06 — Roadmap

Three phases. Each delivers on its own.

The order is not decorative: each phase technically builds on the previous one. Federation without a working protocol would be meaningless, threshold consensus without multiple mirrors impossible.

Phase 1 · running · ~10 weeks

Reach & Runtime MVP

Registry scraping via npm, PyPI, Maven Central, crates.io, and Go Modules
Self-instrumentation SDKs with four event types
One bootstrap mirror in the EU
Open Data snapshots as Parquet and CSV.gz — from day 1
Public Audit Log via Sigstore Rekor — from day 1
K1-K7 as binding acceptance tests before launch

Phase 2 · planned · ~Q3 2026

Federation & Zero Knowledge

End-user agent (Mode B) with k ≥ 25
Hybrid aggregator (Mode C)
ZK-SNARK attestation for k-anonymity — then mandatory
Second independent mirror
Gossip federation between mirrors
Mix-Net submission as opt-in transport — complements direct egress, does not replace it
mTLS as mandatory for federation

Phase 3 · planned · ~Q1 2027

Threshold Consensus

At least three independent mirrors
Threshold consensus on accepted aggregates
Sybil and Eclipse resistance as acceptance criterion

Brought forward and already delivered in P1-Ph3: the SDK languages Java, Go, Rust, and .NET, the build tool plugins for Maven, Gradle, cargo, and npm, as well as the cross-language conformance suite.

Timeframes for Phase 2 and 3 are planning, not commitment. They depend directly on whether mirror operators and pilot libraries can be found.

Before launch

The decision blockers are closed.

Four of the points that blocked the Phase 1 launch were decided on 2026-05-29 — three via ADR, the GDPR assignment via the responsibility matrix in the infrastructure documentation. They are listed here with their decision, not as open questions. What remains open is listed below.

Anti-Sybil — decided

Rate limit per DID (≤ 24 in 24 h for modes A, B, and C), cross-mode plausibility flag between Track A and Track D, and a 7-day burn-in as trust_tier: "new". Proof-of-Work was explicitly rejected — it wastes end-user CPU and works asymmetrically against botnets. Phase 2 adds a maintainer Web-of-Trust.

GDPR per Mirror — decided

The mirror operator is the sole controller for the aggregates stored and published in their mirror. The reporter is a data subject with their own DID; joint controllership does not arise. Each entry in mirrors.json requires a published privacy policy.

PURL and Aliases — decided

PURL strictly according to registry assignment, without mutation. Forks and renames run via a separately signed alias table; resolution is a pure view-layer function, which is why aggregate storage and audit log remain unchanged. Aggregates in __small_cohorts must never be resolved by name.

Open Data License — resolved, clearance pending

Phase 1 snapshots are published under CC-BY-4.0 and carry a Provisional clause in the manifest. The launch is explicitly not blocked by this. The only open item is the Foundation legal clearance; if it is rejected, the published snapshot remains valid and a re-issue appears under a new snapshot ID with new licensing.

Open before mirror launch: bootstrap financing. Who covers the hosting costs of the Phase 1 reference mirror of around €50 per month — foundation sponsorship, university data center, or crowdfunding? This point is scheduled for "before the mirror goes productive" and is thus the last real launch blocker. Help with this →

Additionally, continuously calibrated but not launch-blocking: the specific threshold values of the anti-Sybil heuristic — factor-10 threshold between Track A and Track D, burn-in period, and rate limit values are reviewed quarterly.

To open contributions →