Skip to content
LocumView

Status

Where LocumView stands.

Generated from the project roadmap each time the site is built, so it matches the repository. Done means built and verified; Built means working with open items; In progress means started and not shipped.

Roadmap status as of · commit d930ee0 · Source: ROADMAP.md in the repository

Core products

One philosophy. Different ways to put it to work.

An organization-led workspace designed for data sovereignty, and an engineering platform for its builders. Open engineering, reproducible systems, and people in control connect the products.
  • Built

    LocumView workspace

    An organization-led Linux workspace designed for data sovereignty and control over distribution, infrastructure and jurisdiction

    The clinical reference implementation runs on RHEL; version one and the Phase 4 core release milestone verified

    Linux distribution agnostic by design. Your organization chooses the platform that fits its requirements.

    • Red Hat Enterprise LinuxBuilt
    • SUSE Linux Enterprise / openSUSEIn progress
    • DebianPlanned
    Explore deployment choices
  • In progress

    Catalyst

    An AI-focused development platform helping clinicians and other domain experts deepen IT engineering and building skills

    Alpine VM desktop, native Rust/C workflow and managed LazyVim Rust language-server checks verified

    Explore Catalyst

5 of 5 done

Version one

Version one is complete when all five items are done. The scope is locked; changing it takes a new architecture decision.
  1. Done

    One RHEL 10 desktop built as a bootc image from a Containerfile and provisioned on the reference hypervisor (libvirt) from a clean clone, with zero manual steps

    2026-10-20. The image builds, boots and updates in place; no FIPS mode (ADR 0012). Desktops install from an ISO with LUKS bound to the vTPM and provision themselves on first boot: IdM, RDP, break-glass, firewall. OpenTofu creates and destroys a desktop with its IdM host entry, Guacamole connection and Red Hat registration (, ADR 0013). CI builds, signs (cosign) and attests (SBOM) the image, and the installer is built from the signed image. Desktops track the registry and accept only images signed with the project key, proven on a desktop provisioned with no manual steps. The destroy-and-rebuild proof from a clean clone passed on 2026-10-20: a fresh clone plus the site values file, tofu apply to a provisioned desktop in 8 minutes, checked, then tofu destroy with nothing left behind. The final STIG scan, of a third desktop built from a clean clone and installed from an ISO with the provisioning fixes the first rescan led to: the image STIG profile passes 405 rules with 0 failures, and the HIPAA profile fails 37 rules, 2 fewer than the reference desktop; reports in docs/evidence/stig/20261020-image and 20261020-hipaa. ADR 0007.

    Item 1
  2. Done

    Reached in a browser through Guacamole, Keycloak SSO with enforced MFA, no exposed RDP

    Live at login.locumview.com since 2026-10-02.

    Item 2
  3. Done

    DISA STIG profile applied, OpenSCAP report committed, exceptions documented

    2026-10-19 on the reference desktop: DISA STIG with GUI, tailored; 417 pass, 0 open failures; reports in docs/evidence/stig, exceptions in hardening/stig/README.md. The bootc image applies the same profile at build time and has the separate file systems; FIPS mode is an exception (ADR 0012).

    Item 3
  4. Done

    Encryption in transit everywhere

    2026-10-19: every hop that crosses a network is encrypted. Browser to Cloudflare (TLS), the tunnel, pod traffic between cluster nodes (k3s WireGuard backend, ), Keycloak to IdM (LDAPS), and RDP to the desktop (TLS). Traffic between pods on the same node does not leave the host.

    Item 4
  5. Done

    README with architecture diagram, quick start, HIPAA technical-safeguard mapping, honest status

    2026-10-19: quick start for the checks and the access layer; HIPAA mapping in docs/hipaa-technical-safeguards.md, with its gaps stated (encryption at rest partly met since ). The desktop part of the quick start points to image/desktop/README.md (item 1 done 2026-10-20).

    Item 5

After version one

Work beyond version one, by area. Some is already built ahead of schedule.

Identity

  • Built

    Red Hat IdM directory (first server on the reference hypervisor), Keycloak federation, organizational login on desktops; Keycloak stays the MFA authority

    2026-10-05, ahead of version one by owner decision: IdM server, read-only federation, owner's account in IdM, reference desktop enrolled (GNOME login, lock screen, sudo via IdM), nightly encrypted backups. Open: a second replica, password policy, backup alerting

    ADR 0006
  • Planned

    WebAuthn / passkeys; MFA for the demo login

    ADR 0005

Access

  • Planned

    Guacamole session recording; edge rate limiting

  • Planned

    Per-evaluator demo accounts with an expiry date (disabled at expiry, deleted later)

    When real evaluators exist; until then the shared guest password is rotated after each evaluation (docs/runbooks.md)

  • Planned

    Close abandoned demo connections: idle logout or screen lock on the demo desktop

    Guacamole keeps a session alive while a desktop connection is open, and the demo desktop has no screen lock

