Roadmap

M1 — the trial loop, end to end

Anonymous capability → free catalog (synthetic sessions + redistribution-safe samples) → parse/validate → free sim → certified Blotter + Grade → proof URL → 402 Offers settling via Stripe MPP or a compatible x402 method, with human claim-and-fund as fallback. HTTP, SDK, and MCP from day one; the published CLI runs the local open-source runtime, with its platform-connected mode in the next release. Zero regulatory surface.

M2 — standing commerce

Funded balances, both meters live, Billing-backed recurring resources and subscriptions, Spend Envelopes, and expanded procurement/payment methods. A purchased resource reaches a consumer only through Purchase, Delivery, and ADMITTED Input admission receipts.

M3 — presence

Always-on paper pods, 24/7 wakes, fire-then-inform notifications (SSE/MCP/webhook), and receipt-gated preview promotion. Every candidate Plan revision arms, runs sim regression and paper shadowing, and crosses an obligation-preserving supersession barrier before paper initiation changes.

M4 — live

Term-sheet Envelopes, one broker OAuth connector, live singleton pods, server-side ceiling enforcement, kill switch. The exact promoted semantic artifact receives a human-rooted live Envelope and a signed Deployment Capsule; the Execution module locally verifies authority, scope, admission, and fence before going ACTIVE.

The population arc (M2 and beyond)

Three accepted decisions (ADR-0025/0026/0027) set the direction once standing commerce and presence exist: the unit of portfolio management becomes the population, not the individual agent. Agent count is a free variable; what stays scarce and metered is what the Envelope already meters. This is roadmap, sequenced across M2+, not shipped surface.

• Populations, not hires (ADR-0025). Every PM write becomes an expression over cohorts: selectors resolve populations, a closed verb set acts on them, and one expression executes as one durable Operation with a per-node ledger. Widening authority is inexpressible in the algebra, unwritable rather than refused at runtime, while authority-reducing operations (narrow, disarm, revoke) always take an instant fast path. One imperative survives outside the evaluator: halt, a deliberately boring endpoint on its own minimal code path that disarms and revokes-to-sim over a named subtree, never suspends, and is callable by the human owner with no agent in the loop. The expression algebra is internal canon that every face compiles to; whether it ever becomes a public surface is a later decision, made on usage evidence.
• Language as interface (ADR-0026). A Brief is soft, directional English made accountable: versioned, content-hashed, and bound into the provenance of every Grade it produces, while never entering admission checks. A Journal is the per-session narrative behind the Blotter, hash-linked and immutable once the P&L is known, so the why cannot be rewritten after the outcome. A Thesis is a pre-registered, falsifiable claim with an explicit invalidated_when predicate; armed Plans cite it by hash, and invalidation fires wakes and disarms citing plans at machine speed. Certified calibration ("40 declared, 31 verified") becomes a skill signal at sample sizes where P&L alone says little.
• Allocation as a market (ADR-0027). Simple allocation policies stay the default; large pods can opt into auction allocation, where agents bid for capital and risk tranches with certified Grades and proofs as collateral, and winning mints a narrowing child Envelope with tenor and covenants. A correlationPremium consumes certified diversity telemetry, so near-clones price themselves out of a clearing and genuinely diverse books clear cheap. A human signs the Underwriting ceiling once; clearings mint narrowing children at machine speed inside it, and nothing widens. halt and every authority-reducing operation bypass the policy layer instantly; urgent risk-off never waits for a market.

Later

Marketplace onboarding for licensed data vendors; plan-artifacts as publishable, buyer-armed packages; the cross-customer corpus under designed governance.