-umbrella.md` (decision D-1); `plan/pre-release/spec-rfc-requirement-reattribution.md` (29 rows); `plan/spec-ipsec-rfc9190.md` (33 rows); `plan/spec-fixit-dns-rfc1035-conformance.md` (2 rows) | |
| RFC evidence strength 4 -- an independent second walk of the prose-register extractions (spec-rfc-evidence-strength-4-prose-second-walk) | design | 2026-09-24 | - | `plan/pre-release/spec-rfc-evidence-strength-0-umbrella.md` (decisions D-5, D-6) | |
| a-test-passes-at-any-concurrency (spec-a-test-passes-at-any-concurrency) | skeleton | 2026-09-19 | - | - | |
| Config lists carry a key and leaf-lists carry unique values and every default (spec-config-yang-list-key-leaf-list) | skeleton | 2026-09-21 | - | - | |
| YANG loader refuses the module structures RFC 7950 forbids (spec-config-yang-loader-structural-checks) | skeleton | 2026-09-21 | - | - | |
| RPC invocation and reply honor mandatory and default on input and output (spec-config-yang-rpc-mandatory-defaults) | skeleton | 2026-09-21 | - | - | |
| Config validator evaluates when, unique and mandatory choice (spec-config-yang-when-unique-choice) | skeleton | 2026-09-21 | - | - | |
| eor-treats-route-processes-as-peers (spec-eor-treats-route-processes-as-peers) | skeleton | 2026-09-18 | - | - | |
| excluded-requirement-owes-an-observable-test (spec-excluded-requirement-owes-an-observable-test) | skeleton | 2026-09-21 | - | - | |
| finish-appliance-qemu-evidence (spec-finish-appliance-qemu-evidence) | skeleton | 2026-07-16 | - | - | |
| finish-l2tp (spec-finish-l2tp) | skeleton | 2026-08-07 | - | - | |
| container build provenance (spec-fixit-version-cannot-identify-a-build) | skeleton | 2026-08-18 | - | - | |
| followup-rfc-enrollment (spec-followup-rfc-enrollment) | skeleton | 2026-07-17 | - | - | |
| gokrazy-builddir-tmp-deferred-build-flow-unification (spec-gokrazy-builddir-tmp-deferred-build-flow-unification) | skeleton | 2026-07-23 | - | - | |
| interop-suite-red -- resolve the recorded interop failures and their evidence gaps (spec-interop-suite-red) | skeleton | 2026-08-05 | - | - | |
| ipsec-nat-transport-runs-on-the-runtime-kernel (spec-ipsec-nat-transport-runs-on-the-runtime-kernel) | skeleton | 2026-09-06 | - | - | |
| LDP Address message send side (spec-ldp-address-advertisement) | skeleton | 2026-09-21 | - | - | |
| LDP TCP MD5 signature option (spec-ldp-md5-authentication) | skeleton | 2026-09-21 | - | - | |
| pppoe-virtual-interface-proof (spec-pppoe-virtual-interface-proof) | skeleton | 2026-09-21 | - | - | |
| prefix-count-installed-proven-against-a-real-peer (spec-prefix-count-installed-proven-against-a-real-peer) | skeleton | 2026-09-05 | - | - | |
| release-audit-3-config-cli (spec-release-audit-3-config-cli) | skeleton | 2026-09-19 | - | spec-release-audit-1-surface-inventory.md | |
| release-audit-4-web-lg-api (spec-release-audit-4-web-lg-api) | skeleton | 2026-09-19 | - | spec-release-audit-1-surface-inventory.md | |
| release-audit-5-plugins-rib (spec-release-audit-5-plugins-rib) | skeleton | 2026-09-19 | - | spec-release-audit-1-surface-inventory.md | |
| release-audit-6-system-linux (spec-release-audit-6-system-linux) | skeleton | 2026-09-19 | - | spec-release-audit-1-surface-inventory.md | |
| release-audit-7-resilience-security (spec-release-audit-7-resilience-security) | skeleton | 2026-09-19 | - | spec-release-audit-1-surface-inventory.md | |
| rfc-evidence-deferred-ike-eap-tranche (spec-rfc-evidence-deferred-ike-eap-tranche) | skeleton | 2026-08-03 | - | - | |
| rfc-evidence-deferred-isis-rsvpte-ldp-tranche (spec-rfc-evidence-deferred-isis-rsvpte-ldp-tranche) | skeleton | 2026-08-03 | - | - | |
| RFC evidence strength 2 -- upgrade the grandfathered revert proofs, one document at a time (spec-rfc-evidence-strength-2-revert-upgrade-burndown) | skeleton | 2026-09-24 | - | `plan/pre-release/spec-rfc-evidence-strength-1-targeted-mutant-ratchet.md` (the upgrade mode, the backlog count, and the pilot's cost per record) | |
| rfc-extraction-boilerplate-split-loses-an-obligation (spec-rfc-extraction-boilerplate-split-loses-an-obligation) | skeleton | 2026-09-05 | - | - | |
| the RFC ledger reads a gap count only when it is spelled (spec-rfc-ledger-gap-count-reader) | skeleton | 2026-09-05 | - | - | |
| rfc-ledger-rows-for-the-thirty-two-undeclared (spec-rfc-ledger-rows-for-the-thirty-two-undeclared) | skeleton | 2026-09-05 | - | - | |
