diff --git a/ROADMAP.md b/ROADMAP.md
index e89a046..df3908f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -14,16 +14,38 @@ This document outlines the current status of the Private Proof-of-Reserve CLI pr
 | **Performance** | • Pure Rust; no FFI headaches.<br>• Commitment & Merkle root linear in UTXO count. | • Range-proof verification still `TODO` (Bulletproofs verify cost ~O(n log n)).<br>• For thousands of UTXOs, QR frames explode. | Consider commitment aggregation. |
 | **Compliance / auditability** | • Clear separation of cryptographic steps makes audit easier. | • Bulletproof gadget not audited; same for Merkle inclusion logic. | Engage external audit once code stabilizes. |
 
+## Where we are right now
+
+| Area | Status | Notes |
+| --- | --- | --- |
+| **Compiles & unit-tests** | ✅ | All code builds with `--locked`; the three sanity-tests pass. |
+| **CLI UX** | ✅ | `generate`, `verify`, `build-psbt`, `attach-sigs` all run end-to-end (with a local Core node). |
+| **Pedersen & Bulletproof plumbing** | ✅ (prototype) | Commitments + range-proof verify correctly. |
+| **UTXO gathering** | ⚠️ | Uses `listunspent` → **current** UTXO set, not a historical snapshot at `height`. |
+| **Ownership proof** | ⛔ | Currently just records the raw signature bytes; no validation logic. |
+| **Merkle inclusion** | ⛔ | No membership paths; verifier re-hashes the full commitment list (trusts prover). |
+| **PSBT flow** | ✅ (MVP) | Draft PSBT is built, QR chunking works, signatures merged back. |
+| **Security / audit trail** | ⚠️ | No domain-separation tags in transcripts, no zeroization of secrets, no formal review. |
+| **Dependencies** | ⚠️ | Bulletproofs `4.x`, curve25519-dalek-ng `4.1`: both a year behind upstream. |
+| **Test coverage** | 🟡 | Only 3 unit tests; no property tests, no integration tests. |
+| **Docs / README** | ✅ | High-level README, dev-setup instructions, and build badges present. |
+
 ## Should we keep going with this architecture?
 
 Yes. Offline signing via PSBT leverages a mature ecosystem, and Pedersen commitments plus Bulletproofs follow well-tested cryptographic designs. The remaining features for multisig, descriptor wallets and snapshot-at-height do not require an architectural overhaul.
 
-## Suggested near-term roadmap
+## Recommended next steps
 
-1. **Ownership verification** – implement signature extraction and on-verify checks; support `m-of-n` (1–2 dev‑days).
-2. **Snapshot at declared height** – either pause a pruned node at `--height` or fetch an assumeUTXO hash (2–4 dev‑days).
-3. **Finalize proof JSON v1** – add `proof_format`, `signing_type`, and `psbt_hash`; lock the field set (0.5 day).
-4. **Automated regtest suite** – spin up `bitcoind`, auto-mine, generate a proof and verify it (1 day).
-5. **Docs & README** – deployment guide, security model description and QR signer list (0.5 day).
+| Priority | Task | Why it matters |
+| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
+| **1** | **Historical snapshot** – replace `listunspent` with a deterministic view at `block_height` (e.g. `gettxoutsetinfo` → assumeUTXO or a pruned node halted at that height). | Prevents a prover from “cheating” by spending after the snapshot. |
+| **1** | **Ownership gadget** – decide on a signature-verification strategy (Schnorr in-circuit vs. OP_RETURN PSBT anchor) and implement verification logic. | Without it you only prove that *someone* had those UTXOs. |
+| **1** | **Inclusion proofs** – emit Merkle branches, switch verifier to path-checking. | Makes the proof self-contained; verifier no longer has to trust the entire list. |
+| **2** | **Upgrade deps** – Bulletproofs `5.0`, dalek `4.1.4` (or switch to upstream non-ng). | Brings in subtle 3.0 API and fixes small-scalar bugs. |
+| **2** | **Transcript domain separation** – give each proof type its own label (`b"por-range"`, etc.). | Standard best practice to avoid cross-protocol attacks. |
+| **2** | **Zeroize secrets** – wipe blinding factors & PSBT bytes after use (`zeroize` crate). | Limits key-material leakage. |
+| **3** | **Property / fuzz tests** – proptest that any random set of UTXOs passes round-trip. | Hardens code against edge cases. |
+| **3** | **CI matrix** – run GitHub Actions on stable, beta, nightly; include `cargo audit`. | Keeps supply-chain and MSRV healthy. |
+| **3** | **Multisig support** – treat each PSBT input’s redeem script, gather all sigs, update ownership gadget. | Lets treasuries prove reserves without revealing co-signers. |
 
 When these land the project should be a viable MVP for exchanges or treasury desks to trial on testnet.