specify selective disclosure and anchor policy

docs/roadmap.md

@@ -561,9 +561,21 @@ resource-scoped capability decisions.
   - `[x]` Publish a transport-neutral, deterministic SSHSIGCHAIN v1 record
     format with explicit trust-anchor, chain-link, size-limit, and
     non-claim documentation.
-  - `[x]` Provide a reusable verifier core and a geth keychain profile that
-    rejects self-bootstrap, non-linked forks, non-canonical payloads, and
-    post-revocation timestamp replay.
+  - `[x]` Remove the redundant sequence counter; exact parent hashes alone
+    define genesis and causal order.
+  - `[x]` Provide a mandatory Authority v1 reducer for devices, keys,
+    proof-of-possession, causal revocation, device permission ceilings, scoped
+    permissions, delegation, and anchor-policy changes.
+  - `[x]` Attach application data through profile-scoped salted commitments;
+    disclosures do not change link identity and missing payloads make profile
+    state explicitly incomplete.
+  - `[x]` Reject self-bootstrap, non-linked histories, noncanonical keys and
+    permission lists, permission amplification, invalid key proofs, and use of
+    a revoked device/key on later links.
+  - `[x]` Define signed head claims, separate weighted/required attester and
+    backend receipt policies, required backend classes, old-policy witnessing
+    of policy-change heads, cached-head rollback checks, and
+    incomparable-history fork failure.
   - `[~]` Add explicit CLI storage, signing, verification, publication, and
     import workflows for a pinned SSHSIGCHAIN trust tuple.
     - `[x]` `geth keychain verify-sigchain` verifies a JSONL transport file
@@ -572,15 +584,26 @@ resource-scoped capability decisions.
       head-advance workflows are complete.
   - `[ ]` Persist accepted heads and require proof of extension before a source
     can advance.
+  - `[ ]` Implement and separately test concrete anchor adapters.
+    - Acceptance criteria: immutable Nostr claim publication, signed HTTP or
+      transparency evidence, and any blockchain adapter all bind the canonical
+      `HeadClaim`; none treats backend ordering as SSHSIGCHAIN consensus.
+    - Acceptance criteria: adapter threat models document deletion, stale
+      reads, timestamp manipulation, backend equivocation, inclusion proof, and
+      operator-independence assumptions.
+  - `[ ]` Add record construction and disclosure-management commands which
+    generate unpredictable 32-byte nonces and never expose hidden payloads in
+    signing-byte diagnostics.
   - `[x]` Delete the previous test-only static export, publication,
     verification, import, checkpoint, and fetch workflow. It is not a
     compatibility target because it was never deployed.
   - `[~]` Add OpenSSH integration tests and independently generated wire test
     vectors for the published standard.
-    - `[x]` An OpenSSH `ssh-keygen -Y` integration test signs and verifies a
-      linked root/init chain.
-    - `[x]` The specification and reference implementation share a base
-      signing-byte test vector.
+    - `[x]` An OpenSSH `ssh-keygen -Y` integration test signs and verifies an
+      Authority v1 genesis link.
+    - `[~]` The specification and reference implementation share base signing,
+      key-proof, commitment, and head-claim vectors.
+      - `[ ]` Publish the complete vector set in the specification.
     - `[ ]` Add independently generated cross-implementation vectors.
 
 - `[x]` SSH-admin-rooted keychain initialization.