docs(portal): organize projects by mission-focus + fix wasmagent-py coherence

docs/project-index.json

@@ -1,9 +1,9 @@
 {
   "schema_version": 1,
   "org": "WasmAgent",
-  "description": "Machine-readable source of truth for the WasmAgent project index. Lists every repository in the organization with its category, role, status, and visibility. Consumed by the org profile (profile/README.md project table) and the living roadmap (docs/roadmap.md) so the public project matrix is rendered from a single registry instead of maintained by hand, preventing omissions.",
+  "description": "Machine-readable source of truth for the WasmAgent project index. Lists every repository in the organization with its category, role, status, and visibility. Consumed by the org profile (profile/README.md project table) and the living roadmap (docs/roadmap.md) so the public project matrix is rendered from a single registry instead of maintained by hand, preventing omissions. Each repo also carries a `focus` field (see focus_legend) marking its place relative to the core spine and its long-term lifecycle.",
   "source_url": "https://github.com/WasmAgent/.github/blob/main/docs/project-index.json",
-  "last_reviewed": "2026-07-19",
+  "last_reviewed": "2026-07-23",
   "consumers": [
     "profile/README.md \u2014 Projects table",
     "docs/roadmap.md \u2014 project layers"
@@ -13,6 +13,17 @@
     "in_progress": "Spec or reference implementation landing.",
     "planned": "Not yet public."
   },
+  "focus_legend": {
+    "core-spine": "Mission core: evidence, verification, trust. Sustained long-term investment.",
+    "planned-core": "Planned addition to the core spine; repo not yet created.",
+    "adjacent": "Extends the spine to a surface; moves to community maintenance once its roadmap lands.",
+    "product": "Commercial product surface downstream of the spine.",
+    "research": "Research project; results and interfaces may change.",
+    "reference-workload": "Reference workload / Golden Path fixture producer, not a general product.",
+    "org-hub": "Org portal and governance.",
+    "internal": "Internal automation or operations; ships no public product.",
+    "planned-workload": "Planned reference workload; repo not yet created."
+  },
   "categories": {
     "project-home": "Public landing page that directs readers to the org hub.",
     "org-hub": "Org-wide documentation, ledgers, and source of truth for the project list.",
@@ -35,7 +46,8 @@
       "visibility": "public",
       "in_profile": true,
       "summary": "Organization portal and sole public entry point: profile, roadmap, claims registry, release ledger, RFC registry, and cross-repo documentation.",
-      "url": "https://github.com/WasmAgent/.github"
+      "url": "https://github.com/WasmAgent/.github",
+      "focus": "org-hub"
     },
     {
       "name": "wasmagent-js",
@@ -46,7 +58,8 @@
       "in_profile": true,
       "summary": "Embedded agent runtime v1.x: WASM kernels (QuickJS, Pyodide, Wasmtime, Remote), MCP gateway + attestation, AEP emitter, capability manifests; adapters for A2A, AG-UI, AI SDK, Claude Agent SDK.",
       "url": "https://github.com/WasmAgent/wasmagent-js",
-      "latest_version": "1.20.0"
+      "latest_version": "1.20.0",
+      "focus": "core-spine"
     },
     {
       "name": "bscode",
@@ -56,7 +69,8 @@
       "visibility": "public",
       "in_profile": true,
       "summary": "Coding-agent workload on Cloudflare Workers \u2014 AEP evidence export, deny capabilities, output taint labels, RolloutProvenance.",
-      "url": "https://github.com/WasmAgent/bscode"
+      "url": "https://github.com/WasmAgent/bscode",
+      "focus": "reference-workload"
     },
     {
       "name": "trace-pipeline",
@@ -66,7 +80,8 @@
       "visibility": "public",
       "in_profile": true,
       "summary": "evomerge on PyPI \u2014 eval_trust paired statistics, AgentTrustScore stable JSON schema, training-data admission gate, wasmagent-js v1.x schema compatible.",
-      "url": "https://github.com/WasmAgent/trace-pipeline"
+      "url": "https://github.com/WasmAgent/trace-pipeline",
+      "focus": "adjacent"
     },
     {
       "name": "agent-trust-infra",
@@ -76,7 +91,8 @@
       "visibility": "public",
       "in_profile": true,
       "summary": "AgentBOM, MCP Posture, and Trust Passport spec, reference impl, and CLI; EU AI Act Annex IV compliance mapping in draft (covers 20/29 sub-items, deadline 2026-08-02).",
-      "url": "https://github.com/WasmAgent/agent-trust-infra"
+      "url": "https://github.com/WasmAgent/agent-trust-infra",
+      "focus": "core-spine"
     },
     {
       "name": "open-agent-audit",
@@ -87,7 +103,8 @@
       "in_profile": true,
