Status & Roadmap

The single honest view of what is implemented today versus planned. Every maturity caveat elsewhere links here.

Implemented today

Capability	State	Where it lives
SIDC / MIL-STD-2525E / APP-6E symbology	Implemented	common/src/sidc/ (parser) + mil-sym-android (Android) / mil-sym-ts (web) renderers
ADatP-3 formatted text (OPREP, INTREP, SALUTE)	Implemented	gateway/src/formats/adatp3.rs
CoT / TAK exchange	Implemented	gateway/src/formats/cot*.rs, tak_protobuf.rs
NFFI / STANAG 5527 blue-force tracking	Implemented (file export)	gateway/src/formats/nffi.rs
STANAG 4774/4778 classification labels	Implemented	server/src/classification_gate.rs
Zenoh transport routing (relay + federation)	Implemented	server (Zenoh router; router↔router mTLS)
FIDO2 identity + token issuance	Implemented	directory (FIDO2 login, signs IdentityToken/ServerToken)
Per-message classification gate	Implemented	server/src/classification_gate.rs
Token-only identity (no client-cert PKI)	Implemented	directory (token-only enrollment), common proto (cert fields removed); only transport/federation TLS uses certs
Force-tracking ingest API (/api/feed/*, Epic 14)	Implemented	web (HS256 JWT API credentials, scopes, op-claims, revocation registry); see protocol/ingest-api.md
Targeting board + target state machine + effects/weaponeering	Implemented	web (detected→…→assessed, append-only target_transitions; effects offered→allocated→expended)
Detections / force observations	Implemented	web (op-scoped, kind detection | ew_emitter, source_kind provenance, CAT-1/TLE)
Client-side track fusion	Implemented	web (identity dedup + spatial gating + confidence + merge/split; server-side fused_tracks deferred)
EW zone / emitter authoring	Implemented	web (jamming / gps_denial / ao / fire-control zones; directional-lobe / 3D-volume emitters)
COP decision-support client	Implemented	web (fused COP, threat rings, TCM catalog)
Planning — orders over plan records, replay export	Implemented	web (orders editor over plan_records; seq versioning, all versions kept; NDJSON replay/ORK export schemaVersion: 1; estimate + plan versions + sync-task store retired — execution is the tasks[] table/timeline lenses)
Comms matrix	Implemented	web (ORBAT rows × nets, roles ★/●/◌, petra|radio carriage; read-side, not live transport)
Voice replay recorder	Implemented	web (server-side recorder tier)
Server-blind E2E content confidentiality	Implemented (live fleet-wide)	common (SealedContent + GroupKeyManager), server (payload-blind), android / web / node / gateway (seal+open, fail-closed); only heartbeats plaintext. No dual-read path — cutover complete. See security/model.md
Group-key rotation + offline backfill ring	Implemented	common (GroupKeyManager current+previous+backfill, MAX_BACKFILL_EPOCHS=64, merge_backfill contiguity), directory (operator-triggered rotate, horizon-bounded retirement BACKFILL_HORIZON_MS=7 d). Automatic loss-driven trigger is #40
Opaque invite addressing	Implemented	common (invite_segment HMAC helper + vectors), directory (mint salt + stamp IdentityToken.invite_segment), server (segment clamp), android / web. See protocol/wire-protocol.md
Revocation typestate verify	Implemented	common (VerifiedEnvelope::authorize(&RevocationSnapshot) → AuthorizedIdentity), server (gate_verified)

In progress / transitional

• Browser realtime is subscribe-only; publish is gated and dormant. The web client can subscribe to mesh traffic, but every publish path (operator heartbeat, chat-TX, voice-TX, order/command authoring, multi-net TX) is built dormant, gated on one remaining step:
• (0.1) Deploy the Zenoh remote-api WebSocket bridge. It is not deployed anywhere yet, so browser realtime is non-functional end-to-end until it is.

The browser-operator signing key is in place: the Directory mints it at the webauth exchange and returns signing_private_key in WebauthExchangeResponse, and web seeds it into the transport signing key — so envelope signing is not a blocker, only the bridge is. - Server-side fused_tracks deferred. Track fusion is client-side only today; a server-side fused-track table is not yet built. - Sync-task / comms-net realtime publication deferred. These are authored and read in web but have no live cross-repo publication path; the NDJSON replay/ORK export bundle is the only cross-repo surface for them today.

Planned

Standard	Where it will live	Doc
Link 16 (MIL-STD-6016 / STANAG 5516)	gateway/src/formats/ (no adapter yet)	link16-track-ingest
Link 11B (STANAG 5511)	gateway/src/formats/ (no adapter yet)	link11b-serial-ingest
VMF (MIL-STD-6017)	gateway/src/formats/ (no adapter yet)	vmf-binary-messaging
MIP / DEM	gateway/src/formats/ (no adapter yet)	mip-dem-exchange
NVG (NATO vector graphics)	gateway/src/formats/ (no adapter yet)	nvg-tactical-graphics
OTH-Gold maritime	gateway/src/formats/ (no adapter yet)	oth-gold-maritime
HLA simulation	gateway/src/formats/ (no adapter yet)	hla-simulation
WMS (OGC) map tile layers	Not started (MapLibre supports WMS natively)	wms-map-sources

Known gaps

• Directory horizontal scaling (HA prerequisite). Making the data tier highly available (Postgres/Cloud SQL replication + backup) is an infrastructure choice. But the Directory application assumes a single replica today: its nonce store and per-device refresh rate limiter hold state in process memory, which would have to move behind Postgres before more than one Directory instance could run behind a load balancer (directory:app/domains/api/service_token_refresh_limiter.ts). Until that app change lands, Directory availability is bounded by a single instance regardless of database HA. (The signing key is already DB-backed and re-read per mint, so it is not a blocker.) The Directory is the system's only true SPOF — while it is down no new logins or tokens are issued, though already-issued tokens keep the live mesh running. Routers do not need HA — they are relays whose redundancy comes from running federated peers (see Deployment topology → What needs HA).

Verified against main HEAD on 2026-07-20: common@07e10aa, server@a7fd76f, directory@ebea383, web@688b608, android@bd64d0d, node@3e7bf08, gateway@bca19af.