Open-Core Model & Roadmap
Relevant source files
The following files were used as context for generating this wiki page:
Honmoon is developed under an open-core business model where the security-critical data plane is entirely open source to ensure auditability and trust, while the control plane and fleet management features form the basis for commercial offerings. The project follows a phased roadmap that progressively builds from core networking foundations to a multi-tenant SaaS platform.
The roadmap is structured into eight distinct phases (Phases 0–7), moving from initial foundations and egress filtering to advanced protocol-aware parsing, human-in-the-loop approvals, and eventually enterprise-scale fleet management. Sources: wiki/deep-dive/roadmap-open-core.md:10-18, docs/business-model.md:12-18
The Open-Core Boundary
Honmoon's architecture is strictly divided to support its business model. The data plane—consisting of proxies, parsers, and the policy engine—remains open source because security teams require transparency to trust a tool that inspects production traffic and credentials. Monetization begins when a user transitions from managing a single node to operating a fleet or requiring enterprise compliance features. Sources: wiki/deep-dive/roadmap-open-core.md:33-40, docs/business-model.md:32-44
Distribution of Responsibilities
The following diagram illustrates the boundary between Open Source (OSS) components and the planned Paid/Enterprise surface.
Feature Differentiation
| Area | Open Source (Adoption & Trust) | Paid (Team & Enterprise) |
|---|---|---|
| Data Plane | Proxies, Parsers, CEL engine (crates/*) | None (remains OSS for auditability) |
| Policy | Local YAML, single node | Fleet-wide management, versioning, rollouts |
| Audit | Local log, self-hosted dashboard | Long-term retention, compliance reports |
| Approval | Basic pause verdict | Routing, Slack integration, RBAC/SSO |
| Operations | Self-hosted binary | Hosted SaaS, multi-tenancy, SLAs |
| Intelligence | Basic rule matching | Managed allowlists, threat feeds |
Sources: wiki/deep-dive/roadmap-open-core.md:42-53, docs/business-model.md:32-44
Phased Roadmap
The project is currently in the middle stages of its eight-phase roadmap. Phases 0 through 4 are implemented and tested, while Phases 5 through 7 represent the future growth of the platform. Sources: wiki/deep-dive/roadmap-open-core.md:21-31, README.md:209-222
Implementation Status
Detailed Phase Breakdown
- Phases 0–2 (Core Infrastructure): Focused on the Rust monorepo foundation, the JSON schema for policy validation, and the initial
honmoon-proxyimplementation for HTTP egress filtering using a CONNECT proxy. Sources: wiki/deep-dive/roadmap-open-core.md:21-25, wiki/onboarding/executive-guide.md:21-25 - Phases 3–4 (Protocol Awareness & UX): Introduced the
honmoon-coreprotocol parsers for SQL and Kubernetes, thepauseapproval workflow, in-memory audit logs, and the React-based embedded dashboard. Sources: wiki/deep-dive/roadmap-open-core.md:26-28, wiki/onboarding/executive-guide.md:26-30 - Phase 5 (Hardened Isolation): Planned work for network-namespace (
netns) isolation and hardenedrun/joinmodes to prevent agent bypasses. Currently, isolation is advisory via environment variables. Sources: wiki/deep-dive/roadmap-open-core.md:29-30, wiki/onboarding/executive-guide.md:32-34 - Phases 6–7 (Commercialization): The transition to the paid tier, involving central management of multiple nodes, single sign-on (SSO), and the launch of a managed SaaS version. Sources: wiki/deep-dive/roadmap-open-core.md:31-32, docs/business-model.md:100-107
Technical Debt Tracker
Several key technical debt items (TD-xxx) act as prerequisites or blockers for roadmap milestones. Sources: wiki/deep-dive/roadmap-open-core.md:103-112
| ID | Description | Priority | Blocks Phase |
|---|---|---|---|
| TD-001 | Dual Rust/TS model sync; move to JSON Schema gen | Medium | Maintainability |
| TD-003 | Lack of real netns isolation for honmoon run | High | Phase 5 |
| TD-004 | Body rules need TLS termination (beyond CONNECT) | Medium | Phase 2 follow-up |
| TD-006 | SQL/K8s parsers not currently fed by a live socket | High | Phase 3 follow-up |
Sources: wiki/deep-dive/roadmap-open-core.md:103-112, wiki/onboarding/executive-guide.md:55-65
Licensing Strategy
Honmoon uses a dual-license strategy to protect its commercial interests while fostering an open-source community.
- Data Plane & Core: Targeted for Apache-2.0. This ensures that the code touching user traffic is auditable and can be freely used to build trust.
- Enterprise & Cloud: Targeted for BSL (Business Source License) or FSL (Functional Source License). These licenses allow source access but block competitors from re-hosting Honmoon as a commercial service.
Sources: wiki/deep-dive/roadmap-open-core.md:85-91, docs/business-model.md:64-74
Strategic Moat
Honmoon differentiates itself from competitors (like Deno's clawpatrol or GitHub's egress firewall) through three pillars:
- Protocol Awareness: Deep inspection of SQL, K8s, and HTTP beyond simple domains.
- Multi-runtime/Self-host: Not tied to a specific cloud platform or runtime.
- Unification: Combining egress domain filtering with protocol-level rules in a single tool.
Sources: wiki/deep-dive/roadmap-open-core.md:94-101, docs/business-model.md:77-90
Summary
The Honmoon roadmap balances the immediate need for a trusted, open-source data plane with a long-term commercial strategy focused on fleet management and SaaS operations. By maintaining a transport-agnostic core, the project ensures that its architectural bets remain reversible and adaptable as it moves from its current state (Phase 4) toward enterprise readiness. Sources: wiki/deep-dive/roadmap-open-core.md:115-120, wiki/deep-dive/architecture.md:117-129