RFC Tracker
Every significant change to WAF++ starts with a public Request for Comments or Architecture Decision Record. This page tracks every decision — from first draft to merge — so nothing is hidden.
All Requests for Comments
Filter by project and status, read the summaries, and follow the linked discussions and pull requests.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Framework — Open for review
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Framework — Drafts
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
Framework — Decided / implemented
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Core — Open for review
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Core — Decided / implemented
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
MCP — Open for review
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
Applies the radical dark-first design system to the remaining public pages so the whole site uses one consistent visual language.
MCP
Allow curated aliases for long auto-generated MCP tool names so LLMs can match them more naturally.
Add MCP Resource definitions for run://{run_id}, control://{id}, etc. to expose read-only data without multiple tool calls.
Extend auto-fix/classify with an apply step that records changes and supports rollback.
Add cursor-based pagination helpers so large runs do not blow MCP message size limits.
Add fix blocks to control YAMLs or a central provider registry so common assertions get default patches.
Framework
CI checks for dead xrefs, unregistered nav.adoc files, and control-schema consistency between YAML, AsciiDoc, and navigation.
Expand Sovereign definitions, evidence matrix, and create real overview/glossary pages for resources and wording.
Complete Agentic pillar maturity, evidence, glossary, and best-practice pages with examples.
Standardise module links, convert relative xrefs to module-prefixed xrefs, and clean Markdown links.
Finalise antora.yml registration, create pillar-security nav, update README/AGENTS for 8-module layout.
Align controls to 8 pillars, add Agentic, and extend control-schema.adoc.
Core
Unify fragmented test and coverage strategy across wafpass-core, server, and dashboard.
Define API maturity, backwards-compatibility rules, and versioning strategy for WAF++ PASS APIs.
Define a reliable source-snapshot ingestion contract so dashboard preview and auto-fix work consistently.
Reduce dashboard navigation fragmentation and add guided onboarding with role-based landing pages.
Make dashboard notifications actionable instead of passive text displays.
Expand the control-packs feature beyond admin-only uploads to a real marketplace with discovery and governance.
Tie maturity tiers to CI/CD policy gates so pipelines can block promotion below a target tier.
Framework
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
Framework
Establishes the core seven-pillar model as the foundational structure of WAF++. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars. Later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning.
Adds the standard open-source health files to the framework repository.
Introduces the Sovereign pillar as the 7th pillar of WAF++ with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar into modular best-practice pages and adds case-study content.
Defines a formal schema for WAF++ controls YAML files, enabling validation and tooling integration for the 83+ controls library.
Formalises the PASS scoring model as a normative specification for tier definitions, calculation rules, aggregation logic, and versioning contract.
Defines the approach for official WAF++ assessment tooling including the WAFPass CLI, server, dashboard, and web scorecard.
Introduces automated checks and release workflows for framework, wafpass-core, wafpass-server, and wafpass-dashboard repositories.
Adds the Agentic pillar as the 8th pillar of WAF++ with 10 initial controls, regulatory mappings, and bilingual documentation.
Core
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls as part of a full PASS assessment.
Releases WAFPass CLI v1.1.0, Server v1.1.0, and Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection.
Want to propose a change?
Open a GitHub Discussion using the RFC template. The community reviews it, maintainers decide — everything is documented and traceable.
Architecture Decision Records
ADRs capture the structural and cross-cutting decisions that shape the WAF++ ecosystem, repositories, and contracts.
Master onboarding document explaining the WAF++ ecosystem, repository layout, two-branch documentation model, and central wafpass-result.json contract.
Defines the single JSON schema that all WAF++ components use to exchange scan results, findings, waivers, risks, and metadata.
Uses main-de and main-en branches (checked out as framework/ and framework-en/) so German and English Antora component releases can evolve independently.
Master onboarding document explaining the WAF++ ecosystem, repository layout, two-branch documentation model, and central wafpass-result.json contract.
Defines the single JSON schema that all WAF++ components use to exchange scan results, findings, waivers, risks, and metadata.
Uses main-de and main-en branches (checked out as framework/ and framework-en/) so German and English Antora component releases can evolve independently.
Machine-readable decision registry
All RFCs and ADRs are also available as a single YAML file that tools, scripts, and downstream consumers can parse. The registry includes statuses, categories, repositories, tags, and direct links to every record.
What qualifies as an RFC?
Not every change needs an RFC — only significant ones. Use the table below to decide.
| Change type | RFC needed? | Process |
|---|---|---|
| New pillar or removal of a pillar | Yes | RFC → TSC vote → PR |
| Scoring model changes (PASS tiers, weights) | Yes | RFC → TSC vote → PR |
| Breaking change to controls schema or IDs | Yes | RFC → TSC vote → PR |
| New Working Group proposal | Yes | RFC → lazy consensus → charter published |
| Governance or role changes | Yes | RFC → TSC supermajority |
| New control (non-breaking, additive) | Recommended | PR with discussion link · lazy consensus |
| Docs wording, typo fixes, translations | No | PR only |
| Website content, blog posts | No | PR only |
RFC status flow
Every RFC follows the same documented path — from first draft to closed decision.
How to write a good RFC
Three things that make the difference between an RFC that moves fast and one that stalls.
State the problem, not the solution
Start with what is broken or missing — not with what you want to build. Reviewers need to agree that the problem is real before they can evaluate your proposed solution. Frame the "why" before the "what".
Show trade-offs and alternatives
A strong RFC explains what else was considered and why it was rejected. This saves review cycles and gives future maintainers context when the original author has moved on.
Be specific about impact
Who is affected? Which repositories, files, or public contracts change? The clearer the scope, the faster the community can give useful feedback and a maintainer can make a decision.
Every decision starts with a conversation.
Pick an open RFC, share your perspective, or open a new one. The framework is built in public and every voice counts.