Document Sign-Off MVP + roadmap MRP mapping

[QSchlegel]

Two independent changes, one per commit — review them separately.

1. docs(roadmap) — MRP mapping and the April–July window

The 2026-08-03 renumbering (984aa46) moved Month 1 to April, but MRP task cards created before that still carry the following month's bullet text — the card headed "MRP Month 2" lists the June workstreams. This writes the mapping down so it stops costing time.

• MRP task mapping table at the top of ROADMAP.md: MRP Month N = roadmap Month N = calendar month, all twelve months, with the on-chain task hashes we have.
• Each MRP month routed to its actual PRs — April 10, May 3, June 51, July 16 — with every count linking to the exact GitHub search, so a row can be reproduced instead of trusted.
• "Delivered to date" widened from May–July to April–July. April's output is infrastructure, so it folds into the existing sections: preprod environment + real-chain smoke CI (Preprod #218, fix: filter extraneous VKey witnesses + add CI smoke test system #217) under Testing & CI, and a new transaction-and-signing-integrity through-line under Platform (fix: filter extraneous VKey witnesses + add CI smoke test system #217 VKey witness filtering → fix: guard against invalid CBOR in addTransaction and transaction card #227 invalid-CBOR guard → fix(signing): pin Mesh SDK + reject witnesses that don't verify against the tx body #257 Mesh pin + witness verification guard).
• Recovers two May items the 2026-07-26 audit missed: the Import Wallet wizard (feat(wallets): add Import Wallet wizard #259) and the fix(signing): pin Mesh SDK + reject witnesses that don't verify against the tx body #257 signing fix.
• Fixes the timeline the renumbering left stale (April 2026 – March 2027) in ROADMAP.md, the /roadmap page and the SEO description; removes the Quirin + Andre · ~25 h/wk line from both.

2. feat(documents) — Document Sign-Off MVP (PRD-001)

A wallet-native, off-chain approval layer: bind approval to an exact content hash, inherit the wallet's signers and threshold, export a proof anyone can verify without an account. No chain dependency.

Two rules carry the feature, and both are enforced server-side, not in the UI:

1. Version-hash binding. submitSignerAction rebuilds the canonical signed payload from the server's own records and requires a byte-identical match before the signature is checked. A signature collected for one version cannot be replayed onto another, and a tampered comment invalidates the submission. Inline content is re-hashed server-side and rejected on mismatch.
2. Threshold from a frozen snapshot. DocumentSignerSnapshot captures the wallet's signers, threshold and policy hash when the round starts. Approval counting reads the snapshot, never the live wallet — changing wallet membership cannot rewrite a decision already made.

Data model — Document, DocumentVersion, DocumentReview, DocumentSignerSnapshot, DocumentEvent, migration 20260805090000_add_document_signoff. The migration enables RLS with deny-all PostgREST policies on all five tables, matching the contract in 20260706100000_enable_rls_followup_tables (#332).

Router — createDocument, uploadVersion, startReview, submitSignerAction, exportProof, verifyProof. CIP-8 verification via Mesh's checkSignature against the signer's address. verifyProof is public on purpose: a counterparty holding the JSON and the file must be able to check it without an account, and it reads nothing from the database.

Four routes under /wallets/[wallet]/documents — list, create, detail, version review. Files are hashed in the browser via WebCrypto; only the digest is sent, so the bytes never leave the signer's machine.

src/lib/documents/ is dependency-free apart from node crypto, with the signature check injected into the verifier — the same code runs in an offline verifier with no Mesh install.

Heads-up for the deploy

This adds a migration. Railway's prestart runs prisma migrate deploy, so merging to preprod will apply 20260805090000_add_document_signoff to the preprod database on the next deploy. Five new tables, no changes to existing ones.

Verification

• npx tsc --noEmit — clean (the pre-existing txScriptRecovery.test.ts errors on preprod are untouched)
• npx jest src/__tests__/documentSignoff.test.ts — 28 passing: canonicalization, version-hash binding, threshold evaluation, and proof verification including tampering, duplicate signers, out-of-snapshot signers and non-canonical payloads
• npm run build — passes; all four document routes register as server-rendered
• /roadmap checked in a local production build (next dev cannot serve SSR in a worktree — Turbopack resolves the whisky WASM to /ROOT/node_modules/…)

Not included

PRD-001 is still status: Draft. Proof export is JSON only — the PDF summary and the public verify page are the M5 half of the MVP.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
multisig	Ready	Preview	Aug 7, 2026 7:26am