  • Built

    Clipboard DLP: copy-out blocked, 5-minute clipboard clear in sessions

    Lock-screen fix done, live clipboard tests pending

Desktop

  • Built

    Browser baseline (ADR 0016): Google Chrome for web EHRs in the image, managed policies following the DISA Chrome STIG, a default EHR launcher, Firefox ESR policies following the DISA Firefox STIG; an audit of Chrome's outbound traffic, published

    2026-10-20: with the EHR launcher open for 15 minutes no DNS query or HTTPS connection left the desktop (docs/evidence/browser/). Open: a 24-hour capture (Safe Browsing), egress rules on the desktop firewall

    ADR 0016
  • Built

    Image signing (cosign), SBOMs (syft), registry and build pipeline

    Desktops accept only signed images

    ADR 0007
  • Done

    Background image updates download and stage signed releases; the operator plans the reboot

    Stage-only service; newer signed candidate staged without reboot, then exact digest booted at an owner-planned restart (evidence). Existing desktop timer masks remain; production rollout is separate

  • Built

    Organization-set desktop layout (Mac, Windows or GNOME style), locked centrally

    Mac style and lock verified, Windows/GNOME not exercised

  • Done

    The live demo (login.locumview.com) on an image-built desktop, replacing the hand-built reference desktop

    2026-10-21

    Changelog ; the reference desktop stays as a fallback for about a week, then retires

  • Planned

    Separate, resettable demo desktop

    First KubeVirt workload

Supply chain

  • Built

    Every image build scanned against the STIG image profile before it is pushed, the result attached as a signed attestation; verified promotion: builds go to :testing, desktops follow :stable, which moves only after the signature, SBOM and scan are verified

    In Phase 4: first promotions 2026-10-22; the second tested on a test desktop first (upgrade, full STIG scan, rollback and forward). Live demo moved to :stable, verified in

    ADR 0007
  • Built

    LocumView's own pieces (shell extensions, branding, tour, EHR launcher) as signed RPMs, built and published by CI; the image installs them and checks every signature

    In Phase 4. Version pinning Done: two builds of one commit have the same four expected package versions in verified signed SBOMs (evidence). Planned: a public COPR mirror

Hypervisors

  • Planned

    Proxmox VE (practical production target)

    ADR 0007, 0009
  • Planned

    A dedicated desktop network (own subnet or VLAN); guacd's RDP egress narrowed from the LAN to it

    With Proxmox (Phase 6); today guacd may reach RDP ports on the LAN

  • Planned

    Host configuration as an Ansible role (bridge, nftables, libvirt, k3s prerequisites; the reference hypervisor, the second cluster node, then Proxmox hosts), replacing the shell scripts in hypervisor/

    With Proxmox (Phase 6); the desktop itself stays an image ()

    ADR 0007
  • Planned

    KubeVirt / OpenShift Virtualization (scoped learning piece)

    ADR 0007, 0009
  • Planned

    Public or sovereign cloud (AWS)

    ADR 0009

Integrations

  • Planned

    Nextcloud (files) via Keycloak OIDC, as a reference integration

    ADR 0009
  • Planned

    Synthetic FHIR server, Matrix messaging

    ADR 0009

Clinical AI

  • Planned

    Detachable clinical AI module (US only, FDA CDS design principles): one web app in the hardened Chrome, launched from the desktop and as a SMART on FHIR app from the EHR; deterministic rules flag, a local model explains; Antimicrobial Stewardship, IV to PO and ADE Monitoring queues. First, Phase 9 lite: a clinical AI demo on OpenEMR with synthetic patients, showing a stewardship and an IV to PO finding; then the full Phase 9. Watch item: Epic Connectors (announced 2026-10-21) as a possible read-only delivery path for stewardship findings; revisit when Epic publishes developer documentation

    ADR 0008, 0017
  • In progress

    Phase 9 lite: first a spike (a scenario loaded into OpenEMR reproducibly, cultures and susceptibilities read back through its FHIR API), then a versioned scenario library of 10 to 20 synthetic cases (20 to 30 for evaluation, with negative controls and ambiguous cases), the clinical app with EHR launch, rules and explanations, internal refinement; exit: a frozen, versioned evaluation build

    M1 spike Done: the scenario loads reproducibly; microbiology reads back partly (organism not coded, qualified MICs as text, no susceptibility-to-organism link). Owner decision: continue on OpenEMR with one organism per culture, and contribute fixes upstream in parallel. M2 Done: case format checked in CI, one-command idempotent loader, 14 cases (7 findings, 5 negative controls, 2 ambiguous) all approved in the owner's clinical review, and 20 reproducible Synthea background patients. M3 in progress: the app and its gateway run on k3s behind IdM names and certificates and Keycloak with TOTP; the desktop image's EHR launcher opens OpenEMR, and the SMART launch passes end to end on a desktop; that image is :stable. ADR 0019's spike passed: with a key held in each desktop's TPM, renewed by a small root helper from an IdM sub-CA, the desktop's Chrome reaches a mutual-TLS endpoint with no prompt, and Traefik refuses any other client at the handshake. ADR 0019 revised to match. Owner decision: M3 closes once ADR 0019 is built, so the EHR opens with one MFA sign-in

