[dsiddharth2]

Summary

Docs only. Brings the roadmap and README in line with what has shipped, and adds an ordered plan for the 26 open issues.

Closes #75.

Changes

New: docs/plans/2026-11-03-roadmap-waves.md

• Groups the open issues into seven waves, with a Mermaid diagram and a tracker table (wave, size, dependencies, status).
• Wave 0 is trustworthy testing: e2e (vm) is 0/10 on main but green: Host validation ignores the bind host, and the CI step masks failures #89 plus npm run verify, which runs every test and then npm run smoke. Every later merge should pass it.
• A detailed plan for wave 1 (Redact secrets everywhere the kit persists or logs tool data #72, Scan tool results and memory writes for prompt injection #73, Warn at startup when human input is on with the default anonymous authenticator #74, Update docs/roadmap.md to reflect shipped work #75): current state with file references, design, tasks and "done when" criteria for each.

docs/roadmap.md (#75)

• Shipped: memory, the eval harness, durable human input, checkpoints and resume, the ask-user tool, Azure entity storage (Cosmos and MSSQL options), retention, npm run smoke.
• Removes "Next Up: Phase 3 Memory + Eval (not yet implemented)", since both are built. Next Up now lists waves 0 and 1.
• Each Planned and Future item links to its issue. Human-in-the-loop approval is removed from Future because it shipped.

README.md

• Evals: Planned to Shipped. Tools count corrected from 15 to 12.
• The Guardrails row mentions human approval.
• The Roadmap section lists what recently shipped, with waves 0 and 1 as next up.
• Contributor step 5 adds npm run smoke.

Testing

Docs only, no code changes. All new relative links point to files that exist in the repo.

Open questions (also in the plan)

• Who owns e2e (vm) is 0/10 on main but green: Host validation ignores the bind host, and the CI step masks failures #89?
• Should npm run verify start the agent as a local process by default, or in Docker?