Updates

docs/ROADMAP.md

@@ -49,7 +49,10 @@ cognitive loop and is wrapped rather than rewritten.
   single model alias.
 - [x] Add the initial daemon, computer-use, GNOME extension, D-Bus, and
   control-center boundaries.
-- [ ] Install and lock dependencies with a successful `npm install`.
+- [x] Install and lock dependencies with a successful `npm install`.
+- [~] Review runtime dependency audit: `npm audit --omit=dev` reports 10
+  transitive findings through `dbus-next` (3 critical, 1 high, 6 moderate;
+  upstream reports no available fixes).
 - [ ] Add repository CI for syntax, unit, schema, and extension checks.
 
 Exit gate: a clean checkout can identify the harness, load one root config,
@@ -62,6 +65,7 @@ and run tests without importing dlinux.
 - [x] Request `device: "gpu"`, `gpu_layers: 99`, and GPU multimodal projection.
 - [x] Reject a CPU result instead of accepting QVAC's internal fallback.
 - [x] Preflight QVAC GPU visibility before downloading or loading a model.
+- [x] Enforce the vendored `@qvac/sdk` 0.19.x version at master startup.
 - [x] Add owner counting and a single close path.
 - [x] Set `QVAC_CONFIG_PATH`, `JARVIS_QVAC_MODEL`, and GPU policy in the user
   service.
@@ -106,10 +110,13 @@ GPU-owned worker.
   and state queries.
 - [~] Implement token, transcript, reply, audio-level, chip, job, computer
   step, and error signals.
+- [~] Add the Node D-Bus service implementation. Live bus smoke testing remains
+  pending on a normal user session because this sandbox cannot bind a D-Bus
+  session socket.
 - [ ] Keep payloads small; stream PCM and screenshots through a Unix socket or
   tmpfs paths.
 - [ ] Add lock-screen handling: mute, hide UI, revoke computer use.
-- [ ] Add idle sleep using QVAC `suspend()` and resume on wake.
+- [~] Add idle sleep using QVAC `suspend()` and resume on wake.
 - [ ] Add structured JSON logging with no prompt/audio/image contents by default.
 
 Exit gate: a D-Bus client can ask a typed question, receive streamed events,