       "summary": "Enterprise audit product with AEP v0.3 adapter; deployed at trustavo.com. Packages: @openagentaudit/core, adapters, schema.",
       "url": "https://github.com/WasmAgent/open-agent-audit",
-      "latest_version": "0.2.4"
+      "latest_version": "0.2.4",
+      "focus": "product"
     },
     {
       "name": "fresharena",
@@ -97,7 +114,8 @@
       "visibility": "public",
       "in_profile": true,
       "summary": "Dynamic, verifiable, adversarial evaluation \u2014 FAEP schema, submit-then-test adversarial testing, Public Immunity Pool; technical paper in preparation.",
-      "url": "https://github.com/WasmAgent/fresharena"
+      "url": "https://github.com/WasmAgent/fresharena",
+      "focus": "research"
     },
     {
       "name": "claude-bot",
@@ -107,7 +125,8 @@
       "visibility": "internal",
       "in_profile": false,
       "summary": "Internal automation: issue triage, PR review, and cross-repo coherence patrol. Not a public product.",
-      "url": "https://github.com/WasmAgent/claude-bot"
+      "url": "https://github.com/WasmAgent/claude-bot",
+      "focus": "internal"
     },
     {
       "name": "wasmagent-ops",
@@ -117,7 +136,8 @@
       "visibility": "internal",
       "in_profile": false,
       "summary": "Internal operations hub: generators, release ops, eval, research, and continuous verification daemon that monitors running agents and alerts on trust-policy violations. Not a public product.",
-      "url": "https://github.com/WasmAgent/wasmagent-ops"
+      "url": "https://github.com/WasmAgent/wasmagent-ops",
+      "focus": "internal"
     },
     {
       "name": "erp-agent",
@@ -127,7 +147,8 @@
       "visibility": "public",
       "in_profile": false,
       "summary": "Planned ERP-domain workload with order-state and ledger verifiers, mirroring the role bscode plays for coding tasks.",
-      "url": "https://github.com/WasmAgent/erp-agent"
+      "url": "https://github.com/WasmAgent/erp-agent",
+      "focus": "planned-workload"
     },
     {
       "name": "symkernel",
@@ -137,7 +158,8 @@
       "visibility": "public",
       "in_profile": true,
       "summary": "Go-based symbolic verification backend for the WasmAgent ecosystem: cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT satisfiability proofs. HTTP service with OPA-style request/response envelope; language-agnostic \u2014 consumed by wasmagent-js and future wasmagent-py via a thin adapter.",
-      "url": "https://github.com/WasmAgent/symkernel"
+      "url": "https://github.com/WasmAgent/symkernel",
+      "focus": "core-spine"
     },
     {
       "name": "wasmagent-proxy",
@@ -147,7 +169,8 @@
       "visibility": "public",
       "in_profile": true,
       "summary": "Proxy-Wasm Rust module for Envoy, Istio, Kong, and Consul: intercepts Agent/MCP/A2A HTTP traffic, applies validation\u2192delta\u2192full recording policy, emits PROV-DM AEP records signed with Ed25519 (DSSE). Joins with wasmagent-js mcp-firewall via shared trace_id for full causal coverage from gateway to tool call.",
-      "url": "https://github.com/WasmAgent/wasmagent-proxy"
+      "url": "https://github.com/WasmAgent/wasmagent-proxy",
+      "focus": "adjacent"
     },
     {
       "name": "wasmagent-train-replay",
@@ -157,17 +180,19 @@
       "visibility": "public",
       "in_profile": true,
       "summary": "Causal evidence layer for distributed GPU training: reads PyTorch Flight Recorder dumps, builds cross-rank PROV-DM provenance graphs, records Ed25519-signed EpochEvidenceBundles, and supports deterministic replay and tensor-origin tracing. Shares AEP schema and RecordingMode semantics with wasmagent-js.",
-      "url": "https://github.com/WasmAgent/wasmagent-train-replay"
+      "url": "https://github.com/WasmAgent/wasmagent-train-replay",
+      "focus": "adjacent"
     },
     {
       "name": "wasmagent-py",
       "category": "runtime",
       "role": "Python runtime (planned)",
       "status": "planned",
       "visibility": "public",
-      "in_profile": true,
+      "in_profile": false,
       "summary": "Planned Python agent runtime \u2014 sibling to wasmagent-js. Will share AEP schema, Criterion/ConstraintIR protocol, and symkernel HTTP adapter so Python agents receive the same evidence recording, MCP policy enforcement, and symbolic verification as the JS runtime.",
-      "url": "https://github.com/WasmAgent/wasmagent-py"
+      "url": "https://github.com/WasmAgent/wasmagent-py",
+      "focus": "planned-core"
     }
   ]
 }

docs/repository-boundaries.md

@@ -19,6 +19,25 @@ For per-repo maturity see `docs/maturity-matrix.md`.
 | **Tier 4** — Research | `fresharena` | Dynamic evaluation protocol |
 | **Infrastructure** | `wasmagent-proxy`, `symkernel`, `wasmagent-train-replay` | Gateway evidence, verification, training audit |
 
