docs: mark Phase 0 and Phase 1 done in roadmap, capture Phase 1 closeout notes

README.md

@@ -13,6 +13,8 @@ See [docs/BUILDING.md](docs/BUILDING.md).
 
 ## Status
 
-Pre-alpha. See [docs/plans/](docs/plans/) for design and roadmap.
+Pre-alpha. Phases 0–1 code complete (workspace scaffold + D-Bus daemon stubs);
+Phase 2 (storage layer) is next. See [docs/plans/](docs/plans/) for design,
+roadmap, and per-phase implementation plans.
 
 Copyright 2026 Dangerous Things, LLC. Licensed under the Apache License, Version 2.0.

docs/plans/2026-04-26-authforge-implementation.md

@@ -18,9 +18,9 @@
 
 | Phase | Goal | Approx. Effort | Status |
 |---|---|---|---|
-| 0  | Repo, workspace, CI, packaging skeleton | 2–3 days | **Detailed below** |
-| 1  | Daemon: D-Bus interface stub, systemd unit, polkit rules | 3–4 days | Spec'd |
-| 2  | Daemon: storage layer (policy.d parser, pending flags, user db) | 3–4 days | Spec'd |
+| 0  | Repo, workspace, CI, packaging skeleton | 2–3 days | ✅ **Done** (2026-04-26) |
+| 1  | Daemon: D-Bus interface stub, systemd unit, polkit rules | 3–4 days | ✅ **Code complete** (2026-04-27); smoke gates deferred |
+| 2  | Daemon: storage layer (policy.d parser, pending flags, user db) | 3–4 days | **Next** — re-invoke `superpowers:writing-plans` to expand |
 | 3  | Daemon: FIDO2 enrollment backend via `ctap-hid-fido2` | 5–7 days | Spec'd |
 | 4  | Daemon: policy apply via pam-auth-update wrapper | 4 days | Spec'd |
 | 5  | Daemon: lockout simulator | 3 days | Spec'd |
@@ -41,6 +41,31 @@
 
 Total rough estimate: ~14 weeks of focused work for v1.0. Subsequent phases (Debian packaging, KDE port, RPM) are scoped in the design doc.
 
+### Phase 1 closeout notes (2026-04-27)
+
+Phase 1 expanded to step granularity at [2026-04-26-phase-1-dbus.md](2026-04-26-phase-1-dbus.md). Code-side work is done; some acceptance gates require an Ubuntu desktop with libgtk-4-dev / libadwaita-1-dev / libfido2-dev / libpam0g-dev installed (see [BUILDING.md](../BUILDING.md)) and are deferred to a smoke pass before Phase 14 (PPA build).
+
+**Done in Phase 1:**
+- 9-method D-Bus interface (`io.dangerousthings.AuthForge1`) backed by an in-memory `AppState` with fixtures.
+- polkit authorizer with `Permissive` (env-var bypass) + `System` (real `org.freedesktop.PolicyKit1.Authority`) modes.
+- All wire types in `common`: `Mode`, `Method`, `Transport`, `Credential`, `StackPolicy`, `StorageBackend`, `Storage`, `Firstrun`, `Policy`, `PendingFlag`, `Violation`, `PolicyApplyResult`. All `Serialize + Deserialize + zvariant::Type`.
+- systemd unit (`authforge-daemon.service`) with hardening (`NoNewPrivileges`, `ProtectSystem=full`, scoped `ReadWritePaths`).
+- D-Bus activation file + system policy XML.
+- polkit policy XML with all 7 actions from the design doc.
+- `authforge-daemon.postinst` driving `daemon-reload` + `enable --now`.
+- Packaging (`debian/rules` + `control`) installs the new assets and depends on `dbus`, `policykit-1`.
+- CI installs `dbus` so the new tests run there too.
+- 21 unit/integration tests across `common` (7) and `daemon` (14, including p2p D-Bus tests via `tokio::net::UnixStream::pair`).
+
+**Deferred until a Phase 14 smoke run on a clean Ubuntu VM:**
+- `debuild -us -uc -b` 5-deb output (needs libgtk-4-dev / libadwaita-1-dev / libfido2-dev / libpam0g-dev installed).
+- `busctl introspect` / polkit prompt manual smoke.
+- `systemctl status authforge-daemon` after install.
+
+**Plan deviations recorded in the commit:**
+- `PendingFlag.deadline_unix` is `u64` with `0` = no deadline (zvariant `Type` derive does not support `Option<T>`; sentinel matches the design doc's existing `deadline_hours = 0` convention).
+- Sender → pid resolution for polkit `unix-process` subjects punts to early Phase 2 — Phase 1 passes pid 0, which the permissive authorizer ignores. Until pid resolution lands, the daemon is run with `AUTHFORGE_POLKIT_BYPASS=1` for any local smoke test (loud `warn!` log on startup).
+
 ---
 
 # Phase 0: Repository Scaffolding (FULLY DETAILED)