Everything on this page is not built. It is here because the plan names it, because a
reader will reasonably expect it, or because a gap is better stated than discovered — and
each row says what the product does today in its place. There are no dates on this page and
there will not be: a date is a promise, and the only honest promise a small team can make
about an unbuilt feature is that it is unbuilt. What is finished is on What is finished,
and what is not, and what changed in each release is on Release
history.
An nftables ruleset inspector — the real ruleset chain by chain, mapped back to the configuration objects that generated each rule
Firewall hit counters joined from firewall statistics, per rule. There is no per-object nftables view — PLAN.md §7
Packet capture from the UI, ending in a downloadable .pcap
POST /api/capture answers 501 and returns the monitor traffic command to run by hand; the Diagnostics page shows you that command rather than reporting a capture that never started — agent/main.go
Per-host traffic history, an embedded time-series database, long-term graphs
Live counters, a server-sampled throughput series, and conntrack top-talkers. Flow export exists so an external collector can keep the history — PLAN.md §8
IPv6 operational views
IPv6 is configurable and not observable: no v6 route view, no v6 concept in the uplink model, and a v4-first Firewall page — README.md
A tc and qdisc tree visualiser, and the full CAKE knob set with an IFB ingress pipeline
The QoS editor stages qos policy cake with bandwidth, flow isolation and RTT, attached as egress on one interface, beside the qdisc the kernel installed — ui/src/pages/Qos.tsx
Nothing. No credible published miniupnpd image exists — the available ones are unaudited personal builds, refused on principle for a privileged host-network daemon — and the Companions page says the gap is open rather than offering something that does not work
A companion daemon for wildcard DNS, per-host DHCP options and PXE architecture matching
Nothing. Each of those is a platform gap in the base — Built on VyOS
Creating an OpenVPN instance from the UI
The page lists instances with per-mode status and can disable or delete them. Creation waits on a generate pki flow, and the page shows the commands instead — PLAN.md §8
A 1:1 NAT editor
The nat static table reads rules made from the CLI; the editor is switched off, with the reason on the page — Built on VyOS
The live image boots on hardware; a complete install to disk followed by a reboot into it is recorded only in VMs — What is finished, and what is not
A hardware compatibility list
None, and none will be invented. The image's driver packages can be listed; that is not a compatibility claim
A VM image — qcow2 or OVA
None. Install from the ISO into a VM
An arm64 image
None. The arm64 .deb exists for running the agent off-router against an arm64 router
A rescue boot entry, or a factory reset
Neither. Recovery is the documented order in the upgrade guide, and a console shell
Signed releases
The pipeline signs SHA256SUMS whenever a release key is configured, and publishes unsigned checksums with a warning when it is not. No key exists yet, so nothing published so far is signed — .forgejo/workflows/publish.sh
UI tests
The agent has over two hundred test functions, run race-clean in CI. ui/ has none; CI typechecks and builds it
A licence agreement, terms of service, a support address, published beta terms, prices
Not everything absent is a gap. These are decisions, and they are unlikely to move:
Per-app dashboard widgets. An app's health probe is TCP plus an optional HTTP path
and never an app-specific API, so the store stays a store rather than becoming a
collection of integrations to maintain — docs/apps.md.
Container start and stop out of band. There is no control socket. Stopping an app
stages disable, starting it deletes that, and a restart is a two-commit bounce —
because an app is configuration, and configuration is what rolls back.