🎯 Value Objectives

Value Objectives #

What the roadmap’s work is for. Each bar shows how many of an objective’s listed waypoints are done: it measures work finished, not the promise proven, and it falls when new waypoints are added. A waypoint that serves two objectives counts in both. Tenants’ own products, and upkeep that serves no objective, are not counted.

Fast tenant delivery 9/9
✓ 9 | ↻ 0 | ⏳ 0 (9 total)
Build the product, not the plumbing 4/5
✓ 4 | ↻ 1 | ⏳ 0 (5 total)
Contained failure 6/8
✓ 6 | ↻ 0 | ⏳ 2 (8 total)
Rebuild from code 9/19
✓ 9 | ↻ 2 | ⏳ 8 (19 total)
Works anywhere 9/19
✓ 9 | ↻ 1 | ⏳ 9 (19 total)
One part-time operator can run it 9/15
✓ 9 | ↻ 0 | ⏳ 6 (15 total)
Secure by default 15/23
✓ 15 | ↻ 1 | ⏳ 7 (23 total)
No surprises 4/17
✓ 4 | ↻ 3 | ⏳ 10 (17 total)

Legend: ✅ Complete | 🔄 In Progress | ⏳ Planned

Fast tenant delivery #

A new tenant runs without touching the substrate.

✓ 9 | ↻ 0 | ⏳ 0 (9 total)

Reached:

  • ✅ The boundary between tenants and the site’s infrastructure written as one specification Tenant Lifecycle 2026-11-01
  • ✅ Tenants admitted and removed, and their Wi-Fi keys rotated, by make targets on the build server Tenant Lifecycle 2026-09-29
  • ✅ A reference tenant a newcomer can copy Tenant Lifecycle 2026-09-27
  • ✅ Tenants log in to their own workloads and deploy their app (CHG-0028) Tenant Lifecycle 2026-09-27
  • ✅ The EVPN/VXLAN tenant network running on one hypervisor, with internet access through the perimeter Tenant Fabric 2026-09-17
  • ✅ The Deevnet API and its Terraform provider deployed; tenants built through them (CHG-0010) Tenant Lifecycle 2026-09-17
  • ✅ Tenants publish their own DNS names Tenant Fabric 2026-09-03
  • ✅ The first tenant built end to end from its own repository: code, internet access and DNS Tenant Lifecycle 2026-09-03
  • ✅ Tenant network architecture designed Tenant Fabric 2026-08-30

Product, not plumbing #

Every tenant gets the common services ready-made.

✓ 4 | ↻ 1 | ⏳ 0 (5 total)

Reached:

Still open:

Contained failure #

One tenant cannot harm another, and leaves nothing behind.

✓ 6 | ↻ 0 | ⏳ 2 (8 total)

Reached:

  • ✅ The core router confined to the tenant perimeter: one transit network and one route into the tenant overlay, nothing per tenant Tenant Fabric 2026-11-12
  • ✅ Removing a tenant also deletes its Terraform state and dashboards (CHG-0065) Tenant Removal 2026-11-12
  • ✅ Removing a tenant also deletes its log lines (CHG-0065) Tenant Removal 2026-11-12
  • ✅ Removing a tenant revokes its API token (CHG-0065) Tenant Removal 2026-11-12
  • ✅ Central logging: a log store, each tenant seeing its own logs, device logs over MQTT, and Grafana Observability 2026-09-24
  • ✅ The core router enforces a declared zone policy (CHG-0007) Network Automation 2026-09-19

Still open:

  • ⏳ Network isolation between two tenants’ workloads tested Tenant Fabric
  • ⏳ Unused access switch ports placed in a dead-end VLAN, so a device plugged into one reaches nothing Access Network

Rebuild from code #

Losing anything costs time, not the project.

✓ 9 | ↻ 2 | ⏳ 8 (19 total)

Reached:

  • ✅ Recovery copies of the network’s configuration: the Wi-Fi controller and core router backed up after every change, where they survive losing the build server Extended Management Plane 2026-11-11
  • ✅ A tenant that lost the keys to its own state gets back in with a new key from the operator (CHG-0060) Tenant Lifecycle 2026-11-09
  • ✅ OpenBao’s keys made outside it and loaded from the site’s vault on every build, its access restricted and audited (CHG-0036) Secrets and Identity 2026-10-25
  • ✅ Nightly encrypted backups, one restore rehearsed (CHG-0039) Extended Management Plane 2026-10-07
  • ✅ Core router, access switch, DNS and DHCP configured from code, with 12 VLANs under a zone firewall policy Builder & Core Services 2026-03-26
  • ✅ Machines install themselves from the build server over PXE, BIOS and UEFI Builder & Core Services 2026-01-10
  • ✅ Build server requirements defined: hardware inventory, network layout and offline artifacts Builder & Core Services 2026-01-09
  • ✅ The build server provisions the site’s infrastructure from its own Ansible collection, images and offline package mirror Builder & Core Services 2025-12-31
  • ✅ The Omada Wi-Fi controller deployed from code on the build server Builder & Core Services 2025-12-07

Still open:

Works anywhere #

The factory needs no outside service, and what it builds keeps working elsewhere.

