# Masterplan execution inventory

Status reviewed 25 October 2026 against the original Masterplan, the additive
13-ticket Governance specification, current status/gap/roadmap documents, and
the source/test tree. This is a work inventory, not a claim of completion or a
release gate. Original source documents remain unchanged:
[Masterplan](DECENTRALHUB_CODEX_MASTERPLAN.md) ·
[Governance](MESHFORGE_CODEX_GOVERNANCE.md).

## How to read this inventory

Latest native increment: [compound namespace resolution](NATIVE_NAMESPACE_CLI.md)
adds ordered, hash-bound current-collision previews and separately versioned
resolution steps, replayed through protected review/apply. Prior plan and
resolution bytes remain unchanged. Full dev8 acceptance `4cf433c852a9` passed
37 external checks with pins verified; this newer source needs its own run.

Latest increment: [manual peer activation](PEER_ACTIVATION_CLI.md) adds a
reviewed replacement of discovery URLs using fresh source-diverse observations,
exact config/observation CAS and explicit consent. It does not introduce
continuous peer-ID enforcement, automatic activation/rotation or LAN access.
The preceding resolved-review dev7 freeze `4c0982b15b2c` passed all 36 complete
external checks with source/log pins verified; later activation edits need
their own validation.

Round 4 local increment (26 October):
[explicit conflict-resolution artifacts](NATIVE_RESOLUTION_CLI.md) replay the
original graph/plan and bind every decision to a new ID. CLI exports the result
without modifying the native store. The subsequent
[versioned protected-review integration](RESOLVED_REVIEW_CLI.md) now replays
explicit decisions at proposal and apply, retains `/1` signatures/rejection
keys and supports refs/2, refs/3 and refs/4. Compound namespace resolution,
native transport and complete browser integration remain open.
[VPS variants](VPS_HOSTED_ARCHITECTURE.md) add optional Caddy/systemd-user
packaging and a strict no-disk `/health` liveness endpoint. Existing nginx/
systemd-system deployments remain supported. The hosted real-process checker
is now registered in the acceptance runner. Frozen dev6 source `e3d9d88bb881`
passed all 35 external loopback/process checks, with source/log pins verified.
This does not validate the later resolved-review source edits. Socket creation
is blocked here; real browser, TLS/proxy and VPS acceptance remain external runs.

“Implemented” means only that the cited code exists and has local tests at the
scope stated. “Open local work” is work that can proceed with fixtures and the
standard library or a specifically justified dependency; missing hardware, real identities, legal review, or an
independent audit do not block that development. “External acceptance” is
evidence that cannot be supplied by another unit test or cross-build. The
existing [implementation status](IMPLEMENTATION_STATUS.md),
[governance gap](GOVERNANCE_GAP.md), and [roadmap](ROADMAP.md) remain their own
documents; this file gives them a common actionable work queue.

## Execution update — 25 October 2026

The following are source-backed local increments, not completed masterplan
phases or external acceptance. Reports identify the checked package scope;
they do not assert a single frozen-tree full-suite result for all new work.

| Package | Current fact and evidence | Still open |
|---|---|---|
| Reproducible build/provenance/SBOM | Root implemented `scripts/build-release.py` and `docs/REPRODUCIBLE_BUILDS.md`. Two independent output paths and three platform targets from the previously verified **native source snapshot 17** produced byte-identical binaries, deterministic archives, SPDX and provenance artifacts; independent hash-binding checks passed. | This validates that source snapshot and tool run, not a release of the currently changing tree. Real release roots/signatures, external build reproduction, installer and publication remain separate. |
