Prepare ms-private 0.0.1 release candidate

docs/ROADMAP.md

@@ -0,0 +1,25 @@
+# ms-private 0.0.1 roadmap
+
+Version 0.0.1 is an unpublished release candidate. Implementation exists for the graphical and terminal interfaces, presets, policy engine, debloat, account purge, service control, network modes, Recall, sensors, cleanup, lock handling, security audit, source/AME packaging and the self-contained executable. The remaining work is mostly live acceptance, release provenance and the separately designed offline-maintenance system.
+
+## Open work
+
+| ID | Priority | Work still required |
+| --- | --- | --- |
+| R01 | P0 | Run the complete Windows Home, Pro, Enterprise and Education VM matrix, including supported Windows 10 servicing and reviewed Windows 11 builds. |
+| R03 | P0 | Record controlled baseline and configured traffic at the host and an external gateway across boot, idle, browsing, updates, VPN and restore. |
+| R13 | P1 | Build a versioned third-party application privacy register with publisher sources and separate update/security decisions. |
+| R18 | P2 | Repeat validation after Windows feature/security updates and browser, VPN or installer changes. |
+| R20 | P1 | Reproduce context-specific GDID/PUID, Widgets and Store observations with disposable identities and redacted evidence. |
+| R21 | P0 | Validate the offline update design end to end on an isolated target. |
+| R22 | P0 | Implement and validate the signed offline Windows Update Agent catalog scanner. |
+| R23 | P0 | Cover Defender engine/platform/intelligence, certificate trust, browsers, applications, drivers and firmware in offline maintenance. |
+| R24 | P1 | Authenticate collector downloads and transferred packages with publisher signatures, current catalogs and protected manifests. |
+| R25 | P0 | Add Authenticode signing, trusted timestamping, SBOM/provenance output and a controlled release pipeline. |
+| R26 | P0 | Exercise every privileged action with the built-in Defender protections enabled and no exclusions; optionally record third-party EDR compatibility without adding bypasses. |
+
+## Implementation complete; live acceptance remains
+
+R02, R04–R12 and R14–R17 have working code or prepared material, but their acceptance evidence is incomplete. This includes security-preservation checks, endpoint provenance, timed firewall recovery, real registry/service restoration, Home Settings verification, physical sensor testing, Recall and app-removal recovery, cleanup and lock-event testing, GDID research reproduction, pinned upstream artifacts, browser/VPN acceptance, GUI accessibility, AME execution and the final editorial check.
+
+R19 is complete: the unsafe supplied-script patterns were reviewed and were not integrated. ms-private uses exact targets, write-ahead recovery records, protected components, readback and explicit destructive acknowledgements instead.