diff --git a/ROADMAP.md b/ROADMAP.md
index 5f430f73..2e4363ac 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,48 +1,48 @@
-# Roadmap
-
-## Now — v0.1 draft (June 2026)
-
-Announced at Confidential Computing Summit, San Francisco, June 23 2026.
-
-**In scope:**
-- Full Trust Record schema: `subject`, `model`, `runtime`, `policy`, `data_class`, `tool_transcript`, `build_provenance`, `appraisal`, `transparency`, `cnf`
-- Wire formats: EAT/JWT and CBOR-COSE
-- Hardware roots: NVIDIA H100/Blackwell, Intel TDX, AMD SEV-SNP, Azure MAA, GCP Confidential Space, AWS Nitro
-- JSON Schema and three hardware examples
-- Reference implementation: cMCP Phase 1 (Cedar policy enforcement, TRACE Level 2 emission)
-
-**Not in v0.1:** MCP profile (normative), A2A profile, vendor platform annexes, OWASP/ATLAS cross-walks, encrypted claims envelope.
-
-## Next — v0.2 (Q3 2026)
-
-Driven by founding-member feedback and open questions from §7 of the spec.
-
-- **MCP profile** — normative claim shape and binding rules for MCP tool-call transcripts (`tool_transcript`); proposed for upstream contribution to MCP spec governance
-- **A2A profile** — same, for Google Agent-to-Agent. The optional `delegation` link block (`parent_record_hash` + `credential_id`) has landed in the record as the foundation; A2A is now stable at v1.x, so the normative binding rules are the remaining work
-- **Vendor platform annexes** — co-authored informative claim-mapping docs for NVIDIA NRAS, Intel Trust Authority, AMD CoRIM, Azure MAA, GCP Confidential Space
-- **OWASP Agentic AI Top 10 cross-walk** — which TRACE claim evidences which control for each of the 10 ASIs
-- **MITRE ATLAS cross-walk** — TRACE claim coverage mapped to relevant ATLAS tactics
-- **Encrypted claims envelope** — normative profile for JWE / COSE-Encrypt when `data_class` requires confidential transport to verifiers (open question §7 Q5)
-- **Reference to IETF AIIP** — coordinate with draft-ritz-aiip and determine disposition (open question §7 Q7)
-- **cMCP Phase 2** — policy enforcement and `tool_transcript` binding; first full Trust Records
-
-## Later — v1.0 standard (2027)
-
-- TSC governance under CoSAI / Linux Foundation
-- All §7 open questions resolved
-- Complete conformance certification program
-- Post-quantum signature profile (ML-DSA, tracking NIST SP 800-208)
-- MCP and A2A profiles ratified and proposed to respective upstream governance bodies
-- AAIF-assigned canonical profile URI replacing the provisional v0.1 tag URI
-- Multi-language verification libraries (Python, TypeScript, Go, Rust)
-
-## What TRACE will not do
-
-- Replace RATS, EAT, SLSA, SPIFFE, SCITT, or MCP — TRACE is a profile of these
-- Specify a centralized Trust Record registry — verification is designed to work without one
-- Build a TEE platform — hardware support targets open silicon (TDX, SEV-SNP, NVIDIA CC) and any platform that produces RATS-conformant evidence
-- Adjudicate model alignment or output correctness — TRACE proves what executed and what was in force; correctness is out of scope
-
-## Influencing the roadmap
-
-Open a GitHub issue with the `spec` or `roadmap` label. Contributor and community feedback from the CC Summit period (June–September 2026) has priority for v0.2 scope.
+# Roadmap
+
+Status as of August 2026. Spec **v0.2** is current ([`spec/trace-v0.2.md`](spec/trace-v0.2.md)); the `agentrust-trace` reference SDK is at **0.6.0** and the conformance suite (`agentrust-io/trace-tests`) at **0.4.1**.
+
+## Shipped — v0.2 (July–August 2026)
+
+- **EAT profile URI cutover** to `tag:agentrust-io.com,2026:trace-v0.2`. The v0.1 identifier named a domain this project never controlled, which RFC 4151 does not permit, so it was invalid rather than misspelled. A v0.2 verifier requires the new URI and rejects the old one; `verify_record()` enforces the cutover before any cryptographic work. Records issued under v0.1 stay verifiable against `spec/trace-v0.1.md` and the published 0.4.x releases.
+- **`delegation` link block** (`parent_record_hash` + `credential_id`), optional and additive. A chain of records linked this way forms an offline-verifiable delegation DAG. This is the foundation the A2A profile binds to, not the profile itself.
