Roadmap

Mirrored from NEXT-STEPS.md in the repository — edit that file, not this page.

AIOUM is live: the network, the app, the marketplace, the agent runner and the docs all run today. This page lists what is in progress and what comes next, grouped by area, followed by what shipped most recently. It is linked from the book (docs/SUMMARY.md).

Protocol

  1. Security review. Every release goes through review before it ships; the running record is Security review.
  2. Public bug bounty. A funded bounty on the contracts and the node runtimes, following the posture in SECURITY.md.
  3. Token programmes. The genesis allocation (40% ecosystem incl. protocol-owned delegation / 20% core contributors, 4-year vest / 15% strategic / 20% treasury / 5% protocol-owned liquidity), the ≤5%/yr emissions guardrail on the 1B cap and real-yield-first accrual are in design/tokenomics-proposal.md. Next: the buy-and-burn share and the protocol-owned delegation schedule go to governance votes.
  4. Parameter maintenance. escrowCapPerStake and the ZAI-denominated minimums are retuned by governance on price moves, using the parameter tables in economics.md and arbitration.md (min stakes, per-asset escrow caps, slash floor and bps, quorum, windows, reward pots). Next: an oracle, or a keeper that proposes retunes, so the ratios track price automatically.
  5. Tier 3 verification. The evidence format and the verify-evidence CLI dispatch attestations to pluggable verifiers (spec). Next: TEE and zkML attestation verifiers, and a Solidity proof verifier for on-chain fraud-proof games.
  6. Arbitration tooling. The juror runbook is guides/arbitrate.md and the app has the commit-reveal console. Next: a juror CLI that stores salts safely and batches reveal/claim, and a treasury → reward-pot funding routine (DAO action or automation).

Network and operations

  1. Public test network. A shared test copy of the network on a public test chain, with test USDC and faucet ZAI, so integrators can build against it without spending anything or running the local stack.
  2. Cross-box high availability. AIOUM_STORE=sqlite shares vouchers, transcripts and the settle queue across instances on one box, with a TTL settle-lease electing the settler. Next: a networked store (Redis/Postgres) for instances across boxes, and a worked remote-signer (web3signer) example.
  3. Discovery at scale. Subgraph-backed pagination for the marketplace; juror-staking entities in the subgraph; the explorer reading from the subgraph in place of the RPC scan.
  4. Load testing and gas benchmarks. The settlement loop under many sessions and node throughput under x402 load, on top of the CI gas baseline (.gas-snapshot, 225 entries, diffed via forge snapshot --check).
  5. Prebuilt node image. Publish the offchain/Dockerfile image to a container registry so compose up pulls it instead of building.

SDKs and packages

  1. Registry publishes. @aioum/sdk and @aioum/mcp to npm, aioum to PyPI. The publish dry-runs are green: both tarballs install in a clean project and the packed SDK reproduces the pinned vector (npm pack, then the MCP smoke test in packages/mcp/examples/smoke.ts).
  2. Python SDK. The smart-account path, and LangChain / CrewAI tool wrappers.
  3. Direct x402 spend. Third-party x402 endpoints (Apify's 20,000+ Actors behind Coinbase-scheme x402, and the wider ecosystem of ~2,000 endpoints) are reached today through the apify / brightdata adapters (guide). Next: an EIP-3009 exact signer path in @aioum/sdk so an agent pays them straight from an AIOUM budget, a policy for which funds it draws from (session-key cap vs owner USDC), and transcript records for such calls.

App

  1. Dashboards. Session and earnings dashboards for operators and agents, and explorer polish.
  2. Managed billing. Stripe as the card processor, initCode-based account deploys (a fully gasless one-time setup) and a user billing dashboard, on top of the managed-billing layer (design).
  3. Privacy. Relay reputation weighting in ranking, multi-relay routing, and Layer 3 from design/privacy.md.

