Roadmap

What has shipped, what is next, what is deferred. Honest, dated, revisable — not a commitment ledger.

Last updated 2026-06-26. Forward dates are targets, not contractual commitments. We move them when the work warrants it; when we move one we say so on this page.

How to read this page

Shipped — live in production, anchored on-chain where applicable.
Near-term — scheduled work with an externally-imposed deadline (consultation close, public-comment close, ISE editor feedback cycle).
Medium-term — intended, not yet scheduled.
Deferred — not on the protocol’s direct path; either reframed as an opportunity for operators or scoped out for stated reasons.

The version of this page at any point in time is verifiable through the public on-chain audit anchor (/trust#audit-trail) and the changelog.

Shipped

2026-05-03: gSAIHM v1 genesis anchored on COTI V2 mainnet. 0x755beb60…0d0963a ↑, block 7,024,653. Soulbound governance utility live. Lifetime cap 10,000,000.
2026-05-03: Mainnet operating perimeter — canary-class agent flows running on COTI V2 mainnet (Cashier, Arbitrage, Purchasing) under post-quantum (ML-DSA / FIPS 204) signing.
2026-05-07: Trust Center published. See /trust.
2026-05-07: Audience pages — Individuals, Developers, Enterprise, Government, AI Providers, Supply Chain, Public Good, Competitors. Plus /quickstart, /faq, /comparison, Appendix.
2026-05-07: Pricing transparency — PAYG, Pro, Pro Fast, Enterprise, Enterprise Fast; canonical settlement in USDC.e on COTI V2 mainnet. See /pricing.
2026-05-18: /standards surface launched with first six crosswalks (NIST AI RMF 1.0, ISO/IEC 42001:2023, ISO/IEC 27001:2022, EU AI Act 2024/1689, GDPR Article 17, MCP). Internet-Draft draft-saihm-memory-protocol-00 submitted to the IETF Independent Submission Stream and accepted by the datatracker. W3C Community Group proposal submitted (5 founding supporters required to launch). NIST AI RMF use-case email sent to AIframework@nist.gov.
2026-05-24: Three standards crosswalks added — ISO/IEC 27018:2025, NIST SP 800-66 Rev. 2, NIST SP 800-88 Rev. 2 (Cryptographic Erase). Nine crosswalks now live.
2026-05-24: Five new open standards engagements drafted — IRTF CFRG mailing-list post on HKDF-SHA-256 per-record DEK derivation; public comment on NIST SP 800-133 Rev. 3 (Initial Public Draft); EU AI Act Article 50 transparency-obligations consultation response; EU AI Act Article 6 high-risk-classification consultation response; OWASP Agentic Security Initiative community-engagement plan. W3C CG supporter recruitment package drafted (six archetypes, target 10–15 invitations).
2026-05-26: IETF ISE fifteen-point response cover sent to rfc-ise@rfc-editor.org, with proposed -02 text quoted inline for each of the ISE editor’s review points (received 2026-05-25). cc’d to draft-saihm-memory-protocol@ietf.org.
2026-05-27: Internet-Draft draft-saihm-memory-protocol-01 posted to the datatracker (folds in editorial corrections preceding the ISE-feedback cycle).
2026-05-28: /standards rebuild — nine crosswalks linked; five new SDO engagement rows; honest status notes for AAIF (not yet submitted), AI Alliance (not yet submitted); Independent-Stream status disclaimer (RFC 4846 / RFC 8730); language calibrated for community review.
2026-05-29: EU AI Act Article 50 consultation response submitted to DG CONNECT via ec.europa.eu/eusurvey/runner/Art50guidelines. EU Survey contribution ID c83d1d83-36dd-486a-aca6-2c232ba12641; public-disclosure consent given. Six paste blocks covering Article 50(1) verifiable-manner clarification, Article 50(2) cryptographic-provenance complementarity (including AI agents in virtual / immersive environments), and Article 50(5) lifecycle persistence with the GDPR Article 17(3) carve-out. Five days ahead of the 2026-06-03 deadline.
2026-05-29: NIST SP 800-133 Rev. 3 (Initial Public Draft) public comment submitted to sp800-133-comments@nist.gov. Seven comments (4 Technical, 1 General, 2 Editorial) covering §5.2 category-2 HKDF / RFC 5869 cross-reference, §4.2 hardware-security-module and post-quantum + hybrid Note-to-Reviewers responses, §5.5 key-derivation-key rotation guidance, §4.2 multi-tenant additional-input examples, and two editorial flags. FOIA-disclosable. Eighteen days ahead of the 2026-06-16 close.
2026-05-29: EU AI Act Article 6 high-risk-classification consultation response submitted to DG CONNECT via ec.europa.eu/eusurvey/runner/AIhighrisks_2026. EU Survey contribution ID e555551a-27be-4859-8717-c74997ccd1d5. Section II (II.1 + II.2) and Section IV (IV.2) covered: Article 3(1) substrate-not-AI-system threshold; §II.2 ¶12 general-purpose AI gating; §IV.2.3 split-architectures / agentic-AI distinction; §IV.2.7(a) infrastructure narrow-procedural-task confirmation; Article 25 forward-reference; four concrete substrate-function use-cases proposed for out-of-scope confirmation. Twenty-five days ahead of the 2026-06-23 22:00 CET deadline.
2026-05-29: IRTF CFRG mailing-list post sent to cfrg@ietf.org (subscription confirmed). Single technical question on whether RFC 5869 (HKDF) remains the recommended construction for per-record data-encryption-key derivation given that NIST SP 800-133 Rev. 3 names neither HKDF nor RFC 5869. Operational data point shared from the SAIHM reference implementation. Archive: mailarchive.ietf.org/arch/browse/cfrg/.
2026-06-03: W3C Community Group launched. The AI Agent Memory Interoperability Community Group activated at w3.org/community/ai-agent-memory-interop with five founding supporters and began specification work.

