Transparent priorities from 2026 to 2030 — technically grounded, community-driven, and foundation-ready.
WAF++ Framework 1.0 and WAFPass 1.0 launched on 12 May 2026 on the pre-eve of Cloud Native Conference DE. All eight pillars are stable, the controls library is locked, the PASS scoring model is finalized, and WAFPass is published on PyPI.
All 8 pillars fully documented with locked control sets, PASS scoring model v1.0, regulatory mapping (GDPR, BSI C5, ISO 27001, SOC 2, HIPAA, NIS2), cross-pillar reference architecture, and stable Antora documentation at waf2p.dev/docs/wafpp/1.0.1-en/.
Full three-component stack: CLI (wafpass-core on PyPI), wafpass-dashboard (22+ pages, SSO, evidence packages, gap analysis), and wafpass-server (FastAPI/PostgreSQL, OIDC/SAML2, API keys, 14 migrations). Install: pip install wafpass-core.
Security pillar (Pillar 1) fully finalized for v1.0.0. All WAF-SEC, WAF-COST, WAF-PERF, WAF-REL, WAF-OPS, WAF-SUS, and WAF-SOV controls are stable and covered by WAFPass tooling. Agentic (Pillar 8) released in v1.1.
After the v1.0 launch, WAF++ shifts into full operationalization — community pilots, governance finalization, and complete pillar coverage.
A pilot project to validate the building-block approach in multi-cloud scenarios, along with finalizing the governance and community model.
With all eight pillars documented ahead of schedule, the focus shifts to hardening the Security pillar, scoring model finalization, and growing the early adopter ecosystem.
Long-term milestones that establish WAF++ as a foundational, community-owned standard for cloud architecture quality.
Formal election of a TSC to provide long-term steering for project development — independent of any founding members.
Full alignment with CNCF project guidelines and best practices — governance, lifecycle, and community model modelled after proven open-source foundations.
Enable formal auditability according to the WAF++ standard — criteria are traceable, decisions are documented, and outcomes are reproducible.
Introduce a WAF++ certification program for teams and organizations — a verifiable, community-backed signal of architecture quality.
Founders transition into advisory roles — operational decisions are fully owned by the community, TSC, and Working Groups.
Roadmap priorities are discussed openly in GitHub Discussions and decided via RFCs. Every community member can propose, challenge, or vote on what comes next.
WAF++ now includes an eighth pillar — AI-assisted architecture reviews, autonomous remediation, and policy-aware agents for secure cloud operations.
