RFC Tracker
Every significant change to WAF++ starts with a public Request for Comments. This page tracks every RFC — from first draft to merge — so every decision stays traceable.
All Requests for Comments
Filter by status, read the summaries, and follow the linked discussions and pull requests.
WAF++ Framework
Establishes the core seven-pillar model as the foundational structure of WAF++, covering Security, Reliability, Performance Efficiency, Cost Optimisation, Operational Excellence, Sustainability, and Developer Experience. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, including v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars: scope, rationale, and key assessment questions. Serves as the baseline for the controls library and was later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning (v1.0).
Adds the standard open-source health files to the framework repository: contribution guidelines, code of conduct (based on Contributor Covenant v2.1), and security policy.
Introduces the Sovereign pillar as the 7th pillar of WAF++, covering data sovereignty, compliance, and jurisdictional control. Ships with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar (Pillar 7) into modular best-practice pages, adds case-study content, and updates the Antora navigation to improve discoverability and readability.
Defines a formal schema for WAF++ controls YAML files, enabling consistent validation, tooling integration, and third-party consumption of the 83+ controls library. Shipped as part of the v1.0 release.
Formalises the PASS scoring model as a normative specification: tier definitions, calculation rules, aggregation logic, and versioning contract. Required for and shipped with the WAFPass CLI / Server v1.0.0 release.
Defines the approach for official WAF++ assessment tooling: the WAFPass CLI, server, dashboard, and web scorecard that consume the controls library and produce a PASS score report. Shipped with WAFPass v1.0.0 and extended in v1.1.0.
Introduces automated checks and release workflows for the framework, pass, wafpass-server, and wafpass-dashboard repositories: Antora build validation, controls YAML linting, release automation, and link checking on every pull request.
Adds the Agentic pillar (WAF-AGN) as the 8th pillar of WAF++, covering autonomous AI agent governance. Ships with 10 initial controls (WAF-AGN-010 through WAF-AGN-100), regulatory mappings, and English and German documentation. Brings the framework to 8 pillars and 83+ controls.
Applies the radical dark-first design system to the remaining public pages (RFC tracker, team, roles, about, press, install) so the whole site uses one consistent visual language and accessibility patterns.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly from a PASS report or dashboard.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
- CI-Check für tote xrefs - CI-Check für unregistrierte nav.adoc - Linter für Control-Schema-Konsistenz (YAML ↔ .adoc ↔ Nav)
- Sovereign-Definition/Scope/Principles auf Peer-Level erweitern - Sovereign-Evidence-Matrix - resources/index.adoc und wording/index.adoc als echte Übersicht/Glossar
- maturity.adoc anlegen - evidence.adoc auf Security-Vorbild erweitern - glossary.adoc vervollständigen - alle agent-design/* und best-practices/* mit Beispielen ausschreiben
WIP - Homepage + pillars/index.adoc auf einheitliche Modul-Links umstellen - 64 relative ../-xrefs in modulpräfix-xrefs wandeln - Markdown-Links in bp-runbooks.adoc bereinigen
WIP - antora.yml: alle 10 Nav-Dateien registrieren, start_page setzen - pillar-security/nav.adoc anlegen - README.md + AGENTS.md auf 8-Modul-Layout aktualisieren - Entscheidung: efficiancy umbenennen ja/nein
- 8 Säulen, korrekte Nummerierung - Agentic aufnehmen - WAF-COST-001 entweder in 010 umbenennen oder offiziell als “Pre-010” etablieren - control-schema.adoc auf AGN erweitern
WAF++ Framework — Open for review
Applies the radical dark-first design system to the remaining public pages (RFC tracker, team, roles, about, press, install) so the whole site uses one consistent visual language and accessibility patterns.
