Roadmap

Ordered by dependency and risk, not by date. There are no dates on this page on purpose: the question it answers is “what is the best next thing”, which stays true even when the pace changes.

Shipped

The cryptographic core. The key hierarchy, wrapping, zeroization. Built only on audited primitives, test-first, with known-answer vectors cross-validated against libsodium and the relevant RFCs. Every construction frozen and versioned.

The wire format. Versioned envelopes shared by client and server — and the reason the server depending on this crate only, never the crypto crate, is a structural guarantee rather than a convention.

The zero-knowledge server. Authentication, ciphertext sync with optimistic concurrency, the membership and grant state machine, atomic rotation, recovery endpoints, the audit log, and rate limits. Every endpoint landed with its invariant test.

The desktop app. Unlock and onboarding, the Recovery Kit flow, the vault, members and grants, the fingerprint ceremony, conflict resolution, and both recovery flows.

The CLI. cendarum run, import, and export, on a client engine shared with the desktop app.

Next

Early access. Getting the whole product — app, CLI, team sharing — in front of roughly fifteen to twenty developers, and finding out two things: whether the project-and-environment model matches how teams actually work, and whether zero-knowledge is worth having fewer integrations than the alternatives.

That second question is the real one. It is not rhetorical, and the answer decides everything below.

Finishing the per-framework compatibility pass. The injection mechanism is language-agnostic by construction and covered by tests; what is owed is sitting down with each stack on the list and recording the result. Until then recipes is labelled as guidance rather than a validated matrix.

Later

Deliberately gated on what early access tells us. Building any of it first would be guessing.

Billing. The price is decided and published — free for one person, $8 per user per month for a team — but nothing can collect it yet. Only worth building once team sharing has been validated by people who are not us.

Ephemeral link sharing for people who aren’t project members. A secondary use case, deliberately ranked below membership. The database table exists; the endpoints do not.

Per-OS polish, code signing, notarisation, and an installer matrix. Needed before public distribution, deferred because flows should be stable first. The Windows and Linux sleep and screen-lock hooks land with this work.

Trust hardening. A third-party cryptographic audit, SOC 2 Type II, a security whitepaper, and open-sourcing the client.

That last item deserves a note. It is not on this list because it is nice to have — it is the thing that makes everything on the security pages verifiable rather than merely stated. It is here rather than in “next” because it is expensive and slow, and because doing it properly matters more than doing it soon.

Not on the roadmap

CI and headless secret injection. A separate, harder problem: a build runner has no human to type a master password, so it needs a machine identity — a service-account key pair granted access like any other member. That is a load-bearing change to the key hierarchy and it is tracked separately, on purpose, so CI ergonomics do not leak into the local-development design.

Browser and mobile clients. Decryption needs your keys, and your keys are on your desktop.

Self-hosting. Not planned for now.

Server-side anything — search, templating, policy engines over secret values. Not a roadmap gap; it is the architecture.

How this page changes

When something ships it moves up. When a decision changes, this page changes in the same release as the code.

What will not happen is an item quietly disappearing because it turned out to be hard. If we drop something, it will say so.