RFCRastreador
Cada mudança significativa para WAF++ começa com um pedido público de comentários ou registro de decisão de arquitetura. Esta página rastreia todas as decisões — desde o primeiro rascunho até a fusão — de modo que nada está escondido.
Todos os pedidos de comentários
Filtrar por projeto e status, ler os resumos, e seguir as discussões vinculadas e puxar solicitações.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Framework— Aberto para revisão
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Framework— Projectos
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
Framework— Decidido/implementado
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Core— Aberto para revisão
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Core— Decidido/implementado
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
MCP— Aberto para revisão
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
Applies the radical dark-first design system to the remaining public pages so the whole site uses one consistent visual language.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Core
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Framework
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Queres propor uma mudança?
Abra uma Discussão do GitHub usando o modelo RFC. A comunidade o revisa, os mantenedores decidem — tudo é documentado e rastreável.
Registos de decisão de arquitectura
As RAMs captam as decisões estruturais e transversais que moldam o ecossistema, repositórios e contratos WAF++.
Master onboarding document explaining the WAF++ ecosystem, repository layout, two-branch documentation model, and central wafpass-result.json contract.
Defines the single JSON schema that all WAF++ components use to exchange scan results, findings, waivers, risks, and metadata.
Uses main-de and main-en branches (checked out as framework/ and framework-en/) so German and English Antora component releases can evolve independently.
Master onboarding document explaining the WAF++ ecosystem, repository layout, two-branch documentation model, and central wafpass-result.json contract.
Defines the single JSON schema that all WAF++ components use to exchange scan results, findings, waivers, risks, and metadata.
Uses main-de and main-en branches (checked out as framework/ and framework-en/) so German and English Antora component releases can evolve independently.
Registo de decisão legível por máquina
Todos os RFCs e RAMs também estão disponíveis como um único arquivo YAML que ferramentas, scripts e consumidores a jusante podem analisar. O registro inclui status, categorias, repositórios, tags e links diretos para cada registro.
O que se qualifica como RFC?
Nem todas as mudanças precisam de uma RFC — apenas significativas. Use a tabela abaixo para decidir.
| Mudar o tipo | O RFC precisava? | Processo |
|---|---|---|
| Novo pilar ou remoção de um pilar | Sim. | RFC → TSC votar → PR |
| Variações do modelo de pontuação (níveis PASS, pesos) | Sim. | RFC → TSC votar → PR |
| Quebrar a alteração para controlar o esquema ou IDs | Sim. | RFC → TSC votar → PR |
| Nova proposta do Grupo de Trabalho | Sim. | RFC → consenso preguiçoso → carta publicada |
| Governação ou mudanças de papel | Sim. | Supermajoridade RFC → TSC |
| Novo controle (não quebra, aditivo) | Recomendado | PR com a ligação de discussão · consenso preguiçoso |
| Texto de documentos, correções de erros, traduções | Não | Apenas RP |
| Conteúdo do site, posts do blog | Não | Apenas RP |
Fluxo de estado RFC
Cada RFC segue o mesmo caminho documentado — desde o primeiro projeto até a decisão final.
Como escrever um bom RFC
Três coisas que fazem a diferença entre uma RFC que se move rápido e uma que para.
Indicar o problema, não a solução
Comece com o que está quebrado ou faltando — não com o que deseja construir. Os revisores precisam concordar que o problema é real antes que eles possam avaliar sua solução proposta. Emoldurar o porquê antes do quê.
Mostrar trade-offs e alternativas
Um RFC forte explica o que mais foi considerado e por que foi rejeitado. Isso salva ciclos de revisão e dá contexto aos futuros mantenedores quando o autor original seguir em frente.
Seja específico sobre o impacto
Quem é afectado? Quais repositórios, arquivos ou contratos públicos mudam? Quanto mais claro o escopo, mais rápido a comunidade pode dar feedback útil e um mantenedor pode tomar uma decisão.
Cada decisão começa com uma conversa.
Escolha um RFC aberto, compartilhe sua perspectiva ou abra um novo. A estrutura é construída em público e cada voz conta.