Status

Where LocumView stands.

Generated from the project roadmap each time the site is built, so it matches the repository. Done means built and verified; Built means working with open items; In progress means started and not shipped.

Roadmap status as of 2026-10-22 · commit d2fd2aa · Source: ROADMAP.md in the repository

5 of 5 done

Version one

Version one is complete when all five items are done. The scope is locked; changing it takes a new architecture decision.

Done
One RHEL 10 desktop built as a bootc image from a Containerfile and provisioned on the reference hypervisor (libvirt) from a clean clone, with zero manual steps
2026-10-20. The image builds, boots and updates in place; no FIPS mode (ADR 0012). Desktops install from an ISO with LUKS bound to the vTPM and provision themselves on first boot: IdM, RDP, break-glass, firewall. OpenTofu creates and destroys a desktop with its IdM host entry, Guacamole connection and Red Hat registration (, ADR 0013). CI builds, signs (cosign) and attests (SBOM) the image, and the installer is built from the signed image. Desktops track the registry and accept only images signed with the project key, proven on a desktop provisioned with no manual steps. The destroy-and-rebuild proof from a clean clone passed on 2026-10-20: a fresh clone plus the site values file, tofu apply to a provisioned desktop in 8 minutes, checked, then tofu destroy with nothing left behind. The final STIG scan, of a third desktop built from a clean clone and installed from an ISO with the provisioning fixes the first rescan led to: the image STIG profile passes 405 rules with 0 failures, and the HIPAA profile fails 37 rules, 2 fewer than the reference desktop; reports in docs/evidence/stig/20261020-image and 20261020-hipaa. ADR 0007.
Item 1
Done
Reached in a browser through Guacamole, Keycloak SSO with enforced MFA, no exposed RDP
Live at login.locumview.com since 2026-10-02.
Item 2
Done
DISA STIG profile applied, OpenSCAP report committed, exceptions documented
2026-10-19 on the reference desktop: DISA STIG with GUI, tailored; 417 pass, 0 open failures; reports in docs/evidence/stig, exceptions in hardening/stig/README.md. The bootc image applies the same profile at build time and has the separate file systems; FIPS mode is an exception (ADR 0012).
Item 3
Done
Encryption in transit everywhere
2026-10-19: every hop that crosses a network is encrypted. Browser to Cloudflare (TLS), the tunnel, pod traffic between cluster nodes (k3s WireGuard backend, ), Keycloak to IdM (LDAPS), and RDP to the desktop (TLS). Traffic between pods on the same node does not leave the host.
Item 4
Done
README with architecture diagram, quick start, HIPAA technical-safeguard mapping, honest status
2026-10-19: quick start for the checks and the access layer; HIPAA mapping in docs/hipaa-technical-safeguards.md, with its gaps stated (encryption at rest partly met since ). The desktop part of the quick start points to image/desktop/README.md (item 1 done 2026-10-20).
Item 5

After version one

Work beyond version one, by area. Some is already built ahead of schedule.

Identity

Built
Red Hat IdM directory (first server on the reference hypervisor), Keycloak federation, organizational login on desktops; Keycloak stays the MFA authority
2026-10-05, ahead of version one by owner decision: IdM server, read-only federation, owner's account in IdM, reference desktop enrolled (GNOME login, lock screen, sudo via IdM), nightly encrypted backups. Open: a second replica, password policy, backup alerting
ADR 0006
Planned
WebAuthn / passkeys; MFA for the demo login
ADR 0005

Access

Planned
Guacamole session recording; edge rate limiting
Planned
Per-evaluator demo accounts with an expiry date (disabled at expiry, deleted later)
When real evaluators exist; until then the shared guest password is rotated after each evaluation (docs/runbooks.md)
Planned
Close abandoned demo connections: idle logout or screen lock on the demo desktop
Guacamole keeps a session alive while a desktop connection is open, and the demo desktop has no screen lock
Built
Clipboard DLP: copy-out blocked, 5-minute clipboard clear in sessions
Lock-screen fix done, live clipboard tests pending

Desktop

Built
Browser baseline (ADR 0016): Google Chrome for web EHRs in the image, managed policies following the DISA Chrome STIG, a default EHR launcher, Firefox ESR policies following the DISA Firefox STIG; an audit of Chrome's outbound traffic, published
2026-10-20: with the EHR launcher open for 15 minutes no DNS query or HTTPS connection left the desktop (docs/evidence/browser/). Open: a 24-hour capture (Safe Browsing), egress rules on the desktop firewall
ADR 0016
Built
Image signing (cosign), SBOMs (syft), registry and build pipeline
Desktops accept only signed images
ADR 0007
In progress
Background image updates download and stage signed releases; the operator plans the reboot
Image service override prepared and checked locally; new image and disposable-desktop staging test pending. Existing desktop timer masks remain
Built
Organization-set desktop layout (Mac, Windows or GNOME style), locked centrally
Mac style and lock verified, Windows/GNOME not exercised
Done
The live demo (login.locumview.com) on an image-built desktop, replacing the hand-built reference desktop
2026-10-21
Changelog ; the reference desktop stays as a fallback for about a week, then retires
Planned
Separate, resettable demo desktop
First KubeVirt workload

Supply chain

Built
Every image build scanned against the STIG image profile before it is pushed, the result attached as a signed attestation; verified promotion: builds go to :testing, desktops follow :stable, which moves only after the signature, SBOM and scan are verified
In Phase 4: first promotions 2026-10-22; the second tested on a test desktop first (upgrade, full STIG scan, rollback and forward). Live demo moved to :stable, verified in
ADR 0007
Built
LocumView's own pieces (shell extensions, branding, tour, EHR launcher) as signed RPMs, built and published by CI; the image installs them and checks every signature
In Phase 4. Version pinning Done: two builds of one commit have the same four expected package versions in verified signed SBOMs (evidence). Planned: a public COPR mirror