- CI-Check für tote xrefs - CI-Check für unregistrierte nav.adoc - Linter für Control-Schema-Konsistenz (YAML ↔ .adoc ↔ Nav)
- Sovereign-Definition/Scope/Principles auf Peer-Level erweitern - Sovereign-Evidence-Matrix - resources/index.adoc und wording/index.adoc als echte Übersicht/Glossar
- maturity.adoc anlegen - evidence.adoc auf Security-Vorbild erweitern - glossary.adoc vervollständigen - alle agent-design/* und best-practices/* mit Beispielen ausschreiben
WIP - Homepage + pillars/index.adoc auf einheitliche Modul-Links umstellen - 64 relative ../-xrefs in modulpräfix-xrefs wandeln - Markdown-Links in bp-runbooks.adoc bereinigen
WIP - antora.yml: alle 10 Nav-Dateien registrieren, start_page setzen - pillar-security/nav.adoc anlegen - README.md + AGENTS.md auf 8-Modul-Layout aktualisieren - Entscheidung: efficiancy umbenennen ja/nein
- 8 Säulen, korrekte Nummerierung - Agentic aufnehmen - WAF-COST-001 entweder in 010 umbenennen oder offiziell als “Pre-010” etablieren - control-schema.adoc auf AGN erweitern
WAF++ Framework — Drafts
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly from a PASS report or dashboard.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
WAF++ Framework — Decided / implemented
Establishes the core seven-pillar model as the foundational structure of WAF++, covering Security, Reliability, Performance Efficiency, Cost Optimisation, Operational Excellence, Sustainability, and Developer Experience. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, including v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars: scope, rationale, and key assessment questions. Serves as the baseline for the controls library and was later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning (v1.0).
Adds the standard open-source health files to the framework repository: contribution guidelines, code of conduct (based on Contributor Covenant v2.1), and security policy.
Introduces the Sovereign pillar as the 7th pillar of WAF++, covering data sovereignty, compliance, and jurisdictional control. Ships with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar (Pillar 7) into modular best-practice pages, adds case-study content, and updates the Antora navigation to improve discoverability and readability.
Defines a formal schema for WAF++ controls YAML files, enabling consistent validation, tooling integration, and third-party consumption of the 83+ controls library. Shipped as part of the v1.0 release.
Formalises the PASS scoring model as a normative specification: tier definitions, calculation rules, aggregation logic, and versioning contract. Required for and shipped with the WAFPass CLI / Server v1.0.0 release.
Defines the approach for official WAF++ assessment tooling: the WAFPass CLI, server, dashboard, and web scorecard that consume the controls library and produce a PASS score report. Shipped with WAFPass v1.0.0 and extended in v1.1.0.
Introduces automated checks and release workflows for the framework, pass, wafpass-server, and wafpass-dashboard repositories: Antora build validation, controls YAML linting, release automation, and link checking on every pull request.
Adds the Agentic pillar (WAF-AGN) as the 8th pillar of WAF++, covering autonomous AI agent governance. Ships with 10 initial controls (WAF-AGN-010 through WAF-AGN-100), regulatory mappings, and English and German documentation. Brings the framework to 8 pillars and 83+ controls.
WAFPass
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls (WAF-AGN-*) as part of a full PASS assessment. Merged ahead of the WAFPass v1.1.0 release.
Releases WAFPass CLI v1.1.0, WAFPass Server v1.1.0, and WAFPass Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection. Aligned with framework v1.1 and the 83+ controls library.