    (update 2026-10-22), (Proposed), docs/plans/phase9-lite-and-review-workspace.md, docs/plans/adr-0019-spike.md, docs/evidence/clinical/20261025-openemr-m1-spike/

    ADR 0017, ADR 0019
  • Planned

    Clinical Review Workspace: invited external clinicians assess the frozen build's findings on synthetic cases, through Keycloak with MFA, Guacamole and a short-lived desktop that opens the Review app; minimal reviewer data, no license numbers; first round three clinical pharmacists. A structured expert review, not clinical validation

    ADR 0018
  • Adopted

    Synthetic data and independence policy: synthetic patients only, no data from any employer, own resources only, not used in the owner's clinical work, no implied affiliation, reviewers recruited externally only

    2026-10-22

    Docs/policy/synthetic-data-and-independence.md

Distributions

  • In progress

    SUSE / openSUSE build from the same definitions

    Not shipped

    Infrastructure work has begun and runs largely in parallel with the RHEL build; not supported or shipped yet

  • Planned

    Debian build from the same definitions

Version-one housekeeping

Small items that are not part of the scope.
  • Done

    Remaining ADRs written: Terraform vs OpenTofu (0013), GNOME (0014), Guacamole (0015)

  • Done

    CI that re-runs the pre-commit checks on every push

  • Open

    Scoped kubeconfig for operators; admin GDM connection credentials into SOPS; Tomcat error page; cluster-wide egress policies

  • Open

    Backup procedure for desktop VMs on the reference hypervisor

  • Done

    scan-stig.sh accepts an explicit profile and auto-selects the image profile on bootc desktops, with the chosen profile recorded in the results; live auto-profile scan 405 pass / 0 fail (evidence)

  • Open

    Encryption at rest for desktop disks and cluster nodes. Desktops installed from the bootc image: LUKS bound to the vTPM. The hand-built reference desktop (until it is replaced) and the cluster nodes:

  • Open

    The rules the SSG HIPAA profile still fails: 39 on the reference desktop, 37 on desktops built from the bootc image (2026-10-20, which pass partition_for_var_log_audit and rpm_verify_permissions): applied through the tailoring or documented

Parked

Deliberately not pursued for now.
Parked

FIPS mode on desktops

GNOME Remote Desktop's RDP sign-in uses NTLM, which FIPS mode disables (tested 2026-10-19). Revisited when LocumView targets sectors that require FIPS 140 validated cryptography in FIPS mode (federal and defense health, FedRAMP), or when the remote display stack gains a FIPS-compatible sign-in. ADR 0012.

Parked

Clinical decision support in the EU

Requires MDR certification (Rule 11, Class IIa or higher; ISO 13485 QMS; notified body). Parked until there is a company with the capital and QMS to pursue it. In the EU, AI is limited to productivity verbs (draft, summarize, organize, retrieve). ADR 0008.

Done so far

Highlights. The build log has the detail.
  • Hand-built RHEL 10.2 reference desktop: UEFI + Secure Boot, vTPM, headless GNOME Remote Desktop, branding.
  • Strict LAN RDP validation, including GNOME's double redirection.
  • VM moved to the reference hypervisor on a LAN bridge.
  • SOPS + age secrets with a pre-commit guard.
  • Guacamole, Keycloak (TOTP), straight-to-desktop sessions, RDP firewalled to the cluster.
  • Branding, public access through the tunnel, guest demo, LocumView Tour, layout switch, marketing site and email.
  • DISA STIG with GUI applied to the reference desktop through a tailoring file reusable in the bootc build; 164 to 417 passing rules.
  • CI on every push, with the website preview following this roadmap.
  • Pod traffic between cluster nodes encrypted with WireGuard, closing the last unencrypted network hop.
  • README quick start and a HIPAA technical-safeguard mapping with its evidence.
  • The desktop as a bootc image: builds, boots with Secure Boot and the STIG's separate file systems, updates in place; FIPS mode tested and set aside (, ADR 0012).
  • Desktops install from an ISO with LUKS on the vTPM and provision themselves on first boot (IdM, RDP, break-glass), with no manual steps on the VM.
  • OpenTofu creates a desktop with its IdM host entry and removes all of it again; state encrypted (, ADR 0013).
  • CI builds, signs and attests the desktop image on a dedicated runner; the installer is built only from the signed image.
  • Desktops accept only signed updates: the signature policy rejects unsigned images and other registries; a desktop installed by OpenTofu moved to the signed CI build on first boot and booted it.
  • Browser baseline: Chrome for the EHR and Firefox ESR, both locked down to the DISA STIG settings; Chrome measured silent for 15 minutes (, ADR 0016).
  • Version one complete, 2026-10-20: a desktop built from a clean clone with zero manual steps, destroyed with nothing left behind, and rebuilt; its STIG scan passes 405 rules with 0 failures.