The roadmap is part of the work.

A small but complete read-only service proves identity, transport, deterministic execution, local reasoning, retrieval, evidence, and continuity together before access and input types expand.

• Signed actor and room identity remain attached to every task, retrieval request, evidence item, and audit event.
• One exact deterministic capability works without receiving private context it does not need.
• One qualified local reasoning route returns structured, evidence-referenced results and recovers from interruption.
• Each connected capability reports the permissions and isolation controls actually enforced; required safeguards fail closed when unavailable.
• Selective lookup, exact evidence, exhaustive set, comparative, and exploratory work report the correct completion state.
• Recall remains inspectable, proposed durable-memory changes remain staged, and continuity survives device, service, model, or provider change.

Remote access and files expand both usefulness and exposure. They should be introduced only after the core service can already enforce identity, scope, evidence, failure, and recovery boundaries.

• Approved devices retain reliable access, notification, reconnection, and session revocation across network changes.
• Only the approved conversation surface is publicly reachable; internal services and administrative interfaces remain private.
• Attachments are retrieved through an authorized interface and checked for owner, scope, type, size, hash, and retention before processing.
• Text extraction, later optional modalities, and every unsupported or failed item retain source, parser, location, and coverage status.
• Temporary processing copies expire without altering or deleting source material.

The expensive mistake is not using strong capability. It is using more capability, context, cost, or review than the accepted result requires. Stable tasks and evidence are needed before route comparisons become meaningful.

• Each higher-capability connector completes a bounded task without exposing credentials or taking unapproved action.
• Route eligibility applies privacy, identity, authority, tools, context, modality, consequence, availability, and cost before performance preferences.
• Route selection runs in shadow mode until results justify promotion for a specific low-risk task class.
• Delegated work can preserve or narrow, but cannot expand, its originating identity, information scope, action authority, tool rights, budget, or lifetime.
• Combined work preserves source spans, disagreement, uncertainty, failure, and route identity rather than passing only worker summaries.
• Specialist routes meet the same quality, privacy, traceability, validation, and recovery thresholds as the baseline.

Action and durable change require stronger controls than analysis. Multi-user activation should wait until the personal service can detect failure, reject stale authority, restore state, rotate access, and recover without silent change.

• Every proposed change presents its exact target, owner, destination, difference, evidence, source freshness, and rollback before approval.
• Approval remains bound to the authenticated user, request, result, scope, and expiration; changed, old, duplicate, or withdrawn approval fails closed.
• Every approved write or action produces a redacted execution receipt showing its authority, effective safeguards, attempted and completed effects, verification result, and rollback status.
• One low-risk action completes with post-action verification and a tested rollback path.
• Monitoring, redacted logs, backup, restore, credential rotation, cancellation, degraded operation, incident response, and complete shutdown have usable runbooks and canaries.
• A sustained personal-service canary passes the sovereign, recoverable, and captive tests against actual dependencies.

Collaboration is not a larger version of single-user access. It introduces independent ownership, consent, sharing, withdrawal, membership, and joint-authority boundaries that must remain visible throughout retrieval, memory, action, and recovery.

• The second user directly consents and receives independent identity, personal authority, correction, export, withdrawal, and removal paths before personal context is loaded.
• Each user can access a private service while every attempt to retrieve the other user's private context fails closed.
• The shared room uses shared authority by default and accepts a private item only after its owner explicitly shares it.
• Conflicting personal preferences remain distinct rather than being silently merged.
• Consequential shared actions require the appropriate owner or both users unless an approved policy explicitly delegates authority.
• Collaborative behavior remains correct through simultaneous requests, correction, withdrawal, membership change, partial failure, and any required communication media.