+- **`transparency` is optional below Level 2.** A Level 0 or Level 1 record is unanchored and has no receipt to name; that state was previously unrepresentable.
+- **`azure-cvm-sev-snp` platform**, distinct from `amd-sev-snp`, because Azure runs SEV-SNP behind a Hyper-V paravisor and the runtime binding rides a vTPM AK-signed quote rather than a guest-controlled `REPORT_DATA`. A consumer keying on `runtime.platform` can tell the two roots apart.
+- **Revocation at verification time** (`verify_record(..., revocation=...)`). §3.2.1 always required it; the verifier did not do it. A revocation source that cannot answer is rejected rather than treated as a pass.
+- **OWASP Agentic AI Top 10 cross-walk** — [`docs/crosswalks/owasp-agentic-top-10.md`](docs/crosswalks/owasp-agentic-top-10.md).
+- **Acta decision-receipt cross-walk** — [`docs/crosswalks/acta-decision-receipts.md`](docs/crosswalks/acta-decision-receipts.md).
+- **Producer adapters** for AGT, cMCP, and sandboxed agent runtimes, one code path spanning Level 0 and Level 1.
+- **Platform bindings documented** for AMD SEV-SNP, Intel TDX, and NVIDIA H100 ([`docs/platforms/`](docs/platforms/)). This SDK verifies the record; verification of the attestation evidence itself lives in `cmcp` and `agent-manifest`, both of which have been run against genuine hardware quotes.
+- **Reference implementation.** cMCP enforces Cedar policy inside the TEE and emits signed GatewayClaims carrying `policy`, `data_class`, and `tool_transcript`.
+
+## Next — v0.3
+
+- **MCP profile (normative)** — claim shape and binding rules for MCP tool-call transcripts. The `tool_transcript` claim exists and is bound; what is missing is the normative rule set, for upstream contribution to MCP spec governance.
+- **A2A profile (normative)** — binding rules over the `delegation` block now that A2A is stable at v1.x, including the mutual case. cA2A is the reference implementation.
+- **Anchor and inclusion-proof format** — the normative format that lets a third party verify an anchor without trusting the registry operator. Specified but not published; the registry repository is private. This is the gap that makes "verifiable without trusting the operator" a claim about the future rather than the present, and it is the highest priority item on this page. Tracked in [#111](https://github.com/agentrust-io/trace-spec/issues/111).
+- **Attested memory and persistent state** — a claim for agent memory integrity at runtime, digesting the whole store rather than a manifest of it. Nothing in the ecosystem measures agent memory today; every runtime treats the agent as stateless between actions.
+- **MITRE ATLAS cross-walk** — TRACE claim coverage mapped to relevant ATLAS tactics.
+- **Encrypted claims envelope** — normative profile for JWE / COSE-Encrypt where `data_class` requires confidential transport to verifiers (open question §7 Q5).
+- **Vendor platform annexes** — co-authored informative claim-mapping docs for NVIDIA NRAS, Intel Trust Authority, AMD CoRIM, Azure MAA, GCP Confidential Space. Co-editor seats are open (§4.4); the informative platform docs in `docs/platforms/` are ours, not vendor-co-authored.
+- **Disposition on IETF AIIP** — coordinate with `draft-ritz-aiip`: absorb, supersede, or coexist (open question §7 Q7).
+
+## Later — v1.0 standard (2027)
+
+- TSC governance under "TRACE Specification, a Series of LF Projects, LLC" (formation in progress, see [#127](https://github.com/agentrust-io/trace-spec/pull/127); §6.1 of the spec still names the superseded CoSAI plus LF-MCP-entity plan and is corrected there)
+- All §7 open questions resolved
+- Complete conformance certification program
+- Post-quantum signature profile (ML-DSA, tracking NIST SP 800-208)
+- MCP and A2A profiles ratified and proposed to their respective upstream governance bodies
+- A canonical profile URI assigned by the standards home, replacing the provisional tag URI
+- Multi-language verification libraries (Python, TypeScript, Go, Rust)
+
+## What TRACE will not do
+
+- Replace RATS, EAT, SLSA, SPIFFE, SCITT, or MCP — TRACE is a profile of these
+- Specify a centralized Trust Record registry — verification is designed to work without one
+- Build a TEE platform — hardware support targets open silicon (TDX, SEV-SNP, NVIDIA CC) and any platform that produces RATS-conformant evidence
+- Adjudicate model alignment or output correctness — TRACE proves what executed and what was in force; correctness is out of scope
+
+## Influencing the roadmap
+
+Open a GitHub issue with the `spec` or `roadmap` label. Items land here when they are implemented and tested, not when they are planned; anything above the "Next" line is exercisable today.