docs(roadmap): mark Quirin's M6 deliverables merged in #413

ROADMAP.md

@@ -37,7 +37,7 @@ Each MRP month resolves to a concrete, reproducible set of merged pull requests.
 | **M3 — June 2026** | [51](https://github.com/MeshJS/multisig/pulls?q=is%3Apr+is%3Amerged+author%3AQSchlegel+merged%3A2026-06-01..2026-06-30) | Governance [#271](https://github.com/MeshJS/multisig/pull/271)–[#272](https://github.com/MeshJS/multisig/pull/272), [#279](https://github.com/MeshJS/multisig/pull/279), [#286](https://github.com/MeshJS/multisig/pull/286), [#296](https://github.com/MeshJS/multisig/pull/296)–[#297](https://github.com/MeshJS/multisig/pull/297), [#300](https://github.com/MeshJS/multisig/pull/300), [#302](https://github.com/MeshJS/multisig/pull/302), [#315](https://github.com/MeshJS/multisig/pull/315) · Signing & auth [#273](https://github.com/MeshJS/multisig/pull/273)–[#277](https://github.com/MeshJS/multisig/pull/277), [#281](https://github.com/MeshJS/multisig/pull/281)–[#282](https://github.com/MeshJS/multisig/pull/282), [#324](https://github.com/MeshJS/multisig/pull/324) · Mesh 2.0 groundwork [#229](https://github.com/MeshJS/multisig/pull/229), [#269](https://github.com/MeshJS/multisig/pull/269), [#278](https://github.com/MeshJS/multisig/pull/278) · Mobile & UX [#287](https://github.com/MeshJS/multisig/pull/287)–[#295](https://github.com/MeshJS/multisig/pull/295) · Landing/theme/SEO [#298](https://github.com/MeshJS/multisig/pull/298)–[#299](https://github.com/MeshJS/multisig/pull/299), [#308](https://github.com/MeshJS/multisig/pull/308)–[#318](https://github.com/MeshJS/multisig/pull/318), [#328](https://github.com/MeshJS/multisig/pull/328) · Infra & security [#284](https://github.com/MeshJS/multisig/pull/284), [#301](https://github.com/MeshJS/multisig/pull/301), [#319](https://github.com/MeshJS/multisig/pull/319) · Docs & releases [#280](https://github.com/MeshJS/multisig/pull/280), [#283](https://github.com/MeshJS/multisig/pull/283), [#285](https://github.com/MeshJS/multisig/pull/285), [#303](https://github.com/MeshJS/multisig/pull/303), [#309](https://github.com/MeshJS/multisig/pull/309), [#320](https://github.com/MeshJS/multisig/pull/320)–[#321](https://github.com/MeshJS/multisig/pull/321) |
 | **M4 — July 2026** | [16](https://github.com/MeshJS/multisig/pulls?q=is%3Apr+is%3Amerged+author%3AQSchlegel+merged%3A2026-07-01..2026-07-31) | Bot platform & API [#341](https://github.com/MeshJS/multisig/pull/341)–[#345](https://github.com/MeshJS/multisig/pull/345) · Agent/crawler surface [#346](https://github.com/MeshJS/multisig/pull/346) · DRep vote-history explorer [#337](https://github.com/MeshJS/multisig/pull/337)–[#339](https://github.com/MeshJS/multisig/pull/339) · Roadmap & delivery audit [#347](https://github.com/MeshJS/multisig/pull/347), [#350](https://github.com/MeshJS/multisig/pull/350)–[#352](https://github.com/MeshJS/multisig/pull/352) · Production hardening [#332](https://github.com/MeshJS/multisig/pull/332)–[#334](https://github.com/MeshJS/multisig/pull/334) |
 | **M5 — August 2026** | [31](https://github.com/MeshJS/multisig/pulls?q=is%3Apr+is%3Amerged+author%3AQSchlegel+merged%3A2026-08-01..2026-08-31) | Document Sign-Off MVP [#356](https://github.com/MeshJS/multisig/pull/356), [#373](https://github.com/MeshJS/multisig/pull/373), [#375](https://github.com/MeshJS/multisig/pull/375)–[#378](https://github.com/MeshJS/multisig/pull/378), [#380](https://github.com/MeshJS/multisig/pull/380)–[#382](https://github.com/MeshJS/multisig/pull/382), [#386](https://github.com/MeshJS/multisig/pull/386)–[#388](https://github.com/MeshJS/multisig/pull/388) · Signing fix [#372](https://github.com/MeshJS/multisig/pull/372) · Shielded sign-off / vault [#374](https://github.com/MeshJS/multisig/pull/374), [#383](https://github.com/MeshJS/multisig/pull/383) · MCP server + OAuth 2.1 [#357](https://github.com/MeshJS/multisig/pull/357)–[#361](https://github.com/MeshJS/multisig/pull/361), [#363](https://github.com/MeshJS/multisig/pull/363), [#365](https://github.com/MeshJS/multisig/pull/365), [#367](https://github.com/MeshJS/multisig/pull/367), [#370](https://github.com/MeshJS/multisig/pull/370) · Ballot rationale IPFS [#362](https://github.com/MeshJS/multisig/pull/362) · Proxy access [#364](https://github.com/MeshJS/multisig/pull/364) · Summon wallets [#371](https://github.com/MeshJS/multisig/pull/371) · Agent onboarding & governance overview [#254](https://github.com/MeshJS/multisig/pull/254) · Landing [#359](https://github.com/MeshJS/multisig/pull/359), [#366](https://github.com/MeshJS/multisig/pull/366) · Security [#379](https://github.com/MeshJS/multisig/pull/379), [#384](https://github.com/MeshJS/multisig/pull/384) |
-| **M6 — September 2026** | [2](https://github.com/MeshJS/multisig/pulls?q=is%3Apr+is%3Amerged+author%3AQSchlegel+merged%3A2026-09-01..2026-09-30) + carryover | Proof verifier + PDF [#397](https://github.com/MeshJS/multisig/pull/397), [#398](https://github.com/MeshJS/multisig/pull/398) (M5 Sign-Off MVP items). The M6 deliverables — Revision Provenance and the FROST go/no-go — were not merged in September; they land in the M6 completion PR (see [Month 6 proof of completion](#proof-of-completion-1)). |
+| **M6 — September 2026** | [2](https://github.com/MeshJS/multisig/pulls?q=is%3Apr+is%3Amerged+author%3AQSchlegel+merged%3A2026-09-01..2026-09-30) + carryover | Proof verifier + PDF [#397](https://github.com/MeshJS/multisig/pull/397), [#398](https://github.com/MeshJS/multisig/pull/398) (M5 Sign-Off MVP items). The M6 deliverables — Revision Provenance and the FROST go/no-go — were not merged in September; they landed on `preprod` in the M6 completion PR [#413](https://github.com/MeshJS/multisig/pull/413) (merged 2026-10-16, not yet released to `main`; see [Month 6 proof of completion](#proof-of-completion-1)). |
 
