trukhinyuri · Oct 14, 2026 · Oct 14, 2026
@@ -4,7 +4,7 @@
 and no single point of control.**
 
 CloudRING is an Apache-2.0 open source project for building private clouds,
-public cloud providers, and—eventually—a federation of independently operated
+public cloud providers, and, eventually, a federation of independently operated
 clouds. It is being built to combine a provider control plane with OCSv3 (Open
 Cloud Standard 3), a portable contract for developing and delivering cloud
 services without hard-wiring them into one provider, one platform
@@ -51,7 +51,7 @@ CloudRING's long-term goal is to make cloud infrastructure an interoperable,
 competitive network:
 
 - users choose providers and services for their quality, location, cost, and
-  legal fit—not because leaving is impractical;
+  legal fit, not because leaving is impractical;
 - providers share a reliable open platform and invest in the services and
   operating experience that differentiate them;
 - enterprises run the same model in private infrastructure and can extend it
@@ -89,7 +89,7 @@ Compute, networks, volumes, Kubernetes, object storage, databases, queues, AI
 infrastructure, and future products are cloud services. A service may be part
 of CloudRING, maintained by a provider, or developed independently. It becomes
 a first-class service by satisfying the same integration and operational
-contracts—not by receiving privileged access to platform internals.
+contracts, not by receiving privileged access to platform internals.
 
 ## OCSv3: one contract for cloud services
 
@@ -106,10 +106,11 @@ implementation replaceable. A conforming module declares its:
 - distribution, federation, compatibility, and commercial metadata.
 
 The wire contracts are intended to be language-neutral. The current reference
-implementation is Go-first and targets upstream Kubernetes APIs, but a service
-does not become portable by sharing CloudRING's implementation language. It
-becomes portable by exposing stable APIs, events, packages, and evidence that
-another conforming platform can validate and operate.
+implementation is Go-first and targets upstream Kubernetes APIs, accompanied by
+both a Go SDK (`sdk/ocsv3`) and a zero-dependency Rust SDK (`sdk/rust/ocs-sdk-rs`),
+but a service does not become portable by sharing CloudRING's implementation
+language. It becomes portable by exposing stable APIs, events, packages, and
+evidence that another conforming platform can validate and operate.
 
 OCSv3 is a specification developed by the CloudRING project. It is not currently
 an accredited international standard or certification scheme. See
@@ -156,11 +157,11 @@ flowchart TB
 
 The target separates three concerns:
 
-1. **Provider management plane** — identity, tenancy, product governance,
+1. **Provider management plane**: identity, tenancy, product governance,
    commercial policy, APIs, audit, and fleet coordination.
-2. **Regional cells** — bounded scale and failure units for lifecycle
+2. **Regional cells**: bounded scale and failure units for lifecycle
    controllers and infrastructure bindings.
-3. **Product data planes** — independently built services whose high-volume
+3. **Product data planes**: independently built services whose high-volume
    traffic and implementation details do not pass through the platform core.
 
 Federation must not introduce a shared root administrator, universal database,
@@ -173,8 +174,16 @@ connectivity whenever the product's declared operating model permits it.
 
 The repository already contains useful early slices, including:
 
-- OCSv3 package types, validators, SDK code, conformance fixtures, and a module
-  registry contract;
+- OCSv3 package types, validators, Go SDK (`sdk/ocsv3`), zero-dependency Rust
+  SDK (`sdk/rust/ocs-sdk-rs`), conformance fixtures, and a module registry
+  contract;
+- hexagonal provider port interfaces (`pkg/providerports`) across the nine OCS
+  service categories (`ComputeProvider`, `VolumeProvider`, `NetworkProvider`,
+  `KubernetesClusterProvider`, `ObjectStorageProvider`, `BackupProvider`,
+  `AccessControlProvider`, `SupportProvider`, `ExternalIntegrationProvider`)
+  with a contract conformance test suite;
+- unified operator and developer CLI (`cmd/cloudringctl`) and the Open Blueprint
+  control panel UI (`pkg/portal`);
 - identity, OIDC/JWKS/JWT, IAM-policy, secure-session, and audit primitives;
 - a PostgreSQL-backed transactional-state implementation;
 - provider-neutral site inventory, kubeadm rendering, and HA verification

@@ -20,10 +20,11 @@ the [public current state](roadmap/CURRENT_STATE.md).
 
