docs: inventory local-first architecture and acceptance gates

[boston-ai-agent]

Closes #30

Refs #29

Summary

• records the refreshed local-first baseline, compatibility invariants, hosted validation, phase issue/PR ledger, and a resumable checkpoint;
• adds concise decisions for bootstrap/adoption, stable principals/scoped access, provider/migration ownership, local HTTP MCP delegation, and effective branding precedence; and
• inventories current endpoint policy families and assigns P03 a fail-closed mapping gate.

Requirement-to-test mapping

Requirement	Evidence
Current architecture and compatibility inventory	docs/implementation/local-first-progress.md records current startup, persistence, auth, client, theme, CI, release and baseline evidence.
Fresh setup and established OIDC design	ADR 0001 defines persisted setup/adoption; ADR 0002 preserves verified issuer/subject links and makes the API authority.
SQLite and PostgreSQL design	ADR 0003 requires explicit provider selection, provider-specific migrations and real-provider validation.
Credential and MCP boundaries	ADR 0004 retains purpose-separated credentials and caller-bound delegation.
Branding and theme invariants	ADR 0005 constrains branding to presentation and assigns pre-runtime paint tests to P10.
Scoped endpoint enforcement	local-first-endpoint-permissions.md maps current route families to P03 permission/test ownership.

Validation

• git diff --check
• tools/ci/test-public-disclosure.sh
• tools/ci/verify-product-version.sh — 20 projects at 0.1.0-rc.2
• python3 tools/ci/test-release-validation.py — 16 passed; 3 packages and 1 distribution file digest verified
• dotnet restore NetRatel.sln
• dotnet build NetRatel.sln --configuration Release --no-restore — 0 errors; 42 existing warnings
• dotnet test NetRatel.sln --configuration Release --no-build --filter "category!=compose" -- --report-trx --report-trx-filename "netratel-p00-{asm}_{tfm}_{arch}.trx" — 1,860 passed; 4 explicit live-environment skips; 0 failed

References

The design was adapted from current, read-only RatelDesk patterns: bootstrap and local accounts, bootstrap/RBAC implementation, first-paint theme work, credentials and tooling, bounded delegation, and release/gateway hardening.

No product runtime behavior, deployment, release, tag, package, registry, or private configuration is changed in this documentation-only phase.