docs: the roadmap describes the product that shipped, and a gate so its version cannot rot again

[pdbethke]

ROADMAP.md opened on "Solo-maintained and moving fast (v0.1)" while v1.0.0-rc.13 was cut — and that was the smallest of three problems.

What was actually stale

(v0.1)	rc.13 is cut
"the brain's API is the boundary" — stated as the guiding invariant of the whole document	the brain was demoted to optional Tier-2 on 2026-09-04; certify and review overtook it
corral review and the ledger branch — absent from Shipped entirely	they are what the homepage, both videos, the Show HN post and the whole launch lead with

Someone reading the roadmap to find out what corral is would have missed the two things it now leads with.

What this does

• Header — version fixed; the arc rewritten as what corral is (an auditing engine, two extensions); the invariant restated as the rule that actually holds.
• A note, not a deletion — the brain-era detail below is kept as history, with "read the brain as the optional daemon". That work shipped; removing it would be its own dishonesty.
• Two new Shipped sections — The record (orphan branch, DuckDB reading it in place, ledger verify + Rekor, priors, brief/scans/verify --db) and The review (demote-only tiers, challenger and verifier seats, a human adjudication outranking both, models rank).
• Substrate marked Tier-2 and frozen; through-line no longer claims brain-mediation; shared corpus now says what the docs must — no audit reads shared memory or skills today.

The part worth reading

The file already carried this, written in August after a stale line had made outside reviewers name an already-shipped feature as corral's top remaining task:

a roadmap is the one document a reader trusts to be current, so a stale line here propagates further than a stale line anywhere else … when a claim here is superseded, edit it in the SAME pull request, because nothing downstream will.

That rule was stated in one place and enforced at no door, and the whole document then went stale the same way — the same defect as today's field note, at larger blast radius. The paragraph now says so.

The gate

TestDocsNeverDescribeCorralAsAnOlderSeries refuses any tracked doc describing corral, in the present tense, as a major series older than the newest cut tag. TestDocsPinTheNewestCutTag could not catch this: (v0.1) is not a ref a reader installs, it is corral describing itself in prose. Deliberately the weakest true rule so historical mentions and changelog tags stay legal; floored so an empty walk fails.

Its first draft was vacuous. The regex excluded newlines, and the header it polices wraps between "moving fast" and the version — so it matched nothing and passed both on the correct string and on a restored (v0.1). The negative control caught it; the fix and the reason are in the comment. Verified failing on (v0.1) and passing on rc.13.

Also updated outside this PR, at your ask: the GitHub About blurb, which described only certify — now leads with the auditing engine and names review and the branch-as-record. Topics gained duckdb, motherduck, sigstore, code-review, auditing.

🤖 Generated with Claude Code

https://claude.ai/code/session_011NgkB3eLPBhgfqU1XopR1V