7 shipped
Foundation, Decision Engine v2, DAA shadow adapter, JWKS, x402 middleware + conformance, marketing surfaces, and the rotation-rehearsal driver are all live in production or staging.
Roadmap
Where Axiru is going. And how fast.
Money-path infrastructure deserves a visible trajectory. This is the public-safe view of the internal 90-day cross-rail governance plan. Twelve milestones, target completion August 11, 2026 (day 90). Last reviewed May 24, 2026.
Status snapshot
7 shipped. 0 in flight. 5 next.
Updated as PRs merge. The internal plan is in the repo; this is the customer-facing summary.
0 in flight
Between milestones. Design-partner review prep (M5) is the next active workstream; window opens June 17.
5 next
Design-partner review, Privy round-trip, cross-rail dashboard surfaces, first customer flipped to enforcing on DAA, Phase-1 success criteria.
Milestones
The 12-milestone plan
Each milestone has a definition-of-done. We update status here when the corresponding PRs merge.
M1
OVT type system + v2 policy schema
Rail-agnostic Outbound Value Transfer types ship; v2 policies compile alongside v1 with no breaking changes. Golden tests green.
Week 2
M2
DB migration v1 → v2
Four new columns, three concurrent indexes, idempotent backfill. Migration deployed to staging without downtime.
Week 2
M3
Decision Engine v2 — pure-function rewrite
`evaluate(ovt, policies, context)` replaces six legacy event-specific evaluators behind a flag. Replay golden tests green across all six rails.
Week 4
M4
Stripe DAA adapter (shadow mode)
DAA webhook ingress live, events normalized into OVT shape, surfacing in the decision ledger with `rail='stripe_daa'`. No enforcement yet.
Week 5
M5
Design-partner technical review
Hard gate. Slide deck + live walk-through with design partners; feedback log triaged before any new features ship.
Week 6 · June 17–24, 2026
M6
Ed25519 token issuance + JWKS
Tokens minted on Allow, JWKS endpoint cacheable, verifier passes 100% of conformance suite. Real JWKS + rotation tooling live.
Week 7
M7
@axiru/x402-policy-middleware
TS + Go verifiers landed with shared conformance suite. Demo against Stripe-documented USDC-on-Base flow exercises five scenarios end-to-end including fail-closed engine/signer paths plus downstream token verification (T-040/T-041 merged).
Week 8
M8
Privy Pre-Authorization integration
One x402 round-trip through Privy in a sandbox tenant; fail-closed verified end-to-end. Blocked on partner credentials.
Week 9
M9
Cross-rail dashboard surfaces
Ledger view filter by rail, approval-queue rail badge, three Stripe DAA policy templates installable from the dashboard.
Week 10
M10
/agentic-payments + pricing copy live in prod
Marketing surfaces for cross-rail governance are live. Demo embeds work on mobile + desktop. Pricing copy reflects rail-agnostic pricing model.
Week 11 (ahead of schedule)
M11
First customer flipped to enforcing on DAA
Real Stripe DAA traffic running through the engine in enforcing mode. Seven days without rollback before declaring success.
Week 12
M12
Phase-1 success criteria
Spec §1 acceptance bullets all green; security review signed off; key-rotation rehearsal complete (rehearsal driver landed Week 11).
Week 13
Recently landed
Changelog — last 30 days
The shorter changelog. Customer-visible work only.
Security audit batch 1 — C-1, H-1, H-2, plus mediums and lows
Critical content-type guards, timing-safe token compare, error-response sanitization, rate-limit fingerprint hardening, and the Slack response_url allowlist (SSRF guard) shipped after external review.
API truth pass on /implementation and /pricing
Marketing pages now reference the real POST /api/v1/decisions endpoint (replacing an aspirational /v1/decide), and the MCP tool name reflects the actual axiru.decisions.create surface. Filed two external reviewer audits in /docs/audits.
