# Roadmap (/docs/platform/roadmap)



## M1 — the trial loop, end to end [#m1--the-trial-loop-end-to-end]

Anonymous capability → free catalog (synthetic sessions + redistribution-safe
samples) → parse/validate → free sim → certified Blotter + Grade → proof URL → 402
Offers settling via Stripe MPP or a compatible x402 method, with human claim-and-fund
as fallback. HTTP, SDK, and MCP from day one; the published
[CLI](https://www.npmjs.com/package/kestrel.markets) runs the local
open-source runtime, with its platform-connected mode in the next release. Zero
regulatory surface.

## M2 — standing commerce [#m2--standing-commerce]

Funded balances, both meters live, Billing-backed recurring resources and
subscriptions, Spend Envelopes, and expanded procurement/payment methods. A purchased
resource reaches a consumer only through Purchase, Delivery, and `ADMITTED` Input
admission receipts.

## M3 — presence [#m3--presence]

Always-on paper pods, 24/7 wakes, fire-then-inform notifications (SSE/MCP/webhook),
and receipt-gated preview promotion. Every candidate Plan revision arms, runs sim
regression and paper shadowing, and crosses an obligation-preserving supersession
barrier before paper initiation changes.

## M4 — live [#m4--live]

Term-sheet Envelopes, one broker OAuth connector, live singleton pods, server-side
ceiling enforcement, kill switch. The exact promoted semantic artifact receives a
human-rooted live Envelope and a signed Deployment Capsule; the Execution module
locally verifies authority, scope, admission, and fence before going ACTIVE.

## The population arc (M2 and beyond) [#the-population-arc-m2-and-beyond]

Three accepted decisions (ADR-0025/0026/0027) set the direction once standing
commerce and presence exist: the unit of portfolio management becomes the
**population**, not the individual agent. Agent count is a free variable; what
stays scarce and metered is what the Envelope already meters. This is roadmap,
sequenced across M2+, not shipped surface.

* **Populations, not hires (ADR-0025).** Every PM write becomes an expression
  over cohorts: selectors resolve populations, a closed verb set acts on them,
  and one expression executes as one durable Operation with a per-node ledger.
  Widening authority is *inexpressible* in the algebra, unwritable rather than
  refused at runtime, while authority-reducing operations (narrow, disarm,
  revoke) always take an instant fast path. One imperative survives outside the
  evaluator: `halt`, a deliberately boring endpoint on its own minimal code path
  that disarms and revokes-to-sim over a named subtree, never suspends, and is
  callable by the human owner with no agent in the loop. The expression algebra
  is internal canon that every face compiles to; whether it ever becomes a
  public surface is a later decision, made on usage evidence.
* **Language as interface (ADR-0026).** A **Brief** is soft, directional English
  made accountable: versioned, content-hashed, and bound into the provenance of
  every Grade it produces, while never entering admission checks. A **Journal**
  is the per-session narrative behind the Blotter, hash-linked and immutable
  once the P\&L is known, so the *why* cannot be rewritten after the outcome. A
  **Thesis** is a pre-registered, falsifiable claim with an explicit
  `invalidated_when` predicate; armed Plans cite it by hash, and invalidation
  fires wakes and disarms citing plans at machine speed. Certified calibration
  ("40 declared, 31 verified") becomes a skill signal at sample sizes where P\&L
  alone says little.
* **Allocation as a market (ADR-0027).** Simple allocation policies stay the
  default; large pods can opt into auction allocation, where agents bid for
  capital and risk tranches with [certified Grades](/docs/concepts/evidence) and
  proofs as collateral, and winning mints a narrowing child Envelope with tenor
  and covenants. A `correlationPremium` consumes certified diversity telemetry,
  so near-clones price themselves out of a clearing and genuinely diverse books
  clear cheap. A human signs the **Underwriting** ceiling once; clearings mint
  narrowing children at machine speed inside it, and nothing widens. `halt` and
  every authority-reducing operation bypass the policy layer instantly; urgent
  risk-off never waits for a market.

## Later [#later]

Marketplace onboarding for licensed data vendors; plan-artifacts as publishable,
buyer-armed packages; the cross-customer corpus under designed governance.