# Roadmap

The roadmap advances one observable demonstration at a time. Later stages do not invalidate earlier cursor records.

## 0 — Executable truth model (now)

**Demo:** three bodies fan out work, one disappears, another resumes it, results join, and an effect occurs once.

- canonical typed codec;
- signed cursor and capability records;
- capability attenuation and budget split;
- leased attributed tuples;
- mailbox deduplication and effect receipts;
- visual cockpit and behavior-oriented tests.

Exit condition: independent implementers can explain every field and reproduce test vectors without reading UI code.

## 1 — Real local constellation

**Demo:** separate OS processes communicate over a framed local transport; kill one process and watch another resume.

- persistent object store;
- local key agent;
- executor protocol and compatibility assertions;
- mailbox journal;
- child process / worker isolation;
- deterministic fault injector;
- first Preserves/Syndicate-compatible edge adapter.

## 2 — Network constellation

**Demo:** two people's machines discover each other through replaceable rendezvous, exchange grants, and cooperatively execute a cursor.

- end-to-end authenticated sessions;
- signed bootstrap manifests and invite flow;
- QUIC/WebRTC/Caravan transport adapters;
- scoped distributed dataspaces;
- revocation/expiry cockpit;
- NAT traversal and relay privacy analysis;
- fountain-coded recovery experiment.

## 3 — Language worlds

**Demo:** a Squeak or Self-like live world pauses a facet locally and resumes it on another body while preserving inspectable history.

- portable continuation ABI;
- Smalltalk image/object bridge;
- Syndicate facets and assertions;
- WASM executor;
- headless world server;
- polyglot object views and debugging.

Current foundation: the SQLite-owned Cursor Machine, explicit continuation state, restricted watch-party Lua profile, browser SQLite Wasm Worker, Nelua scheduler-packet ABI, and cockpit proof flight are shipped research slices. A general embedded Lua VM, Smalltalk image bridge, and portable live-world editor remain future work.

## 4 — Linux host and driver cells

**Demo:** a Cursors record performs real NVMe and network operations through restartable isolated Linux driver cells.

- narrow host ABI;
- shared queue and sealed-region protocol;
- IOMMU/DMA confinement;
- device reset and uncertain-effect recovery;
- virtio path for VM testing;
- Linux application body/personality.

## 5 — Native host — deferred boundary

> **Decision gate: skip this implementation for now.** The guide records the boundary so readers can understand the eventual shape, but the current program must not boot or target selected hardware. Work continues at stages 6 and 7 without claiming stage 5 is complete.

**Future demo, not authorized in the current program:** boot in a VM and then selected hardware, join an existing constellation, run the same protocol vectors, and recover from a body reset.

- boot, memory, timers, interrupts, SMP, and isolation;
- native NVMe and minimal network path;
- verified boot and key agent;
- driver-cell hosting;
- native cockpit or remote world tools;
- reproducible images and hardware matrix.

None of those bullets are implementation tasks in the current Cursors work. They remain research inputs until a separate human decision explicitly reopens native-host work.

## 6 — Public operations world (now)

**Demo:** anyone can open the Cursors cockpit and flight manual, understand every visible connection and uncertainty, follow cross-linked guides, and inspect the same documentation as Open MCT objects without repository access.

- stable territorial netwalk with retained radar rather than a force-directed graph;
- contextual `?` helpers backed by one shared vocabulary;
- searchable and categorized public guides;
- guide objects and guide actions in the Open MCT tree;
- browser, webseed, relay, TURN, native, and signed-directory truth boundaries;
- an orbiting Self / Body pip and separately inspectable Cloudflare admission, mailbox, SQLite, signaling, and release machinery;
- public per-PR previews and production publication.
- an executable Machine Lab showing restricted Lua compilation, a renewable Linda lease, and transactional SQLite outbox readback without blocking the UI thread.

## 7 — Cooperative workbench and identity

**Demo:** an operator discusses the selected world, saves a proposal, signs in through a mailbox-bound local key, and grants an agent only enough authority to create a branch and draft pull request.

- server-side model and repository boundary;
- signed workbench proposal records;
- attenuated branch and draft-PR capability;
- mailbox challenge bound to PKCE and a local signing key;
- human review and CI as the production gate;
- encrypted session and checkpoint ledger experiments above the existing transport adapters.
- root-signed mailbox admission with bounded quotas before any public enrollment;
- resurrection capsules and peer-first signed-release recovery;
- a staged GitHub-to-mailbox Cursor Forge adapter.

## What not to do early

- promise transparent migration of arbitrary native processes;
- fork Linux before the host boundary is proven;
- design a global consensus layer for every application;
- invent a programming language before cursor and facet semantics are pleasant;
- launch trusted public signaling before key recovery exists;
- split repositories until independently releasable components actually appear.