| rfc-requirement-reattribution (spec-rfc-requirement-reattribution) | skeleton | 2026-09-01 | - | - | |
| fourteen RFC 3748 obligations Ze meets and does not declare (spec-rfc3748-undeclared-met-obligations) | skeleton | 2026-09-05 | - | spec-rfcgate-6-supported-extraction-signoff | |
| rfc4861-rfc8106-enrolment (spec-rfc4861-rfc8106-enrolment) | skeleton | 2026-09-07 | 0/1 | - (was `spec-router-advertisement`, delivered and closed 2026-09-07) | |
| rfcgate-5-should-level (spec-rfcgate-5-should-level) | skeleton | 2026-08-04 | - | `plan/pre-release/spec-followup-rfc-enrollment.md` (MUST-level enrolment milestone defined below) | |
| selfupdate-manifest-authenticity (spec-selfupdate-manifest-authenticity) | skeleton | 2026-10-03 | - | - | |
| test-synchronisation-is-a-fence-never-a-clock (spec-test-synchronisation-is-a-fence-never-a-clock) | skeleton | 2026-09-19 | - | - | |
| VPP SRv6 service policies and local binding SIDs (spec-vpp-srv6-service-policy) | skeleton | 2026-10-02 | design required | - | |
| ze-config-fmt (spec-ze-config-fmt) | skeleton | 2026-08-15 | - | spec-config-fmt-preserves-operator-information.md | |
| rfcgate-1b-rfc7296-pilot-deferred-child-rekey-refusal-proof (spec-rfcgate-1b-rfc7296-pilot-deferred-child-rekey-refusal-proof) | blocked | 2026-08-05 | - | - (live-SA versus test-seam design decision remains blocked below) | |
| rfcgate-6-supported-extraction-signoff (spec-rfcgate-6-supported-extraction-signoff) | blocked | 2026-09-19 | - | `plan/immediate/spec-rfc7947-adj-rib-in-accepts-filtered-updates.md` (RFC 7947 implementation/sign-off slice) |
Nice-to-haves
The first release can ship without these items; no later delivery date is implied.
Optional work (221)
| Work item | Status | Updated | Phase | Dependencies | Diagnostics |
|---|---|---|---|---|---|
| the generic .ci parser refuses an assertion key it does not read (spec-ci-parser-refuses-an-assertion-key-it-does-not-read) | in-progress | 2026-09-19 | - | - | |
| a prepared commit's message file carries its own random suffix (spec-commit-message-file-carries-its-own-suffix) | in-progress | 2026-09-19 | - | - | |
| a prepared commit stages in a private index over a snapshot (spec-commit-stages-in-a-private-index) | in-progress | 2026-09-19 | - | `plan/spec-ledger-shards-per-commit-session.md` (both touch `internal/le/commit/prepare.go`) | |
| crash-capture (spec-crash-capture) | in-progress | 2026-09-19 | 7/8 | - | |
| the link-flap test cannot build the stimulus it exists to measure (spec-fixit-flap-test-cannot-build-its-own-stimulus) | in-progress | 2026-09-19 | - | - | |
| fixit-plugin-concurrency-is-pinned-to-a-ci-constant (spec-fixit-plugin-concurrency-is-pinned-to-a-ci-constant) | in-progress | 2026-09-19 | 3/4 | - | |
| fixit-unexport-package-private-symbols (spec-fixit-unexport-package-private-symbols) | in-progress | 2026-09-19 | 7/8 | - | |
| interop image copies a prebuilt ze (spec-interop-image-copies-a-prebuilt-ze) | in-progress | 2026-09-19 | - | - | |
| ipsec-esp-dual-form-receive (spec-ipsec-esp-dual-form-receive) | in-progress | 2026-09-19 | 5/5 | - | |
| ipsec-rfc9190 (spec-ipsec-rfc9190) | in-progress | 2026-09-08 | 8/8 | - | |
| the two test ledgers become one shard per commit session (spec-ledger-shards-per-commit-session) | in-progress | 2026-09-19 | - | - | |
| password-weakness-warning (spec-password-weakness-warning) | in-progress | 2026-09-19 | 5/6 | - | |
| perf-next-0-umbrella -- Third Hot-Path Optimization Round (spec-perf-next-0-umbrella) | in-progress | 2026-09-19 | 5/5 | - | |
| plugin-query-mode (spec-plugin-query-mode) | in-progress | 2026-09-08 | 5/5 | - | |
| route-config-plugin-migration (spec-route-config-plugin-migration) | in-progress | 2026-09-19 | 5/8 | - | |
| the test/parse .ci parser refuses a directive it does not read (spec-test-parse-ci-parser-refuses-an-unread-directive) | in-progress | 2026-09-19 | - | `plan/spec-ci-parser-refuses-an-assertion-key-it-does-not-read.md` (landed at `8c7f0a5bf2`, which set the vocabulary this one adopts) | |
| verify-scope-5-suite-coverage-map (spec-verify-scope-5-suite-coverage-map) | in-progress | 2026-09-07 | 5/5 | spec-verify-scope-2-change-set-selector (closed 2026-09-05; the selector is `internal/le/changed/selector.go` and `docs/architecture/testing/verify-freshness-scope.md`) | |
