Complete production roadmap: vault, peers, swarm, streams, ops

Ship remaining roadmap items: encrypted registry vault, peer invite/revoke,
Swarm/plugins behind flags, binary streams, engine create validation, deploy
rollback, schema validation, fleet/access UI, metrics, fuzz/load/soak tests,
systemd packaging, and release tooling. Mark ROADMAP fully complete.

test/protocol.coverage.test.js

@@ -0,0 +1,26 @@
+import test from 'brittle'
+import { Methods, MethodRoles, Roles, roleAllows, Pushes } from '../shared/protocol.js'
+
+test('every Method has MethodRoles', (t) => {
+  for (const m of Object.values(Methods)) {
+    t.ok(MethodRoles[m], `missing MethodRoles for ${m}`)
+  }
+})
+
+test('viewer cannot admin methods', (t) => {
+  t.not(roleAllows(Roles.viewer, Methods.invitePeer))
+  t.not(roleAllows(Roles.viewer, Methods.vaultStoreCredential))
+  t.not(roleAllows(Roles.viewer, Methods.createContainer))
+  t.ok(roleAllows(Roles.viewer, Methods.getMetrics))
+  t.ok(roleAllows(Roles.viewer, Methods.getStatsHistory))
+  t.ok(roleAllows(Roles.operator, Methods.createContainer))
+  t.ok(roleAllows(Roles.operator, Methods.pushImage))
+  t.ok(roleAllows(Roles.admin, Methods.swarmInit))
+})
+
+test('push channels defined', (t) => {
+  t.ok(Pushes.binaryChunk)
+  t.ok(Pushes.pushProgress)
+  t.ok(Pushes.attachOutput)
+  t.ok(Pushes.metrics)
+})