@@ -1,73 +1,40 @@
 # Agent Mesh Roadmap
 
-## Phase 1: Alpha
+Agent Mesh is developed in three clear stages: validating the core architecture (`pre-v0.1.0`), expanding ecosystem integrations on a stable foundation (`v0.1.0` – `v0.x`), and locking in long-term backward compatibility (`v1.0.0`).
 
-**Versions:** `v0.1.0-alpha.x`
-**Status:** Under Construction / Ephemeral
+---
 
-The Alpha phase is focused on laying the foundational architecture, finalizing API contracts, and gathering community feedback. The network is functional but expects breaking changes as we iterate.
+## 1. Pre-`v0.1.0` — Exploratory and Core Foundation
 
-* **Core Objectives:**
+**Versions:** `v0.1.0-alpha.x`, `v0.1.0-rc.x`  
+**Stability:** Exploratory — rapid iteration to validate the core protocol, security model, and developer experience.
 
-  * Establish P2P routing and base node lifecycle.
-  * Deploy community developer testnets.
-  * Draft the initial architecture documentation.
-  * Integrate baseline network services: MCP, A2A, Inference.
+* **P2P Dataplane and Discovery:** Encrypted peer-to-peer connectivity (`libp2p` QUIC and TLS 1.3), Kademlia DHT service discovery, NAT hole-punching, and stateless `agentmesh-router` relays.
+* **Named Service Primitives:** Deny-by-default routing over four named schemes (`mcp://`, `a2a://`, `inference://`, `egress://`) instead of flat IP subnets.
+* **Identity and Task-Scoped Authorization:** Enrollment via OIDC, SPIFFE, and Kubernetes ServiceAccounts; channel-bound Biscuit credentials; compiled Datalog policy; and offline task attenuation (`tar_block`).
+* **Unified API and SDKs:** Single protobuf contract (`api/agentmesh.proto`), `agentmesh-node` daemon, standalone `agentmesh-one` binary, and native TypeScript (`sdk/js`) and Python (`sdk/python`) SDKs.
+* **Developer Testnets:** Public testnets and one-command onboarding (`agentmesh-node skill install`).
 
-* **Exit Criteria:**
+---
 
-  * Core network primitives are stable.
-  * Documentation accurately reflects the cryptographic boundaries and operational models.
+## 2. `v0.1.0` – `v0.x` — Stable Core, Integrations, and Ecosystem
 
-## Phase 2: Beta (Feature Completion)
+**Versions:** `v0.1.0` through `v0.x.x`  
+**Stability:** Stable for adoption — the core architecture and wire protocol are stable, with minor breaking changes possible between `0.x` minor releases as integrations mature.
 
-**Versions:** `v0.1.0` through `v0.x.x`
-**Status:** Functional, but APIs may break
+* **Sandboxes and Kubernetes Interoperability:** Turnkey integration with Kubernetes and isolated agent sandboxes so existing workloads can connect and burst across platforms with zero credentials inside guest memory.
+* **Agent Gateways and Service Meshes:** Native interoperability with agent gateways and service meshes over standard HTTP and OAuth 2.0 Token Exchange (`RFC 8693`).
+* **Cloud Secret Managers and Identity Federation:** Integration with cloud secret managers, key management systems, certificate authorities, and outbound cloud token exchange services for customer-governed sovereign meshes.
+* **Visibility, Audit Logging, and Fleet Operations:** OpenTelemetry metrics, tamper-evident audit logs across multi-hop agent calls, cryptographic geo-fencing (`region` labels), and multi-mesh fleet management.
+* **Packaging and Ecosystem:** Production Helm charts, Kubernetes controllers, agent harness skills, and mobile and edge companion nodes.
 
-The Beta phase iterates on functional completeness based on real-world deployments. Breaking changes are isolated to minor version bumps (`0.2.0`, `0.3.0`).
+---
 
-* **Core Objectives:**
+## 3. `v1.0.0` and Beyond — Long-Term Production Stability
 
-  * Full implementation of local Datalog attenuation (the "Autonomous Local Veto").
-  * Uncooperative sandbox confinement for agent execution (`network=none`).
-  * Bring-Your-Own (BYO) OIDC Identity Provider federation (e.g., Keycloak, Dex).
-  * Fail-closed jurisdictional label routing (e.g., `X-Mesh-Required-Labels: jurisdiction=eu`).
+**Versions:** `v1.0.0+`  
+**Stability:** Super stable — strict SemVer backward compatibility and enterprise-grade reliability.
 
-* **Exit Criteria:**
-
-  * All planned data-residency and control features are implemented and passing integration tests.
-  * API and Datalog schemas are frozen.
-
-## Phase 3: The Audit Freeze (Release Candidates)
-
-**Versions:** `v1.0.0-rc.x`
-**Status:** Feature Frozen / Undergoing Audit
-
-During this phase, **no new features are merged**.
-The codebase is strictly locked down to undergo rigorous external validation to ensure it meets our security and data-residency guarantees.
-
-* **Core Objectives:**
-
-  * **Security Audit:** Comprehensive third-party penetration testing, code review, and cryptography validation (focusing on Biscuit tokens and Ed25519 key handling).
-  * **Compliance Audit:** Validation against data-residency and traceability frameworks (e.g., GDPR data residency, EU AI Act traceability, CSF SEAL-3).
-
-* **Exit Criteria:**
-
-  * All critical and high-severity security vulnerabilities are remediated.
-  * External auditors officially sign off on the cryptographic and architectural claims.
-
-## Phase 4: Production Stable
-
-**Versions:** `v1.0.0` and beyond
-**Status:** Mission-Critical Ready
-
-The framework is certified for enterprise, regulated, and cross-border deployments.
-
-* **Core Objectives:**
-
-  * Strict enforcement of SemVer backward compatibility.
-
-* **Exit Criteria:**
-
-  * Continuous automated compliance scanning integrated into CI/CD.
-  * Established incident response and CVE publication lifecycle.
+* **Frozen Wire and Policy Contracts:** Guaranteed backward compatibility for `api/agentmesh.proto`, persisted node credentials (`MemberCredential`), and Datalog policy evaluation across `1.x` releases.
+* **Independent Security Audits:** Third-party cryptographic and penetration audits covering Biscuit token verification, PeerID channel binding, and key rotation.
+* **High Availability and Lifecycle Guarantees:** Multi-replica control plane high availability, zero-downtime upgrades, automated conformance testing, and a formal CVE disclosure and long-term support (LTS) policy.