BREAKING EXPERIMENTAL: Holepunch-native hard migration (RPC core, shared storage, SDK v2)

BREAKING: All nodes must upgrade together. Legacy p2ns.core-request string
messages are rejected; invite/consensus control plane uses protomux-rpc
(invite.request, invite.ack, invite.relay*, consensus.*). Shared Corestore
namespaces are the default for plugin DBs and drives; USE_SHARED_CORESTORE_NAMESPACES=false
is debug-only. Admin plugin actions with params are validated before run.

EXPERIMENTAL: End-to-end RPC invite path reuses existing handlers via adapters;
invite wire still ships on the invite channel. Multi-peer invite/relay
integration tests are not in CI yet (core-rpc-smoke only).

SDK & channels:
- channel-rpc.js, sdk.channels.rpc (register/request/event)
- core-rpc.js for p2ns.core; action-params + plugin route validation
- sdk.db.getCore/reopen, sdk.state.getPeerChannelSnapshot,
  sdk.metrics.getHolepunchStats (schema v1)

Runtime:
- p2ns.js: RPC-first core invite/consensus; Hyperswarm firewall/reconnect
- channel-manager: required protomux-rpc per peer
- db-shared-namespace-migration; drive-manager shared namespaces
- proxy-server: invite.request RPC for joiners

Plugins: file.drop, global.profile, peer.directory, domain.consensus,
peer.visualize, example.plugin (RPC demo); peer.directory UI polish

Also: CI/smoke scripts, diagnostics hardening, plugin config schema validation,
admin action param modal, docs/RFCS, package-lock + engines.node >= 18

docs/rfcs/0001-autobase-consensus.md

@@ -0,0 +1,40 @@
+# RFC 0001: Autobase Consensus Evaluation
+
+## Status
+
+Draft
+
+## Problem
+
+P2NS currently resolves domain ownership with custom vote/quorum logic on top of Autopass entries. This works, but it carries maintenance overhead and bespoke reconciliation behavior.
+
+## Proposal
+
+Evaluate an Autobase-backed consensus stream for claim and vote events, with deterministic apply logic for ownership resolution.
+
+## Scope
+
+- Prototype an isolated consensus view for domain claims and votes.
+- Compare convergence behavior with the current implementation.
+- Keep existing Autopass paths as source-of-truth during evaluation.
+
+## Non-Goals
+
+- Immediate migration of production consensus logic.
+- Changing plugin APIs in this phase.
+
+## Migration Plan
+
+1. Build sidecar Autobase view fed from current claim/vote entries.
+2. Add parity checks against current resolver output.
+3. Gate optional read path via feature flag.
+4. Decide go/no-go after parity and performance testing.
+
+## Risks
+
+- Reordering semantics may expose hidden assumptions in current handlers.
+- Requires deterministic apply handlers and strong replay discipline.
+
+## Rollback
+
+Disable feature flag and keep existing consensus resolver.

docs/rfcs/0002-service-discovery.md

@@ -0,0 +1,40 @@
+# RFC 0002: Service Discovery Modernization
+
+## Status
+
+Draft
+
+## Problem
+
+Service subscription and discovery rely on JSON-based state and ad-hoc synchronization, which makes distributed service indexing harder to evolve.
+
+## Proposal
+
+Evaluate Autobase discovery patterns for dynamic service registration and subscription updates, while preserving current subscription behavior.
+
+## Scope
+
+- Define canonical service record shape (domain, serviceName, protocol, port, metadata).
+- Add optional replicated discovery index.
+- Add compatibility adapters for existing subscription files.
+
+## Non-Goals
+
+- Removing current subscription files immediately.
+- Breaking existing admin workflows.
+
+## Migration Plan
+
+1. Introduce read-only discovery index generation.
+2. Expose dual-source view in admin diagnostics.
+3. Enable optional write-through to discovery index.
+4. Phase out file-backed writes only after stable parity.
+
+## Risks
+
+- Duplicate source-of-truth during transition.
+- Peer compatibility concerns across mixed versions.
+
+## Rollback
+
+Disable discovery-index write/read toggles and continue file-backed behavior only.

docs/rfcs/0003-pear-bare-distribution.md

@@ -0,0 +1,40 @@
+# RFC 0003: Pear and Bare Distribution Path
+
+## Status
+
+Draft
+
+## Problem
+
+P2NS distribution currently assumes direct Node.js runtime usage. Broader packaging and deployment options are limited.
+
+## Proposal
+
+Define a staged packaging strategy for Pear/Bare-compatible distribution without disrupting the current Node entrypoint.
+
+## Scope
+
+- Identify Node runtime assumptions blocking Pear/Bare portability.
+- Define a packaging profile for CLI/desktop delivery.
+- Evaluate `pear://` links for domain and plugin deep-linking.
+
+## Non-Goals
+
+- Replacing Node runtime in this phase.
+- Shipping production installers immediately.
+
+## Migration Plan
+
+1. Document portability blockers and required shims.
+2. Create minimal packaging prototype with current feature subset.
+3. Add compatibility matrix (macOS/Linux/Windows) by feature.
+4. Decide phased rollout for packaged distributions.
+
+## Risks
+
+- Native networking and privileged port behavior may differ by runtime.
+- Increased support surface for packaging artifacts.
+
+## Rollback
+
+Keep current Node-based distribution as default path.

docs/rfcs/0004-admin-auth-rbac.md

@@ -0,0 +1,41 @@
+# RFC 0004: Admin Authentication and RBAC
+
+## Status
+
+Draft
+
+## Problem
+
+`p2ns.admin` provides powerful operational endpoints and currently assumes a trusted local context. Multi-user environments and remote access scenarios need stronger controls.
+
+## Proposal
+
+Introduce optional authentication and role-based authorization for admin APIs and UI operations.
+
+## Scope
+
+- Define auth modes (disabled, local token, signed session).
+- Define role model (viewer, operator, admin).
+- Add endpoint-level authorization policy mapping.
+- Add audit log for privileged actions.
+
+## Non-Goals
+
+- External identity provider integrations in first phase.
+- Breaking existing local-default behavior for current users.
+
+## Migration Plan
+
+1. Add feature flags and middleware scaffolding.
+2. Enforce auth on high-risk endpoints first.
+3. Add RBAC checks and permission-aware UI controls.
+4. Make authenticated mode recommended default after stabilization.
+
+## Risks
+
+- Operational lockout risks during misconfiguration.
+- Backward compatibility with existing automation scripts.
+
+## Rollback
+
+Disable auth/RBAC flags and revert to current trusted-local behavior.

docs/rfcs/README.md

@@ -0,0 +1,10 @@
+# P2NS Architecture RFCs
+
+This directory captures design proposals that require staged migrations.
+
+- `0001-autobase-consensus.md`
+- `0002-service-discovery.md`
+- `0003-pear-bare-distribution.md`
+- `0004-admin-auth-rbac.md`
+
+These RFCs are intentionally implementation-agnostic and describe goals, tradeoffs, rollout strategy, and fallback plans.