✓ 9 | ↻ 1 | ⏳ 9 (19 total)

Reached:

  • ✅ The take-home Pi image in the tenant downloads, using Deevnet certificates by default or a starter kit for an owner’s own Tenant PKI 2026-11-08
  • ✅ The EdS tenant’s certificates reissued under a name not tied to a site (CHG-0055) Tenant PKI 2026-11-01
  • ✅ The first take-home Pi installed with Deevnet certificates, using a name not tied to a site (CHG-0056) Tenant PKI 2026-10-29
  • ✅ EdS’s home Pi uses Deevnet certificates, under names not tied to a site (EdS CHG-0042) Platform 2026-10-29
  • ✅ Tenant names not tied to a site, issued by the Deevnet API and Terraform provider (CHG-0054) Tenant PKI 2026-10-25
  • ✅ The Raspberry Pi image tenants take home kept current with its setup tool, deevnet-kit (CHG-0049–0051) Tenant PKI 2026-10-18
  • ✅ Deevnet’s own root and site certificate authorities created and kept offline (CHG-0033) TLS Cert Automation 2026-10-05
  • ✅ Hosts and DNS zones renamed to a scheme that includes the site’s code (CHG-0003) Builder & Core Services 2026-09-05
  • ✅ The build server provisions the site’s infrastructure from its own Ansible collection, images and offline package mirror Builder & Core Services 2025-12-31

Still open:

  • 🔄 All of EdS’s back end on one Pi at home: in service, the change record awaiting its evidence (EdS ADR-0033, CHG-0028) Platform
  • ⏳ The home site’s certificate authorities created under the Deevnet root Home Site
  • ⏳ The home site’s network defined in inventory, with DNS and DHCP on its core router Home Site
  • ⏳ Later at the home site: Kea for DHCP, and a hypervisor when a tenant needs one Home Site
  • ⏳ The build server’s Wi-Fi onto the home network, decided in a change record (EdS ADR-0053) Builder Upkeep
  • ⏳ A local song recognizer EdS’s turntable can ask in place of today’s outside service EdS Local Song Detection
  • ⏳ GPS time server requirements defined: accuracy, antenna placement and alerting Stratum 1 NTP
  • ⏳ Pi Zero and GPS module chosen and bought for the time server Stratum 1 NTP
  • ⏳ GPS time server image built, with Chrony, telemetry and accuracy tests Stratum 1 NTP
  • ⏳ GPS time server on the network, with clients using it Stratum 1 NTP

One operator #

Routine work takes little attention and little memory.

✓ 9 | ↻ 0 | ⏳ 6 (15 total)

Reached:

  • ✅ Management plane architecture, deployment and troubleshooting documentation written Extended Management Plane 2026-11-11
  • ✅ A tenant that lost the keys to its own state gets back in with a new key from the operator (CHG-0060) Tenant Lifecycle 2026-11-09
  • ✅ Automation repositories’ syntax and docs build checked on every pull request Network Automation 2026-11-03
  • ✅ Tenants admitted and removed, and their Wi-Fi keys rotated, by make targets on the build server Tenant Lifecycle 2026-09-29
  • ✅ Builds take their secrets from OpenBao, none on disk (CHG-0026) Secrets and Identity 2026-09-25
  • ✅ Site management services grouped onto six VMs by domain (CHG-0008) Extended Management Plane 2026-09-16
  • ✅ Wi-Fi networks and the access point set by the Omada controller from inventory, through its API Network Automation 2026-09-15
  • ✅ Core router, access switch, DNS and DHCP configured from code, with 12 VLANs under a zone firewall policy Builder & Core Services 2026-03-26
  • ✅ Bare-metal inventory and standards documented on a Hugo docs site Builder & Core Services 2026-01-09

Still open:

  • ⏳ Leftover DHCP reservations, DNS records and boot files from deleted hosts removed Declarative Reconciliation
  • ⏳ Automation removes a host’s DHCP, DNS and boot entries when it leaves inventory Declarative Reconciliation
  • ⏳ A labeled block of access switch ports for plugging in management devices Access Network
  • ⏳ The core router’s (OPNsense) interface assignment automated Network Automation
  • ⏳ Rerunning the access switch’s automation changes nothing unless something needs changing Network Automation
  • ⏳ Automatic certificate renewal, expiry monitoring, and a clean new root once device certificates work TLS Cert Automation

Secure by default #

Doing the easy thing is doing the safe thing.

