docs: bring the roadmap and competitive analysis in line with what shipped

[arthurpanhku]

Summary

Documentation-only. Three files had drifted behind the code in ways that misdirect planning.

ROADMAP.md — the first Now/next entry still described the server route as the bottleneck holding up both GUIs. It has not been for some time: the route executes through executeSecurityScan, the web UI renders a coverage badge where the hand-written caveat used to be, the TUI and both CLIs report coverage, and the Action re-derives the record on the runner and posts it beside the diff. Two surfaces genuinely remain and neither had an issue to point at — which is the state the file itself says issues are for. Both now do: #204 (VS Code shows findings without saying what the scan covered) and #205 (headless runs emit no coverage or fix record at all — the surface with no human present to notice). Also adds two Recently-shipped entries for work that had landed unrecorded.

docs/VERIFICATION-SURFACES-PLAN.md — phases 1–3 have landed, so the plan reads as describing work that exists. It gets a status banner rather than a rewrite: its §1 analysis is the record of what the work started from, and several findings are deliberately no longer true of the code, so marking it history is more useful than editing it into agreement with the present. The §6 note that the VS Code extension is unpublished is corrected, since that is what the phase was ordered by.

docs/COMPETITIVE-ANALYSIS.md — the report recommended lever B (promote the internal verification field to a portable, offline re-derivable Verified Fix Record) and it was built; phases 0–2 of its own staging plan all landed, including the MCP exit it called the most important one. The original judgements stay and the outcome is marked against them, per-phase, with the two follow-ups still outstanding — the public SDK export and the FEATURE_GAP.md archive note — marked as outstanding rather than quietly dropped. §1 needed more than a mark: its finding was that the second strategic line had no P0 item scheduled at all, and that mismatch is gone, so it is corrected with the original claim kept visible. §2 is left alone as a dated market snapshot this pass did not re-research, which the banner says outright.

Also in this session, outside the diff: #109 and #136 closed, #53 / #55 / #118 / #120 bodies corrected, and #204 – #207 opened.

Testing

No code changed, so the suite is unaffected — npm run check is typecheck && typecheck:gui && test, none of which reads these files (verified by grep: no test references ROADMAP.md or either doc). Every factual claim added was checked against the code rather than assumed:

• server route goes through executeSecurityScan — src/server/routes/remediation.ts:2,27
• web coverage badge, and the caveat line it replaced — web/src/components/DvalinWorkspace.tsx:432,508
• VS Code has diagnostics but no coverage — editors/vscode/src/extension.ts:161
• harness carries neither concept — no match in src/harness/
• mcp-install command name — README.md:163
• weekly interop schedule — .github/workflows/harness-interop.yml (cron: '0 6 * * 1')
• VFR phases 0–2 — SECURITY_SCHEMA_VERSION = 2 and SECURITY_COVERAGE_STATUSES in src/security/contracts.ts, src/security/fixRecord.ts, dvalin_verify_fix in src/mcp/server.ts:215, fix-record I/O in action.yml, fixRecords in src/evidence/pack.ts
• SDK still absent — no exports entry in package.json

Security and AI Governance

• This change does not expand file, shell, network, model, or approval permissions.
• If it changes agent behavior, prompts, policy, providers, audit logging, or release/build security, I updated the relevant governance evidence in docs/. — No behavior change; this PR only updates docs/ to match behavior already shipped and reviewed.
• If it introduces a new model/provider/tool or new data flow, I completed docs/governance/AI-CHANGE-IMPACT-ASSESSMENT.md. — Not applicable; no new model, provider, tool, or data flow.

Notes

The competitive analysis is left readable as the dated report it is. The alternative — editing its reasoning into agreement with the outcome — would destroy the only interesting thing about it, which is that the call it made can now be checked against what happened.

🤖 Generated with Claude Code

https://claude.ai/code/session_0186VyaiQq3MTo4i4mK8P3aW

---

Generated by Claude Code

[arthurpanhku]

Web end-to-end is red here, and it is not this PR's failure.

This PR changes three Markdown files and nothing else. The same check is red on the base branch — main at 6ccd3c0, the commit this branch was cut from — with the same two test failures:

Web end-to-end        failure    ← main, 6ccd3c0
Web end-to-end        failure    ← this PR, 417aec2

Every other check passes on both: test, CodeQL, Dvalin self-scan, MCP client interoperability, native shell on all three OSes, VS Code extension.

Root cause is tests/e2e/dvalin-first-run.e2e.ts still asserting on web UI copy that 48bad29 changed — one locator now matches two elements after a subtitle was added, and one notice was renamed from "Remediation needs a model" to "Verification needs a model". Deterministic, not a flake.

No fix for it exists yet to port, so I am not carrying one into a docs-only PR — that would widen it. Filed as #210 with the diagnosis and the two-line patch.

Merging this on that basis: the failure predates the branch, is unrelated to the diff, and is tracked separately.

---

Generated by Claude Code