| Release roadmap for the repository, website, and weekly news (spec-release-roadmap) | verification | 2026-09-20 | 5/5 | - | |
| Behavioral Security Anomaly Detection (Umbrella) (spec-anomaly-0-umbrella) | ready | 2026-07-02 | - | 1046 (traffic-analysis), 1048 (anomaly-1-detect), 1049 (anomaly-2-shape) | |
| Anomaly Child 7 -- Per-ASN Entities & AS-Origin Cohort Rarity (spec-anomaly-7-as-entities-cohorts) | ready | 2026-07-02 | - | - | |
| bgp-decode-render -- one ordered description tree for decoded BGP messages (spec-bgp-decode-render) | ready | 2026-08-15 | - | - | |
| firewall-arp-nd-matches (spec-firewall-arp-nd-matches) | ready | 2026-09-28 | - | - | |
| fixit-netns-test-dut-tags (spec-fixit-netns-test-dut-tags) | ready | 2026-08-14 | 0/2 (research) | — | |
| fixit-private-asn-leak-deferred-ebgp-auto-filters (spec-fixit-private-asn-leak-deferred-ebgp-auto-filters) | ready | 2026-08-14 | - | - (but SEQUENCES against three in-progress specs -- see "Convergence") | |
| ike-missing-transforms (spec-ike-missing-transforms) | ready | 2026-09-28 | - | - | |
| improve-4 -- File-Driven Protocol Conformance Fixtures (spec-improve-4-conformance-fixtures) | ready | 2026-07-10 | - | - | |
| improve-6 -- YANG Coverage Report (spec-improve-6-yang-coverage) | ready | 2026-07-10 | - | - | |
| improve-8 -- Fuzz the Negotiated-Capability Decode Space (spec-improve-8-fuzz-decode-context) | ready | 2026-09-05 | - | - | |
| ipsec-12-esn -- Extended Sequence Numbers (ESN) for ESP Child SAs (spec-ipsec-12-esn) | ready | 2026-06-20 | - | spec-ipsec-0-umbrella (native IKEv2 engine, XFRM/VPP dataplane) | |
| ospf-ext-0 -- OSPF Extensions (Umbrella, both address families) (spec-ospf-ext-0-umbrella) | ready | 2026-06-24 | - | spec-ospf-ext-13-l3vpn-dn-bit.md | |
| rename-0-umbrella -- retire the legacy package names (spec-rename-0-umbrella) | ready | 2026-07-08 | 0/3 | - | |
| rename-1-ike-packet -- rename ike/wire to ike/packet (spec-rename-1-ike-packet) | ready | 2026-07-08 | - | - | |
| rename-2-bgp-packet -- rename bgp/message to bgp/packet (spec-rename-2-bgp-packet) | ready | 2026-07-22 | - | spec-rib-arch-0-umbrella.md (closed, learned 1128) | |
| bgp-deferred-confederation-otc (spec-bgp-deferred-confederation-otc) | design | 2026-09-05 | - | - | |
| bgp-evpn-route-type-match (spec-bgp-evpn-route-type-match) | design | 2026-07-04 | - | - | |
| bgp-remote-as-auto (spec-bgp-remote-as-auto) | design | 2026-07-04 | - | - | |
| bridge-disable-learning (spec-bridge-disable-learning) | design | 2026-07-04 | - | - | |
| cmd-deprecation (spec-cmd-deprecation) | design | 2026-05-21 | - | - | |
| dhcp-log-level (spec-dhcp-log-level) | design | 2026-07-03 | - | - | |
| eap-tls-authenticator-empty-message-guard (spec-eap-tls-authenticator-empty-message-guard) | design | 2026-08-10 | - | - | |
| filter-wire-0-umbrella -- Wire-native filter-chain IPC (remove the text round-trip) (spec-filter-wire-0-umbrella) | design | 2026-07-16 | - | - | |
| finish-vpp-stub (spec-finish-vpp-stub) | design | 2026-09-19 | - | - | |
| firewall-prefix-normalize (spec-firewall-prefix-normalize) | design | 2026-07-04 | - | - | |
| firewall-remote-group (spec-firewall-remote-group) | design | 2026-09-02 | - | - | |
| fixit-bgp-off-plugin-functional (spec-fixit-bgp-off-plugin-functional) | design | 2026-07-22 | - | - | |
| fixit-functional-suite-pins-the-unshipped-backend (spec-fixit-functional-suite-pins-the-unshipped-backend) | design | 2026-08-28 | - | - | |
| fleet-0 -- Fleet Management (Umbrella) (spec-fleet-0-umbrella) | design | 2026-05-15 | - | - | |
| hardware-watchdog (spec-hardware-watchdog) | design | 2026-07-04 | - | - | |
| ike-ppk (spec-ike-ppk) | design | 2026-07-04 | - | - | |
| ike-reauth (spec-ike-reauth) | design | 2026-07-03 | - | - | |
| Cloud-Init for Gokrazy Appliance (spec-install-9-cloud-init) | design | 2026-06-03 | RESEARCH | spec-install-8-appliance-iso (completed; closed, learned 854) | |
| ipsec-11 -- MOBIKE (RFC 4555) (spec-ipsec-11-mobike) | design | 2026-05-21 | - | ipsec-8 (Child SA/XFRM), ipsec-9 (NAT-T) | |
| ipsec-lifetime-volume (spec-ipsec-lifetime-volume) | design | 2026-07-04 | - | - | |
| ipsec-vpp-policy-interface (spec-ipsec-vpp-policy-interface) | design | 2026-08-10 | - | - | |