Near-term (scheduled, with deadlines)

ISE-feedback +7d: Internet-Draft draft-saihm-memory-protocol-02. Per /standards#timeline, -02 will be posted within seven calendar days of any follow-up feedback from the ISE editor on the 2026-05-26 cover-letter response.

Medium-term (intent, not scheduled)

W3C Community Group charter: The AI Agent Memory Interoperability Community Group launched 2026-06-03 (see Shipped). A v1.0 draft charter was circulated to the group for consensus ratification on 2026-06-05, scoping the Group’s work as an interoperability complement to the IETF Internet-Draft rather than a competing specification. Open to any W3C-account holder at w3.org/community/ai-agent-memory-interop/join.
Agentic AI Foundation (AAIF) candidate project: Address the three adoption-floor gaps identified in v1 self-review (≥2 production-org deployments, ≥2 cross-organisation maintainers, ≥10 contributors). v2 proposal drafted 2026-05-19; submission gated on those metrics moving. AAIF founded 2025-12-09 with MCP, goose, AGENTS.md as inaugural projects.
AI Alliance working-group engagement: HubSpot working-group form-fill text drafted 2026-05-18; manual submission scheduled after near-term EU and NIST sends clear the queue. Targeted working groups: AI Trust and Safety, Application and Tools, Policy.
OWASP Agentic Security Initiative community engagement: Engagement plan drafted 2026-05-24 for the OWASP GenAI Security Project Slack channel #team-genai-agentic-security-initiative. Goal: SAIHM cross-reference in ASI Top 10 v2027 guidance for ASI03 (Identity & Privilege Abuse) and ASI09 (Memory & Context Compromise).
Independent security audit: Engage a reputable cryptographic / smart-contract / web-application audit firm to review the protocol implementation. Scope to be agreed with the audit firm; report and remediation status will be linked from /trust#audit-history.
Operator Track expansion: Onboard additional independent operators running SAIHM nodes for paying customers, with operator-specific compliance attestations (SOC, ISO, HIPAA BAAs) layered above the protocol. Apply.
Privacy + invoice 3-layer hybrid: Privacy-preference architecture using COTI’s native privacy primitives + private ERC-20 tooling for invoicing. Currently deferred until mainnet redeployment burn-in completes; once unlocked, may use first-party COTI Privacy Portal tooling rather than a SAIHM-custom adapter. Tracked.
Federated sharing primitives: Cross-vendor agent sharing is supported today via consent-gated grants. Federation conveniences (shared revocation views, aggregated audit-export) are planned but unscheduled.

Deferred

Bug bounty programme: Deferred — review 2026-12-31. A bounty programme will be stood up once it can be run credibly and sustainably. Vulnerability disclosure runs through /.well-known/security.txt in the meantime; reporters are coordinated with respectfully and credited (with consent) when fixes ship. We will revisit this entry on or before 2026-12-31.
OASIS Open TC chartering: Deferred pending AAIF traction. Not warranted before adoption signals from the open AAIF / IETF / W3C / NIST tracks justify a formal OASIS technical committee.
IEEE-SA Project Authorization Request: Deferred. Revisit when standards-track momentum or a corporate participant emerges to champion it.
Multi-chain settlement (operator opportunity): The protocol settles on COTI V2 mainnet only — SAIHM’s privacy and erasure properties depend on COTI V2’s native primitives, and out-of-band bridging into USDC.e on COTI V2 (e.g. via Hyperlane Nexus) already covers cross-chain payments. Multi-chain settlement at the operator layer — offering customers the ability to pay on Ethereum, an L2, or another chain and having the operator handle the bridge transparently — is an opportunity for any operator who wishes to serve their own customer base that way. The protocol does not need to grow its own settlement surface for that to happen.
Permanent storage for memory cells: Intentionally not on the roadmap. A permanence-oriented (immutable) substrate’s model is incompatible with cryptographic-erasure semantics under GDPR Art. 17 / CCPA right-to-delete, so cells are never written to an immutable substrate. Note: SAIHM does use an immutable substrate at the protocol layer for governance / registry / activation anchors that are meant to be permanent — cells are scoped out, not immutable storage wholesale. See /appendix/storage-nodes.

Cadence

We update this page when something ships, slips, or is added or deferred. Material slips are noted at the entry rather than silently rewriting the date.

For the cryptographically anchored history of operations and registry events, see /changelog when published, plus the public on-chain anchors at mainnet.cotiscan.io.

Found something missing or wrong?

If we have promised something on another page that is not reflected here, that is the bug. Tell us: ops@saihm.coti.global with subject prefix [roadmap]. Discrepancies are reconciled by updating this page; this page is the canonical roadmap.