✓ 15 | ↻ 1 | ⏳ 7 (23 total)

Reached:

  • ✅ OpenBao sealed by split-key (Shamir) shares, opened only for a work session (CHG-0053) Secrets and Identity 2026-11-08
  • ✅ The secret store itself refuses tenant certificates for a site’s or the platform’s own names (CHG-0059) Tenant PKI 2026-11-07
  • ✅ Every long-lived credential listed, with what it unlocks and what uses it Credential Rotation 2026-11-03
  • ✅ A stated policy for what counts as an exposed credential and what happens next Credential Rotation 2026-11-03
  • ✅ The first take-home Pi installed with Deevnet certificates, using a name not tied to a site (CHG-0056) Tenant PKI 2026-10-29
  • ✅ OpenBao’s keys made outside it and loaded from the site’s vault on every build, its access restricted and audited (CHG-0036) Secrets and Identity 2026-10-25
  • ✅ Tenant certificate authorities’ keys generated outside the OpenBao secrets manager (CHG-0036) TLS Cert Automation 2026-10-25
  • ✅ Tenants’ own services on Deevnet certificates (CHG-0047) Tenant PKI 2026-10-11
  • ✅ Exposed credentials rotated; every public repository scanned on push (CHG-0035) Credential Rotation 2026-10-06
  • ✅ Deevnet’s own root and site certificate authorities created and kept offline (CHG-0033) TLS Cert Automation 2026-10-05
  • ✅ Every machine the site builds trusts the Deevnet root certificate TLS Cert Automation 2026-10-05
  • ✅ Every infrastructure service and appliance on the site serves a Deevnet certificate, and its clients verify it TLS Cert Automation 2026-10-05
  • ✅ Builds take their secrets from OpenBao, none on disk (CHG-0026) Secrets and Identity 2026-09-25
  • ✅ OpenBao secrets manager deployed; the Deevnet API reads its credentials from it (CHG-0010) Secrets and Identity 2026-09-17
  • ✅ The site’s infrastructure secrets in Ansible Vault, guarded on every commit Secrets and Identity 2026-03-14

Still open:

  • 🔄 Tenant VMs that trust only the retired root certificate replaced TLS Cert Automation
  • ⏳ IoT devices issued their own certificates through the Deevnet API Tenant PKI
  • ⏳ OpenBao rebuilt from the site’s vault alone in a drill, nothing restored (ADR-0042 V12) Secrets and Identity
  • ⏳ Single sign-on and role-based access for infrastructure services Secrets and Identity
  • ⏳ IoT devices get their own certificates through the Deevnet API and use them to log in to the MQTT broker TLS Cert Automation
  • ⏳ Automatic certificate renewal, expiry monitoring, and a clean new root once device certificates work TLS Cert Automation
  • ⏳ A written rotation procedure for each kind of credential, naming everything that must change with it Credential Rotation
  • ⏳ Static credentials assessed for short lifetimes, and the ones that cannot be shortened recorded Credential Rotation

No surprises #

Problems and drift are found before they bite.

✓ 4 | ↻ 3 | ⏳ 10 (17 total)

Reached:

  • ✅ The Software Catalog’s rows moved into a data file that reports can compare against Software Discovery 2026-11-03
  • ✅ Deevnet’s own software pinned to exact versions and licensed Software Discovery 2026-11-03
  • ✅ Central logging: a log store, each tenant seeing its own logs, device logs over MQTT, and Grafana Observability 2026-09-24
  • ✅ Each Wi-Fi network’s reach checked from a real client Extended Management Plane 2026-09-23

Still open:

  • 🔄 Management plane requirements defined: retention, alerting, secrets access and identity Extended Management Plane
  • 🔄 Automated checks that a finished build matches inventory, with a pass/fail report Extended Management Plane
  • 🔄 Metrics collected from the site’s infrastructure hosts and shown on dashboards Observability
  • ⏳ Replacement core router hardware chosen (the N100 Router Appliance is the candidate) Core Router Uplift
  • ⏳ New core router built from code and swapped in, the old ZimaBoard kept to put back Core Router Uplift
  • ⏳ New core router proven under a multi-gigabyte transfer and a full deploy Core Router Uplift
  • ⏳ The core router hang incident (INC-0004) closed Core Router Uplift
  • ⏳ Alerts on infrastructure problems, delivered to the operator Observability
  • ⏳ A read-only report of live network state with no matching declaration Declarative Reconciliation
  • ⏳ Installed versions collected from routers, hypervisors, VMs, network devices and Pis Software Discovery
  • ⏳ A dated report of installed versus cataloged versions, run as part of build verification Software Discovery
  • ⏳ Every cataloged product’s release and security advisory sources recorded and watched Patch Awareness
  • ⏳ One feed of the new advisories and releases that need attention, delivered to the operator Patch Awareness
Page last modified: November 9, 2026