 | Path | Purpose | Current maturity |
 | --- | --- | --- |
-| `cmd/` | Public CLIs for contract validation, roadmap verification, source safety, recovery, and reference operations. | Mixed `supported` repository tooling and `reference` operations; each command's help/README defines its scope. |
-| `pkg/` | Reusable Go packages for OCS, identity/IAM primitives, provider adapters, resilience, secure execution, and transactional state. | Implemented slices; not a complete provider runtime. |
+| `cmd/` | Public CLIs (`ocsctl`, `cloudringctl`, `cloudring-roadmap`, `cloudring-sourcecheck`, `cloudring-manifestcheck`, `cloudring-registry`, and reference operations). | Mixed `supported` repository tooling and `reference` operations; each command's help/README defines its scope. |
+| `pkg/` | Reusable Go packages for OCS, hexagonal provider port contracts (`pkg/providerports`), Open Blueprint portal UI (`pkg/portal`), identity/IAM primitives, provider adapters, resilience, secure execution, and transactional state. | Implemented slices; not a complete provider runtime. |
 | `internal/` | Implementation details for public commands and validators. | Internal API; no compatibility promise. |
 | `sdk/ocsv3/` | OCS Go SDK and authoring surfaces. | Early `reference`; OCS 1.0 is planned. |
+| `sdk/rust/ocs-sdk-rs/` | Zero-dependency Rust SDK for OCSv3 types, operation state validation, and conformance reporting. | Early `reference`; OCS 1.0 is planned. |
 | `contracts/` | Versioned schemas, fixtures, and validation contracts. | Contract-specific; a schema alone is not runtime readiness. |
 | `modules/` | Public OCS module-package definitions and early module slices. | Mostly `reference` or `experimental`. |
 | `reference/` | Synthetic end-to-end examples with no real provider or tenant data. | `reference`. |

@@ -1,6 +1,6 @@
 # Public current state
 
-Snapshot reviewed: 2026-07-28.
+Snapshot reviewed: 2026-10-14.
 
 This document is a public orientation aid. It contains no private deployment
 inventory or downstream status. [`roadmap.yaml`](roadmap.yaml) is the single
@@ -22,15 +22,17 @@ advance a goal.
 | Capability | Public state | Evidence and boundary |
 | --- | --- | --- |
 | Build, unit/race/vet, source-safety, and supply-chain checks | `implemented` for repository validation | Workflows and Go tests validate the accepted source revision; they do not prove a deployed cloud. |
-| OCS package types, validators, Go SDK, fixtures, and conformance tooling | `reference` / `experimental` | Packages and synthetic modules are testable. OCS 1.0 compatibility, a complete product runtime, and independent product release proof remain planned. |
+| OCS package types, validators, Go SDK (`sdk/ocsv3`), Rust SDK (`sdk/rust/ocs-sdk-rs`), fixtures, and conformance tooling | `reference` / `experimental` | Packages and synthetic modules are testable in both Go and Rust. OCS 1.0 compatibility, a complete product runtime, and independent product release proof remain planned. |
+| Hexagonal provider port contracts (`pkg/providerports`) across the nine OCS service categories | `reference` | Portable interfaces, deterministic SHA-256 request commitments, and an in-memory contract conformance suite exist. Concrete production provider runtimes remain planned. |
+| Unified CLI (`cmd/cloudringctl`) and Open Blueprint control panel UI (`pkg/portal`) | `reference` / `experimental` | Operator and developer CLI commands (`vm`, `k8s`, `s3`, `net`, `iam`, `billing`, `support`, `quota`, `doctor`) and the Open Blueprint web surface exist in the repository; full G03-G11 production qualification remains planned. |
 | Identity, OIDC/JWT, IAM-policy, secure-session, and audit primitives | `reference` | Reusable primitives exist. A complete serving identity platform, durable production authorization path, and full recovery lifecycle are not delivered. |
 | Transactional PostgreSQL state and migrations | `reference` | A reusable implementation and tests exist; it is not yet the complete provider-control-plane state model. |
 | Provider adapters and site profiles | `experimental` | Public schemas, validation, and synthetic inputs exist. Concrete provider accounts and inventory are outside the public boundary. |
 | kubeadm rendering and Kubernetes deployment profiles | `blocked` for independent installation | Public issues document missing executable substitution/join paths, schema integration, topology validation, and storage dependencies. A complete supported installer is not available. |
 | Backup, proof signing, restore collection, and resilience observers | `reference` / `experimental` | Reusable collectors and protocols exist. Integrated off-site recovery and promotion-grade failure campaigns are not publicly proved. |
 | Three-node and one-server-loss material | `reference` | It tests one declared single-failure topology. It is not a universal HA topology or production-grade availability promise. |
-| Provider control plane, organization model, inventory reconciliation, durable operations, and portal | `planned` | Owned by G03-G11 and the provider-control-plane public issues; no complete runtime exists. |
-| Network, volume, image, compute, Kubernetes, object storage, backup, access, support, and external products | `planned` | Goal contracts exist, but the products are not complete public runtime capabilities. |
+| Provider control plane, organization model, inventory reconciliation, durable operations, and portal | `planned` | Owned by G03-G11 and the provider-control-plane public issues; no complete production runtime exists. |
+| Network, volume, image, compute, Kubernetes, object storage, backup, access, support, and external products | `planned` | Goal contracts and hexagonal port interfaces exist, but the products are not complete public runtime capabilities. |
 | Multi-cell, multi-region, marketplace economics, and sovereign federation | `planned` | Explicit later roadmap work. No current implementation or availability claim. |
 
 ## Publicly known blockers