— Roadmap —

WHAT'S NEXT, IN THE ACTUAL ORDER

This mirrors docs/ROADMAP.md directly -- the same document the rest of this site links out to, presented in full here instead of only as an external link.

Why this scope, specifically

Building a real STARK-based VM with unconstrained branching, memory, and a full RISC-V-compatible instruction set is a multi-year effort for a team, not a single session. This project picked the smallest slice that still has the essential hard part: an AIR whose transition constraints correctly gate multiple instruction types via opcode selectors, with per-row assertions that bind the proof to an exact program — the same core technique (generalized) that real STARK-based VMs like RISC Zero, SP1, Cairo, and Miden use. Once that pattern is validated, extending it is additive work, not a redesign.

Suggested next slice, in order

  1. Loops: a dynamically-sized trace (bounded by a max-cycle count, padded/truncated based on actual execution length) so JZ/JNZ can jump backward too. The "verifier re-executes and asserts everything" trick still works — but trace-length selection and the resulting proof-size variability need real design.
  2. Addressable memory (dynamic addresses, distinct from the static register file) — worth checking first whether the same re-execute-and-assert trick extends here before assuming a full permutation/lookup argument is required.
  3. Only after 1–2 are solid: consider RV32I compatibility.

What's explicitly not here yet

Loops
JZ/JNZ are forward-only; nothing revisits a static instruction twice. Real loops need a dynamically-sized execution trace, not just added control flow.
Addressable memory
The register file is 4 fixed, statically-named slots. Real memory means a dynamic address computed at runtime -- closer to the branching problem than to the register file.
RISC-V compatibility
The instruction set is custom and minimal, not RV32I. Real ELF-binary execution is future work.
Formal verification, fuzzing, external audits
The only soundness evidence today is the unit test suite in zkvm-stark.
Performance work
GPU/ASIC proving, recursion, aggregation, sub-second targets -- not started. Blake3_256 + a 128-bit field with default parameters is correctness-first, not performance-first.
Trustless on-chain verification
AttestedVerifier is a trusted bridge, not a cryptographic verifier. See docs/ONCHAIN_VERIFIER.md for what closing that gap actually requires.
Everything economic or network-effect related
No token, no proving marketplace, no decentralized prover network, no cross-chain bridges. None of that has a code artifact.
A second real proving backend
SP1 was specifically investigated and not pursued -- 518 resolved dependencies, a Go FFI requirement, and an ISA mismatch. See docs/HOST_SERVICE.md.
Full document with complete reasoning: docs/ROADMAP.md. Related: FAQ, Architecture.