Implementation Roadmap

CIAF-LCM Implementation Roadmap

Version 0.6.1Last Updated: April 28, 2026

Next steps for deployment-ready system

Current Status

Database Foundation:Complete and aligned with CIAF-LCM concepts

Core Architecture:Evidence spine correctly implemented

Extension Packs:All major domains covered

API Enforcement:Needs implementation before production

Priority 1

API Enforcement Layer

Critical for production: Before exposing external API endpoints, implement:

Schema Validation Middleware

Ensure all payloads match expected structure before processing

Why: Prevent malformed data from entering the system

// ui/lib/api/middleware/validate-schema.ts
import Ajv from 'ajv'
import { schemas } from '@/lib/schemas'

export async function validateSchema(
  payload: unknown,
  schemaType: string
): Promise<{ valid: boolean; errors?: string[] }> {
  const ajv = new Ajv()
  const schema = schemas[schemaType]
  const valid = ajv.validate(schema, payload)
  
  if (!valid) {
    return { valid: false, errors: ajv.errors?.map(e => e.message) }
  }
  
  return { valid: true }
}

Files to create:

• ui/lib/schemas/ - JSON schema definitions
• ui/lib/api/middleware/validate-schema.ts - Validation middleware
• ui/app/api/*/route.ts - Add validation to all routes

Canonical Hashing Implementation

Ensure consistent hash generation for evidence integrity

Why: Cryptographic integrity depends on deterministic hashing

Files to create:

• ui/lib/api/canonicalization.ts - Hashing utilities
• ui/app/api/receipts/verify/route.ts - Verification endpoint
• Update all routes creating receipts to compute hashes

Dependencies to add:

npm install canonicalize

Digital Signature Implementation

Cryptographically bind evidence to principals

Why: Non-repudiation and authenticity verification

Files to create:

• ui/lib/api/signatures.ts - Signature utilities
• ui/app/api/principals/keys/route.ts - Key management endpoint
• Update receipt creation to include signatures

Database changes needed:

• Add signature and signature_algorithm columns where missing
• Store principal public keys in principals.public_key_fingerprint

Service Grant Authorization Middleware

Verify API keys have required permissions before allowing access

Why: Enforce service bundle scopes and quotas

Files to create:

• ui/lib/api/middleware/authorize-service.ts - Authorization middleware
• Update all external API routes to use authorization

Request Logging Middleware

Track all API usage for audit trails

Why: Complete audit trail of API operations

Files to create:

• ui/lib/api/middleware/log-request.ts - Logging middleware
• Update all routes to log requests

Rate Limiting & Quota Enforcement

Prevent abuse and enforce service level agreements

Why: Fair usage and DDoS protection

Files to create:

• ui/lib/api/middleware/rate-limit.ts - Rate limiting utilities
• Update authorization middleware to check limits

Output Linking

Link API responses back to evidence objects

Why: Complete traceability from API call to evidence

Files to create:

• ui/lib/api/middleware/link-output.ts - Output linking utilities
• Update routes that create evidence to link outputs

Priority 2

Verification Endpoints

Public Verification Endpoints

Allow external parties to verify evidence integrity

Endpoints to implement:

• POST /api/verify/receipt - Verify receipt integrity
• POST /api/verify/vault - Verify vault object seal
• POST /api/verify/audit-pack - Verify complete audit pack

Priority 3

Dashboard Enhancements

Metrics and Analytics

Enhanced visibility into governance operations

New metrics to display:

• Technical pass rate vs Governance approval rate
• Policy evaluation breakdown (which rules pass/fail most)
• Service usage by bundle
• HITL decision times and outcomes
• Agent behavior anomaly alerts

Implementation Roadmap

CIAF-LCM Implementation Roadmap

Version 0.6.1Last Updated: April 28, 2026

Next steps for deployment-ready system

Current Status

Database Foundation:Complete and aligned with CIAF-LCM concepts

Core Architecture:Evidence spine correctly implemented

Extension Packs:All major domains covered

API Enforcement:Needs implementation before production

Priority 1

API Enforcement Layer

Critical for production: Before exposing external API endpoints, implement:

Schema Validation Middleware

Ensure all payloads match expected structure before processing

Why: Prevent malformed data from entering the system

// ui/lib/api/middleware/validate-schema.ts
import Ajv from 'ajv'
import { schemas } from '@/lib/schemas'

export async function validateSchema(
  payload: unknown,
  schemaType: string
): Promise<{ valid: boolean; errors?: string[] }> {
  const ajv = new Ajv()
  const schema = schemas[schemaType]
  const valid = ajv.validate(schema, payload)
  
  if (!valid) {
    return { valid: false, errors: ajv.errors?.map(e => e.message) }
  }
  
  return { valid: true }
}

Files to create:

• ui/lib/schemas/ - JSON schema definitions
• ui/lib/api/middleware/validate-schema.ts - Validation middleware
• ui/app/api/*/route.ts - Add validation to all routes

Canonical Hashing Implementation

Ensure consistent hash generation for evidence integrity

Why: Cryptographic integrity depends on deterministic hashing

Files to create:

• ui/lib/api/canonicalization.ts - Hashing utilities
• ui/app/api/receipts/verify/route.ts - Verification endpoint
• Update all routes creating receipts to compute hashes

Dependencies to add:

npm install canonicalize

Digital Signature Implementation

Cryptographically bind evidence to principals

Why: Non-repudiation and authenticity verification

Files to create:

• ui/lib/api/signatures.ts - Signature utilities
• ui/app/api/principals/keys/route.ts - Key management endpoint
• Update receipt creation to include signatures

Database changes needed:

• Add signature and signature_algorithm columns where missing
• Store principal public keys in principals.public_key_fingerprint

Service Grant Authorization Middleware

Verify API keys have required permissions before allowing access

Why: Enforce service bundle scopes and quotas

Files to create:

• ui/lib/api/middleware/authorize-service.ts - Authorization middleware
• Update all external API routes to use authorization

Request Logging Middleware

Track all API usage for audit trails

Why: Complete audit trail of API operations

Files to create:

• ui/lib/api/middleware/log-request.ts - Logging middleware
• Update all routes to log requests

Rate Limiting & Quota Enforcement

Prevent abuse and enforce service level agreements

Why: Fair usage and DDoS protection

Files to create:

• ui/lib/api/middleware/rate-limit.ts - Rate limiting utilities
• Update authorization middleware to check limits

Output Linking

Link API responses back to evidence objects

Why: Complete traceability from API call to evidence

Files to create:

• ui/lib/api/middleware/link-output.ts - Output linking utilities
• Update routes that create evidence to link outputs

Priority 2

Verification Endpoints

Public Verification Endpoints

Allow external parties to verify evidence integrity

Endpoints to implement:

• POST /api/verify/receipt - Verify receipt integrity
• POST /api/verify/vault - Verify vault object seal
• POST /api/verify/audit-pack - Verify complete audit pack

Priority 3

Dashboard Enhancements

Metrics and Analytics

Enhanced visibility into governance operations

New metrics to display:

• Technical pass rate vs Governance approval rate
• Policy evaluation breakdown (which rules pass/fail most)
• Service usage by bundle
• HITL decision times and outcomes
• Agent behavior anomaly alerts