Hypervisors

Planned
Proxmox VE (practical production target)
ADR 0007, 0009
Planned
A dedicated desktop network (own subnet or VLAN); guacd's RDP egress narrowed from the LAN to it
With Proxmox (Phase 6); today guacd may reach RDP ports on the LAN
Planned
Host configuration as an Ansible role (bridge, nftables, libvirt, k3s prerequisites; the reference hypervisor, the second cluster node, then Proxmox hosts), replacing the shell scripts in hypervisor/
With Proxmox (Phase 6); the desktop itself stays an image ()
ADR 0007
Planned
KubeVirt / OpenShift Virtualization (scoped learning piece)
ADR 0007, 0009
Planned
Public or sovereign cloud (AWS)
ADR 0009

Integrations

Planned
Nextcloud (files) via Keycloak OIDC, as a reference integration
ADR 0009
Planned
Synthetic FHIR server, Matrix messaging
ADR 0009

Clinical AI (US)

Planned
Detachable clinical AI module, US only; not part of the EU product
ADR 0008, 0017
Planned
Detachable clinical AI module, US only; not part of the EU product
(update 2026-10-22), docs/plans/phase9-lite-and-review-workspace.md
ADR 0017
Planned
Detachable clinical AI module, US only; not part of the EU product
ADR 0018
Adopted
Detachable clinical AI module, US only; not part of the EU product
2026-10-22
Docs/policy/synthetic-data-and-independence.md

Distributions

In progress
SUSE / openSUSE build from the same definitions
Not shipped
Infrastructure work has begun and runs largely in parallel with the RHEL build; not supported or shipped yet
Planned
Debian build from the same definitions

Version-one housekeeping

Small items that are not part of the scope.

Done
Remaining ADRs written: Terraform vs OpenTofu (0013), GNOME (0014), Guacamole (0015)
Done
CI that re-runs the pre-commit checks on every push
Open
Scoped kubeconfig for operators; admin GDM connection credentials into SOPS; Tomcat error page; cluster-wide egress policies
Open
Backup procedure for desktop VMs on the reference hypervisor
Planned
scan-stig.sh takes the profile as an argument, defaulting to the image profile on image-built desktops, so a deployed-desktop scan reports on the release gate's profile directly
Open
Encryption at rest for desktop disks and cluster nodes. Desktops installed from the bootc image: LUKS bound to the vTPM. The hand-built reference desktop (until it is replaced) and the cluster nodes:
Open
The rules the SSG HIPAA profile still fails: 39 on the reference desktop, 37 on desktops built from the bootc image (2026-10-20, which pass partition_for_var_log_audit and rpm_verify_permissions): applied through the tailoring or documented

Parked

Deliberately not pursued for now.

Parked

FIPS mode on desktops

GNOME Remote Desktop's RDP sign-in uses NTLM, which FIPS mode disables (tested 2026-10-19). Revisited when LocumView targets sectors that require FIPS 140 validated cryptography in FIPS mode (federal and defense health, FedRAMP), or when the remote display stack gains a FIPS-compatible sign-in. ADR 0012.

Parked

Clinical decision support in the EU

Requires MDR certification (Rule 11, Class IIa or higher; ISO 13485 QMS; notified body). Parked until there is a company with the capital and QMS to pursue it. In the EU, AI is limited to productivity verbs (draft, summarize, organize, retrieve). ADR 0008.

Done so far

Highlights. The build log has the detail.

Hand-built RHEL 10.2 reference desktop: UEFI + Secure Boot, vTPM, headless GNOME Remote Desktop, branding.
Strict LAN RDP validation, including GNOME's double redirection.
VM moved to the reference hypervisor on a LAN bridge.
SOPS + age secrets with a pre-commit guard.
Guacamole, Keycloak (TOTP), straight-to-desktop sessions, RDP firewalled to the cluster.
Branding, public access through the tunnel, guest demo, LocumView Tour, layout switch, marketing site and email.
DISA STIG with GUI applied to the reference desktop through a tailoring file reusable in the bootc build; 164 to 417 passing rules.
CI on every push, with the website preview following this roadmap.
Pod traffic between cluster nodes encrypted with WireGuard, closing the last unencrypted network hop.
README quick start and a HIPAA technical-safeguard mapping with its evidence.
The desktop as a bootc image: builds, boots with Secure Boot and the STIG's separate file systems, updates in place; FIPS mode tested and set aside (, ADR 0012).
Desktops install from an ISO with LUKS on the vTPM and provision themselves on first boot (IdM, RDP, break-glass), with no manual steps on the VM.
OpenTofu creates a desktop with its IdM host entry and removes all of it again; state encrypted (, ADR 0013).
CI builds, signs and attests the desktop image on a dedicated runner; the installer is built only from the signed image.
Desktops accept only signed updates: the signature policy rejects unsigned images and other registries; a desktop installed by OpenTofu moved to the signed CI build on first boot and booted it.
Browser baseline: Chrome for the EHR and Firefox ESR, both locked down to the DISA STIG settings; Chrome measured silent for 15 minutes (, ADR 0016).
Version one complete, 2026-10-20: a desktop built from a clean clone with zero manual steps, destroyed with nothing left behind, and rebuilt; its STIG scan passes 405 rules with 0 failures.