A2A Mesh is currently operated as a solo-maintainer professional OSS project. The roadmap is intentionally split into near-term repository maturity, protocol/runtime hardening, and longer-term foundation-readiness work.
Target: Professional OSS / Mature OSS.
The repository should not claim Gold or foundation-grade maturity until it has multiple active maintainers, independent human review, a sustainable governance process, repeatable releases, and strong release integrity evidence.
- Keep
mainprotected with required CI, docs, security, CodeQL, and Scorecard checks. - Maintain clear contributor, support, security, and governance documentation.
- Keep OpenSSF evidence current and avoid overclaiming badge readiness.
- Stabilize release automation, release notes, provenance, and package verification.
- Expand storage, registry, runtime, and protocol conformance tests.
- Runtime and protocol conformance.
- Registry reliability and tenant trust.
- MCP integration security boundaries.
- Documentation discoverability using the Diataxis model.
- Supply-chain integrity, package verification, and release provenance.
- Contributor onboarding and issue triage process.
Foundation-grade readiness requires more than automation. The project still needs independent maintainers, human review, contributor diversity, documented governance rotation, published security response metrics, and durable release cadence evidence.