| isis-spf-lsp-timers (spec-isis-spf-lsp-timers) | design | 2026-07-04 | - | - | |
| kernel-lockdown-hardening (spec-kernel-lockdown-hardening) | design | 2026-06-30 | - | - | |
| knowledge-routing (spec-knowledge-routing) | design | 2026-08-03 | - | - | |
| liveness-event-tears-down-bgp-peer (spec-liveness-event-tears-down-bgp-peer) | design | 2026-09-07 | - | - | |
| login-service authorisation, a named set of doors an account may use (spec-login-service-authorisation) | design | 2026-08-11 | - | - | |
| Structured Policy Language Umbrella (spec-pol-0-umbrella) | design | 2026-09-19 | - | - | |
| Plugin hook manifest and single YANG declaration (DESIGN-REVIEW finding 8) (spec-review-plugin-registration-manifest) | design | 2026-07-06 | - | - | |
| ssh-fido2-keys (spec-ssh-fido2-keys) | design | 2026-08-16 | - | `spec-ssh-optional-composition` (closed) | |
| vrf-0 -- VRF as first-class organising principle (Umbrella) (spec-vrf-0-umbrella) | design | 2026-04-15 | - | - | |
| web-plugin-extension-registry (spec-web-plugin-extension-registry) | design | 2026-09-11 | - | - | |
| ze-website-0 -- Browser CLI and Protocol Lab (Umbrella) (spec-ze-website-0-umbrella) | design | 2026-08-17 | - | - | |
| an apply that would destroy live session state must refuse (spec-apply-refuses-to-destroy-live-session-state) | skeleton | 2026-08-18 | - | - | |
| BCP 194 child 5 -- route flap dampening position (spec-bcp194-5-damping) | skeleton | 2026-08-08 | - | spec-bcp194-0-umbrella | |
| bgp-deferred-community-name-leaf (spec-bgp-deferred-community-name-leaf) | skeleton | 2026-07-16 | - | - | |
| bgp-pcap-decode-real-capture-fixture -- prove the reader on bytes a network produced (spec-bgp-pcap-decode-real-capture-fixture) | skeleton | 2026-09-08 | - | - | |
| bgp-peer-metric-labels (spec-bgp-peer-metric-labels) | skeleton | 2026-08-01 | - | - | |
| bgp-vpn-attr-set (spec-bgp-vpn-attr-set) | skeleton | 2026-09-19 | - | - | |
| blackhole-authorization-from-irr (spec-blackhole-authorization-from-irr) | skeleton | 2026-08-13 | - | - | |
| changed-source functional-suite coverage and CI consumption (spec-changed-source-to-functional-suite-map) | skeleton | 2026-08-18 | - | plan/spec-verify-scope-5-suite-coverage-map.md | |
| ci-coverage-remaining-surfaces (spec-ci-coverage-remaining-surfaces) | skeleton | 2026-08-17 | - | - | |
| ci-peer-harness-contract-backlog (spec-ci-peer-harness-contract-backlog) | skeleton | 2026-08-23 | - | - | |
| cli-operator-defined-aliases (spec-cli-operator-defined-aliases) | skeleton | 2026-08-19 | 0/1 | - | |
| cli-pipe-column-modifiers (spec-cli-pipe-column-modifiers) | skeleton | 2026-08-19 | 0/1 | - | |
| cli-retired-command-hint (spec-cli-retired-command-hint) | skeleton | 2026-08-21 | 0/1 | - | |
| code-can-land-with-no-design-doc (spec-code-can-land-with-no-design-doc) | skeleton | 2026-08-09 | - | - | |
| config-at-rest-encryption (spec-config-at-rest-encryption) | skeleton | 2026-08-01 | - | - | |
| config-operation-oldconfig-has-no-reader (spec-config-operation-oldconfig-has-no-reader) | skeleton | 2026-09-12 | - | - | |
| Repository checks over the embedded YANG modules: namespace and revision rules (spec-config-yang-authoring-checks) | skeleton | 2026-09-21 | - | - | |
| YANG deviation statement (spec-config-yang-deviation) | skeleton | 2026-09-21 | - | - | |
| YANG feature and if-feature statements (spec-config-yang-if-feature) | skeleton | 2026-09-21 | - | - | |
| YANG built-in type bits (spec-config-yang-type-bits) | skeleton | 2026-09-21 | - | - | |
| YANG built-in type identityref (spec-config-yang-type-identityref) | skeleton | 2026-09-21 | - | - | |
| YANG built-in type instance-identifier (spec-config-yang-type-instance-identifier) | skeleton | 2026-09-21 | - | - | |
| YANG built-in type leafref (spec-config-yang-type-leafref) | skeleton | 2026-09-21 | - | - | |
| YANG 1.1 yang-version declaration and submodules (spec-config-yang-version-submodule) | skeleton | 2026-09-21 | - | - | |
| an operator command to list, re-check and close live connections (spec-connection-management-command) | skeleton | 2026-09-05 | - | - | |
| crypto-policy (spec-crypto-policy) | skeleton | 2026-08-01 | - | - | |
| dataplane-seams-1 -- Route Type Values Independent of Linux (Skeleton) (spec-dataplane-seams-1-route-type-numbering) | skeleton | 2026-08-07 | - | `plan/immediate/spec-dataplane-seams-0-umbrella.md` (finding F-1) | |