| BACKUP-1 | `internal/localrepo/backup*.go`: verified whole native `.dh` inventory including detached snapshots/objects, new-destination restore, bounded manifest and optional expected HEAD. Worker reports normal/race/vet PASS. Root integrated `cmd/decentralhub/backup_cli.go`; combined localrepo/CLI race checks passed. | Restore creates native `.dh`, no worktree. Expected HEAD authenticates that history, not unrelated extra objects; whole-backup authenticity needs a manifest pin. Atomic publication currently Linux amd64/arm64; unsupported platforms fail closed. Retention/quota UX and hardware tests remain. |
| PC-1 / PC-2 | `internal/privatecrypto/envelope.go` and `cmd/decentralhub/private_package.go`: bounded local AES-GCM packages, independent context and separately stored fresh recovery key. PC-1 normal/race/vet and root PC-2 targeted tests plus actual process E2E including eight concurrent seal attempts passed. | This is local file encryption, not identity recovery, group enrollment or private remote history sync. Non-Linux key ACL/directory durability are not verified by inherited CLI helpers. |
| PC-3 | `internal/privatecrypto/writer*.go`: pinned writer binding, durable pre-Seal budget, fresh key/installation IDs, retired-state checks, missing-state refusal. Worker normal x20/race/vet PASS and Darwin arm64 test cross-compile PASS; reviewer parent-directory fsync and lock-bound inventory fixes included. | Writer execution is Linux-only; other platforms fail closed. No hardware antirollback, automatic key recovery or externally approved OS keystore. |
| PS-1a / PS-1b | `internal/privatesync/{types,codec,store,http,client}.go`: bounded private ciphertext store, owner cutover anchors, atomically authorized reads/writes, private HTTP and durable client history pins. Local fixture stage tested; independent `security_review_test.go` normal/race/vet PASS. Three concrete review findings were fixed and covered. | Small-store quota, manual trusted onboarding and explicit private mount. Native encrypted bridge and `cmd/decentralhub/private_sync.go` are implemented: independent real-HTTP push/clone, offline divergence, historical-key and ancestry tests passed. Root reports actual two-device CLI E2E, protected read-key sharing, full-history read-only clone, persisted own revocation, fresh epoch isolation, explicit retirement and encrypted outbox metadata binding passed; combined privatesync/localrepo/CLI race passed. No native merge or production private service claim; Windows writer execution remains unsupported. |
| GR-1 / GR-2 | [Recovery contract](RECOVERY_DESIGN.md) implemented as separate opt-in v2 library: explicit migration CAS, dual-quorum rotation, terminal-anchor recovery and retained negative history. Independent reviewer normal/race/vet PASS; review fixes include late-reject order, multiple unresolved terminal causes, immutable local floors and separate recovery authority. Existing v1 Config/fingerprints remain unchanged. | `release_recovery_cli.go` and `release_recovery_bundle.go` integrated; root actual-process E2E passed four groups covering review delay, terminal reject/recovery, resolved replay and migration digest CAS/no reset. Migration refuses any v1 completed LastTransition, including nonterminal ones, until its late-negative format is supported; no reset fallback. Independent roots/reviewer identities and external audit remain gates. |
| Native branches | `internal/nativerepo` N1a/N1b implements separate immutable DOP store, bounded graph/disk reservations, owner-signed genesis/ref sidecars and CAS refs; explicitly signed incoming branches retain offline divergence. Independent normal/race/vet PASS after FD, quota, uncertain-result and stale-import fixes. | N3 pure merge/CLI, N5 pinned-backup migration, N4 protected review/apply, ROT2 policy epochs and same-owner terminal recovery are locally implemented. Conflict resolution, owner-loss/direct refs/3 terminal recovery, DOP transport and browser/MCP writes remain. Legacy `.dh` IDs/format unchanged. |

