Docs/Project
Status and roadmap
What is usable now, what remains deliberately gated and how RustyAuth moves from one realm to Fleet.Capability matrix
| Capability | Status | Boundary |
|---|---|---|
| Passkey registration and sign-in | Implemented | Server-side, single-use ceremonies and durable sessions |
| Accounts and credentials | Implemented | Stable UUID, email/phone identifiers, profile and multiple passkeys |
| JWT and signing keys | Implemented | ES256, JWKS, staged rotation and retired-key overlap |
| Dioxus web dashboard | Implemented | Supported 1.0 client and separately deployable gateway |
| Native clients | Preview | Shared desktop/mobile feature builds; no 1.0 packages or support |
| Fleet hierarchy and pairing | Implemented | Public-endpoint topology, scoped roles, audit and revocation |
| Fleet Analytics V1 | Implemented | Trusted export, canonical/materialized serving, delegated Dioxus and signed recovery |
| Encrypted backup and restore | Implemented | Logical snapshot, verification and empty-target recovery |
| Configuration as code | Implemented | Versioned YAML, schema, CLI validation and Docker/Railway inputs |
| Signed webhook delivery | Implemented on main | IaC or dashboard ownership, durable retry, history and replay |
| Account recovery | Implemented | One-use recovery codes, passkey re-enrolment, session revocation and audit |
| Verification delivery | Implemented | One-time challenges through exact signed-webhook subscriptions |
| Email sign-in delivery | Event only | A delivery provider/consumer remains an integration responsibility |
| Continuous security assurance | Ongoing | Automated checks plus independent review across supported releases |
Product direction
RustyAuth supports two deployment styles without weakening realm isolation:
- Standalone: one project contains a Dioxus dashboard, one RustyAuth backend and one private SableDB for a single isolated realm.
- Fleet: a separate central dashboard, control-plane API and datastore manage organizations, projects and environments while each realm keeps its own three-service boundary.
SolidJS is retired from the shipped product path. Dioxus is the supported web presentation architecture and the shared basis for post-1.0 native previews; the Rust control-plane services remain the authority.
Continuous assurance after 1.0.0
- Publish and verify signed images through clean install, upgrade and rollback.
- Pass the supported web browser, OS and authenticator matrix.
- Repeat the Analytics scale, soak, chaos and recovery matrix for supported releases.
- Run a real organization-policy Analytics canary and witnessed recovery drill.
- Continue independent application, deployment, pinned-SableDB and Analytics assessments.
Desktop, iOS and Android distribution is separately gated post-1.0 work and does not block the server, container and web GA.
How to read status
Implemented means code and automated coverage exist in this repository. It does not by itself mean production-qualified. Event only means RustyAuth records the request but an external delivery integration remains responsible for transport. Direction is not a product claim.
For the post-Fleet sequence, see the guided Fleet Analytics roadmap and its V1 semantic contract.
The normative roadmap, changelog and Fleet architecture preserve the detailed program.