| dataplane-seams-2 -- The Resolved Interface Index Carries Its Dataplane (Skeleton) (spec-dataplane-seams-2-backend-typed-index) | skeleton | 2026-08-07 | - | `plan/immediate/spec-dataplane-seams-0-umbrella.md` (finding F-2) | |
| dataplane-seams-3 -- Egress Interface on the Route Event (Skeleton) (spec-dataplane-seams-3-route-egress-interface) | skeleton | 2026-08-07 | - | `plan/immediate/spec-dataplane-seams-0-umbrella.md` (finding F-3) | |
| dataplane-seams-4 -- Shared Control-Packet Receive Path: Decide Whether One Should Exist (Skeleton) (spec-dataplane-seams-4-control-packet-rx) | skeleton | 2026-08-07 | - | `plan/immediate/spec-dataplane-seams-0-umbrella.md` (finding F-4) | |
| dataplane-seams-5 -- Control-Plane Policing Beyond TCP (Skeleton) (spec-dataplane-seams-5-copp-non-tcp) | skeleton | 2026-08-07 | - | `plan/immediate/spec-dataplane-seams-0-umbrella.md` (finding F-5) | |
| ddos-direction-allowlist-deferred-per-source-drop-term -- carve the drop by source (spec-ddos-direction-allowlist-deferred-per-source-drop-term) | skeleton | 2026-07-16 | - | - | |
| ddos-per-destination-detection (spec-ddos-per-destination-detection) | skeleton | 2026-08-15 | - | - | |
| spec-ddos-show-hook (title unavailable) (spec-ddos-show-hook) | skeleton | 2026-07-16 | - | - | title unavailable |
| dhcp-pool-options (spec-dhcp-pool-options) | skeleton | 2026-07-10 | - | - | |
| dhcpv6-server (spec-dhcpv6-server) | skeleton | 2026-07-03 | - | - | |
| doctor codes move to their owners (spec-doctor-codes-move-to-their-owners) | skeleton | 2026-09-14 | - | - | |
| eap-tls-anonymous-nai (spec-eap-tls-anonymous-nai) | skeleton | 2026-08-12 | - | - | |
| eap-tls-certificate-profile (spec-eap-tls-certificate-profile) | skeleton | 2026-09-21 | - | - | |
| eap-tls-tls10 (spec-eap-tls-tls10) | skeleton | 2026-09-21 | - | - | |
| fail-open-call-site-drain (spec-fail-open-call-site-drain) | skeleton | 2026-08-14 | - | - | |
| finish-report-bus (spec-finish-report-bus) | skeleton | 2026-07-06 | - | - | |
| finish-web-cli-ux (spec-finish-web-cli-ux) | skeleton | 2026-07-16 | - | - | |
| fixit-parse-suite-helper-cannot-invoke-ze (spec-fixit-parse-suite-helper-cannot-invoke-ze) | skeleton | 2026-08-16 | - | - | |
| fixit-rfc-summary-protocol-only-rule-contradicts-annotations (spec-fixit-rfc-summary-protocol-only-rule-contradicts-annotations) | skeleton | 2026-08-16 | - | - | |
| fixit-sleeps-qemu-bulk (spec-fixit-sleeps-qemu-bulk) | skeleton | 2026-09-19 | - | - | |
| fixit-stress-repro-counts-a-run-that-never-started (spec-fixit-stress-repro-counts-a-run-that-never-started) | skeleton | 2026-08-16 | - | - | |
| fixit-strongswan-tls13-certreq-authorities -- two upstream strongSwan defects Ze works around, and the reports that must be filed (spec-fixit-strongswan-tls13-certreq-authorities) | skeleton | 2026-08-14 | - | - | |
| fleet-1 -- Device Registry and Fleet Dashboard (spec-fleet-1-device-registry) | skeleton | 2026-05-15 | - | - | |
| fleet-2 -- Config Templates and Group Assignment (spec-fleet-2-config-templates) | skeleton | 2026-05-15 | - | spec-fleet-1-device-registry | |
| fleet-3 -- Fleet Audit Trail (spec-fleet-3-audit-trail) | skeleton | 2026-05-15 | - | spec-fleet-1-device-registry | |
| fleet-4 -- Inventory and Health Reporting (spec-fleet-4-inventory-health) | skeleton | 2026-05-15 | - | spec-fleet-1-device-registry | |
| fleet-5 -- Staged Rollout (spec-fleet-5-staged-rollout) | skeleton | 2026-05-15 | - | spec-fleet-2-config-templates, spec-fleet-4-inventory-health | |
| fleet-7 -- Diverged Config Resolution (spec-fleet-7-config-reconnect-resolution) | skeleton | 2026-06-26 | - | spec-fleet-6-config-freeze | |
| Flow Export - Sampled Scale (NetFlow v9 / IPFIX at high rate) (spec-flow-export-3-sampled-scale) | skeleton | 2026-05-29 | - | spec-flow-export-2-flow-records (closed, learned 819) | |
| followup-pki-chain (spec-followup-pki-chain) | skeleton | 2026-09-03 | - | - | |
| gr-advanced (spec-gr-advanced) | skeleton | 2026-07-08 | - | - | |
| gr-fixtures-bypass-config-loading (spec-gr-fixtures-bypass-config-loading) | skeleton | 2026-09-20 | - | - | |
| harness-fail-open-guard-backlog (spec-harness-fail-open-guard-backlog) | skeleton | 2026-08-14 | - | - | |
| ike-post-quantum (spec-ike-post-quantum) | skeleton | 2026-07-03 | - | - | |