📋 Context & Problem Statement The WAF++ PASS platform code and test coverage are highly fragmented across three distinct repositories: * pass (Python CLI / pytest): Contains ~150 unit tests, localized auto-fix tests, and a single golden-file E2E fixture, but…
Context and Goals The WAF++ PASS product is moving through an API maturity push. Several parallel efforts already exist or are planned: * Maturity enforcement: Achievements, leaderboard, project passports, and tier rules. * Action-oriented notifications:…
Context Dashboard local preview and auto-fix features rely on Run.source_snapshot, a JSONB map of relative IaC file paths to raw file contents. Today, this snapshot is only captured when the CLI is explicitly invoked with both --output json, --upload-source,…
📋 Context & Problem Statement The dashboard currently exposes 46 pages through a bloated, 700px-wide mega-menu in TopNavigation.tsx. The navigation model is highly fragmented; buildNavSections() is duplicated across Sidebar.tsx and MobileMenu.tsx, leading to…
📋 Context & Problem Statement The dashboard currently features a NotificationBell and a dedicated NotificationsPage, but notifications are entirely passive—they only display text titles, messages, and categories with no trailing interactive…
📋 Context & Problem Statement The dashboard currently features a ControlsPacksPage and the server exposes /control-packs endpoints, but functionality is restricted to admin-only uploads and basic catalogue syncs[cite: 1]. Auditors have highlighted that the…
📋 Context & Problem Statement Currently, the maturity journey is purely a dashboard visualization and local settings concept. Auditors have flagged a critical gap: there are no policy gates tying maturity tiers to CI/CD pipeline behavior (e.g., preventing a…
WAFPass — Open for review
📋 Context & Problem Statement The WAF++ PASS platform code and test coverage are highly fragmented across three distinct repositories: * pass (Python CLI / pytest): Contains ~150 unit tests, localized auto-fix tests, and a single golden-file E2E fixture, but…
Context and Goals The WAF++ PASS product is moving through an API maturity push. Several parallel efforts already exist or are planned: * Maturity enforcement: Achievements, leaderboard, project passports, and tier rules. * Action-oriented notifications:…
Context Dashboard local preview and auto-fix features rely on Run.source_snapshot, a JSONB map of relative IaC file paths to raw file contents. Today, this snapshot is only captured when the CLI is explicitly invoked with both --output json, --upload-source,…
📋 Context & Problem Statement The dashboard currently exposes 46 pages through a bloated, 700px-wide mega-menu in TopNavigation.tsx. The navigation model is highly fragmented; buildNavSections() is duplicated across Sidebar.tsx and MobileMenu.tsx, leading to…
📋 Context & Problem Statement The dashboard currently features a NotificationBell and a dedicated NotificationsPage, but notifications are entirely passive—they only display text titles, messages, and categories with no trailing interactive…
📋 Context & Problem Statement The dashboard currently features a ControlsPacksPage and the server exposes /control-packs endpoints, but functionality is restricted to admin-only uploads and basic catalogue syncs[cite: 1]. Auditors have highlighted that the…
📋 Context & Problem Statement Currently, the maturity journey is purely a dashboard visualization and local settings concept. Auditors have flagged a critical gap: there are no policy gates tying maturity tiers to CI/CD pipeline behavior (e.g., preventing a…
WAFPass — Decided / implemented
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls (WAF-AGN-*) as part of a full PASS assessment. Merged ahead of the WAFPass v1.1.0 release.
Releases WAFPass CLI v1.1.0, WAFPass Server v1.1.0, and WAFPass Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection. Aligned with framework v1.1 and the 83+ controls library.
WAFPass MCP
Problem: Tool names are long and auto-generated (api_auto_fix_classify_api_v1_auto_fix_classify_post). The LLM has to match long operation IDs, and the descriptions are now long because they embed role/category. Proposal: Allow curated aliases for the…
Problem: The MCP only exposes tools. Users cannot ask "what controls failed in this run?" or "show me the source snapshot" without making multiple tool calls and stitching the JSON together. Proposal: Add MCP Resource definitions for run://{run_id},…
Problem: Users can classify and preview patches, but applying them requires a separate auto-fix call with a filesystem path. There is no safe "apply this classify result to this run and record what changed." Proposal: Extend /api/v1/auto-fix/classify with an…
Problem: Runs with thousands of findings return huge JSON blobs. The current proxy loads everything into one TextContent block, which is slow and can hit MCP message size limits. Proposal: Add cursor-based pagination helpers to the bridge: - For list…
Problem: auto-fix/classify returns zero active patches for many controls because assertions like not_empty, attribute_exists, is_true have no registered default value. Proposal: Add a fix block to control YAMLs (or a central provider registry) that declares:…
