diff --git a/README.md b/README.md
index c919e2a..6098a09 100644
--- a/README.md
+++ b/README.md
@@ -21,19 +21,26 @@ Generators and ops tooling live in
 ## Canonical paths
 
 The assets and ledgers above are the org-wide source of truth. Product
-repositories (`wasmagent`, `wasmagent-js`, and the rest) should link to these
-centralized paths instead of keeping local copies, so media and ledger
-references are never orphaned when content moves between repos. Prefer the
-`.svg` product matrix hosted here over repo-local raster copies (e.g.
-`product-matrix.webp`).
-
-- Product matrix image (raw URL for embedding):
-  `https://raw.githubusercontent.com/WasmAgent/.github/main/assets/product-matrix.svg`
-- Project index (machine-readable repo, role, and status registry):
-  `https://github.com/WasmAgent/.github/blob/main/docs/project-index.json`
-- Claims registry:
-  `https://github.com/WasmAgent/.github/blob/main/claims/public-claims.yml`
-- Release ledger:
-  `https://github.com/WasmAgent/.github/blob/main/releases/public-release-ledger.yml`
-- Media & posts:
-  `https://github.com/WasmAgent/.github/blob/main/media/posts.yml`
+repositories should link to these centralized paths instead of keeping local copies.
+
+- Product matrix image: `https://raw.githubusercontent.com/WasmAgent/.github/main/assets/product-matrix.svg`
+- Project index: `https://github.com/WasmAgent/.github/blob/main/docs/project-index.json`
+- Claims registry: `https://github.com/WasmAgent/.github/blob/main/claims/public-claims.yml`
+- Release ledger: `https://github.com/WasmAgent/.github/blob/main/releases/public-release-ledger.yml`
+- Media & posts: `https://github.com/WasmAgent/.github/blob/main/media/posts.yml`
+
+## WasmAgent Ecosystem
+
+| Repository | Role |
+|---|---|
+| [.github](https://github.com/WasmAgent/.github) | **Org hub** — this repo: org portal, roadmap, claims registry, release ledger, project index |
+| [wasmagent-js](https://github.com/WasmAgent/wasmagent-js) | Runtime — embedded agent runtime (WASM kernels, MCP gateway, AEP emitter, capability manifests; A2A/AG-UI/Claude Agent SDK adapters) |
+| wasmagent-py | Runtime (planned) — Python agent runtime; shares AEP schema, Criterion/ConstraintIR, symkernel adapter |
+| [wasmagent-proxy](https://github.com/WasmAgent/wasmagent-proxy) | Gateway 🚧 — Proxy-Wasm evidence engine for Envoy/Istio/Kong; Ed25519-signed AEP records |
+| [symkernel](https://github.com/WasmAgent/symkernel) | Verification 🚧 — Go symbolic verification backend; cel-go rules, wazero sandbox, Z3 SMT proofs |
+| [bscode](https://github.com/WasmAgent/bscode) | Workload — coding-agent workload on Cloudflare Workers; AEP evidence, deny capabilities, RolloutProvenance |
+| [fresharena](https://github.com/WasmAgent/fresharena) | Evaluation — dynamic adversarial evaluation protocol; FAEP schema, submit-then-test, Public Immunity Pool |
+| [trace-pipeline](https://github.com/WasmAgent/trace-pipeline) | Evidence pipeline — trace-to-training backend; AgentTrustScore, training-data admission gate |
+| [wasmagent-train-replay](https://github.com/WasmAgent/wasmagent-train-replay) | Evidence pipeline 🚧 — causal evidence for distributed GPU training; cross-rank PROV-DM graph, signed EpochEvidenceBundles |
+| [agent-trust-infra](https://github.com/WasmAgent/agent-trust-infra) | Trust artifacts — AgentBOM, MCP Posture, Trust Passport spec + CLI; EU AI Act Annex IV mapping |
+| [open-agent-audit](https://github.com/WasmAgent/open-agent-audit) | Audit — enterprise audit product with AEP v0.3 adapter; deployed at trustavo.com |