| improve-0 -- Comparison-Review Improvements (Umbrella) (spec-improve-0-umbrella) | skeleton | 2026-07-08 | - | - | |
| improve-1 -- Northbound Config Transaction Contract (spec-improve-1-nb-transactions) | skeleton | 2026-07-08 | - | - | |
| `count installed` discloses its bound and not its magnitude (spec-installed-count-memory-magnitude-undisclosed) | skeleton | 2026-09-05 | - | - | |
| interop-wire-capture -- observe the bytes on the wire in an interop scenario (spec-interop-wire-capture) | skeleton | 2026-08-05 | - | - | |
| ipsec-0 -- IPsec VPN (Umbrella) (spec-ipsec-0-umbrella) | skeleton | 2026-05-19 | - | - | |
| ipsec-auth-piggyback (spec-ipsec-auth-piggyback) | skeleton | 2026-08-01 | - | - | |
| ipsec-dataplane-selector (spec-ipsec-dataplane-selector) | skeleton | 2026-08-10 | - | spec-ipsec-vpp-policy-interface; spec-ipsec-esp-dual-form-receive (real-VPP ESP proof) | |
| ipsec-ipcomp (spec-ipsec-ipcomp) | skeleton | 2026-07-31 | - | - | |
| ipsec-non-first-fragments-also (spec-ipsec-non-first-fragments-also) | skeleton | 2026-09-21 | - | - | |
| ipsec-opaque-selector-port-mask (spec-ipsec-opaque-selector-port-mask) | skeleton | 2026-08-01 | - | - | |
| ipsec-pad-dual-family-range (spec-ipsec-pad-dual-family-range) | skeleton | 2026-09-21 | - | - | |
| ipsec-spd-selection (spec-ipsec-spd-selection) | skeleton | 2026-09-21 | - | - | |
| ipsec-vpp-dataplane-readback (spec-ipsec-vpp-dataplane-readback) | skeleton | 2026-09-11 | SCOPE approved; RESEARCH and DESIGN pending | - | |
| irr-filtering-both-directions (spec-irr-filtering-both-directions) | skeleton | 2026-08-13 | - | - | |
| knowledge-0-umbrella-deferred-model-selection-policy (spec-knowledge-0-umbrella-deferred-model-selection-policy) | skeleton | 2026-08-03 | - | - | |
| l2tp-ipv6-subscriber (spec-l2tp-ipv6-subscriber) | skeleton | 2026-08-30 | - | - | |
| l2tp-new-avp-definitions (spec-l2tp-new-avp-definitions) | skeleton | 2026-09-23 | - | - | |
| l2tp-proxy-authentication (spec-l2tp-proxy-authentication) | skeleton | 2026-09-23 | - | - | |
| LDP over label-controlled ATM and Frame Relay links (spec-ldp-atm-frame-relay) | skeleton | 2026-09-21 | - | - | |
| LDP capability advertisement (RFC 5561) (spec-ldp-capability-advertisement) | skeleton | 2026-09-21 | - | - | |
| LDP capability error status codes (RFC 5561) (spec-ldp-capability-status-codes) | skeleton | 2026-09-21 | - | - | |
| LDP Downstream-on-Demand: Label Request, Release and Abort (spec-ldp-label-request-path) | skeleton | 2026-09-21 | - | - | |
| LDP loop detection (Path Vector and Hop Count) (spec-ldp-loop-detection) | skeleton | 2026-09-21 | - | - | |
| LDP vendor-private TLVs and messages (spec-ldp-vendor-private-tlvs) | skeleton | 2026-09-21 | - | - | |
| le-builds-every-personality (spec-le-builds-every-personality) | skeleton | 2026-09-13 | - | - | |
| le-every-area-dispatches-through-one-table (spec-le-every-area-dispatches-through-one-table) | skeleton | 2026-09-12 | - | - | |
| le-one-verb-one-job (spec-le-one-verb-one-job) | skeleton | 2026-09-12 | - | plan/spec-le-every-area-dispatches-through-one-table.md | |
| mcp2026-5-state-resources (spec-mcp2026-5-state-resources) | skeleton | 2026-07-28 | - | - | |
| native-action-job-admission (spec-native-action-job-admission) | skeleton | 2026-09-05 | - | - | |
| ntp-server (spec-ntp-server) | skeleton | 2026-07-03 | - | - | |
| parallel agents verify a tree nobody authored (spec-parallel-agents-verify-a-tree-nobody-authored) | skeleton | 2026-08-19 | - | - | |
| a plugin's pipe alias reaches the CLI client (spec-plugin-alias-reaches-the-client) | skeleton | 2026-09-05 | - | - | |
| plugin-declaration-fields-on-registration (spec-plugin-declaration-fields-on-registration) | skeleton | 2026-09-09 | - | - | |
| a plugin declares only on a command path it serves (spec-plugin-declaration-names-a-path-it-serves) | skeleton | 2026-09-05 | - | - | |
| plugin-runner-inertness (spec-plugin-runner-inertness) | skeleton | 2026-09-09 | - | - | |
| ppp-discard-request-sender (spec-ppp-discard-request-sender) | skeleton | 2026-09-23 | - | - | |
| pppoe-generic-error-tag (spec-pppoe-generic-error-tag) | skeleton | 2026-09-23 | - | - | |
| pppoe-relay-agent (spec-pppoe-relay-agent) | skeleton | 2026-09-23 | - | - | |
