diff --git a/.gitignore b/.gitignore
index 098d87c..3f53140 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,6 @@ __pycache__/
 .env/
 /dist/
 /build/
+.coverage
+coverage.xml
+.pytest_cache/
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..d642587
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,36 @@
+# Changelog
+
+All notable changes to PyIsolate are recorded here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/). PyIsolate is a
+prototype in the `0.0.x` series and does not yet make Semantic Versioning
+guarantees; **no release should be treated as a hardened security boundary**.
+
+## [Unreleased]
+
+### Added
+- `backend="process"` boundary mode: a real separate-process boundary confined
+  by `no_new_privs` + a seccomp deny-list, Landlock filesystem rules, Landlock
+  TCP-egress rules (Landlock ABI ≥ 4), a coarse per-cgroup eBPF/LSM deny-mask,
+  and `rlimit` caps, recorded in a per-sandbox confinement report.
+- Capability-gated broker `request` mediation in the process backend (surfaces a
+  `BrokerRequest` to the supervisor; an ungranted capability is denied).
+- microVM backend scaffolding: VMM/KVM capability detection, fail-closed
+  admission, a Firecracker machine-config builder, and a VMM launcher.
+- No-GIL readiness axis tests and a free-threaded (`3.13t`) CI gate.
+- PyPI packaging metadata and a Trusted-Publishing release workflow.
+- `pyisolate doctor --grade` components for Landlock network egress and microVM
+  readiness (now a 10-point conformance score).
+- `scripts/benchmark.py` for reproducible spawn/round-trip measurements.
+- `pyisolate[operator]` optional-dependency group for the Kubernetes operator.
+
+### Changed
+- Threat model and `SECURITY.md` reconciled with the real, backend-conditional
+  boundary (the sub-interpreter backend is an execution cell, not a boundary
+  against hostile Python).
+
+### Known gaps
+- The broker `request` op is surfaced but not yet executed end-to-end.
+- Process-backed sandboxes are not attached to cgroups or watched by the
+  resource watchdog (they get `rlimit` only).
+- `backend="microvm"` fails closed: the guest agent and vsock cell transport are
+  not implemented yet.
diff --git a/pyproject.toml b/pyproject.toml
index 80f4dcd..ea2e1bf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -35,7 +35,7 @@ dependencies = ["pyyaml", "cryptography", "platformdirs"]
 Homepage = "https://github.com/seanwevans/pyisolate"
 Repository = "https://github.com/seanwevans/pyisolate"
 Issues = "https://github.com/seanwevans/pyisolate/issues"
-Changelog = "https://github.com/seanwevans/pyisolate/blob/main/ROADMAP.md"
+Changelog = "https://github.com/seanwevans/pyisolate/blob/main/CHANGELOG.md"
 
 [build-system]
 # setuptools >= 77 emits PEP 639 license metadata (License-Expression /