Roadmaps
Status: Current
Last reviewed: 2026-06-22
Roadmaps record engineering direction, not a substitute for the user guide or API reference. Every feature below is marked with one of three states:
| State | Meaning |
|---|---|
| Complete | Implemented in current code and documented as current behavior. |
| Planned | Not complete; use for design direction only. |
| Deprecated | Superseded by another implementation path or intentionally removed. |
Current Status
| Roadmap | Feature State | Summary |
|---|---|---|
| Transport Composition | Complete + Planned | Current profiles are implemented for TCP/UDP/IP over RAW/TLS/REALITY/Noise/QUIC where listed; UDP-over-TCP and TCP-over-UDP remain planned. |
| QUIC REALITY | Complete | Runtime path is Quinn-based QUIC REALITY in nexus-agent/src/gateway/quic.rs with crates/quinn-reality. |
| QUIC REALITY DATAGRAM | Complete + Planned | UDP and L3 DATAGRAM paths exist; performance counters and higher-throughput goals continue. |
| QUIC L3 | Deprecated | The standalone L3 product surface was removed. Reusable TUN I/O, userspace WireGuard, QUIC DATAGRAM, offload, GSO, and GRO foundations remain for SD-WAN and future transport work. |
| Unified TUN I/O Engine | Complete + Planned | Batch-first Linux VNET/Wintun-shaped engine; Linux netns relay reaches 10.44 Gbps TCP P1 with VNET/GSO passthrough; loopback full-protocol medians are 1.48 Gbps QUIC TLS L3 and 1.70 Gbps BoringTun WG L3, while real Windows driver validation remains planned. |
| SD-WAN and NNSR | Current NNSR direction | SD-WAN uses NNSR-C over hop-by-hop QUIC REALITY and BoringTun WireGuard underlays. |
| SD-WAN WebUI Design | Planned | Frontend information architecture, i18n, page slices, and collaboration plan for the SD-WAN/NNSR operations console. |
| NNSR Compact Header | Planned | 4-byte MPLS-style internal compact label carried inside hop-by-hop WG/QUIC protected SD-WAN payloads. |
| Quinn QUIC REALITY | Complete + Planned | Quinn migration is the active path and has replaced the hand-written QUIC runtime. |
| Kernel DCO | Planned | Project-level dataplane offload vision for TCP, UDP, QUIC, and L3; no custom DCO implementation exists in this repository. |
| Security Hardening | Complete + Planned | SPKI pinning, removed local agent config cache, Noise first-packet behavior, rekey intervals, and REALITY rotation plan. |
| Observability Matrix | Planned | Future telemetry, audit, TimeDB, node health, network performance, and SD-WAN signal plan. |
Deprecated Work
| Deprecated Item | Replacement |
|---|---|
Hand-written quic-core runtime roadmap | Quinn-based crates/quinn-reality and src/gateway/quic.rs. |
Legacy /api/routes as the primary console workflow | L4 chains and SD-WAN. |
Standalone /api/l3-networks product workflow | SD-WAN underlay profiles plus reusable TUN transport foundations. |
| Dedicated TLS/ENC key pages | Unified security credentials page. |
| Legacy archive docs | Current user guide, reference, operations, and roadmap pages. |
| Kernel-managed L3 as SD-WAN underlay | Userspace SD-WAN underlay: QUIC REALITY and BoringTun userspace WireGuard. |
Roadmap Shape
text
Transport Composition
-> L4 chains: RAW / TLS / REALITY / Noise / QUIC
-> Unified TUN I/O engine
-> SD-WAN route policies
-> SD-WAN WebUI operations console
-> Internal NNSR over QUIC REALITY / BoringTun WireGuard
-> NNSR compact labels after WG/QUIC decapsulation
-> Kernel DCO as a cross-cutting future offload path