Document OSS funding use and roadmap

FUNDING_USE.md

@@ -0,0 +1,53 @@
+# Funding Use: Codex Open Source Fund
+
+Passpod TASK Core is a public open-source standard layer for sensitive-action control: **no receipt, no sensitive action**.
+
+This repository provides schemas, examples, validator/CLI tooling, OpenAPI references, and documentation for Trust Action Receipts and decision states such as `allow`, `deny`, `review_required`, `freeze`, and `revoke`.
+
+## Why API credits matter
+
+Passpod TASK Core is security-sensitive OSS. Developers may copy its schemas, examples, and validation patterns when building AI-agent, automation, approval, or sensitive-action workflows. Weak examples or inconsistent validation could spread unsafe patterns.
+
+API credits would help maintain and harden the public OSS layer as a solo maintainer.
+
+## Planned use of API credits
+
+Credits would be used for public repository maintenance only:
+
+- Codex-assisted schema validation checks
+- Validator and CLI test generation
+- OpenAPI consistency checks
+- Example receipt generation and review
+- Regression tests for valid and invalid receipts
+- Detection of unsafe or ambiguous examples
+- Documentation drift checks
+- Release note and changelog drafting
+- Issue and pull request triage automation
+- Security review of receipt, state, and revocation flows
+
+## Not for private commercial use
+
+Credits requested for this repository would not be used for private customer operations, private pilot data, commercial backend execution, or production key issuance.
+
+Commercial and private systems remain separate from this public OSS standard layer.
+
+## 30 / 60 / 90 day plan
+
+### First 30 days
+
+- Harden validator examples
+- Add invalid and replay-risk test cases
+- Improve README quickstart
+- Add clear public/private boundary notes
+
+### First 60 days
+
+- Expand receipt gallery
+- Add OpenAPI/schema drift checks
+- Add issue templates for schema, security, docs, and validator feedback
+
+### First 90 days
+
+- Add maintainer automation for pull request review
+- Publish release workflow notes
+- Improve standards crosswalk notes for OWASP, NIST, OpenID, W3C DID/VC, EUDI, MCP, and FIDO

README.md

@@ -46,3 +46,13 @@ Request Pilot Access: pilots@passpod.io
 ## Public/private boundary
 
 This repo does not contain production signing keys, scoped key generation internals, buyer-specific workflows, real customer receipts, or Passpod Hub backend code.
+
+
+## Open source maintenance
+
+Passpod TASK Core is maintained as a public OSS standard layer for sensitive-action control.
+
+- [Roadmap](ROADMAP.md)
+- [Funding Use](FUNDING_USE.md)
+
+Credits or OSS support requested for this repository are intended for public maintenance only: schema checks, validator/CLI improvements, OpenAPI consistency, examples, tests, documentation, release workflows, and security hardening.

ROADMAP.md

@@ -0,0 +1,46 @@
+# Passpod TASK Core Roadmap
+
+Passpod TASK Core is an open-source Trust Action Standard Kit for sensitive-action control.
+
+The goal is to help developers test safer patterns before high-risk actions execute.
+
+## Current scope
+
+- Trust Action Receipt schema
+- Example receipts
+- Validator / CLI tooling
+- OpenAPI reference
+- Demo-only implementation guidance
+- Public/private boundary documentation
+
+## Near-term milestones
+
+### v0.1.x — OSS clarity and testability
+
+- Make the README understandable in 30 seconds
+- Ensure fresh-clone validation works
+- Add valid and invalid example receipts
+- Document decision states clearly
+- Improve OpenAPI/schema consistency
+
+### v0.2.x — Security hardening
+
+- Add replay-risk examples
+- Add revocation and freeze examples
+- Add unsafe-example checks
+- Add regression tests for validator edge cases
+- Improve security reporting and maintainer workflow
+
+### v0.3.x — Maintainer automation
+
+- Add issue triage workflow notes
+- Add pull request review checklist automation
+- Add release checklist automation
+- Add documentation drift checks
+- Add standards crosswalk notes
+
+## Non-goals for this public repo
+
+This repository does not issue production receipts, production keys, customer credentials, private pilot records, or commercial access.
+
+Production and hosted workflows belong in a separate private/commercial boundary.