N3 pure merge and CLI plan export have reached local package review; root owns
the shared source freeze, full-suite checks and source checkpoint. Native branch/merge follow-up packages have
separate object-store, attestation, pure merge, ref/transaction and migration
ownership. Browser wiring comes after backend acceptance; no decorative UI is
counted as implemented behavior.

## Ordered local work queue

| Order | Local package | Concrete remaining work | Existing code to extend | Review evidence to add |
|---|---|---|---|---|
| A | DH-006 visibility and private-by-default contract | Define and enforce the local/remote distinction for `private`, `intranet`, `unlisted`, and `public`; legacy remotesync remains explicitly public while a separate private ciphertext-store prototype now exists; complete four-mode product semantics remain open. Add explicit metadata exposure preview and irreversible-publication warning. Do not imply unlisted is access control. | `internal/remotesync/store.go`, `cmd/decentralhub/public_sync.go`, `cmd/decentralhub/private.go`, `cmd/decentralhub/local_actions.go`, `cmd/decentralhub/templates.go` | Extend `internal/remotesync/privacy_review_test.go`, `cmd/decentralhub/private_preview_test.go`, `cmd/decentralhub/local_actions_test.go`; new visibility/ACL contract tests for each mode, unauthorized reads/writes, no private metadata in DDP/MCP/outbox, public-preview consent and no-write-on-cancel. Private bridge implementation is root-owned under Astra’s reviewed design; do not merge its namespace into public remotesync. |
| B | DH-003 offline repository backup/restore | BACKUP-1 library and CLI implemented and package/race checks passed; remaining work is retention/recovery UX and hardware acceptance. Restore only into a new destination, validate complete native metadata, preserve all IDs and detached history. Existing export/recover remain distinct operations. | `internal/localrepo/store.go`, `internal/localrepo/durable.go`, `internal/localrepo/export.go`, `cmd/decentralhub/main.go` | New focused localrepo and CLI tests for corruption, missing objects, symlinks/path swaps, concurrent source mutation, interrupted copy, existing destination, recovery after interruption, and identity of source bytes/HEAD. Keep device keys, remote credentials, and Node state out of repository backup by default. |
| C | P1-6/7 peer-source diversity and status limits | Local peer-select preview now requires independently pinned fresh sources in at least two locally assigned groups, excludes self-endorsement/aliases and applies every supporting-group quota. It is deterministic greedy selection with no network/config writes; automatic peer activation/rotation and operational eclipse resilience remain open. Keep public-only address policy separate from any future LAN opt-in. | `internal/peertrust/store.go`, `internal/peertrust/protocol.go`, `cmd/decentralhub/bootstrap.go`, `cmd/decentralhub/network.go`, `cmd/decentralhub/outbox.go` | Add deterministic fixture tests for one-source capture, many Sybil source IDs, duplicate endpoint/key aliases, stale/unverified candidates, failure/backoff, and explicit pin requirement. Extend network status tests so Offline, local/intranet-only, public peer observed, synchronizing, and degraded are never conflated. |
| D | P1-7 durable public queue and snapshot-queue semantics | Public event outbox is durable. Snapshot pending push/pull is currently observational and requires explicit CLI actions; new commits are intentionally not auto-published. If adding a queue, keep credentials explicit, never unlock keys, and require per-repository opt-in and inspectable retry/abort behavior. | `cmd/decentralhub/outbox.go`, `cmd/decentralhub/network.go`, `internal/remotesync/status.go`, `internal/remotesync/bridge.go`, `cmd/decentralhub/public_sync.go` | Extend outbox/network/bridge tests for offline recovery, revoked/removed peers, stale intents, cancellation, duplicate delivery, and no private worktree or key access. Coordinate private transport details with Astra before changing any private remote path. |
| E | P1-8/9 governance follow-through | V2 library and explicit CLI workflows now pass package checks and root process E2E; complete frozen-tree validation and operational runbooks. Existing v1 terminal rejection has no reset or retrofitted recovery authority; its root set remains immutable. | `internal/releaseverify/transition_*.go`, `internal/releaseverify/checkpoint.go`, `cmd/decentralhub/release_transition_*.go` | Expand adversarial tests for multi-transition history, late rejects, root compromise/revocation, process races, and recovery only after a separately reviewed v2 contract. No production approval or real Founder key is implied. |
| F | P2-10 Discovery retention and follows | Add typed signed follow/unfollow and category subscription records only after defining subject identity binding, opt-out, expiry, and old-peer behavior. Define bounded local event/seen-ID retention before implementing TTL/GC; do not prune signed evidence based only on publisher time. Trending must be a time-window metric, not total stars. | `cmd/decentralhub/main.go`, `cmd/decentralhub/feeds.go`, `cmd/decentralhub/bookmarks.go`, `cmd/decentralhub/node_store.go`, `cmd/decentralhub/outbox.go`, `protocol/DDP-EXPERIMENTAL.md` | Add DDP canonical vectors/context separation, replay/withdrawal/expiry tests, retention tests across restart/multiprocess, deterministic window/ranking tests, and 1,000-event feed limits. Private bookmarks remain local and are not public follows. |
| G | DH-014 agent proposal/review boundary | MCP is public read-only. Add no agent write path until capabilities, per-operation authorization, reviewable proposal objects, host-execution denial, and durable audit events have a concrete contract. | `cmd/decentralhub/mcp.go`, `internal/identity/identity.go`, `protocol/MCP-EXPERIMENTAL.md`, `protocol/DOP-1.md` | New capability-negative tests, signed proposal/review canonical vectors, revoked/expired capability tests, and audit privacy tests. Host commands/tests must remain outside the server process. |
| H | DH-009/10/11/12 optional profile/organization/attestation models | Schemas and product contracts exist; no profile/firm identity runtime. Implement only after subject authorization and privacy/expiry/revocation semantics; an entered URL or company comment must not produce a verification badge. | `protocol/OPTIONAL-INTERFACES.md`, future `internal/profile`/`internal/attestation` modules (not present) | New typed codecs, domain-separated vectors, field/size limits, signer authorization, expiry/revocation tests, and UI wording tests separating self-assertion, domain control, and external verification. External verifier trust remains external. |
| I | DH-013 wallets/payments and DH-015 Buzz | Keep disabled/specification-only until specific adapters and trust contracts are approved. No custom wallet cryptography, payment custody, or Buzz dependency in the core. | `protocol/OPTIONAL-INTERFACES.md`; no wallet/payment/Buzz runtime package is present | Per-network wallet compatibility vectors and replay/origin/chain-confusion tests; provider/legal review; Buzz revision/license/API and candidate crypto dependency reviewed in [BUZZ_ADAPTER_DESIGN.md](BUZZ_ADAPTER_DESIGN.md); isolation/runtime tests remain. These are not prerequisites for local/offline work. |