WAFPass MCP — Open for review
Problem: Tool names are long and auto-generated (api_auto_fix_classify_api_v1_auto_fix_classify_post). The LLM has to match long operation IDs, and the descriptions are now long because they embed role/category. Proposal: Allow curated aliases for the…
Problem: The MCP only exposes tools. Users cannot ask "what controls failed in this run?" or "show me the source snapshot" without making multiple tool calls and stitching the JSON together. Proposal: Add MCP Resource definitions for run://{run_id},…
Problem: Users can classify and preview patches, but applying them requires a separate auto-fix call with a filesystem path. There is no safe "apply this classify result to this run and record what changed." Proposal: Extend /api/v1/auto-fix/classify with an…
Problem: Runs with thousands of findings return huge JSON blobs. The current proxy loads everything into one TextContent block, which is slow and can hit MCP message size limits. Proposal: Add cursor-based pagination helpers to the bridge: - For list…
Problem: auto-fix/classify returns zero active patches for many controls because assertions like not_empty, attribute_exists, is_true have no registered default value. Proposal: Add a fix block to control YAMLs (or a central provider registry) that declares:…
WAF++ Framework
Establishes the core seven-pillar model as the foundational structure of WAF++, covering Security, Reliability, Performance Efficiency, Cost Optimisation, Operational Excellence, Sustainability, and Developer Experience. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, including v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars: scope, rationale, and key assessment questions. Serves as the baseline for the controls library and was later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning (v1.0).
Adds the standard open-source health files to the framework repository: contribution guidelines, code of conduct (based on Contributor Covenant v2.1), and security policy.
Introduces the Sovereign pillar as the 7th pillar of WAF++, covering data sovereignty, compliance, and jurisdictional control. Ships with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar (Pillar 7) into modular best-practice pages, adds case-study content, and updates the Antora navigation to improve discoverability and readability.
Defines a formal schema for WAF++ controls YAML files, enabling consistent validation, tooling integration, and third-party consumption of the 83+ controls library. Shipped as part of the v1.0 release.
Formalises the PASS scoring model as a normative specification: tier definitions, calculation rules, aggregation logic, and versioning contract. Required for and shipped with the WAFPass CLI / Server v1.0.0 release.
Defines the approach for official WAF++ assessment tooling: the WAFPass CLI, server, dashboard, and web scorecard that consume the controls library and produce a PASS score report. Shipped with WAFPass v1.0.0 and extended in v1.1.0.
Introduces automated checks and release workflows for the framework, pass, wafpass-server, and wafpass-dashboard repositories: Antora build validation, controls YAML linting, release automation, and link checking on every pull request.
Adds the Agentic pillar (WAF-AGN) as the 8th pillar of WAF++, covering autonomous AI agent governance. Ships with 10 initial controls (WAF-AGN-010 through WAF-AGN-100), regulatory mappings, and English and German documentation. Brings the framework to 8 pillars and 83+ controls.
Applies the radical dark-first design system to the remaining public pages (RFC tracker, team, roles, about, press, install) so the whole site uses one consistent visual language and accessibility patterns.
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly from a PASS report or dashboard.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
- CI-Check für tote xrefs - CI-Check für unregistrierte nav.adoc - Linter für Control-Schema-Konsistenz (YAML ↔ .adoc ↔ Nav)
- Sovereign-Definition/Scope/Principles auf Peer-Level erweitern - Sovereign-Evidence-Matrix - resources/index.adoc und wording/index.adoc als echte Übersicht/Glossar
- maturity.adoc anlegen - evidence.adoc auf Security-Vorbild erweitern - glossary.adoc vervollständigen - alle agent-design/* und best-practices/* mit Beispielen ausschreiben
WIP - Homepage + pillars/index.adoc auf einheitliche Modul-Links umstellen - 64 relative ../-xrefs in modulpräfix-xrefs wandeln - Markdown-Links in bp-runbooks.adoc bereinigen
WIP - antora.yml: alle 10 Nav-Dateien registrieren, start_page setzen - pillar-security/nav.adoc anlegen - README.md + AGENTS.md auf 8-Modul-Layout aktualisieren - Entscheidung: efficiancy umbenennen ja/nein
- 8 Säulen, korrekte Nummerierung - Agentic aufnehmen - WAF-COST-001 entweder in 010 umbenennen oder offiziell als “Pre-010” etablieren - control-schema.adoc auf AGN erweitern
WAFPass
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls (WAF-AGN-*) as part of a full PASS assessment. Merged ahead of the WAFPass v1.1.0 release.