 Reproduce any row:
 
@@ -284,17 +284,17 @@ Revised 2026-07-26. July's actual output ([Delivered to date](#delivered-to-date
 
 ### Proof of completion
 
-Status of M6 tasks. Andre's rows last updated 2026-09-07; Quirin's rows and the merge status 2026-10-16.
+Status of M6 tasks. Andre's rows last updated 2026-09-07; Quirin's rows and the merge status 2026-10-17. "Merged" means on `preprod`; "released" means merged to `main`.
 
 | Task | Status | Evidence |
 |------|--------|----------|
 | MCP unsigned transaction creation | Done — merged in [#399](https://github.com/MeshJS/multisig/pull/399), released in [#393](https://github.com/MeshJS/multisig/pull/393) (2026-10-05) | Branch `feat/mcp-unsigned-tx-creation`: new `transactions:write` scope; `transaction_preview` builds payments, staking certificates and DRep votes through the canvas builder's `src/lib/tx-draft/` pipeline server-side and returns a signed draft token; `transaction_propose` accepts only that token and creates the pending transaction with zero signatures (never broadcasts). Design and boundary in `src/pages/api/mcp/README.md`; guarded by `src/__tests__/mcpTools.test.ts` and `txReview*.test.ts` |
 | Transaction review PNG & in-chat review | Done — merged in [#399](https://github.com/MeshJS/multisig/pull/399), released in [#393](https://github.com/MeshJS/multisig/pull/393) (2026-10-05) | Same branch: `src/lib/tx-review/summary.ts` (one summary model behind text, JSON and image), `card.ts` + `render-png.ts` (rasterized with the `ImageResponse` bundled in Next, no new dependency); the card is returned as an MCP `image` content block by preview, propose and `multisig_review_pending_transaction` (any pending transaction). Render proven by `src/__tests__/txReviewRenderPng.test.ts` |
 | Project task board with multisig payouts | Done — merged in [#399](https://github.com/MeshJS/multisig/pull/399), released in [#393](https://github.com/MeshJS/multisig/pull/393) (2026-10-05) | Same branch: `Task` / `TaskRecipient` / `TaskPayout` models (`prisma/migrations/20260910090000_add_task_board`), kanban board at `/wallets/[wallet]/tasks` (`src/components/pages/wallet/tasks/`, dnd-kit), `task` tRPC router with `preparePayout` → `confirmPayout` sharing the `src/lib/tx-review/` pipeline server-side through `src/lib/task-payout/` (draft token bound to the task ids and a hash of their recipient rows; `TaskPayout` links created inside the pending row's insert transaction; links flip to Paid on submit and Cancelled on delete/replace); MCP tools `task_list`, `task_upsert` (new `tasks:write` scope) and `task_prepare_payout` (confirmed through the existing `transaction_propose`). Guarded by `src/__tests__/taskPayout*.test.ts`, `taskBoardModel.test.ts`, `trpc/taskRouter.test.ts`, extended `txReviewPropose`/`txReviewDraftToken`/`createPendingMultisigTransaction`/`mcpTools` tests, and `e2e/tests/task-board.spec.ts` |
-| Document Sign-Off v1 — Provenance: history | Done | Chained Ed25519 platform attestation per version ([#375](https://github.com/MeshJS/multisig/pull/375)): inserting, removing, reordering or back-dating a version is detectable offline. `src/lib/documents/attestation.ts`, `src/__tests__/documentAttestation.test.ts` |
-| Document Sign-Off v1 — Provenance: diff & rollback | In review (M6 completion PR) | `diffVersions` (metadata always; line diff when both versions are inline text, bounded, says why otherwise) in `src/lib/documents/diff.ts`; `restoreVersion` re-publishes an earlier version as N+1 — append-only, logged as `version.restored`, attested, approvals reset to zero. UI: Changes / Restore on each version card. `src/__tests__/documentDiff.test.ts`, `src/__tests__/trpc/documentProvenance.test.ts` (real DB, real CIP-8) |
