📝 Update README.md

README.md

@@ -85,11 +85,91 @@ backend/                FastAPI app, models, dynsec client, configgen
 frontend/               React + Vite SPA served by nginx
 ```
 
-## Release 1 scope (see specification.md §68.1)
+## Status & TODO — per release plan (specification.md §68)
 
-Included: management authentication & RBAC, dynsec clients/groups/roles
-with the six ACL types, config generation from the PostgreSQL model,
-validation, deployment with revision history.
+Progress against the MVP release plan. Checked items are implemented and
+covered by the test suite / running stack.
 
-Not yet (Release 2/3): PKI/certificates, mTLS listeners, diff view,
-rollback, ACL simulator, dashboard/$SYS, audit browsing UI, backup.
+### Release 1 — Core broker administration (§68.1) — COMPLETE
+
+- [x] Docker Compose stack (5 services, 2 networks, no Docker socket)
+- [x] Mosquitto 2.1.2 (pinned) + PostgreSQL
+- [x] FastAPI backend + React (Vite) frontend
+- [x] Management authentication (HttpOnly session cookies, Argon2id,
+      `ADMIN_INITIAL_*` bootstrap, must-change-password flagging; the
+      backend exposes the change-password API — UI enforcement of the
+      forced change is still pending, see Release 3)
+- [x] Management RBAC (super_admin / broker_admin / operator / auditor)
+- [x] Dynamic Security integration (backend as the dynsec admin client)
+- [x] MQTT clients: create / disable / enable / delete, password reset,
+      random passwords (returned exactly once)
+- [x] Groups: create / delete, member + role assignment with priorities
+- [x] Roles: create / delete, ACL editor (all six ACL types, `%u`/`%c`
+      substitution, priorities, draft-then-save)
+- [x] Broker configuration editor, basic mode (structured forms +
+      read-only preview of the generated `mosquitto.conf`)
+- [x] Listener management (port, bind address, protocol, anonymous,
+      max-connections; enable/disable, edit, delete)
+- [x] Configuration validation (`mosquitto --test-config` via sidecar)
+- [x] Configuration generation from the PostgreSQL model
+
+Hardening done beyond the plan:
+
+- [x] Management identity protection: the dynsec `admin` client is hidden
+      from Clients and refuses reset/disable/delete (resetting it kicks
+      every connection using it — including the backend's own control
+      channel)
+- [x] Dynsec channel resilience: disconnects are detected immediately and
+      the MQTT client is rebuilt instead of failing silently
+- [x] Login flow returns to the originally requested page; mid-session
+      expiry redirects to login with a return target
+- [x] Navigation follows spec §57; unimplemented pages are greyed out
+      with the planned release as tooltip
+
+### Release 2 — PKI, versioning, and controlled change (§68.2) — PARTIAL
+
+- [x] Configuration revisions (immutable history; list + detail API and UI)
+- [x] Configuration deployment with health check (dynsec roundtrip probe)
+- [x] Broker reload (`mosquitto_signal config-reload` via sidecar)
+- [x] mosquitto-control service (validate / atomic activate / signal /
+      broker health)
+- [ ] Configuration diff view (revision N-1 → N)
+- [ ] Configuration rollback (creates a new revision, §62)
+- [ ] Reload-vs-restart classification (§28) — only a restart warning on
+      listener port/bind edits so far, no general classification
+- [ ] CA creation (internal CA, import CA)
+- [ ] Server certificate generation (CN, SANs, key algorithm)
+- [ ] Client certificates (managed-key mode, one-time download)
+- [ ] CSR signing
+- [ ] Certificate revocation + CRL generation/publishing
+- [ ] mTLS listeners (model fields + config generation exist; blocked on
+      PKI — certfile/keyfile cannot be emitted yet)
+
+### Release 3 — Operations, safety, and visibility (§68.3) — PARTIAL
+
+- [x] Audit logging (backend records every privileged action: LOGIN,
+      LOGOUT, CLIENT_*, GROUP_*, ROLE_*, ACL_CHANGED, LISTENER_*,
+      BROKER_CONFIG_DEPLOYED, USER_*, …)
+- [x] Client metadata/tags (owner / purpose / tags in PostgreSQL; API
+      accepts them on create)
+- [ ] Audit browsing UI (events are recorded; no viewer page yet)
+- [ ] Forced password-change UI (backend flag + API exist; the frontend
+      does not enforce `must_change_password` yet)
+- [ ] Client metadata editing in the UI
+- [ ] ACL simulator (§15)
+- [ ] Dashboard ($SYS monitoring, broker status, §33)
+- [ ] Certificate expiry monitoring
+- [ ] Backup and restore (logical, encrypted, §45)
+- [ ] Configuration drift detection (§48)
+- [ ] Last-known-connection tracking + connected-client view (§34)
+
+### Post-MVP (§68.4 / §69 / §70) — NOT STARTED
+
+- [ ] Topic explorer / MQTT test client
+- [ ] Connection tester + client provisioning wizard
+- [ ] Bridge configuration
+- [ ] Retained-message administration
+- [ ] Certificate expiry alerts
+- [ ] Prometheus metrics + external notifications
+- [ ] Change approval (four-eyes) workflow
+- [ ] Topic namespace / JSON-schema registries, and later Phase-3 items