Releases WAFPass CLI v1.1.0, WAFPass Server v1.1.0, and WAFPass Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection. Aligned with framework v1.1 and the 83+ controls library.
📋 Context & Problem Statement The WAF++ PASS platform code and test coverage are highly fragmented across three distinct repositories: * pass (Python CLI / pytest): Contains ~150 unit tests, localized auto-fix tests, and a single golden-file E2E fixture, but…
Context and Goals The WAF++ PASS product is moving through an API maturity push. Several parallel efforts already exist or are planned: * Maturity enforcement: Achievements, leaderboard, project passports, and tier rules. * Action-oriented notifications:…
Context Dashboard local preview and auto-fix features rely on Run.source_snapshot, a JSONB map of relative IaC file paths to raw file contents. Today, this snapshot is only captured when the CLI is explicitly invoked with both --output json, --upload-source,…
📋 Context & Problem Statement The dashboard currently exposes 46 pages through a bloated, 700px-wide mega-menu in TopNavigation.tsx. The navigation model is highly fragmented; buildNavSections() is duplicated across Sidebar.tsx and MobileMenu.tsx, leading to…
📋 Context & Problem Statement The dashboard currently features a NotificationBell and a dedicated NotificationsPage, but notifications are entirely passive—they only display text titles, messages, and categories with no trailing interactive…
📋 Context & Problem Statement The dashboard currently features a ControlsPacksPage and the server exposes /control-packs endpoints, but functionality is restricted to admin-only uploads and basic catalogue syncs[cite: 1]. Auditors have highlighted that the…
📋 Context & Problem Statement Currently, the maturity journey is purely a dashboard visualization and local settings concept. Auditors have flagged a critical gap: there are no policy gates tying maturity tiers to CI/CD pipeline behavior (e.g., preventing a…
WAFPass Action
WAFPass MCP
Problem: Tool names are long and auto-generated (api_auto_fix_classify_api_v1_auto_fix_classify_post). The LLM has to match long operation IDs, and the descriptions are now long because they embed role/category. Proposal: Allow curated aliases for the…
Problem: The MCP only exposes tools. Users cannot ask "what controls failed in this run?" or "show me the source snapshot" without making multiple tool calls and stitching the JSON together. Proposal: Add MCP Resource definitions for run://{run_id},…
Problem: Users can classify and preview patches, but applying them requires a separate auto-fix call with a filesystem path. There is no safe "apply this classify result to this run and record what changed." Proposal: Extend /api/v1/auto-fix/classify with an…
Problem: Runs with thousands of findings return huge JSON blobs. The current proxy loads everything into one TextContent block, which is slow and can hit MCP message size limits. Proposal: Add cursor-based pagination helpers to the bridge: - For list…
Problem: auto-fix/classify returns zero active patches for many controls because assertions like not_empty, attribute_exists, is_true have no registered default value. Proposal: Add a fix block to control YAMLs (or a central provider registry) that declares:…
WAF++ Framework
Applies the radical dark-first design system to the remaining public pages (RFC tracker, team, roles, about, press, install) so the whole site uses one consistent visual language and accessibility patterns.