## Masterplan ticket matrix (DH-001–016)

| Ticket | Current source-backed scope | Remaining local implementation / verification | External-only or separately owned gate |
|---|---|---|---|
| DH-001 | Inventory/findings and regressions are documented in `docs/INVENTORY.md` and `internal/localrepo/masterplan_review_test.go`. | Maintain as a living review; do not claim a full independent audit from regression tests. | Independent security review. |
| DH-002 | DOP/1 Blob/Tree/Commit/Ref codec, vectors and `object-check`: `internal/objects/objects.go`, `protocol/DOP-1.md`, `protocol/dop-v1-vectors.json`. | Proposal/Attribution and broader object family, broader protected-review integration and independent interoperability review; native store and explicit N5 migration are implemented. Keep v1 IDs/signatures unchanged. | Independent implementation/interoperability review. |
| DH-003 | Durable local stores, process locks, CAS, crash boundaries, fault-injected write/sync failures, Linux atomic export: `internal/localrepo/durable.go`, `store.go`, `export_atomic_linux.go`, `*_test.go`. | BACKUP-1 verified whole-repository library implemented (see execution update); CLI delivered; complete retention, disk quota/recovery UX and final runbook verification. | Real Windows runtime, power-loss, disk-full hardware/filesystem, NFS/network-FS behavior. Root owns stdlib reproducible-build/SBOM work, not these storage gaps. |
| DH-004 | Ed25519 identity/delegation, request binding, replay and persistent revocation: `internal/identity/**`, `cmd/decentralhub/keystore*.go`, `protocol/DIP-EXPERIMENTAL.md`. | PC-3 durable local writer budgets exist; device inventory/UI, OS-backed keystore, actual identity recovery/rotation and user-level enrollment remain. Do not conflate loopback with OS-user authentication. | OS keystore/platform validation and externally approved recovery authority. |
| DH-005 | Explicit **public** snapshot sync, owner pin, signed import provenance, graph/quota checks, CAS, CLI clone/fetch/push/pull and retry intent: `internal/remotesync/**`, `cmd/decentralhub/public_sync.go`. | Private ciphertext store/HTTP/client, durable writer budget and encrypted full native-history push/clone CLI pass local/process tests. Merge/apply, full enrollment UI, automatic credential-backed queue and cross-platform execution remain open. | Actual Windows↔Linux hardware E2E; independent audit for public service. |
| DH-006 | Private local storage/browser and explicit snapshot-only public publication exist: `cmd/decentralhub/private.go`, `local_actions.go`, `internal/localrepo/browser.go`, `public_sync.go`. | Four visibility modes, remote ACLs, intranet/unlisted semantics, public exposure preview now freezes the complete graph/metadata and CLI push requires its reviewed digest; four-mode UI/ACL policy remains open. | E2EE/grouproles/key management separately owned; no network consensus can retract already replicated public content. |
| DH-007 | Peer observations, event outbox, status/header, inspect-only snapshot retry intents: `cmd/decentralhub/network.go`, `outbox.go`, `internal/remotesync/status.go`. | Explicit LAN mode, honest distinction between local/intranet/public reachability; credential-explicit snapshot queue policy. | Real LAN deployments and network topology tests. |
| DH-008 | Bounded DDP cache/ingestion, batch gossip/outbox, separate feeds, local bookmarks, signed star/unstar: `cmd/decentralhub/node_store.go`, `feeds.go`, `bookmarks.go`, `outbox.go`, `protocol/DDP-EXPERIMENTAL.md`. | Public signed follows, categories/subscriptions, time-window trending, finite-cache TTL/GC policy, further spam/admission strategy. | Sybil resistance is not achievable from peer counts alone; production abuse rates need operational evidence. |
| DH-009 | Profile/org envelope requirements only; no runtime. | Subject-authorized signed developer/org profiles, schema/vector, edit/read/revocation path. | Legal entity identity is external. |
| DH-010 | URL/file/form input contract only. | Local editor/import and UI clearly label the source as a self-provided claim. | Legal sufficiency varies by jurisdiction; external legal review. |
| DH-011 | Donation/payment metadata contracts only. | Optional non-custodial display model with chain-specific address validation and no secret/card storage, after policy approval. | Provider availability, PCI/legal/tax review; not a core prerequisite. |
| DH-012 | Domain/registry/attester schemas are proposed only. | Challenge protocol, trust/evidence/revocation integration, subject consent and expiry. | Domain/registrar and legal-verifier trust. |
| DH-013 | Wallet linking/login contracts only; no adapter. | Choose supported wallet/network combinations and test chain/origin/nonce binding before implementing any adapter. | Wallet ecosystem and independent signature vectors. |
| DH-014 | Native MCP public read-only tools and identity capability primitives exist: `cmd/decentralhub/mcp.go`, `protocol/MCP-EXPERIMENTAL.md`. | MCP conformance gap, persisted audit, agent-specific capabilities, workspace/tasks/proposals/review, sandbox boundary. | External MCP interoperability/security review. |
| DH-015 | Exact block/buzz revision, license, API and default-off adapter contract reviewed in BUZZ_ADAPTER_DESIGN; crypto candidate identified, no module added. | Implement bounded NIP11 probe and separately verified offline preview after explicit dependency integration; authenticated reads remain later. | Upstream service/API continuity. |
| DH-016 | Offline release verifier/CLI, signed metadata, local rules, checkpoint and opt-in policy transitions exist: `internal/releaseverify/**`, `cmd/decentralhub/release_*.go`. | Reproducible-build/SBOM tooling passed the snapshot-17 run; current changing source still needs a frozen release run. Installer/updater absent; v2 recovery/rotation library and CLI locally tested; keep production gates visible. | Independently confirmed Founder roots, real reviewer/group independence, external security audit, hardware/platform validation, operational disclosure/runbook and SLOs. |