Recently shipped

  • Verifying paymaster and managed billing (2026-07-19). AIOUMVerifyingPaymaster: signature-gated sponsorship with time-boxed, op-bound, chain-bound sponsor signatures and a rotatable signer (13/13 tests through the real EntryPoint). Real-chain deploys ship it unfunded via SPONSOR_SIGNER_ADDRESS; verify-deploy confirms signature-gating on-chain before it permits a funded deposit. The managed-billing layer (design): accounts and a credit ledger with a platform fee on top-ups, prepaid / subscription / free-tier plans with rolling caps, low-balance and depleted notifications with webhooks, treasury-funded deposits, and SDK sponsorship config — verified end to end (card top-up → credits → funded escrow → gasless open through the verifying paymaster → free-tier cap refusal).
  • Subgraph (2026-07-19). Refreshed ABIs, Service.commitRequired, EscrowCap + Protocol.slashBps, Dispute.stakeAtRaise + escalated, and the full DisputeCommit juror lifecycle (commit / reveal / penalize).
  • Dispute verifiability, Tiers 0–2 (2026-07-19). Canonical Merkle transcript format with cross-implementation pinned vectors; both node runtimes record durable transcripts and auto-anchor roots before settle; the commitRequired service flag enforced at settle; SDK evidence packages; the verify-evidence arbitrator CLI with deterministic re-execution and Tier 3 attestation hooks (spec).
  • Arbitrator runbook (2026-09-17). guides/arbitrate.md: stake, watch disputes, commit with safe salt storage, reveal, finalize, claim, penalties, exit — as cast steps and via the app's console.
  • Privacy Layers 1–2 (2026-07-19, design/privacy.md). SDK deposit bucketing and per-relationship account salts, node settle jitter, and the bonded privacy relay (npm run relay, agent.openSessionVia); npm run demo:relay shows no on-chain client ↔ target link. The indexer's GET /relays is the relay directory and the explorer surfaces it.
  • Service adapters and the template gallery. Config-driven services.json adapters (generic REST, OpenAI-compatible LLM reseller, local Ollama) with env-resolved secrets and template / dot-path mapping, loaded by multinode via AIOUM_SERVICES_CONFIG; verifiability applies to resold APIs automatically. The gallery (2026-09-17): 90 ready-made listings in offchain/templates/, npm run templates (list / add / verify / docs), the app's Earn page, and docs/reference/templates.md.
  • Packaged node. offchain/Dockerfile + docker-compose.yml + the node quickstart: config file + env + compose up, zero code edits.
  • Operator HA (2026-07-19). Encrypted-keystore / env operator keys, PID instance locks, Prometheus /metrics, and multi-instance under one operator key: AIOUM_STORE=sqlite shares vouchers, canonically-ordered transcripts and the settle queue across N instances, with a TTL settle-lease electing the one settler and automatic failover (7/7 store/lease units; npm run demo:ha alternates calls across two instances, kills the leader mid-session, and the survivor settles with an anchored root covering both instances' calls).
  • Python SDK. packages/python-sdk (pip install aioum): discovery (node or indexer), EOA sessions via web3.py, per-call EIP-712 x402 vouchers, settle / reclaim, canonical transcripts and evidence packages sharing the pinned cross-implementation vectors. 7/7 tests.
  • Global discovery. npm run indexer (:8549): chain scan + seed-URL endpoint probing + ranking, served in the node /services shape so SDK discover() sees the whole marketplace unchanged.
  • Explorer and landing page (2026-07-19). frontend/explorer.html — sessions / settlements / disputes / staking / ZAI-transfer views scanned from RPC, with configurable Etherscan / Basescan outlinks for raw tx and address views; site/index.html — the landing page, deployable to any static host.
  • The app (2026-07-19; Earn and Deploy Agents pages 2026-09-17; dapp/). Next.js 15 + wagmi v2 + RainbowKit (MetaMask / Coinbase Wallet / WalletConnect) in the brand design system: Marketplace (indexer-ranked + relay directory), block-style Explorer (ZAI transfers / supply / burn tracker, node registry, sessions with anchored-root badges, disputes, search + scan outlinks), Staking (delegate / undelegate / withdraw / claim USDC), Arbitration (commit-reveal console, salt-before-broadcast + backup), the live ZAI dashboard, Pay by card through on-ramp partners (their keys on the deposit service), the Earn page (template gallery → services.json) and the Deploy Agents page (wallet → smart account → session key, with paste-ready Claude / SDK configs; SESSION_KEY mode in @aioum/mcp, agentFromSession in the SDK). scripts/devstack.sh review boots the whole product surface on localhost. The static frontend/ pages remain as dev consoles, including the commit-reveal arbitration console (crypto-random salts persisted locally before the commit tx broadcasts, outstanding-commitment tracking, export / import backups, reveal / finalize / slash-no-reveal / DAO-escalate).
  • Ramps and paymaster tooling. funding-and-ramps.md (onramp guidance, paymaster funding policy, off-ramp notes) and npm run paymaster (deposit status, runway estimate, AIOUM_PAYMASTER_MIN_ETH threshold alerting, refill).
  • Release engineering. The docs book builds with mdBook (book.toml, .github/workflows/docs.yml → GitHub Pages) and is served by the app at /docs.
  • Gas baseline. .gas-snapshot (225 entries), diffed in CI via forge snapshot --check.