Status
Where LocumView stands.
Roadmap status as of · commit d2fd2aa · Source: ROADMAP.md in the repository
5 of 5 done
Version one
- Done
One RHEL 10 desktop built as a bootc image from a Containerfile and provisioned on the reference hypervisor (libvirt) from a clean clone, with zero manual steps
2026-10-20. The image builds, boots and updates in place; no FIPS mode (ADR 0012). Desktops install from an ISO with LUKS bound to the vTPM and provision themselves on first boot: IdM, RDP, break-glass, firewall. OpenTofu creates and destroys a desktop with its IdM host entry, Guacamole connection and Red Hat registration (, ADR 0013). CI builds, signs (cosign) and attests (SBOM) the image, and the installer is built from the signed image. Desktops track the registry and accept only images signed with the project key, proven on a desktop provisioned with no manual steps. The destroy-and-rebuild proof from a clean clone passed on 2026-10-20: a fresh clone plus the site values file, tofu apply to a provisioned desktop in 8 minutes, checked, then tofu destroy with nothing left behind. The final STIG scan, of a third desktop built from a clean clone and installed from an ISO with the provisioning fixes the first rescan led to: the image STIG profile passes 405 rules with 0 failures, and the HIPAA profile fails 37 rules, 2 fewer than the reference desktop; reports in docs/evidence/stig/20261020-image and 20261020-hipaa. ADR 0007.
Item 1 - Done
Reached in a browser through Guacamole, Keycloak SSO with enforced MFA, no exposed RDP
Live at login.locumview.com since 2026-10-02.
Item 2 - Done
DISA STIG profile applied, OpenSCAP report committed, exceptions documented
2026-10-19 on the reference desktop: DISA STIG with GUI, tailored; 417 pass, 0 open failures; reports in docs/evidence/stig, exceptions in hardening/stig/README.md. The bootc image applies the same profile at build time and has the separate file systems; FIPS mode is an exception (ADR 0012).
Item 3 - Done
Encryption in transit everywhere
2026-10-19: every hop that crosses a network is encrypted. Browser to Cloudflare (TLS), the tunnel, pod traffic between cluster nodes (k3s WireGuard backend, ), Keycloak to IdM (LDAPS), and RDP to the desktop (TLS). Traffic between pods on the same node does not leave the host.
Item 4 - Done
README with architecture diagram, quick start, HIPAA technical-safeguard mapping, honest status
2026-10-19: quick start for the checks and the access layer; HIPAA mapping in docs/hipaa-technical-safeguards.md, with its gaps stated (encryption at rest partly met since ). The desktop part of the quick start points to image/desktop/README.md (item 1 done 2026-10-20).
Item 5
After version one
Identity
- Built
Red Hat IdM directory (first server on the reference hypervisor), Keycloak federation, organizational login on desktops; Keycloak stays the MFA authority
2026-10-05, ahead of version one by owner decision: IdM server, read-only federation, owner's account in IdM, reference desktop enrolled (GNOME login, lock screen, sudo via IdM), nightly encrypted backups. Open: a second replica, password policy, backup alerting
ADR 0006 - Planned
WebAuthn / passkeys; MFA for the demo login
ADR 0005
Access
- Planned
Guacamole session recording; edge rate limiting
- Planned
Per-evaluator demo accounts with an expiry date (disabled at expiry, deleted later)
When real evaluators exist; until then the shared guest password is rotated after each evaluation (docs/runbooks.md)
- Planned
Close abandoned demo connections: idle logout or screen lock on the demo desktop
Guacamole keeps a session alive while a desktop connection is open, and the demo desktop has no screen lock
- Built
Clipboard DLP: copy-out blocked, 5-minute clipboard clear in sessions
Lock-screen fix done, live clipboard tests pending
Desktop
- Built
Browser baseline (ADR 0016): Google Chrome for web EHRs in the image, managed policies following the DISA Chrome STIG, a default EHR launcher, Firefox ESR policies following the DISA Firefox STIG; an audit of Chrome's outbound traffic, published
