diff --git a/AGENTS.md b/AGENTS.md
index caec729..aa97227 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -16,13 +16,15 @@ repository.
 - Record repository-specific product and release decisions locally in
   `ROADMAP.md`, `ARCHITECTURE.md`, `RELEASING.md`, and this file.
 
-## Current Milestone: Private Remote Validation
-
-Complete Private Remote Validation and stop before changing repository
-visibility. Repository-local source, tests, documentation, metadata, fixtures,
-and workflows may be changed and verified. Creation of the empty private
-canonical repository, its sanitized first history, a push, and observation of
-credential-free GitHub Actions require explicit maintainer authorization.
+## Current Milestone: Public Preview
+
+Private Remote Validation is complete, and the current execution target is
+Public Preview. Repository-local source, tests, documentation, metadata,
+fixtures, workflows, private pull requests, and credential-free CI may be
+changed and verified. Stop before changing repository visibility: making the
+canonical repository public and configuring or exercising public-only settings,
+protected environments, secrets, or live smoke require explicit maintainer
+authorization.
 
 The accepted identity is:
 
diff --git a/RELEASING.md b/RELEASING.md
index 50b5c0c..05678d5 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -83,9 +83,9 @@ complete only when `npm owner ls cometapi` lists the maintainer-confirmed
 `cometapi-team` account after bootstrap; until then this remains a Registry
 Alpha prerequisite, not a Public Preview blocker.
 
-For the current milestone, authorized external actions stop at creating the
-empty private repository, pushing its sanitized first history, and observing
-credential-free CI. Visibility changes and every subsequent external action
+For the current Public Preview milestone, authorized external actions remain
+limited to private pull requests and credential-free CI. Changing repository
+visibility and every subsequent public-only configuration or live action
 require separate authorization.
 
 ## Candidate verification gate
diff --git a/ROADMAP.md b/ROADMAP.md
index 0cdd0af..57f72ae 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,6 +1,6 @@
 # CometAPI TypeScript and Node.js SDK Roadmap
 
-Status: Private Remote Validation complete; Public Preview and later milestones planned  
+Status: Public Preview in progress; visibility change awaiting explicit authorization
 Last updated: 2026-07-21  
 Repository contract: This roadmap is self-contained and is the public source
 of truth for this repository's release sequence.
@@ -11,9 +11,11 @@ The TypeScript and Node.js SDK will provide a typed CometAPI entry point that
 preserves the official OpenAI JavaScript client experience while shipping a
 small, auditable package for supported Node.js LTS runtimes.
 
-Private Remote Validation is complete for the sanitized private repository,
-and work stops before its visibility changes. Public Preview and the functional
-`0.1.0-alpha.1` prerelease follow as separate evidence gates. Registry
+Private Remote Validation is complete for the sanitized private repository, and
+the current execution target is Public Preview. Preparation continues in the
+private repository, but work stops before its visibility changes until a
+maintainer explicitly authorizes that action. The functional `0.1.0-alpha.1`
+prerelease remains a separate evidence gate after Public Preview. Registry
 publication proceeds only through Private Remote Validation, Public Preview,
 Registry Alpha, and stable 0.1.0 stages.
 
@@ -23,7 +25,7 @@ Registry Alpha, and stable 0.1.0 stages.
 | ---------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
 | Repository foundation        | In progress | The repository has reproducible development, contribution, security, and release processes.                                              |
 | Private Remote Validation    | Complete    | The sanitized private repository passes real credential-free default-branch CI; public-only controls and live tests remain disabled.     |
-| Public Preview               | Planned     | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. |
+| Public Preview               | In progress | The public repository has blocking CI, repository rules, security reporting, protected environments, and authorized live-smoke evidence. |
 | 0.1.0-alpha.1 Registry Alpha | Planned     | Early adopters can install a functional prerelease from npm's `next` channel and call the three required OpenAI-compatible resources.    |
 | 0.1.0 Stable                 | Planned     | Users can install a fully verified package from npm's default channel.                                                                   |
 | 0.2.0 provider-native text   | Planned     | Users can opt into Anthropic Messages and Gemini text adapters through isolated subpath exports.                                         |