What is finished, and what is not#

Wheelhouse is a working router platform with real gaps. This page is the list of both, before you move a network onto it. The same list is on the status page of the product site.

Built, and exercised#

What has actually been run#

If you are evaluating this, install it in a VM first. That is still the path with the most evidence behind it, and it exercises the same installer, the same units and the same first-boot sequence as the metal.

Not finished#

• The hardware evidence is one machine. The image installs to a disk and reboots into it on one physical machine, and that is the whole of the metal record: there is no hardware compatibility list and no second board. There is also no VM image — no qcow2, no OVA — and images are amd64 only, booting UEFI or legacy BIOS. The arm64 .deb exists for running the agent off-router against an arm64 router; there is no arm64 image.
• The end-user terms are a placeholder, marked as one in their own first paragraph. Nothing should be sold until real terms replace them — The Wheelhouse licence.
• IPv6 is not yet everywhere IPv4 is. Network → IPv6 shows v6 addresses, neighbours, routes and ip6 counters, and edits addressing, router advertisements and prefix delegation; static routes are edited for both families. The neighbour tables are v4, and the uplink model has no v6 concept; the Firewall page is v4-first.
• Nothing signs the audit log, and no router ships with a witness. The chain and the syslog export are described below; what neither buys is a signature, and the export sends nothing until you name a collector.
• App images are pinned, and pinning is a manual step. All 37 container entries carry name:tag@sha256:…, so what a diff approves is the bytes that install, and CI refuses a catalogue that goes back to a floating tag. Moving to a newer upstream image is a deliberate re-pin that produces a diff someone reads, so a pinned image ages until somebody does that.
• Releases are not signed. The pipeline signs checksums the moment a key exists; no key does. A checksum proves the download survived the network, not who built it.
• The interface is tested in jsdom, not in a browser. CI runs the agent's test suite with the race detector, and the web UI's suite beside the type-check and build. That suite renders nearly every page against answers mostly captured from real routers, and holds each to what it shows and what it stages; it also covers the sentences pending changes are described in, the search, the sidebar and the QR encoder's vectors. The configuration tree, reconcile, Support, About and the licence page have no test, and neither do some tabs of the pages that do. jsdom sees no layout, no focus order and no telemetry socket, so an overflowing table, a panel off the edge of a phone or a live view that stops updating is found only by looking, and that is done by hand, in a browser, before each release.
• A packet capture outlives the page that started it, by about twenty seconds. Diagnostics → Capture runs a bounded tcpdump on the router and ends in a downloadable pcap. With Stop it when nobody is watching — on by default — the agent ends it 20-25 seconds after the last time any signed-in page asked how it was doing, with reason unwatched and an audited stop against whoever started it; unticked, only its limits do, at most 300 seconds. What the page no longer does is lie about the file afterwards: it keeps watching, slowly, for as long as a pcap exists, and the download goes when the 15-minute retention deletes it. An agent that starts up sweeps the capture directory, so the pcap an agent killed mid-retention left behind no longer waits on the router for somebody to start another capture.
• The audit log on disk holds whatever was committed, secrets included. An entry stores the commands exactly as they were sent, so a commit that carried a WireGuard private key someone typed writes that key into the file, into the syslog export and into the hash chain. GET /api/audit redacts it below operator, but the file is secret material and a collector receiving it is holding secrets. A key the agent generated — a WireGuard tunnel's, an OpenVPN client's, a TLS key — is recorded as [redacted].
• IPv6, like every op-mode read, is served from a 3-second cache that answers first and refreshes behind. The first read after a commit can therefore show the v6 tables as they were before it — the ip6 ruleset tile can read 0 for a router that already has one, for one poll.
• The release gate has never decided a release. iso.yml installs the image before it publishes anything, and ci.yml publishes nothing, but both live on a branch that has reached neither main nor a tag. Until a v* tag is pushed, the by-hand tools/install-smoke.sh run is the only evidence an image installs.
• The traffic archive has not been watched for a month. Its arithmetic, its restore and its interface cap are covered by tests and were measured against a stub router over minutes. A router whose interface names come and go for 31 days has not been observed.
• UPnP is Wheelhouse's own, not the platform's. The pinned base has no service upnp configuration node and no miniupnpd package, so the agent answers UPnP and NAT-PMP itself and writes each mapping as a port forward and a firewall rule. It covers port mapping only: IPv6 pinholes are refused. See UPnP.

Shipped, but narrower than the name suggests#

The features below exist. Each is narrower than its name, so the boundary is stated here rather than found later.

Commercially, what is not ready#

Before each release#

Every release is driven in a browser against a live router before it is tagged. That is not the same bar as a hardware compatibility programme, a signed supply chain or a support contract.

See also#

• Roadmap — which of the gaps above are planned, marked as not built.
• Release history — what has changed, release by release.
• Reporting a vulnerability — the security gaps, in more detail.
• The Wheelhouse licence — the commercial gaps, in more detail.
• Requirements — what it runs on, and what has been run on it.
• Install in a VM — the path with the most evidence behind it.