Project roadmap
All-system plan plus detailed roadmaps for Oracle, Agency, and SPOOL
All / company roadmap System
North star
Make industrial production legible, intelligent, and liquid. One system in three layers: Oracle answers what is true, Agency answers what may be done, SPOOL answers what credit and settlement follows.
Phased company timeline
Phase 0 — Now
Company site, white papers, vision docs live. Local MVP vertical demo exists at MVP workspace (ERP fixture → score → policy → simulated advance + fail-closed). Oracle private prototype; Agency & SPOOL in active development.
Phase 1 — Pilot-ready MVP · Weeks 1–8
One Electronics PO on Arbitrum Sepolia. Deploy ScoreRegistry, Order NFT, IndustrySpool, PolicyEngine; wire agency loop; operator dashboard + audit export. Exit: stale feed blocks advance; allowlist enforced; human multi-sig for over-cap.
Phase 2 — First real pilot · Months 3–4
One mid-market supplier, one buyer PO. Real ERP connector (not fixture only). Ops runbook, escalation drills, pilot metrics. Capital remains testnet or tightly capped.
Phase 3 — Depth · Months 5–8
Stronger evidence + safer agency. Vision/logistics multi-source fusion, model calibration, richer policy bounds, fork simulation, optional L1 score-root anchoring.
Phase 4 — Credit markets · Months 9–12+
Mainnet Arbitrum with limited liquidity. More industry spools, LP/buyer surfaces, Stylus where needed, audits, governance, observability SLOs.
Company-wide exit criteria (pilot-ready)
- Score updates within minutes of ERP change
- Stale / paused oracle blocks advance (fail-closed)
- Agent never calls a non-allowlisted selector
- Demo path: score up → advance; score crash → pause; human approves escalations
- Audit trail: attestation + decision + tx hash
Fulfillment Oracle Evidence layer
Status · Private prototype → Sepolia publish
Turns plant reality into a cryptographically attested Fulfillment Probability Score. MVP uses ERP-only features; full vision adds computer vision and logistics.
Mission by phase
| Phase | Oracle deliverable | Acceptance |
|---|---|---|
| 0 Now | ERP fixture schema, weighted score engine, fail-closed states, HMAC attest stub, local ingest | Local demo publishes Normal scores; stale → Paused |
| 1 Weeks 1–2 | Real EIP-712 attest; ScoreRegistry on Arbitrum Sepolia; publish/read API | On-chain latest score per orderId; consumers verify signer |
| 2 Months 3–4 | Live ERP connector for one pilot plant; freshness SLO; operator alerts | PO score updates within minutes of real work-order change |
| 3 Months 5–8 | Vision + logistics fusion; calibration / drift monitors; threshold signing option | Degraded mode when one source fails; no false confidence publish |
| 4 Months 9–12+ | Two-tier publish (L2 freshness + L1 Merkle root); multi-node consensus | Advance-grade reads can require parent-chain safe finality |
Detailed MVP tickets (Oracle)
| ID | Work | Done when |
|---|---|---|
| ORC-1 | ERP JSON schema + fixture PO-2026-0001 | Schema validates; orderId stable |
| ORC-2 | Score engine → scoreBps + explanation | High/mid/low unit tests |
| ORC-3 | EIP-712 attest + verify | Recovers authorized oracle address |
| ORC-4 | Fail-closed: Normal / Degraded / Paused / Recovering | Stale feed does not publish |
| ORC-5 | ScoreRegistry + Sepolia deploy | Publish & read on chain |
MVP score features (ERP-only)
- Deadline slack (35%)
- Production velocity (30%)
- Quality proxy / defect rate (15%)
- Supplier on-time history (15%)
- Lead-time risk (5%)
Fail-closed rules
| State | Trigger | Behavior |
|---|---|---|
| Normal | Snapshot ≤ 5 min | Publish attested score |
| Degraded | 5–15 min age | Publish with uncertainty; agency haircut |
| Paused | > 15 min or missing fields | Stop publishing; advances blocked |
| Recovering | Feed restored after pause | −500 bps haircut one cycle |
Later Oracle backlog
- MES / mid-market ERP adapters beyond fixture
- Line vision throughput & stoppage detectors
- Carrier / dock logistics milestones
- PyTorch calibrated model replacing weighted MVP scorer
- HSM/MPC oracle keys; k-of-n threshold attestation
Agency for Smart Contracts Governance layer
Status · Building → Sepolia agent loop
Policy-bounded DeFi agents that observe oracle scores, simulate calls, and execute only allowlisted actions. Keys and limits stay off-model; high-impact moves escalate to human multi-sig.