## Governance extension ticket matrix (P0-1…P2-13)

| Governance ticket | State verified from code/docs | Local remainder | External acceptance |
|---|---|---|---|
| P0-1 Branding/inventory | MeshForge/legacy CLI aliases and exact attribution are implemented; UI coverage exists. | Keep English translation/internationalization scoped; no crypto namespace rename. | None beyond normal release review. |
| P0-2 Storage/privacy | Root-confined paths, process locks, atomic writes/CAS, local action review digest and Linux export protections have fixture/fault tests. | BACKUP-1 library and CLI delivered; quota/retention UX and hardware acceptance remain. | Windows hardware, true power interruption, real disk-full, NFS and independent audit. |
| P0-3 Local key storage | Bounded regular files, Linux owner/mode checks, exclusive init and identity consistency checks. | OS keychain, device inventory/enrollment, recovery/rotation UX. | Platform keystore tests and approved recovery trust. |
| P0-4 Remote E2E | Public explicit store and two-client fixtures; private ciphertext store/HTTP/client and writer prototype locally tested. | Native encrypted full-history bridge/CLI passes local two-device process tests; complete key enrollment/recovery UX, group roles and native merge/apply remain. | Real cross-platform machines and private cryptographic review. |
| P0-5 Public endpoints | Public sync authorization/quotas; discovery limits; shared SSRF/network policy; read-only MCP validation, paging and bounded concurrency. | Complete MCP conformance and explicit admission/abuse policy; avoid public-production claims. | Internet-scale abuse and load testing; no Sybil identity solution from self-created keys. |
| P1-6 Peerstore/bootstrap | Signed public bootstrap, fresh nonce proof, local pinned observations, bounded provenance and public address policy. | Local source-diverse preview and adversarial tests delivered; automatic peer rotation, real eclipse resilience, LAN mode and installer integration remain. | Independently acquired seed/founder pins and real-network diversity. |
| P1-7 Peer exchange/gossip | Bounded outbox, leases/retries/dedupe, anti-entropy and observed connection states. | Source selection; explicit private/local LAN policy; real snapshot queue remains opt-in/manual. | Real topology, independent peer availability and eclipse resilience. |
| P1-8 Release | Experimental offline verifier, CLI, root/config pinning, manifest/artifact hash and persistent checkpoint. | Installer/updater not implemented; v2 recovery/rotation library and CLI locally tested. Provenance tooling tested on snapshot 17; final current-source production artifacts remain. | Real founder key, reproducible signed artifact, audit and hardware validation. |
| P1-9 Governance | Opt-in transitions, immutable local floors, stronger root quorum, old-policy security reviews/tests, wait and persistent negatives. | Safe opt-in v2 recovery/rotation library and CLI now implemented/tested; existing v1 terminal late-negative quarantine still has no reset or retrofitted recovery authority. | Actual group independence and trust provisioning. |
| P2-10 Discover/Pulse | New/release/critical feeds, local bookmark, star/unstar and anti-promotion tests. | Signed follows, category subscriptions, time-window trending, TTL/GC. | Sybil/abuse operational evidence. |
| P2-11 Attribution/workspaces | Public read-only MCP; separate explicit native signed proof/proposal/review journal and reviewed apply. No task/workspace runtime. | Signatures, workflows, scoped agent capabilities and sandboxing. | Cross-implementation review and workspace E2E. |
| P2-12 Optional modules | Interfaces are specified; no account/payment/company runtime. | Only after identity and subject authorization; provider-independent schemas. | Legal, provider and external company-verification trust. |
| P2-13 Buzz/Nostr | No adapter runtime; pinned upstream/license/API and explicit default-off contract reviewed, crypto candidate documented. | NIP11 and verified offline preview implementation, dependency/SBOM integration and isolation tests. | Upstream continuation and license compatibility. |

## Masterplan sections and phase crosswalk

| Source scope | Delivered evidence | Action still open |
|---|---|---|
| §0–1 working rules and baseline | Current modular Go implementation, stdlib policy, offline fixtures, inventory/findings. | Continue accurate status and migration accounting. The original archive description is historical, not current state. |
| §2 operating modes, privacy, identity/domain | Local offline and explicit public modes exist. | Intranet mode, four visibility/ACL states, multi-peer/domain locators and user-facing metadata exposure preview. |
| §3 object and remote architecture | DOP/1 codec, separate owner-only DOP branchstore and native v1 store; public/private native-history adapters, N4 review/apply, N5 migration, ROT2 epochs and same-owner terminal policy recovery locally tested. | DOP transport, conflict resolution, owner-loss/direct refs/3 terminal recovery and broader object families. |
| §4 identity/devices | DIP identity, bounded delegation and persistent revocation. | OS-keystore, device inventory, safe recovery/rotation and wallet-link separation. |
| §5–6 finance/company | Contracts only. | No local payment runtime until authorized profile identity exists; external legal/provider verification is distinct. |
| §7 discovery | Signed events, bounded transport, separate feeds, stars and local bookmarks. | Follows, categories, trending, TTL/GC and robust source/abuse strategy. |
| §8 AI/workspaces/Buzz | Read-only MCP exists. | MCP-scoped write capabilities, tasks/workspaces and execution sandbox; native local signed review/audit exists separately. Buzz remains optional and absent. |
| §9 frontend/status/onboarding/i18n | German responsive UI, private local browser, status page and write opt-in. | Full English/i18n, actual Intranet state, browser public-publish UX and explicit four-mode visibility. |
| §10 safety/privacy/ops | Many local path, HTTP, state, SSRF and privacy regressions. | BACKUP-1 library and CLI exist; complete retention policy/runbook validation; provider/legal/privacy workflows remain. |
| §11 P0–P7 | Parts of P0/P1 are experimental, not whole phases complete. | Work remaining is detailed above; P2–P6 features are not prerequisites to continue P0/P1 local work. P7 is a set of external and operational release gates. |
| §12 tickets DH-001–016 | Status crosswalk above. | Do not infer completion from a partial ticket title match. |
| §13 protocols | DOP, DIP, DDP, MCP, Bootstrap, Remote Sync, Release specs exist. | Proposal/Attribution/Verification/Profile-payment protocols need production-grade schemas/vectors before runtime. |
| §14 acceptance scenarios | Fixture, process, negative, race and some CLI E2E coverage exists. | Private two-device/E2EE process fixtures now pass; real Windows/hardware, LAN, wallet, payments, external company and full upgrade scenarios remain unproven or unimplemented. |
| §15 optional benefits | Release and backup concerns are inventoried. | Device dashboard, mirrors, attribution/license view, bounties, sandboxed CI and advisories are later features. |
| §16 immediate prompt | DH-001–005 foundations were substantially advanced and status is documented. | Whole-repo backup/restore and private native CLI are delivered locally; complete Windows↔Linux/private ACL acceptance and external gates remain work. It is not a directive to stop after one milestone. |
| §17 fixed/open decisions | Offline-first, no central requirement, stable legacy IDs and no wallet as primary identity preserved. | Recovery authority, E2EE/group keys, NAT/source diversity, provider matrix, auditor trust, Buzz and SLO policy remain decisions or future design. |

