Roadmap & improvements

Ready, reviewed, proposed, and still open.

A roadmap is most useful when it separates shipped behavior from evidence, ideas, and unfinished release work. Cascade Vault keeps those categories distinct.

Implemented today

Authenticated AES → Twofish → Serpent streaming cascade and v1.0/v1.1 interoperability
Optional independent secondary keyslot for the outer Serpent layer
Safe PAX archiving, atomically private staging, no-overwrite promotion, and full-content source verification
Windows x64/ARM64 and macOS x64/ARM64 build targets
Headless core, desktop app, interoperability CLI, deterministic vectors, and Rust verifier
Format 2.0 streaming Brotli compression presets: Off, Balanced, and Maximum
Authenticated size padding: None, 10%, or next size bucket
One output selector for destination, filename, compression, and padding

Internally verified

248 .NET tests plus two independent Rust corpus tests
Golden vectors, malformed inputs, 10,000 mutation cases, parser fuzz targets, and CodeQL configuration
Windows x64 interactive development testing and forced-termination scenarios
Deterministic SBOM, checksums, and unsigned development-package structure verification

Next engineering pass

Deterministic format 2.0 golden containers and an independent compatible reader
Broader cross-platform compression determinism and adversarial expansion testing
Signed installers and native package-lifecycle validation

Not yet available

Signed production installers, Apple notarization, and clean-machine package validation
Physical macOS and Windows ARM64 runtime validation
Completed screen-reader, high-DPI, high-contrast, APFS, exFAT, and network-share matrices
Independent third-party cryptographic audit or FIPS validation
Mobile apps, cloud sync, accounts, or password recovery

Compression design direction

Smaller is not stronger.

Compression occurs before encryption and is presented as storage efficiency—not another encryption layer. Decompression starts only after authentication and enforces total-byte, entry, file-size, and expansion-ratio limits.

Existing uncompressed v1.0/v1.1 vaults remain readable. Off plus None continues to write v1.1; enabled transforms use the explicit v2.0 framed format. Compression may reduce simple size correlation, but it cannot eliminate metadata leakage. Optional size padding is separate and authenticated.