Public roadmap (this page) + /implementation engineer page
Trajectory now visible to buyers without scheduling a call. Engineer-facing /implementation page shows the 10-line integration plus MCP examples.
Typed-v2 Prisma PolicyV2 reader for x402 authorizations
End-to-end wiring through Decision Engine v2 + Prisma-backed v2 policies + signer. /api/v1/authorizations now serves real customer policy data.
Automated key-rotation rehearsal driver + green log
18 assertions across 7 steps. First green log archived under docs/cross-rail/key-rotation-rehearsals/. Operationalizes M12.
x402 demo — fail-closed scenarios + downstream verification
Demo app exercises invalid-token / expired-token / wrong-rail paths and verifies the Go verifier rejects them. Foundation for M7's conformance suite.
Fail-closed contract test at the service seam
Locks the fail-closed default at the engine's service boundary so regressions surface in CI, not in production. Required by SOC 2 control narrative.
Beyond Phase-1
What's after the Stripe phase
Three horizons. These are directional bets, not dated commitments — we'll move items into the milestone plan above when they earn a quarter.
Horizon 1
Months 4–12 · multi-processor parity
Stripe is the first rail, not the only rail. Once Phase-1 closes, the same decision engine extends to the rails real finance teams already use for redundancy.
- Plaid ACH + Modern Treasury adapters — Bank-to-bank governance with the same OVT type system, deterministic policies, and immutable ledger. Same engine, new adapters.
- Adyen, Braintree, Square adapters — Multi-processor merchants get one policy plane across providers. Cross-rail dedupe stays free — a refund that touches two providers still counts once.
- Cross-rail policy templates — Velocity caps, country blocklists, and goodwill-credit limits expressed once and enforced across every connected provider.
Horizon 2
Months 12–24 · stablecoin + custody
Blockchain settlement is irreversible. The pre-execution control surface matters more on USDC than it does on a Stripe refund — you can't claw a stablecoin back.
- USDC + PYUSD governance (production) — The type system already reserves these rails. Production wiring extends the engine to outbound stablecoin transfers with deterministic, signed authorization.
- Fireblocks + Coinbase Prime custody integrations — Custody providers become a first-class adapter — same idempotency key, same decision ledger, same fail-closed semantics under load.
- Sealed-at-decision tokens for chain settlement — x402's Ed25519/ES256 signing path generalized for non-HTTP rails: a signed allow becomes the only auth a downstream broadcaster will accept.
Horizon 3
Months 24–36 · sovereign + on-prem
Regulated entities won't route financial-intent payloads through a multi-tenant SaaS regardless of how strong the encryption is. The architecture is non-custodial today; the deployment topology needs to match.
- VPC sidecar deployment — Run the decision engine inside the customer's VPC. Control plane stays managed; data plane never leaves the customer boundary.
- On-prem Kubernetes distribution — Helm chart with the engine, signer, ledger writer, and JWKS endpoint. Same code as the SaaS, deployed under customer-controlled keys.
- Sovereign cloud architectures — Region-locked deployments for jurisdictions that require it. Same SOC 2 controls; localized residency and key custody.
These horizons are subject to design-partner input and market signal. If one of them matters for your team, the fastest path to influence the ordering is to become a design partner.
How we update this
Status here matches what's merged
If a milestone shows shipped here, the underlying PRs are merged into main and the change is in production or staging. We update the page on the same day.
- Shipped — code is on main, deployed to staging or production, and the milestone's definition-of-done is met.
- In flight — there's at least one open PR actively driving toward this milestone, or CI is running on the closing change.
- Next — on the 90-day plan, not yet started. We reserve the right to reorder these based on design-partner feedback after milestone M5.
Want to weigh in on what we build next? Design partners get roadmap input. Book a design-partner conversation →
Next step
Buy the trajectory, not just the feature list.
The product is what's shipped today. The roadmap is what makes Axiru a long-term bet. Shadow mode is free — connect Stripe and you're seeing your own data in five minutes.
Start in shadow mode first. Move to live enforcement later.