## External acceptance register (does not block local implementation)

| Gate | Why local tests do not satisfy it | What can continue meanwhile |
|---|---|---|
| Founder/release roots | No independent SteveCo-AI root fingerprint exists; a fixture key or self-generated Node key is not the founder. | Generic verifier, signed fixture policies, protocol and CLI hardening. |
| Reviewer/group independence | Group strings are signed assertions, not proof that people or organizations are independent. | Build the local policy contract and adversarial quorum tests; never label fixture groups as real reviewers. |
| Windows/Linux real hardware and power loss | Cross-builds and injected I/O failures do not model actual filesystems, kernel locks or power removal. | Continue platform-neutral code and deterministic fault tests; record cross-builds separately. |
| NFS/network filesystem/disk-full | Local temporary filesystems and fault injection cannot establish semantics of all deployed storage. | Make limits/failure modes explicit and fail closed. |
| Independent security audit | In-repo tests share implementation assumptions and do not establish absence of design flaws. | Keep threat model and reviewable scopes current; provenance/SBOM tools passed the snapshot-17 run, with current-source freeze/revalidation still required. |
| Legal/provider/company verification | Contracts and local UI cannot validate jurisdictional duties or third-party provider status. | Keep interfaces optional; do not claim verified status or process funds. |
| Production SLO/abuse performance | Synthetic load and localhost fixtures do not establish internet-scale Sybil resistance, availability or cost. | Bounded resource tests and observability without private data. |

## Next disjoint implementation packages

BACKUP-1, PC-1/2/3, private native-history bridge/CLI and opt-in v2 governance
library/CLI have package/process evidence above. Do not reassign completed
implementation merely because this inventory originally proposed it. N1a/N1b
owner-only DOP branchstore is frozen after independent package review;
N3 pure bounded three-way merge is independently reviewed, including the fixed
directory-delete/child-add conflict regression. No further feature packages
start before root completes the shared source freeze/checkpoint checks.

[NATIVE_BRANCH_DESIGN.md](NATIVE_BRANCH_DESIGN.md) separates native store, N3 pure merge, N4 protected review/apply and N5 migration.
N4 local protected review/apply is now separately opt-in implemented; its exact
contract is [NATIVE_REVIEW.md](NATIVE_REVIEW.md). Import attestations and raw owner
refs still cannot grant delegated review/apply authority. Remaining P0/P1
visibility/public-exposure preview, source-diverse peer selection, explicit
LAN policy, credential-explicit snapshot queue and OS-keystore work stay ahead
of optional provider integrations. Buzz now has a specific upstream and
[adapter contract](BUZZ_ADAPTER_DESIGN.md), but its optional module addition is
currently deferred by root while native/P0/P1 integration proceeds. External
gates remain external evidence, not a blanket stop for local implementation.

Final review increment: `public-preview` freezes a local public intent and full
exposure digest; CLI push requires explicit confirmation before upload, changed
source HEAD needs abort/re-review, and old confirmation cannot recreate an
aborted intent. Independent exposure normal/race/vet checks passed. Peer selection
review normal/race/vet passed with stale-source, origin-alias and shared-endpoint
regressions. These are package results; the final shared source-frozen validation
and checkpoint are pending, not retroactively supplied by the snapshot-14 build.


## N5: experimenteller geprüfter Stand

`internal/nativeimport` prüft owner-signierte Importnachweise gegen neue
Repo-/Genesis-/Ownerpins und beide unabhängigen Quellpins (HEAD und exakte
Backupmanifest-SHA256). `internal/nativerepo` installiert den typisierten
Nachweis unter der gemeinsamen Quotenprüfung und migriert ausschließlich in
ein neues Ziel. Alle ursprünglichen Objekt-/Snapshotbytes, verwaiste Objekte,
abgetrennte Historien, HEAD und optionale `.dh/ignore` bleiben nachprüfbar
erhalten; Zeitstempel einschließlich Nanosekunden bleiben im Rohbeleg.
Importerattribution ist kein Beweis historischer Autorenschaft.

[Native-Migrations-CLI](NATIVE_MIGRATION_CLI.md) und
[BackupReader](BACKUP_READER.md) beschreiben die expliziten Pins und Aufrufe.
Die Migration nutzt Linux-No-replace-Publikation, prüft physische Quellaliase
über gepinnte Verzeichnisidentitäten und lässt bestehende `.dh`-Stores
unverändert. Fehlende Plattformgarantien führen zur Ablehnung. Keine neue
Windows-Backend-, DOP-Remote- oder Browserbranch-Funktion. N4 ergänzt den
geschützten lokalen Review-/Apply-Pfad ausdrücklich separat.

Unabhängige lokale Normal-/Race-/Vet-Prüfungen bestanden, einschließlich
Quellmanifeständerung, ausgetauschtem Zielparent, Sourcealias und konkurrierender
Importinstallation. Der echte Prozesschecker bestand fünf Gruppen mit
unabhängiger Python-Rekonstruktion aller Originalbytes, DOP-Trees/-Commits,
Mapping-/Attest-IDs und Ed25519-Signatur. Sein Binary lag vor der abschließenden
linearen Topologieoptimierung; die jüngste Bibliotheksfassung bestand danach
erneut Normal-/Race-/Vet-Prüfungen. Anschließend bestanden für Checkpoint14
19 gemeinsame unveränderte Sourceprüfungen, tatsächliche Quellmigration mit
unabhängiger Rekonstruktion und zwei vollständige Reproduktionsläufe.
Die spätere N4-Erweiterung benötigt einen eigenen neuen Freezebericht.


