bare-crypto lacks scrypt; derive vault keys with PBKDF2-SHA256 there, keep scrypt on Node, and record the KDF on encrypted blobs.
Wire credential-aware pull/push, session auth, and an Images Registries tab for vault management.
Ship remaining roadmap items: encrypted registry vault, peer invite/revoke, Swarm/plugins behind flags, binary streams, engine create validation, deploy rollback, schema validation, fleet/access UI, metrics, fuzz/load/soak tests, systemd packaging, and release tooling. Mark ROADMAP fully complete.