- CI-Check für tote xrefs - CI-Check für unregistrierte nav.adoc - Linter für Control-Schema-Konsistenz (YAML ↔ .adoc ↔ Nav)
- Sovereign-Definition/Scope/Principles auf Peer-Level erweitern - Sovereign-Evidence-Matrix - resources/index.adoc und wording/index.adoc als echte Übersicht/Glossar
- maturity.adoc anlegen - evidence.adoc auf Security-Vorbild erweitern - glossary.adoc vervollständigen - alle agent-design/* und best-practices/* mit Beispielen ausschreiben
WIP - Homepage + pillars/index.adoc auf einheitliche Modul-Links umstellen - 64 relative ../-xrefs in modulpräfix-xrefs wandeln - Markdown-Links in bp-runbooks.adoc bereinigen
WIP - antora.yml: alle 10 Nav-Dateien registrieren, start_page setzen - pillar-security/nav.adoc anlegen - README.md + AGENTS.md auf 8-Modul-Layout aktualisieren - Entscheidung: efficiancy umbenennen ja/nein
- 8 Säulen, korrekte Nummerierung - Agentic aufnehmen - WAF-COST-001 entweder in 010 umbenennen oder offiziell als “Pre-010” etablieren - control-schema.adoc auf AGN erweitern
WAFPass MCP
Problem: Tool names are long and auto-generated (api_auto_fix_classify_api_v1_auto_fix_classify_post). The LLM has to match long operation IDs, and the descriptions are now long because they embed role/category. Proposal: Allow curated aliases for the…
Problem: The MCP only exposes tools. Users cannot ask "what controls failed in this run?" or "show me the source snapshot" without making multiple tool calls and stitching the JSON together. Proposal: Add MCP Resource definitions for run://{run_id},…
Problem: Users can classify and preview patches, but applying them requires a separate auto-fix call with a filesystem path. There is no safe "apply this classify result to this run and record what changed." Proposal: Extend /api/v1/auto-fix/classify with an…
Problem: Runs with thousands of findings return huge JSON blobs. The current proxy loads everything into one TextContent block, which is slow and can hit MCP message size limits. Proposal: Add cursor-based pagination helpers to the bridge: - For list…
Problem: auto-fix/classify returns zero active patches for many controls because assertions like not_empty, attribute_exists, is_true have no registered default value. Proposal: Add a fix block to control YAMLs (or a central provider registry) that declares:…
WAFPass
📋 Context & Problem Statement The WAF++ PASS platform code and test coverage are highly fragmented across three distinct repositories: * pass (Python CLI / pytest): Contains ~150 unit tests, localized auto-fix tests, and a single golden-file E2E fixture, but…
Context and Goals The WAF++ PASS product is moving through an API maturity push. Several parallel efforts already exist or are planned: * Maturity enforcement: Achievements, leaderboard, project passports, and tier rules. * Action-oriented notifications:…
Context Dashboard local preview and auto-fix features rely on Run.source_snapshot, a JSONB map of relative IaC file paths to raw file contents. Today, this snapshot is only captured when the CLI is explicitly invoked with both --output json, --upload-source,…
📋 Context & Problem Statement The dashboard currently exposes 46 pages through a bloated, 700px-wide mega-menu in TopNavigation.tsx. The navigation model is highly fragmented; buildNavSections() is duplicated across Sidebar.tsx and MobileMenu.tsx, leading to…
📋 Context & Problem Statement The dashboard currently features a NotificationBell and a dedicated NotificationsPage, but notifications are entirely passive—they only display text titles, messages, and categories with no trailing interactive…
📋 Context & Problem Statement The dashboard currently features a ControlsPacksPage and the server exposes /control-packs endpoints, but functionality is restricted to admin-only uploads and basic catalogue syncs[cite: 1]. Auditors have highlighted that the…
📋 Context & Problem Statement Currently, the maturity journey is purely a dashboard visualization and local settings concept. Auditors have flagged a critical gap: there are no policy gates tying maturity tiers to CI/CD pipeline behavior (e.g., preventing a…
WAF++ Framework
Standardises machine- and human-readable remediation guidance for every WAF++ control so operators can act on findings directly from a PASS report or dashboard.
Defines how WAFPass detection and controls will be extended to cover Azure, GCP, and other cloud providers while keeping the framework cloud-agnostic.
WAF++ Framework
Establishes the core seven-pillar model as the foundational structure of WAF++, covering Security, Reliability, Performance Efficiency, Cost Optimisation, Operational Excellence, Sustainability, and Developer Experience. Extended to eight pillars by RFC-0012.
Defines the public roadmap for 2026 covering Q1–Q4 milestones, including v1.0 target, pilot programme, and foundation readiness goals.