2026-10-20: with the EHR launcher open for 15 minutes no DNS query or HTTPS connection left the desktop (docs/evidence/browser/). Open: a 24-hour capture (Safe Browsing), egress rules on the desktop firewall
ADR 0016 - Built
Image signing (cosign), SBOMs (syft), registry and build pipeline
Desktops accept only signed images
ADR 0007 - In progress
Background image updates download and stage signed releases; the operator plans the reboot
Image service override prepared and checked locally; new image and disposable-desktop staging test pending. Existing desktop timer masks remain
- Built
Organization-set desktop layout (Mac, Windows or GNOME style), locked centrally
Mac style and lock verified, Windows/GNOME not exercised
- Done
The live demo (login.locumview.com) on an image-built desktop, replacing the hand-built reference desktop
2026-10-21
Changelog ; the reference desktop stays as a fallback for about a week, then retires
- Planned
Separate, resettable demo desktop
First KubeVirt workload
Supply chain
- Built
Every image build scanned against the STIG image profile before it is pushed, the result attached as a signed attestation; verified promotion: builds go to :testing, desktops follow :stable, which moves only after the signature, SBOM and scan are verified
In Phase 4: first promotions 2026-10-22; the second tested on a test desktop first (upgrade, full STIG scan, rollback and forward). Live demo moved to :stable, verified in
ADR 0007 - Built
LocumView's own pieces (shell extensions, branding, tour, EHR launcher) as signed RPMs, built and published by CI; the image installs them and checks every signature
In Phase 4. Version pinning Done: two builds of one commit have the same four expected package versions in verified signed SBOMs (evidence). Planned: a public COPR mirror
Hypervisors
- Planned
Proxmox VE (practical production target)
ADR 0007, 0009 - Planned
A dedicated desktop network (own subnet or VLAN); guacd's RDP egress narrowed from the LAN to it
With Proxmox (Phase 6); today guacd may reach RDP ports on the LAN
- Planned
Host configuration as an Ansible role (bridge, nftables, libvirt, k3s prerequisites; the reference hypervisor, the second cluster node, then Proxmox hosts), replacing the shell scripts in hypervisor/
With Proxmox (Phase 6); the desktop itself stays an image ()
ADR 0007 - Planned
KubeVirt / OpenShift Virtualization (scoped learning piece)
ADR 0007, 0009 - Planned
Public or sovereign cloud (AWS)
ADR 0009
Integrations
- Planned
Nextcloud (files) via Keycloak OIDC, as a reference integration
ADR 0009 - Planned
Synthetic FHIR server, Matrix messaging
ADR 0009
Clinical AI
- Planned
Detachable clinical AI module (US only, FDA CDS design principles): one web app in the hardened Chrome, launched from the desktop and as a SMART on FHIR app from the EHR; deterministic rules flag, a local model explains; Antimicrobial Stewardship, IV to PO and ADE Monitoring queues. First, Phase 9 lite: a clinical AI demo on OpenEMR with synthetic patients, showing a stewardship and an IV to PO finding; then the full Phase 9. Watch item: Epic Connectors (announced 2026-10-21) as a possible read-only delivery path for stewardship findings; revisit when Epic publishes developer documentation
ADR 0008, 0017 - Planned
Phase 9 lite: first a spike (a scenario loaded into OpenEMR reproducibly, cultures and susceptibilities read back through its FHIR API), then a versioned scenario library of 10 to 20 synthetic cases (20 to 30 for evaluation, with negative controls and ambiguous cases), the clinical app with EHR launch, rules and explanations, internal refinement; exit: a frozen, versioned evaluation build
(update 2026-10-22), docs/plans/phase9-lite-and-review-workspace.md
ADR 0017 - Planned
Clinical Review Workspace: invited external clinicians assess the frozen build's findings on synthetic cases, through Keycloak with MFA, Guacamole and a short-lived desktop that opens the Review app; minimal reviewer data, no license numbers; first round three clinical pharmacists. A structured expert review, not clinical validation
ADR 0018 - Adopted