+## Focus & lifecycle
+
+The maturity tiers above answer *"how stable is this repo?"* A second,
+orthogonal axis answers *"how central is it to the mission, and what happens to
+it long-term?"* — captured by the `focus` field in `docs/project-index.json`:
+
+- **Core spine** — `wasmagent-js`, `symkernel`, `agent-trust-infra`, and planned
+  `wasmagent-py`. Evidence, verification, trust. Sustained investment; these
+  define the org's identity.
+- **Adjacent** — `wasmagent-proxy`, `trace-pipeline`, `wasmagent-train-replay`.
+  Extend the spine to a surface. Their **exit condition** (per the "Adding a new
+  repository" rule) is *roadmap complete → community maintenance*, not
+  archival: code, schemas, and history stay in place.
+- **Product / research / reference** — `open-agent-audit`, `fresharena`,
+  `bscode`. Downstream surfaces, governed by their own repo scope.
+
+A repo's focus changing (e.g. adjacent → community-maintained) is an
+architecture-review event, like any change to org-wide structure.
+
 ## Rules
 
 ### Adding a new capability

docs/roadmap.md

@@ -12,6 +12,28 @@ counterpart is [`project-index.json`](project-index.json).
 - 🚧 In progress — spec or reference implementation landing.
 - 📋 Planned — not yet public.
 
+## Focus & lifecycle
+
+WasmAgent's north star is **open infrastructure for _provable_ AI agents**.
+Repositories are ranked by how close they sit to that mission, orthogonal to the
+maturity tiers in
+[`repository-boundaries.md`](repository-boundaries.md):
+
+- **Core spine** (`wasmagent-js`, `symkernel`, `agent-trust-infra`, and the
+  planned `wasmagent-py`) — evidence emission, verification, and trust artifacts.
+  Sustained long-term investment. AEP is their connective standard, sedimented
+  from the shipping runtime rather than designed up front.
+- **Adjacent** (`wasmagent-proxy`, `trace-pipeline`, `wasmagent-train-replay`) —
+  extend the spine to specific surfaces. Once their roadmaps land they move to
+  **community maintenance**; they are not retired, and their code and evidence
+  schemas stay put.
+- **Product / research / reference** (`open-agent-audit`, `fresharena`,
+  `bscode`) — the commercial audit surface, the research lab, and the reference
+  workload, all downstream of the spine.
+
+The machine-readable `focus` field in
+[`project-index.json`](project-index.json) is the source of truth for this axis.
+
 ## Layers
 
 ### Runtime ✅

profile/README.md

@@ -24,24 +24,59 @@ See [`golden-path/README.md`](../golden-path/README.md) for details.
 
 ## Projects
 
-The **architecture** layer below is the human-readable view of
+WasmAgent is **open infrastructure for _provable_ AI agents** — not another
+agent framework. The core spine answers one question end-to-end: *can you prove
+the agent ran correctly?* Every other repository is organized around that spine
+so a first-time visitor can tell the mission from its supporting cast at a
+glance.
+
+This section is the human-readable view of
 [`docs/project-index.json`](../docs/project-index.json), the machine-readable
-source of truth for the project list. This repository (`.github`) is the
-organization's sole public portal.
+source of truth (see each repo's `focus` field). This repository (`.github`) is
+the organization's sole public portal.
+
+### Core spine — evidence, verification, trust
+
+The mission lives here. These repositories receive sustained, long-term
+investment.
+
+| Repository | Role |
+| --- | --- |
+| [wasmagent-js](https://github.com/WasmAgent/wasmagent-js) | **Runtime** · Embedded agent runtime v1.x — WASM kernels (QuickJS, Pyodide, Wasmtime, Remote), MCP gateway + attestation, AEP emitter, capability manifests; adapters for A2A, AG-UI, AI SDK, and Claude Agent SDK. This is where signed evidence is born. |
+| [symkernel](https://github.com/WasmAgent/symkernel) | **Verification** 🚧 · Go symbolic verification backend — cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT proofs; HTTP service consumed by wasmagent-js and wasmagent-py. "Proving it ran correctly" is the mission itself. |
+| [agent-trust-infra](https://github.com/WasmAgent/agent-trust-infra) | **Trust & compliance** · AgentBOM, MCP Posture, and Trust Passport spec, reference impl, and CLI; EU AI Act Annex IV compliance mapping (draft, deadline **2026-08-02**). |
+
+> **`wasmagent-py`** *(planned)* joins the spine as the Python runtime sibling —
+> same AEP schema, Criterion/ConstraintIR protocol, and symkernel adapter — so
+> evidence is emitted wherever agents actually run, not just in JS.
+>
+> **AEP (Agent Evidence Protocol)** is the connective standard across the spine.
+> It is sedimented from the shipping runtime rather than designed up front; its
+> RFCs live in the [RFC registry](../docs/RFC/README.md), not a standalone repo.
+
+### Adjacent — maturing, then handed to the community
+
+These extend the spine to specific surfaces. Once their roadmaps land they move
+to **community maintenance** — they are not retired, and their code, evidence
+schemas, and history stay put.
 