| publish-the-regenerated-command-catalog (spec-publish-the-regenerated-command-catalog) | skeleton | 2026-09-08 | - | - | |
| radius-acct-timewheel (spec-radius-acct-timewheel) | skeleton | 2026-07-10 | - | - | |
| radius-chap-eap-admin (spec-radius-chap-eap-admin) | skeleton | 2026-07-16 | - | - | |
| reactor-split -- decompose the bgp/reactor god package (spec-reactor-split) | skeleton | 2026-07-08 | - | spec-rib-arch-0-umbrella.md (closed, learned 1128) | |
| every payload handler outside the two RIB walks still buffers its answer (spec-record-answers-payload-handlers-outside-the-rib-walks) | skeleton | 2026-09-05 | - | - | |
| prove a refactor commit moved code without changing it (spec-refactor-commit-proof-by-per-function-diff) | skeleton | 2026-08-18 | - | - | |
| reject-literal-has-a-producer (spec-reject-literal-has-a-producer) | skeleton | 2026-08-22 | - | - | |
| rfc-anchor-resolution-check (spec-rfc-anchor-resolution-check) | skeleton | 2026-08-10 | - | - | |
| RFC evidence strength 5 -- black-box conformance with external suites and protocol fuzzers (spec-rfc-evidence-strength-5-black-box-conformance) | skeleton | 2026-09-24 | - | `plan/pre-release/spec-rfc-evidence-strength-0-umbrella.md` (children 1 to 4 first, by the owner's priority order) | |
| RFC evidence strength 6 -- negative-path fuzzing for each RFC error-handling clause (spec-rfc-evidence-strength-6-error-handling-fuzz) | skeleton | 2026-09-24 | - | `plan/pre-release/spec-rfc-evidence-strength-0-umbrella.md` (children 1 to 4 first, by the owner's priority order) | |
| router-advertisement-options-out-of-scope (spec-router-advertisement-options-out-of-scope) | skeleton | 2026-09-05 | 0/1 | - (was `spec-router-advertisement`, delivered and closed 2026-09-05) | |
| RSVP IntServ flow reservations for host applications (RFC 2205) (spec-rsvp-intserv-host-flows) | skeleton | 2026-09-23 | - | - | |
| RSVP multicast sessions, wildcard filter style and reservation merging (RFC 2205) (spec-rsvp-multicast-wildcard) | skeleton | 2026-09-23 | - | - | |
| RSVP policy control (RFC 2205 Section 2.2) (spec-rsvp-policy-control) | skeleton | 2026-09-23 | - | - | |
| RSVP UDP encapsulation for hosts without raw network I/O (RFC 2205 Appendix C) (spec-rsvp-udp-encapsulation) | skeleton | 2026-09-23 | - | - | |
| RSVP-TE ATM and Frame Relay label ranges (RFC 3209 Sections 4.2.2, 4.2.3) (spec-rsvpte-atm-frame-relay-labels) | skeleton | 2026-09-23 | - | - | |
| RSVP-TE bypass with guaranteed bandwidth (RFC 4090 Sections 4.4, 6) (spec-rsvpte-bypass-bandwidth-protection) | skeleton | 2026-09-23 | - | - | |
| RSVP-TE Hello extension (RFC 3209 Section 5) (spec-rsvpte-hello-extension) | skeleton | 2026-09-23 | - | - | |
| RSVP-TE IPv6 LSP_TUNNEL objects (RFC 3209 Sections 4.6.1.2, 4.6.2.2, 4.6.3.2) (spec-rsvpte-ipv6-lsp-tunnel) | skeleton | 2026-09-23 | - | - | |
| RSVP-TE knowledge of non-RSVP neighbors and hops (RFC 3209 Section 4.2.5, RFC 2205 Section 3.8) (spec-rsvpte-non-rsvp-neighbors) | skeleton | 2026-09-23 | - | - | |
| RSVP-TE resource affinities (RFC 3209 Section 4.7.4) (spec-rsvpte-resource-affinities) | skeleton | 2026-09-23 | - | - | |
| RSVP-TE per-sender policing (RFC 3209 Section 4.1.1.1) (spec-rsvpte-sender-policing) | skeleton | 2026-09-23 | - | - | |
| rules-situation-index (spec-rules-situation-index) | skeleton | 2026-08-07 | - | - | |
| a shrink-only baseline cannot see a relocation (spec-shrink-only-baseline-cannot-see-a-relocation) | skeleton | 2026-08-19 | - | - | |
| srv6-labeled-unicast -- SRv6 Support for Labeled Unicast (SAFIMPLSLabel) (spec-srv6-labeled-unicast) | skeleton | 2026-06-16 | - | - | |
| srv6-static-segments (spec-srv6-static-segments) | skeleton | 2026-07-04 | - | - | |
| stale-spec-frame-check (spec-stale-spec-frame-check) | skeleton | 2026-08-10 | - | - | |
| standard families register outside the bgp tag (spec-standard-families-register-outside-the-bgp-tag) | skeleton | 2026-09-14 | - | - | |
| streaming-answer-protocol (spec-streaming-answer-protocol) | skeleton | 2026-09-05 | - | - | |
| stress-repro-refuses-a-stale-binary (spec-stress-repro-refuses-a-stale-binary) | skeleton | 2026-08-15 | - | - | |
| tcp-ao-rfc5925 (spec-tcp-ao-rfc5925) | skeleton | 2026-08-12 | - | - | |
| a latched counter passes a test it cannot fail (spec-testing-latched-counter-vacuity-trap) | skeleton | 2026-08-18 | - | - | |