Synthetic data and independence policy: synthetic patients only, no data from any employer, own resources only, not used in the owner's clinical work, no implied affiliation, reviewers recruited externally only
2026-10-22
Docs/policy/synthetic-data-and-independence.md
Distributions
- In progress
SUSE / openSUSE build from the same definitions
Not shipped
Infrastructure work has begun and runs largely in parallel with the RHEL build; not supported or shipped yet
- Planned
Debian build from the same definitions
Version-one housekeeping
- Done
Remaining ADRs written: Terraform vs OpenTofu (0013), GNOME (0014), Guacamole (0015)
- Done
CI that re-runs the pre-commit checks on every push
- Open
Scoped kubeconfig for operators; admin GDM connection credentials into SOPS; Tomcat error page; cluster-wide egress policies
- Open
Backup procedure for desktop VMs on the reference hypervisor
- Planned
scan-stig.sh takes the profile as an argument, defaulting to the image profile on image-built desktops, so a deployed-desktop scan reports on the release gate's profile directly
- Open
Encryption at rest for desktop disks and cluster nodes. Desktops installed from the bootc image: LUKS bound to the vTPM. The hand-built reference desktop (until it is replaced) and the cluster nodes:
- Open
The rules the SSG HIPAA profile still fails: 39 on the reference desktop, 37 on desktops built from the bootc image (2026-10-20, which pass partition_for_var_log_audit and rpm_verify_permissions): applied through the tailoring or documented
Parked
FIPS mode on desktops
GNOME Remote Desktop's RDP sign-in uses NTLM, which FIPS mode disables (tested 2026-10-19). Revisited when LocumView targets sectors that require FIPS 140 validated cryptography in FIPS mode (federal and defense health, FedRAMP), or when the remote display stack gains a FIPS-compatible sign-in. ADR 0012.
Clinical decision support in the EU
Requires MDR certification (Rule 11, Class IIa or higher; ISO 13485 QMS; notified body). Parked until there is a company with the capital and QMS to pursue it. In the EU, AI is limited to productivity verbs (draft, summarize, organize, retrieve). ADR 0008.
Done so far
- Hand-built RHEL 10.2 reference desktop: UEFI + Secure Boot, vTPM, headless GNOME Remote Desktop, branding.
- Strict LAN RDP validation, including GNOME's double redirection.
- VM moved to the reference hypervisor on a LAN bridge.
- SOPS + age secrets with a pre-commit guard.
- Guacamole, Keycloak (TOTP), straight-to-desktop sessions, RDP firewalled to the cluster.
- Branding, public access through the tunnel, guest demo, LocumView Tour, layout switch, marketing site and email.
- DISA STIG with GUI applied to the reference desktop through a tailoring file reusable in the bootc build; 164 to 417 passing rules.
- CI on every push, with the website preview following this roadmap.
- Pod traffic between cluster nodes encrypted with WireGuard, closing the last unencrypted network hop.
- README quick start and a HIPAA technical-safeguard mapping with its evidence.
- The desktop as a bootc image: builds, boots with Secure Boot and the STIG's separate file systems, updates in place; FIPS mode tested and set aside (, ADR 0012).
- Desktops install from an ISO with LUKS on the vTPM and provision themselves on first boot (IdM, RDP, break-glass), with no manual steps on the VM.
- OpenTofu creates a desktop with its IdM host entry and removes all of it again; state encrypted (, ADR 0013).
- CI builds, signs and attests the desktop image on a dedicated runner; the installer is built only from the signed image.
- Desktops accept only signed updates: the signature policy rejects unsigned images and other registries; a desktop installed by OpenTofu moved to the signed CI build on first boot and booted it.
- Browser baseline: Chrome for the EHR and Firefox ESR, both locked down to the DISA STIG settings; Chrome measured silent for 15 minutes (, ADR 0016).
- Version one complete, 2026-10-20: a desktop built from a clean clone with zero manual steps, destroyed with nothing left behind, and rebuilt; its STIG scan passes 405 rules with 0 failures.