 | Repository | Role |
 | --- | --- |
-| [`.github`](https://github.com/WasmAgent/.github) | **Org hub** · Organization portal — roadmap, claims registry, release ledger, project index, and cross-repo documentation |
-| [wasmagent-js](https://github.com/WasmAgent/wasmagent-js) | **Runtime** · Embedded agent runtime v1.x — WASM kernels (QuickJS, Pyodide, Wasmtime, Remote), MCP gateway + attestation, AEP emitter, capability manifests; adapters for A2A, AG-UI, AI SDK, and Claude Agent SDK |
-| wasmagent-py *(planned — repo not yet created)* | **Runtime (planned)** · Python agent runtime — sibling to wasmagent-js; shares AEP schema, Criterion/ConstraintIR protocol, and symkernel HTTP adapter |
 | [wasmagent-proxy](https://github.com/WasmAgent/wasmagent-proxy) | **Gateway** 🚧 · Proxy-Wasm (Rust) evidence engine for Envoy, Istio, Kong, Consul — intercepts Agent/MCP/A2A traffic, emits Ed25519-signed AEP records, joins mcp-firewall via shared trace_id |
-| [symkernel](https://github.com/WasmAgent/symkernel) | **Verification** 🚧 · Go symbolic verification backend — cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT proofs; HTTP service consumed by wasmagent-js and wasmagent-py |
-| [bscode](https://github.com/WasmAgent/bscode) | **Workload** · Coding-agent workload on Cloudflare Workers — AEP evidence export, deny capabilities, output taint labels, RolloutProvenance |
-| [fresharena](https://github.com/WasmAgent/fresharena) | **Evaluation protocol** · Dynamic, verifiable, adversarial evaluation — FAEP schema, submit-then-test, Public Immunity Pool; paper in preparation |
 | [trace-pipeline](https://github.com/WasmAgent/trace-pipeline) | **Evidence pipeline** · `evomerge` — trace-to-training backend: eval_trust paired statistics, AgentTrustScore, training-data admission gate, wasmagent-js v1.x schema compat |
 | [wasmagent-train-replay](https://github.com/WasmAgent/wasmagent-train-replay) | **Evidence pipeline** 🚧 · Causal evidence for distributed GPU training — cross-rank PROV-DM provenance graph, Ed25519-signed EpochEvidenceBundles, tensor-origin tracing, deterministic replay CLI |
-| [agent-trust-infra](https://github.com/WasmAgent/agent-trust-infra) | **Trust artifacts** · AgentBOM, MCP Posture, and Trust Passport spec, reference impl, and CLI; EU AI Act Annex IV compliance mapping (draft, deadline **2026-08-02**) |
-| [open-agent-audit](https://github.com/WasmAgent/open-agent-audit) | **Audit** · Enterprise audit product with AEP v0.2 adapter; deployed at [trustavo.com](https://trustavo.com) |
+
+### Product, research, and reference
+
+Downstream of the spine: the commercial audit surface, the research lab, the
+reference workload, and this portal.
+
+| Repository | Role |
+| --- | --- |
+| [open-agent-audit](https://github.com/WasmAgent/open-agent-audit) | **Audit product** · Enterprise audit product with AEP adapter; deployed at [trustavo.com](https://trustavo.com) |
+| [fresharena](https://github.com/WasmAgent/fresharena) | **Research — evaluation** · Dynamic, verifiable, adversarial evaluation — FAEP schema, submit-then-test, Public Immunity Pool; paper in preparation |
+| [bscode](https://github.com/WasmAgent/bscode) | **Reference workload** · Coding-agent workload on Cloudflare Workers — AEP evidence export, deny capabilities, output taint labels, RolloutProvenance |
+| [`.github`](https://github.com/WasmAgent/.github) | **Org hub** · Organization portal — roadmap, claims registry, release ledger, project index, and cross-repo documentation |
 
 ## Vision