-| Document Sign-Off v1 — Provenance: richer audit export | In review (M6 completion PR) | `exportAudit` / public `verifyAudit`: format `mesh-multisig.document-signoff.audit.v1` — every version with lineage and its standalone `proof.v1`, the full event log, and the attestation chain with keys; `verifyAuditPackage` cross-checks the two records offline. `src/lib/documents/audit.ts`, `src/__tests__/documentAudit.test.ts` (tamper cases) |
-| FROST research — findings, PoC, go/no-go (#220) | In review (M6 completion PR) | [`docs/research/frost-go-no-go.md`](docs/research/frost-go-no-go.md): **no-go** on replacing native scripts (saves 0.009–0.016 ADA/tx, loses on-chain signer auditability and hardware/CIP-30 support); **conditional go** on an opt-in FROST signer as one leaf inside a native script; **no-go** on PQ multisig until the ledger verifies a PQ signature ("Lemour" = Lemur, ePrint 2026/1161). PoC `scripts/research/frost-ed25519/` reproduces the RFC 9591 Ed25519 test vector and verifies 2-of-3 / 3-of-5 aggregates as ordinary Cardano vkey witnesses — `src/__tests__/frostResearchPoc.test.ts` |
+| Document Sign-Off v1 — Provenance: history | Done — merged in [#375](https://github.com/MeshJS/multisig/pull/375), released | Chained Ed25519 platform attestation per version ([#375](https://github.com/MeshJS/multisig/pull/375)): inserting, removing, reordering or back-dating a version is detectable offline. `src/lib/documents/attestation.ts`, `src/__tests__/documentAttestation.test.ts` |
+| Document Sign-Off v1 — Provenance: diff & rollback | Done — merged in [#413](https://github.com/MeshJS/multisig/pull/413) (2026-10-16), not yet released | `diffVersions` (metadata always; line diff when both versions are inline text, bounded, says why otherwise) in `src/lib/documents/diff.ts`; `restoreVersion` re-publishes an earlier version as N+1 — append-only, logged as `version.restored`, attested, approvals reset to zero. UI: Changes / Restore on each version card. `src/__tests__/documentDiff.test.ts`, `src/__tests__/trpc/documentProvenance.test.ts` (real DB, real CIP-8) |
+| Document Sign-Off v1 — Provenance: richer audit export | Done — merged in [#413](https://github.com/MeshJS/multisig/pull/413) (2026-10-16), not yet released | `exportAudit` / public `verifyAudit`: format `mesh-multisig.document-signoff.audit.v1` — every version with lineage and its standalone `proof.v1`, the full event log, and the attestation chain with keys; `verifyAuditPackage` cross-checks the two records offline. `src/lib/documents/audit.ts`, `src/__tests__/documentAudit.test.ts` (tamper cases) |
+| FROST research — findings, PoC, go/no-go (#220) | Done — merged in [#413](https://github.com/MeshJS/multisig/pull/413) (2026-10-16), not yet released; issue #220 still open | [`docs/research/frost-go-no-go.md`](docs/research/frost-go-no-go.md): **no-go** on replacing native scripts (saves 0.009–0.016 ADA/tx, loses on-chain signer auditability and hardware/CIP-30 support); **conditional go** on an opt-in FROST signer as one leaf inside a native script; **no-go** on PQ multisig until the ledger verifies a PQ signature ("Lemour" = Lemur, ePrint 2026/1161). PoC `scripts/research/frost-ed25519/` reproduces the RFC 9591 Ed25519 test vector and verifies 2-of-3 / 3-of-5 aggregates as ordinary Cardano vkey witnesses — `src/__tests__/frostResearchPoc.test.ts` |
 
 ---