| traceroute-unprivileged-socket (spec-traceroute-unprivileged-socket) | skeleton | 2026-09-15 | - | - | |
| two verifies share one run, proven through the real binary (spec-two-verifies-share-one-run-end-to-end) | skeleton | 2026-09-05 | - | - | |
| unrecognized-field-value-must-fail-loudly (spec-unrecognized-field-value-must-fail-loudly) | skeleton | 2026-08-14 | - | - | |
| unused-code-hidden-behind-exported-symbols (spec-unused-code-hidden-behind-exported-symbols) | skeleton | 2026-08-10 | - | - | |
| verify-scope-0-umbrella (spec-verify-scope-0-umbrella) | skeleton | 2026-08-19 | - | - | |
| vpp-loopback-mac (spec-vpp-loopback-mac) | skeleton | 2026-08-01 | - | - | |
| vpp-mac-change-capability (spec-vpp-mac-change-capability) | skeleton | 2026-08-18 | - | - | |
| vpp-numa-smt (spec-vpp-numa-smt) | skeleton | 2026-07-10 | - | spec-vpp-isolated-cpus (closed 2026-09-07), spec-vpp-host-tuning (closed, learned 1105) | |
| vpp-slaac-tap-premise (spec-vpp-slaac-tap-premise) | skeleton | 2026-08-24 | - | none. `spec-fixit-vpp-slaac-no-dataplane-path` landed the gate and closed on 2026-08-29 | |
| vrf (spec-vrf) | skeleton | 2026-08-29 | - | spec-vrf-0-umbrella.md | |
| vrrp-7 -- VRRP on the VPP Dataplane (Skeleton) (spec-vrrp-7-vpp) | skeleton | 2026-07-14 | - | spec-vrrp-5-plugin (closed with vrrp-0..5, commit fbc99f1d4, learned 1124) | |
| vrrp-deferred-keepalived-interop-scenarios (spec-vrrp-deferred-keepalived-interop-scenarios) | skeleton | 2026-07-16 | - | - | |
| web-testing-gaps (spec-web-testing-gaps) | skeleton | 2026-08-16 | - | - | |
| wildcard-bind-excuses-a-binder-from-an-address-move (spec-wildcard-bind-excuses-a-binder-from-an-address-move) | skeleton | 2026-09-12 | - | `plan/immediate/spec-every-binder-root-stops-and-starts-around-an-address-move.md` | |
| wire-edit-5-fanout-dedup-deferred-fanout-ci -- finish the socket-level fan-out dedup functional test (spec-wire-edit-5-fanout-dedup-deferred-fanout-ci) | skeleton | 2026-08-02 | - | - | |
| wire-edit-5-fanout-dedup-deferred-small-fanout-regression -- the 3% cost of dedup when every destination is its own group (spec-wire-edit-5-fanout-dedup-deferred-small-fanout-regression) | skeleton | 2026-08-02 | - | - | |
| yang-config-leaf-short-and-long-help (spec-yang-config-leaf-short-and-long-help) | skeleton | 2026-08-31 | - | `spec-yang-short-and-long-command-help` (closed) | |
| ze-api-callback-pump (spec-ze-api-callback-pump) | skeleton | 2026-08-16 | - | - | |
| cli-root-namespace-grammar-deferred-gate-reach (spec-cli-root-namespace-grammar-deferred-gate-reach) | blocked | 2026-08-05 | - | - | |
| fixit-dns-rfc1035-conformance (spec-fixit-dns-rfc1035-conformance) | blocked | 2026-08-28 | - | - | |
| improve-3-event-replay-deferred-deterministic-scheduler (spec-improve-3-event-replay-deferred-deterministic-scheduler) | blocked | 2026-08-05 | - | - | |
| ospf-ext-13 -- OSPFv2 L3VPN PE-CE DN bit (RFC 4576, RFC 4577) (spec-ospf-ext-13-l3vpn-dn-bit) | blocked | 2026-09-19 | - | spec-vrf-0-umbrella.md | |
| rename-3-wireu-fold -- fold bgp/wireu into bgp/packet (spec-rename-3-wireu-fold) | blocked | 2026-07-08 | - | spec-rename-2-bgp-packet.md | |
| support-export (spec-support-export) | blocked | 2026-09-05 | - | - | |
| wire-edit-2-deferred-ci-substitution -- did child 2 close on substitute tests it was allowed to substitute? (spec-wire-edit-2-deferred-ci-substitution) | blocked | 2026-08-02 | - | - | |
| bgp-local-as-inbound-append -- the RFC 7705 inbound append as a configuration recipe (spec-bgp-local-as-inbound-append) | deferred | 2026-09-19 | - | `plan/immediate/spec-bgp-local-as-options.md` |
Status legend
| Status | Meaning |
|---|---|
| skeleton | Captured task; design has not started |
| design | Research and design in progress |
| ready | Design complete; ready for implementation |
| in-progress | Implementation in progress |
| verification | Committed implementation awaiting independent review and closure; still open |
| blocked | Waiting on a declared prerequisite |
| deferred | Explicitly postponed; still counted |
| unparsed / unknown / other values | Metadata needs attention; still counted |
The report records declared status only. Phase text and checkboxes do not establish completion. Removed specs require source verification before a delivery claim.