Document prototype closure plan

docs/roadmap.md

@@ -9,6 +9,69 @@ Status markers:
 - `[~]` In progress
 - `[x]` Done
 
+## Prototype Viability Closure Plan
+
+These are the remaining gaps that must close before the prototype is a smooth
+end-to-end test target for the intended personal mesh use cases.
+
+- `[~]` Two-node operator-flow test coverage.
+  Acceptance criteria:
+  - `[ ]` A two-daemon test covers owner-rooted init, peer-card exchange,
+    enrollment request submission, owner approval, `geth sync now`, and
+    `geth sync status`.
+  - `[ ]` A two-daemon test proves approved keychain/auth state reaches the
+    enrolled node without using the old one-off `node enroll sync` shortcut.
+  - `[ ]` Tests assert rejected/unsigned/conflicting replicated records do not
+    mutate local trust or resource state.
+
+- `[~]` Remote authorization enforcement audit.
+  Acceptance criteria:
+  - `[ ]` Every remote mutable operation has an explicit resource capability
+    check before mutating local state or opening a host service.
+  - `[ ]` Tests cover denied and allowed paths for CAS, KV, DB, document,
+    pubsub, pipe, SSH proxy/admin shell, SSH cert metadata, and revocations.
+  - `[ ]` `auth explain` output can explain discovered-only peers, missing
+    endpoint bindings, missing grants, matching grants, revocations, and bearer
+    access.
+
+- `[~]` Iroh-native backend replacement.
+  Acceptance criteria:
+  - `[ ]` CAS fetch/provider paths use `iroh-blobs` or a documented pinned
+    equivalent instead of bootstrap control-ALPN blob transfer.
+  - `[ ]` KV metadata and entries replicate through Iroh Documents or a
+    documented pinned equivalent.
+  - `[ ]` Pubsub wakeups/presence use `iroh-gossip` or a documented pinned
+    equivalent.
+  - `[ ]` Fallback/stub behavior remains clearly marked where APIs are not yet
+    pinned.
+
+- `[~]` File sync reconciliation polish.
+  Acceptance criteria:
+  - `[ ]` `cas root apply` has a richer three-way base/local/remote reconcile
+    path for safe updates and deletes.
+  - `[ ]` Ambiguous changes continue to produce durable conflicts instead of
+    overwriting local files.
+  - `[ ]` Tests cover create/update/delete/rename application across two local
+    roots.
+
+- `[~]` Durable Automerge documents.
+  Acceptance criteria:
+  - `[ ]` Document state is stored as durable Automerge data, not only JSON
+    last-writer-wins state.
+  - `[ ]` Sync converges according to Automerge semantics across two nodes.
+  - `[ ]` Resource authorization gates remote document reads and writes.
+
+- `[~]` Operational first-run polish.
+  Acceptance criteria:
+  - `[ ]` README has a complete two-machine walkthrough for owner init,
+    enrollment, grants, sync status, SSH cert request/approval, SSH proxy, KV,
+    CAS/file-root, and DB/document smoke tests.
+  - `[ ]` CLI errors for stale peer cards, missing endpoint bindings, missing
+    grants, unavailable relays, unavailable service managers, and unsupported
+    platform features tell the operator what command to run next.
+  - `[ ]` `geth sync status --json` is sufficient for scripts to detect stale
+    peers and failed streams.
+
 ## Phase 0: Bootstrap
 
 Goal: establish a compiling single-binary local runtime with local state, local