docs(roadmap): bring the roadmap up to what actually shipped

[imran-siddique]

Response-plan list 1, P1.

ROADMAP.md opened with "Now — v0.1 draft (June 2026)" and listed the MCP profile, the A2A profile and cMCP Phase 2 under "Next — v0.2 (Q3 2026)". The repo ships spec v0.2, SDK 0.6.0, and a 0.4.1 conformance suite. The roadmap is the second file a serious evaluator opens and it said the project was two months behind where it is.

What changed

Now/Next/Later re-cut against the code rather than against the plan.

Shipped now lists what landed: the profile URI cutover and its enforcement in verify_record(), the delegation link block, transparency optional below Level 2, the azure-cvm-sev-snp platform, revocation at verification time, the OWASP and Acta cross-walks, and the AGT/cMCP/sandbox producer adapters.

Two corrections of substance, not just dates:

• The delegation block is described as the foundation the A2A profile binds to, not as the profile. The normative binding rules are the outstanding work, and the old text let a reader conclude otherwise.
• The anchor and inclusion-proof format (Publish the registry anchor format (inclusion-proof spec) publicly #111) is named as the highest-priority item on the page. Until it publishes, "verifiable without trusting the operator" is a claim about the future, and the roadmap should say so where an evaluator will read it.

One accuracy fix. The platform bullet describes what this repo does: the SDK verifies the record; verification of attestation evidence lives in cmcp and agent-manifest.

Added to Next: attested memory and persistent state, per the response plan.

Follow-up not in this PR

Two places in spec/trace-v0.2.md are stale in the same way and need their own change:

• §4.1 still says the MCP and A2A profiles are "targeted for v0.2", and §7 is headed "These need input before v0.2".
• §6.1 names CoSAI plus the LF entity hosting MCP as the proposed host. The org profile now names AAIF under the Linux Foundation as the single path (docs(profile): stamp the AI Act dates, name one standards home, lead with the self-attestation gap .github#28). This roadmap notes the discrepancy rather than quietly resolving it, since normative spec text is a separate decision.

🤖 Generated with Claude Code