Mission by phase
| Phase | Agency deliverable | Acceptance |
|---|---|---|
| 0 Now | Band mapper, allowlist table, in-process simulate, escalate queue stubs | Local vertical demo: mint → escalate over-cap → pause on stale |
| 1 Weeks 5–6 | On-chain PolicyEngine; runtime observe→decide→simulate→act on Sepolia | Unknown selector rejected; over-cap requires 2-of-2 |
| 2 Months 3–4 | Pilot ops console for approvals; runbooks; notification codes | Operators can approve/reject with audit |
| 3 Months 5–8 | Anvil/Foundry fork simulation; argument-level bounds; Timeboost optional for pause/reprice | State-diff rejects unexpected balance moves |
| 4 Months 9–12+ | Mainnet policy governance (timelock); signer HSM/MPC; novelty escalation | Agent compromise cannot bypass allowlist or escalation |
Policy bands (MVP)
| Band | Condition | Action | Escalate? |
|---|---|---|---|
| High | scoreBps ≥ 8000, fresh Normal | advance (within caps) | If amount > $25k auto-cap |
| Mid | 5500–7999 or Degraded | reprice → notify | No |
| Low | scoreBps < 5500 | pause + notify | Yes (pause lift) |
| Stale | Paused / missing score | pause | Yes |
Detailed MVP tickets (Agency)
| ID | Work | Done when |
|---|---|---|
| AGY-1 | PolicyEngine allowlist + value caps | Unknown selector rejected |
| AGY-2 | Band mapper | Matches band table |
| AGY-3 | Simulation gate | Bad diff → simulate_reject audit |
| AGY-4 | Runtime on Sepolia | High-score advance E2E |
| AGY-5 | Escalation 2-of-2 | Over-cap needs human |
Allowlisted actions only
mintOrder·advance·reprice·pause·notify- Empty allowlist authorizes nobody
- Model never receives signing keys, RPC secrets, or mutable policy text
Later Agency backlog
- Selector + argument decoding bounds for every value-moving call
- Express-lane (Timeboost) only for risk-reducing pause/reprice
- Novelty detection: first-time selectors always escalate
- Off-chain confidential policy with on-chain proof (optional)
SPOOL Protocol Credit layer
Status · Building → Sepolia Electronics spool
Production-verified credit: Verified Order NFTs, industry spools, score-linked advances. MVP is one Electronics spool on Arbitrum Sepolia with MockUSDC — not mainnet capital.
Mission by phase
| Phase | SPOOL deliverable | Acceptance |
|---|---|---|
| 0 Now | In-memory spool model (mint/advance/reprice/pause/notify) for local demo | Vertical-slice tests green |
| 1 Weeks 3–4 | VerifiedOrderNFT, IndustrySpool, MockUSDC on Sepolia; maxAdvance from score | Lower score → lower cap; paused score → revert |
| 2 Months 3–4 | Pilot funding of spool; supplier payout path; outstanding tracking | One real PO advanced under policy |
| 3 Months 5–8 | Repayment waterfall; continuous reprice; buyer notify surfaces | Score crash pauses new advances without manual scramble |
| 4 Months 9–12+ | Mainnet limited liquidity; Auto/Pharma spools; LP participation; Stylus path | Audited contracts; utilization & risk dashboards |
Detailed MVP tickets (SPOOL)
| ID | Work | Done when |
|---|---|---|
| SPL-1 | VerifiedOrderNFT mint-once | Duplicate mint reverts |
| SPL-2 | IndustrySpool Electronics actions | Selectors match allowlist |
| SPL-3 | MockUSDC + fund spool | Advance transfers to supplier |
| SPL-4 | maxAdvance = f(notional, ratio, score) | Paused/stale → 0 |
| SPL-5 | Foundry tests happy + fail-closed | CI green |
MVP advance formula
maxAdvance = notional × advanceRatioBps × scoreBps / 10000 / 10000
Default advanceRatioBps = 4000 (40% of notional at perfect score). Freshness window 900s.
Later SPOOL backlog
- Industry verticals beyond Electronics (Auto, Pharma)
- Buyer stake / notification for mid-band risk
- Stablecoin settlement asset upgrade from MockUSDC
- Public LP tranches with oracle-gated exposure
- Stylus compute for heavy credit logic; Ethereum L1 finality anchors
Dependencies & shared milestones Integration
Integration order
Layers are a directed chain. Do not advance SPOOL liquidity before Oracle fail-closed and Agency allowlist are proven.
Build order (MVP)
- Oracle ORC-1…4 — local truth + fail-closed (mostly done in
MVP workspace) - Oracle ORC-5 — ScoreRegistry on Sepolia
- SPOOL SPL-1…5 — NFT + spool + MockUSDC wired to registry
- Agency AGY-1…5 — policy + runtime driving spool
- Dashboard DASH-1…5 — operator surface + pilot drill
Shared dashboard tickets
| ID | Work | Done when |
|---|---|---|
| DASH-1 | PO list + detail | Score, state, last decision visible |
| DASH-2 | HTTP API | Orders / audit / demo controls |
| DASH-3 | Audit export JSON | Attest + decision + txHash |
| DASH-4 | Fail-closed drill script | Supplier walkthrough reproducible |
| DASH-5 | Site contact → pilot runbook | /contact/?topic=oracle-pilot linked |
Cross-layer dependency matrix
| From → To | Interface | If broken |
|---|---|---|
| Oracle → Agency | EIP-712 attested score + state | Agency must treat as Paused / no score |
| Agency → SPOOL | Allowlisted calldata after simulate | No capital movement |
| SPOOL → Oracle | Reads registry for maxAdvance | Advance reverts when stale/paused |
| Human → Agency/SPOOL | 2-of-2 escalation | Over-cap and pause-lift blocked |
Suggested next 2 weeks
- Finish ORC-5 — ScoreRegistry on Sepolia
- Land SPL-1–3 — NFT + spool + MockUSDC
- Keep marketing site as pilot intake only
Team posture
- Core team: 2 engineers, remote-first
- Stack: Rust · Solidity · Python · TypeScript
- Execution: Arbitrum Sepolia → Arbitrum One; settlement root Ethereum L1 (later)