RFCTracker
Każda znacząca zmiana WAF++ rozpoczyna się od publicznej prośby o komentarze lub Architecture Decision Record. Ta strona śledzi każdą decyzję - od pierwszego szkicu do połączenia - więc nic nie jest ukryte.
Wszystkie wnioski o uwagi
Filtruj według projektu i statusu, przeczytaj podsumowania, a następnie śledzić powiązane dyskusje i wyciągnąć wnioski.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Framework- Otwarte do przeglądu
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Framework- Projekty
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
Framework- Decyzja / realizacja
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Core- Otwarte do przeglądu
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Core- Decyzja / realizacja
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
MCP- Otwarte do przeglądu
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
Applies the radical dark-first design system to the remaining public pages so the whole site uses one consistent visual language.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Core
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Framework
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Chcesz zaproponować zmianę?
Otwórz dyskusję o GitHub używając szablonu RFC. Społeczność to ocenia, opiekunowie decydują - wszystko jest udokumentowane i identyfikowalne.
Architektura Decision Records
Działania niepożądane uwzględniają decyzje strukturalne i przekrojowe, które kształtują ekosystem WAF++, repozytoria i kontrakty.
Master onboarding document explaining the WAF++ ecosystem, repository layout, two-branch documentation model, and central wafpass-result.json contract.
Defines the single JSON schema that all WAF++ components use to exchange scan results, findings, waivers, risks, and metadata.
Uses main-de and main-en branches (checked out as framework/ and framework-en/) so German and English Antora component releases can evolve independently.
Master onboarding document explaining the WAF++ ecosystem, repository layout, two-branch documentation model, and central wafpass-result.json contract.
Defines the single JSON schema that all WAF++ components use to exchange scan results, findings, waivers, risks, and metadata.
Uses main-de and main-en branches (checked out as framework/ and framework-en/) so German and English Antora component releases can evolve independently.
Rejestr decyzji do odczytu maszynowego
Wszystkie RFC i ADR są również dostępne jako pojedynczy plik YAML, który narzędzia, skrypty i konsumenci niższego szczebla mogą analizować. Rejestr zawiera statusy, kategorie, repozytoria, znaczniki i bezpośrednie linki do każdego rekordu.
Co kwalifikuje się jako RFC?
Nie każda zmiana wymaga RFC - tylko znaczące. Użyj poniższej tabeli, aby zdecydować.
| Typ zmiany | RFC potrzebowało? | Proces |
|---|---|---|
| Nowy filar lub usunięcie filaru | Tak. | RFC → TSC głosuje → PR |
| Zmiany modelu punktowego (poziomy PASS, wagi) | Tak. | RFC → TSC głosuje → PR |
| Przerwanie zmiany schematów kontroli lub identyfikatorów | Tak. | RFC → TSC głosuje → PR |
| Nowy wniosek grupy roboczej | Tak. | RFC → leniwy konsensus → karta opublikowana |
| Zmiany w zarządzaniu lub roli | Tak. | RFC → superwiększość TSC |
| Nowa kontrola (nieniszcząca, dodatek) | Zalecane | PR z linkiem dyskusyjnym · leniwy konsensus |
| Teksty dokumentów, poprawki literackie, tłumaczenia | Nie. | Tylko PR |
| Zawartość stron internetowych, blogi | Nie. | Tylko PR |
Przepływ stanu RFC
Każdy RFC podąża tą samą udokumentowaną ścieżką - od pierwszego projektu do decyzji zamkniętej.
Jak napisać dobry RFC
Trzy rzeczy, które czynią różnicę między RFC, który porusza się szybko i jeden, który zatrzymuje.
Podaj problem, a nie rozwiązanie
Zacznij od tego, co jest zepsute lub brakujące - nie od tego, co chcesz zbudować. Recenzenci muszą się zgodzić, że problem jest prawdziwy, zanim będą mogli ocenić proponowane rozwiązanie. Wrabiaj "dlaczego" przed "co".
Pokaż oferty handlowe i alternatywy
Silny RFC wyjaśnia, co jeszcze zostało rozważone i dlaczego zostało odrzucone. To oszczędza cykle przeglądów i daje kontekst przyszłych opiekunów, gdy oryginalny autor przeniósł się dalej.
Określić wpływ
Kto ucierpiał? Które repozytoria, pliki czy zamówienia publiczne się zmieniają? Im jaśniejszy zakres, tym szybciej społeczność może udzielić przydatnych informacji zwrotnych, a opiekun może podjąć decyzję.
Każda decyzja zaczyna się od rozmowy.
Wybierz otwarty RFC, podziel się perspektywą lub otwórz nowy. Ramy są budowane publicznie i każdy głos się liczy.