Roadmap

This page describes the order in which VIGIL ships, phase by phase, and what has to be true before each phase is considered done. It is a sequence, not a schedule. Each phase depends on the one before it, and nothing in a later phase is offered until the earlier phase's exit criteria are met.

Phase 1: Probes & scores

The first phase produces public Endpoint Scores without touching anyone's money. The reference Probe runs against live x402 endpoints, Attestations are written to a registry on Base Sepolia, and scores are aggregated and published. This proves the measurement layer before any escrow depends on it. Watchers in this phase run the reference implementation without stake; their Attestations are accepted on an allow-list basis until staking exists.

Deliverables:

• Reference Probe (vigil-probe, not yet released) measuring uptime, latency, schema validity, and quoted versus charged price, from at least 3 regions.
• Attestation registry contract on Base Sepolia.
• Score aggregation: stake-weighted mean with exponential time decay, per-Watcher cap, and the minimum-attestation threshold, with stake replaced by an equal weight per allow-listed Watcher in this phase.
• Public score read endpoint (placeholder https://api.vigil.example/v1/score/{endpoint}, not live).
• ERC-8004 Reputation Registry writes: endpoint identifier, score, attestation count, last updated block, content hash of the attestation set.
• Public documentation of the score formula and check weights.

Exit criteria:

• Scores are published for a meaningful set of real x402 endpoints and have been stable across the minimum-attestation threshold for each.
• Independent parties have reproduced a score from the public Attestations and the documented formula.
• ERC-8004 writes are verifiable on Base Sepolia by any reader.

Phase 2: Escrow on Base mainnet

The second phase moves money. The VIGIL Facilitator goes live as a drop-in x402 facilitator, the escrow contract is deployed to Base mainnet after audit, and agents can route payments through escrow with automatic refunds on failed checks. Disputes open at the same time, because contested escrow outcomes need a resolution path from the first mainnet call. Attestations from real escrowed calls begin feeding scores alongside Probes.

Deliverables:

• Escrow contract implementing the states Quoted, Locked, Responded, Checked, Released, Refunded, Disputed, with the deadline, check window, and Disputed window as documented.
• Independent audit of the escrow contract, with the report linked from Security and risks.
• VIGIL Facilitator in production (placeholder https://facilitator.vigil.example, not live) with fallback to direct x402 in the client packages.
• Client packages @vigil/x402 and vigil_x402 (placeholders) supporting score-gated calls and escrow routing.
• Automatic refunds on any failed check or missed deadline.
• Dispute mechanism for escrow outcomes, initially resolved by the allow-listed Watcher set from Phase 1.
• The protocol fee on escrowed volume, collected in USDC and accumulated for distribution in Phase 3.
• Migration of the attestation registry and scores from Base Sepolia to Base mainnet.

Exit criteria:

• The audit is complete, published, and all findings above informational severity are resolved.
• Real agents have routed real USDC through escrow, with refunds and releases both exercised on mainnet.
• At least one dispute has been opened and resolved end to end.
• Every address in these docs is replaced with a deployed, verified contract address.

Phase 3: Token & Watcher staking

The third phase opens watching to anyone and makes Attestations costly to fake. $VIGIL is launched, Watchers stake to have their Attestations counted, disputes move to stake-weighted voting with slashing, and the accumulated fees begin flowing to the Watcher pool and the buyback. VIGIL Verified opens to providers at the same time, because a paid badge only makes sense once scores are backed by stake.

Deliverables:

• $VIGIL token contract and staking contract on Base mainnet. Launch details will be announced only on x.com/VigilOnBase. Any other address is a scam.
• Permissionless Watcher onboarding: stake, run Probes, publish Attestations, earn attestation rewards.
• Stake-weighted scoring with the per-Watcher cap, replacing the interim equal weighting.
• Slashing of the losing side of a dispute by a fraction of stake defined by governance.
• Fee share: half of protocol fees to active Watchers.
• Buyback and burn: the other half of protocol fees.
• VIGIL Verified subscription and badge for providers holding a Reliable score.
• Retirement of the Phase 1 allow-list.

Exit criteria:

• Staked Watchers, not the allow-list, account for all weight in every published score.
• At least one slashing event has been executed through a dispute.
• The first fee distribution and the first buyback have been executed onchain and are verifiable.
• VIGIL Verified is live and at least one provider is displaying the badge.

Following progress

Progress is posted on x.com/VigilOnBase and reflected in these docs as each deliverable lands. Placeholder URLs and zero addresses are replaced only when the corresponding component is live. If a page still shows a placeholder, that component has not shipped, regardless of what anyone else says.