Roadmap

A plan stated as plainly as the code.

Phases 0 and 1 — the substrate and the operational layer — are complete and verified. Real signature verification, a live Arweave client, and a deployable resolver service are shipped and fail closed. What remains is gated on an external audit and named honestly, phase by phase. This is the roadmap, not a wish list: a box is shipped only if the pipeline exercises it today.

Shipped Partial · defined seam Roadmap · next Vision · sibling scope
Phase 0

The substrate

SHIPPED

The engineering baseline — the part everything else is gated on — is complete and reproducible from one command. This is what an evaluator can run today.

  • TypeScript SDK with a lean, audited dependency surface: resolveAid, validateAid, verifyChain, canonicalize
  • JSON Schemas, the RDF ontology, and the knowledge-graph module — projected and proven in Oxigraph (98 quads / 2 named graphs)
  • The two hash rules and the frozen praxis-canonical-json/1 encoding, with golden byte-equality vectors
  • CI with an artifact-drift gate proven in both directions · 68 tests · npm provenance on release
Phase 1

The operational layer

SHIPPED

The three boundaries the specification build left as defined seams are now closed and exercised by the pipeline. Real cryptography, real storage, real resolution — each fails closed rather than returning a plausible-but-fake result.

  • Real signature verification — BLS12-381 (Tezos tz4 min-sig), Ed25519, P-256, secp256k1 via @noble/curves, behind a CryptoProvider boundary; proofs are content-bound (a v1 proof is rejected on v2)
  • Live Arweave client — multi-gateway fetch with failover and a size ceiling (gateways untrusted), plus a bundler publisher with an HSM/KMS Signer seam
  • Deployable resolver service — chain → Arweave → re-hash → signature → status, returning an auditable proofChain; holds no keys and cannot mutate state
  • Signed examples verify end-to-end; runtime surface is two audited dependencies with 0 vulnerabilities in the shipped build
Phase 2

Contract & audit

CURRENT FRONTIER

The soulbound FA2 anchor contract has a full SmartPy test harness exercising every invariant and authority path — but it remains unaudited, and the tooling refuses to originate it to mainnet by policy. This is the one boundary held closed by choice, not capability.

  • SmartPy scenario suite for every authority path and the two-step controller handoff — present and passing
  • The five TAP-8 events and fail-closed transfer semantics confirmed against the spec
  • Independent third-party audit — the gate before any origination
  • Guarded Ghostnet origination (the deploy path compiles always, refuses mainnet)
Milestone: one real end-to-end identity on Ghostnet, after audit
Phase 3

The hosted resolver network

ROADMAP

The resolver is already deployable — this phase runs it as a hosted, federated network. Convenience over the protocol, never authority within it: independently built indexes federate by merging quads, and each side re-verifies for itself.

  • Hosted resolver & indexer network with federation by set-union merge
  • Developer dashboards, analytics, and enterprise integrations
  • Indexers remain non-authoritative — the anchor and the recomputation are the truth
Phase 4

Standards & registration

ROADMAP

Bind the identifiers and controls to stable, citable homes so the format becomes a standard rather than a single-vendor artifact.

  • Register the w3id.org/praxis identifiers at stable URLs
  • Formal alignment with NIST NCCoE, SP 800-63, and OWASP NHI guidance
  • The conformance evaluator describes compliance for others to certify against
Phase 5

Hardening & mainnet

ROADMAP

Production posture: sustained review, threat-model hardening, and the operational maturity a mainnet identity registry demands before institutions depend on it.

  • Continuous security review and threat-model expansion
  • Operational SLAs, monitoring, and incident procedures
  • Mainnet readiness for institutional identity at scale
Invariant I11 — honesty about boundaries

The status on this page is not editorial. It is drawn from the repository's vision-to-code cross-reference, and CI enforces the distinction: a phase reads SHIPPED only if the pipeline exercises it today. Everything ahead is named, phased, and gated — an investor and an auditor are shown the same map, because a trust system that hides its own edges has not earned trust.

Run phases 0 and 1 yourself. Watch the rest land.

Run the live verifier Build with the SDK Read the docs