RFCTracker
Chaque changement important à WAF++ commence par une demande publique de commentaires ou un dossier décisionnel d'architecture. Cette page suit chaque décision — du premier projet à la fusion — donc rien n'est caché.
Toutes les demandes de commentaires
Filtrer par projet et état, lire les résumés, et suivre les discussions liées et tirer les demandes.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Framework— ouvert à la révision
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Framework— Projets
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
Framework— décidé / mis en œuvre
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Core— ouvert à la révision
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Core— décidé / mis en œuvre
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
MCP— ouvert à la révision
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
Applies the radical dark-first design system to the remaining public pages so the whole site uses one consistent visual language.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Core
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Framework
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Vous voulez proposer un changement ?
Ouvrez une discussion GitHub en utilisant le modèle RFC. La communauté l'examine, les responsables décident — tout est documenté et traçable.
Dossiers de décision en architecture
Les EIM reflètent les décisions structurelles et transversales qui façonnent l'écosystème, les dépôts et les contrats WAF++.
Master onboarding document explaining the WAF++ ecosystem, repository layout, two-branch documentation model, and central wafpass-result.json contract.
Defines the single JSON schema that all WAF++ components use to exchange scan results, findings, waivers, risks, and metadata.
Uses main-de and main-en branches (checked out as framework/ and framework-en/) so German and English Antora component releases can evolve independently.
Master onboarding document explaining the WAF++ ecosystem, repository layout, two-branch documentation model, and central wafpass-result.json contract.
Defines the single JSON schema that all WAF++ components use to exchange scan results, findings, waivers, risks, and metadata.
Uses main-de and main-en branches (checked out as framework/ and framework-en/) so German and English Antora component releases can evolve independently.
Registre de décision lisible par machine
Tous les RFC et les ADR sont également disponibles en un seul fichier YAML que les outils, les scripts et les consommateurs en aval peuvent analyser. Le registre comprend des statuts, des catégories, des dépôts, des balises et des liens directs vers chaque enregistrement.
Qu'est-ce qu'un RFC?
Tous les changements n'ont pas besoin d'un RFC — seulement des changements importants. Utilisez le tableau ci-dessous pour décider.
| Modifier le type | Besoin de RFC ? | Processus |
|---|---|---|
| Nouveau pilier ou enlèvement d'un pilier | Oui | RFC → TSC vote → PR |
| Changements de modèle de notation (niveaux PASS, poids) | Oui | RFC → TSC vote → PR |
| Breaking change to controls schema or IDs | Oui | RFC → TSC vote → PR |
| Nouvelle proposition du Groupe de travail | Oui | RFC → paresseux consensus → charte publiée |
| Gouvernance ou changement de rôle | Oui | Supermajorité RFC → TSC |
| Nouveau contrôle (non brisant, additif) | Recommandation | PR avec lien de discussion · consensus paresseux |
| Docs rédaction, faute de frappe, traductions | Numéro | PR seulement |
| Contenu du site Web, billets de blog | Numéro | PR seulement |
Débit de statut RFC
Chaque RFC suit la même voie documentée — du premier projet à la décision close.
Comment écrire un bon RFC
Trois choses qui font la différence entre un RFC qui se déplace rapidement et un qui s'arrête.
Présenter le problème, pas la solution
Commencez par ce qui est cassé ou manquant — pas par ce que vous voulez construire. Les évaluateurs doivent convenir que le problème est réel avant de pouvoir évaluer votre solution proposée. Frapper le "pourquoi" avant le "quoi".
Afficher les compromis et les alternatives
Une forte RFC explique ce qui a été envisagé et pourquoi elle a été rejetée. Cela permet d'enregistrer les cycles de révision et donne un contexte aux futurs responsables lorsque l'auteur original a évolué.
Être précis sur l'impact
Qui est touché? Quels dépôts, dossiers ou marchés publics changent? Plus la portée est grande, plus la collectivité peut donner des commentaires utiles et plus le responsable peut prendre une décision.
Chaque décision commence par une conversation.
Choisissez un RFC ouvert, partagez votre point de vue, ou ouvrez un nouveau. Le cadre est construit en public et chaque voix compte.