diff --git a/Roadmap.md b/Roadmap.md
new file mode 100644
index 0000000..668855a
--- /dev/null
+++ b/Roadmap.md
@@ -0,0 +1,22 @@
+# Roadmap
+
+## Completed baseline
+
+- Safe local artifact discovery and SHA-256 evidence
+- JSON and SARIF output
+- Eight documented deterministic rules
+- Versioned schemas and rule catalog
+- 12-case evaluation corpus and TP, FP, FN accounting
+- Agent authorization, SLSA provenance, and ML-BOM checks
+
+## Open research
+
+- Ambiguous and multilingual prompt-injection corpus
+- Formal CycloneDX and SLSA schema validation
+- Runtime and peak-memory benchmarks
+- Signed provenance verification policy
+- Release-blocking redaction regression suite
+- Blind-labeled public artifact study
+- Isolation contract for probabilistic analyzers
+
+The public issue tracker is the authoritative work queue.