## N4: explicit local protected review/apply

`internal/nativepolicy` supplies bounded typed signed policy, author proofs,
proposals, reviews, revocations and same-key grant renewals. `internal/nativerepo`
adds explicit digest-pinned one-way refs/2 protection, immutable sidecars plus
a globally sequenced acceptance journal, historical receipt-time authority replay,
monotone author exclusions, exact rejection keys, quorum/window and CAS apply.
Central raw write/import/AlreadyPresent guards deny protected ref bypasses.
Late negatives or newly certified authors invalidating fixed counted reviewers
quarantine already applied refs without rewriting them. Status reports numeric
capacity limits; explicit local author inspection retains expired/revoked history.

Independent package normal/race/vet and four process groups passed before the
shared freeze. Process checks reconstruct IDs and verify Ed25519 signatures
in Python. Full-tree acceptance is identified only by the matching external
source hash report. [NATIVE_REVIEW.md](NATIVE_REVIEW.md) describes explicit CLI
steps and limits. Conflict resolution, native policy rotation/recovery, DOP
transport, browser/MCP writes and execution sandbox remain separate unfinished
work; no complete N4/masterplan or production authorization is claimed.


## R0/R1: read-only diagnostics and recovery-bootstrap evidence

R0 `ReviewDiagnostics` and explicit CLI report one accepted snapshot's immutable
pins, certificate lineages, current expiry/revocation, quarantine causes and
capacity/replay accounting without mutating state or advancing its clock.
`nativepolicy.ResolveAuthority` resolves the signed history once and returns
defensive copies; it makes no current authorization claim. The original refs/2
plan budgets remain unchanged. Already bounded ref-inventory and author-commit
reads are observed under separate derived overhead limits, preserving previously
valid states at the original plan boundary.

R1 `internal/nativerecovery` adds pure typed Constitution/Bootstrap/Consent/
KeyProof/Bundle codecs, own signature contexts, explicit expected pins, stable
bootstrap content keys, disjoint recovery roles, exact key-possession proofs
and current-policy reviewer consent evaluation. Normal/race/vet package checks
and independent security regressions passed. The offline `native-recovery-id/sign`
helpers passed three process groups with Python SHA256 and Ed25519 checks.
R1 helpers/evaluation alone do not activate recovery authority, persist
consent/rejections, prove a completed review window or unlock a terminal store.
The separate R2 increment below adds its journal and runtime bootstrap.
Terminal/owner-loss/physical-capacity recovery require their own later contracts.


## R2: explicit healthy bootstrap with composite native journal

A refs/3 extension preserves existing N4 signed wires and code policy while
ordering preparation, consents, one activation and N4 changes in a single
atomic journal. Retained immutable canonical refs/2 source bytes, clock-free
operational anchor and the current full-state CAS have separate roles.
FirstSeen and negatives survive new prepares; actual N4 changes invalidate
old activation anchors. Global N4 IDs, per-kind limits, DAG validation and
shared budgets remain enforced across the baseline and incremental tails.

[CLI steps](NATIVE_RECOVERY_BOOTSTRAP_CLI.md) expose status, material collection,
prepare, consent and activate. Independent package review and normal/race/vet
passed. Root tests cover exact concurrent CAS, uncertain source installation,
no-result-on-error, expiry/late rejection and independent code policy. Five
process groups verify receipt/source/operational hashes independently in Python,
full reviewer/window activation, canonical N4 bridging, stable AlreadyPresent
and corrupt-source refusal. Full-tree acceptance still requires a matching
unchanged-source report rather than extrapolation from an older checkpoint.

This provisions an initial authority only in a healthy store. Fresh late
rejections can quarantine that recovery authority without rolling back code
refs. Terminal recovery, owner loss, code policy rotation and physical capacity
recovery remain unfinished separate packages. No real recovery operator or
external production acceptance is implied.


## ROT1a evidence and next P0 scaling increment

`internal/nativepolicychange` and `native-policy-id/sign` implement only strict
offline Rotation/RotationConsent evidence. Independent fixed vectors, normal/
race/vet review, bounded decoder fuzzing and three real process groups passed.
No runtime policy rotation, semantic equivalence of distinct policy IDs, epoch
activation, OwnerEpochAck or cross-epoch negative bridge is implied. Those remain
explicit ROT1b/ROT2 gates in NATIVE_POLICY_ROTATION_DESIGN.md.

After this small evidence increment, private-store/transfer scaling takes priority
over further governance expansion: actual source17 backup contains 544 files
and 5,176,715 file bytes, while private native v1 transfer is bounded to
4,194,304 bytes. The server prototype stores at most 64 ciphertext objects/8MiB
in a 16MiB JSON state. Round 3 implements a separate explicitly selected
disk-backed v2 store and paged streaming v2 bridge as local WIP; matching frozen
full process acceptance is pending. Existing wire IDs, AEAD contexts,
durable writer budgets, exact retry bytes, membership and privacy boundaries
must remain unchanged; no silent store upgrade or quota/negative-history reset.

## Round 3: private scaling and domain presentation

Store v2 uses immutable per-envelope files, durable full-size reservations,
reserve/publish/fresh-authorize/finalize, conservative residue accounting and
explicit backend selection. Local aggregate `private-store-inspect` does not
advance its clock or repair acceptance. The generic transaction adapter rejects
unsupported projection mutations. Static delegation/request validation occurs
before the expensive store scan, with current membership and proof authorization
still checked inside the transaction. This does not remove O(N²) total scan cost
or prove public abuse resistance for valid/revoked credentials.