Adds the initial content definition for each of the 7 pillars: scope, rationale, and key assessment questions. Serves as the baseline for the controls library and was later extended to cover the 8th Agentic pillar (RFC-0012).
Migrates all framework documentation from Markdown to AsciiDoc and establishes Antora as the documentation build system with component versioning (v1.0).
Adds the standard open-source health files to the framework repository: contribution guidelines, code of conduct (based on Contributor Covenant v2.1), and security policy.
Introduces the Sovereign pillar as the 7th pillar of WAF++, covering data sovereignty, compliance, and jurisdictional control. Ships with 10 initial controls (WAF-SOV-010 through WAF-SOV-100).
Restructures the Governance pillar (Pillar 7) into modular best-practice pages, adds case-study content, and updates the Antora navigation to improve discoverability and readability.
Defines a formal schema for WAF++ controls YAML files, enabling consistent validation, tooling integration, and third-party consumption of the 83+ controls library. Shipped as part of the v1.0 release.
Formalises the PASS scoring model as a normative specification: tier definitions, calculation rules, aggregation logic, and versioning contract. Required for and shipped with the WAFPass CLI / Server v1.0.0 release.
Defines the approach for official WAF++ assessment tooling: the WAFPass CLI, server, dashboard, and web scorecard that consume the controls library and produce a PASS score report. Shipped with WAFPass v1.0.0 and extended in v1.1.0.
Introduces automated checks and release workflows for the framework, pass, wafpass-server, and wafpass-dashboard repositories: Antora build validation, controls YAML linting, release automation, and link checking on every pull request.
Adds the Agentic pillar (WAF-AGN) as the 8th pillar of WAF++, covering autonomous AI agent governance. Ships with 10 initial controls (WAF-AGN-010 through WAF-AGN-100), regulatory mappings, and English and German documentation. Brings the framework to 8 pillars and 83+ controls.
WAFPass
Extends WAFPass CLI, server, and dashboard to evaluate the Agentic pillar controls (WAF-AGN-*) as part of a full PASS assessment. Merged ahead of the WAFPass v1.1.0 release.
Releases WAFPass CLI v1.1.0, WAFPass Server v1.1.0, and WAFPass Dashboard v1.1.0 with Pillar-8 Agentic support, detection fixes, and SINA Cloud region detection. Aligned with framework v1.1 and the 83+ controls library.
Want to propose a change?
Open a GitHub Discussion using the RFC template. The community reviews it, maintainers decide — everything is documented and traceable.
What qualifies as an RFC?
Not every change needs an RFC — only significant ones. Use the table below to decide.
| Change type | RFC needed? | Process |
|---|---|---|
| New pillar or removal of a pillar | Yes | RFC → TSC vote → PR |
| Scoring model changes (PASS tiers, weights) | Yes | RFC → TSC vote → PR |
| Breaking change to controls schema or IDs | Yes | RFC → TSC vote → PR |
| New Working Group proposal | Yes | RFC → lazy consensus → charter published |
| Governance or role changes | Yes | RFC → TSC supermajority |
| New control (non-breaking, additive) | Recommended | PR with discussion link · lazy consensus |
| Docs wording, typo fixes, translations | No | PR only |
| Website content, blog posts | No | PR only |
RFC status flow
Every RFC follows the same documented path — from first draft to closed decision.
How to write a good RFC
Three things that make the difference between an RFC that moves fast and one that stalls.
State the problem, not the solution
Start with what is broken or missing — not with what you want to build. Reviewers need to agree that the problem is real before they can evaluate your proposed solution. Frame the "why" before the "what".
Document trade-offs explicitly
Every decision has costs. Name them. What gets worse? What are the alternatives you considered? An RFC that acknowledges trade-offs earns trust faster than one that only sells the upside.
Link to evidence
Point to real examples — issues, incidents, prior discussions, or production patterns. Evidence turns opinions into traceable facts and dramatically shortens the review cycle.
Start an RFC today.
Open a discussion on GitHub, follow the template, and let the process do the rest. No prior approval needed — just a clear problem statement.