Bridge v2 is separately selected with `--transfer v2`. It uses canonical bound
manifest pages, a 64-MiB transfer cap, 4096 files, 512 raw chunks and an immutable
bounded outbox. Preparation/upload/clone do not retain the complete payload.
An existing outbox retries its exact bytes; partial preparation is refused.
Version dispatch supports mixed history and rejects invalid or unknown formats.
Historical ancestry reads only authenticated root summaries instead of retaining
all prior inventories. V1 retains its original 4-MiB allocation boundary.
See [the transfer contract](PRIVATE_BRIDGE_V2_DESIGN.md).

`serve --presentation-origin https://DOMAIN` adds a separate read-only showcase
boundary, exact DNS Host binding, raw path allowlist, no federation worker,
no transport/MCP/admin routes and small global rate/concurrency limits.
It requires loopback and excludes workspace/write/sync/bootstrap flags.
[Domain presentation](DOMAIN_PRESENTATION.md) supplies reviewable Linux service
and nginx templates. No certificate, account, DNS record, real project publication
or remote deployment has been performed. This is not remote private-repo UX.

The current session cannot create network sockets, including loopback. A frozen
baseline with source hash `db3781e7065ce5e4f22705e995b8f195ca15341e76508117f198e0ba543c6da7`
has since passed external normal-terminal acceptance: 30 recorded checks,
including full suites, three builds, 22 CLI groups and IPv4/IPv6 loopback.
Root independently checked the source/report/artifact pins. Later live-source
changes need separate acceptance. New socket-free tests exercise
the actual Client and Handler via an in-memory RoundTripper, with real proofs,
AEAD, state files, writer budgets and restore primitives; those tests are not
real network evidence. Source freeze reports outside the source tree identify
exact executed checks and failures. The last accepted checkpoint remains 18
until a complete new matching acceptance passes.

The complete masterplan remains unfinished: owner-loss/direct refs/3 terminal
recovery and conflict resolution, native DOP private transport, visibility/ACL
and exposure UX, LAN policy, credential queue/OS key storage and actual Windows
support, tasks/capabilities/sandbox, remaining discovery/profile/organization
workflows and optional provider/Buzz modules remain open. External independent
trust, audit, hardware and operations gates also remain unfulfilled. Neither
this increment nor presentation hosting may be called the requested complete
production v1.0.0.

The separate [epoch evidence increment](NATIVE_POLICY_EPOCH_EVIDENCE.md) now
adds normalized policy/rejection identities, OwnerEpochAck with ProposalID,
negative-only EpochRejection codecs and explicit offline CLI. Independent Python
process tests verify projections and digest signatures, renewal stability and
input/output boundaries. This completes that schema/identity subpackage only.
The [pure healthy-rotation evaluator](NATIVE_POLICY_HEALTHY_ROTATION.md) now
checks independently pinned current policy/constitution, unanimous active old
reviewers, complete next-grant possession proofs, historical revocations and
conservative capability monotonicity. It always reports outstanding store
obligations. The [refs/4 epoch runtime](NATIVE_POLICY_EPOCH_RUNTIME.md) now
retains an exact accepted refs/3 source, replays current and historical authority,
journals durable negatives, and atomically prepares/activates healthy rotation
and epoch-bound protected/unprotected ref writes. Local package/race/vet checks
pass. Seven independent offline CLI process groups also pass, including
protected apply with exact owner acknowledgement. The frozen HTTP bundle
`http-acceptance-69dfdb66960b` is prepared but its socket-based run is pending.
Same-owner terminal recovery now has a separate pure verifier and refs/4 runtime;
owner-loss recovery and independent production authority remain open.

P1 network status now reports an additive machine-readable `state` while
retaining the existing JSON fields. It distinguishes no configured peers,
unchecked peers, fresh local/intranet success, fresh verified public success,
active synchronization and degraded errors/backoff. Fresh storage errors take
precedence over a simultaneous sync flag. Deterministic tests cover state and
JSON compatibility; automatic peer activation and eclipse resilience remain
open.

The [same-owner terminal recovery CLI](NATIVE_POLICY_TERMINAL_RECOVERY_CLI.md)
now records exact unresolved causes, separate Constitution root/reviewer
endorsements, a persistent review window, pre-activation semantic vetoes and
late post-activation quarantine. Accepted activation advances the policy epoch
and records immutable cause-to-activation receipts without deleting any signed
negative. Local nativerepo integration and nine real-process CLI groups passed;
an independent read-only review found no remaining concrete blocker after the
pre-activation veto fix. Matching whole-tree, HTTP and external trust/host
acceptance remain open.

The hosted private-browser increment now has a dedicated ciphertext-only
operator catalog, current device proof and membership checks, a small encrypted
name index tested with 180 entries, local-only key-bundle assembly, and a Go
WebAssembly reader. It authenticates the catalog first, decrypts names locally,
then selects one independently pinned repository and reads only its current
snapshot metadata and requested text file chunks. A compact per-repo rollback
pin is stored in browser local storage; no full clone is written to the device.
Targeted in-memory HTTP integration, race tests, WebAssembly build/Node smoke
and asset preflight pass. A separate hosted Ubuntu archive is a development
candidate, not a release. The real browser/TLS/nginx/VPS path, source-frozen
socket-based process suite and 100+-repo device-storage measurement are open.
This increment does not close the other masterplan packages or external gates.