MeshJS · QSchlegel · Jun 13, 2026 · Jun 13, 2026 · Jun 13, 2026 · Jun 13, 2026
diff --git a/.agents/README.md b/.agents/README.md
@@ -2,6 +2,14 @@
 
 Project-specific context for AI coding agents. See also [.cursor/skills/multisig/SKILL.md](../.cursor/skills/multisig/SKILL.md) for the multisig Cursor skill.
 
+## Specs & PRDs
+
+Specs live in the vault, not this repo. The maintainer keeps a document-driven dev base (an Obsidian vault) where features are specified as **PRDs** before they are built; concept and entity notes there are the upstream source for data models and flows.
+
+- Before building a vault-specced feature, read its **PRD** (and the concept/entity notes it links) for scope, data model, and acceptance criteria. An entity note is the spec for its Prisma model.
+- Implementing PRs should **cite the PRD id** in the description (e.g. "Implements PRD-001"), so code stays traceable to the document that produced it.
+- The vault is the maintainer's local knowledge base; if you don't have access, ask for the relevant PRD's contents rather than guessing scope.
+
 ## Stack and layout
 
 - **Stack**: Next.js (Pages Router), TypeScript, tRPC, Prisma, PostgreSQL, Cardano (Mesh SDK). Auth: NextAuth (user) + JWT (API: wallet sign-in or bot keys).

diff --git a/.env.example b/.env.example
@@ -19,6 +19,12 @@ JWT_SECRET="your-jwt-secret-minimum-32-characters-long"
 # Get your JWT token from https://app.pinata.cloud/
 PINATA_JWT="your-pinata-jwt-token"
 
+# Optional: dedicated Pinata IPFS gateway origin (e.g. https://<id>.mypinata.cloud).
+# IPFS reads resolve through /api/ipfs/resolve, which tries this gateway first
+# (our pinned content) before falling back to public gateways, and new uploads
+# return a URL on this gateway instead of the frequently-504ing public ipfs.io.
+# NEXT_PUBLIC_PINATA_GATEWAY_URL="https://your-gateway.mypinata.cloud"
+
 # GitHub Personal Access Token
 # Create one at https://github.com/settings/tokens
 # GITHUB_TOKEN="your-github-token" (Optional - for GitHub issue creation)
@@ -33,6 +39,12 @@ NEXT_PUBLIC_BLOCKFROST_API_KEY_PREPROD="your-blockfrost-preprod-api-key"
 # Used to authenticate the balance snapshot batch endpoint
 # SNAPSHOT_AUTH_TOKEN="your-snapshot-auth-token"
 
+# Canonical public URL of the deployment.
+# Used for SEO: canonical tags, Open Graph / Twitter URLs, robots.txt and the
+# sitemap. Defaults to the production domain when unset; set this on preview or
+# self-hosted environments so links point at the right origin.
+# NEXT_PUBLIC_SITE_URL="https://multisig.meshjs.dev"
+
 # Optional: Skip environment validation during builds
 # Useful for Docker builds where env vars are set at runtime
 # SKIP_ENV_VALIDATION=true

diff --git a/ROADMAP.md b/ROADMAP.md
@@ -42,70 +42,228 @@ Status of M1 tasks. Last updated 2026-04-23.
 
 ---
 
-## Months 2–3 — June–July 2026
+## Month 2 — June 2026
 
-**Direction:** Authentication, Summon migration, collateral service, minor fixes.
+**Focus:** Mesh 2.0 upgrade and CI improvements.
 
-- Improved authentication — nonce-based auth, wallet connection fixes, registration flow (#135, #53)
-- Summon migration — land API routes and wallet import (PR #212, PR #208)
-- Collateral service — 22 ADA → 4 UTxOs for proxy collateral (#221)
-- Full address verification (#196)
-- Transaction pagination (#30)
-- Better 404 page (#22)
-- Monthly report
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| Mesh 2.0 upgrade — migrate to Mesh SDK 2.0 | |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| CI improvements | |
+
+---
+
+## Month 3 — July 2026
+
+**Focus:** On-chain wallet discovery and FROST kickoff.
+
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| FROST research kickoff | #220 |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| Wallet V2 — on-chain registration and discovery | #33 |
+
+---
+
+## Month 4 — August 2026
+
+**Focus:** Document Sign-Off MVP — build (see [Flagship feature](#flagship-feature--document-sign-off)).
+
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| Document Sign-Off MVP (build) — 5-table data model, four routes, CIP-8 signature enforcement, version-hash binding | |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| Document Sign-Off MVP (build) — Documents section UI, six-state lifecycle, signer review screen | |
+
+---
+
+## Month 5 — September 2026
+
+**Focus:** Document Sign-Off MVP — ship (8–10 wk effort completes).
+
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| Document Sign-Off MVP (ship) — proof export (JSON + PDF), verify route | |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| Document Sign-Off MVP (ship) — diffs where feasible, status grouping, polish | |
+| Monthly report | |
 
 ---
 
-## Months 4–6 — August–October 2026
+## Month 6 — October 2026
 
-**Direction:** Governance, smart contracts, and on-chain wallet discovery.
+**Focus:** Document Sign-Off provenance, FROST findings, hardware wallets.
 
-- Aiken crowdfund integration (PR #164)
-- Governance metadata fix (#122)
-- Proxy voting polish and documentation
-- Wallet V2 — on-chain registration and discovery (#33)
-- Pending transactions on homepage (#125)
-- FROST research kickoff (#220)
-- Backlog cleanup, dependency/security updates
-- Monthly reports
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| Document Sign-Off v1 — Provenance (history, diff & rollback, richer audit export) | |
+| FROST research — deliver findings, PoC, go/no-go | #220 |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| Hardware wallet support — Ledger/Trezor | #44 |
 
 ---
 
-## Months 7–9 — November 2026–January 2027
+## Month 7 — November 2026
+
+**Focus:** Governance polish, dApp connector, bot platform.
+
+**Quirin**
 
-**Direction:** Ecosystem integrations and developer experience.
+| Task | Issues |
+|------|--------|
+| Governance metadata fix | #122 |
+| dApp connector — external dApps request multi-sig transactions | |
 
-- Hardware wallet support — Ledger/Trezor (#44)
-- Bot platform v2 — SDK, webhooks, example bots
-- dApp connector — external dApps request multi-sig transactions
-- API documentation and developer portal
-- FROST research — deliver findings, PoC, go/no-go (#220)
-- Monthly reports
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| Pending transactions on homepage | #125 |
+| Bot platform v2 — SDK, webhooks, example bots | |
 
 ---
 
-## Months 10–12 — February–April 2027
+## Month 8 — December 2026
+
+**Focus:** Proxy voting, testing, developer experience.
+
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| Proxy voting polish and documentation | |
+| Transaction builder & tRPC integration tests | #255 |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| API documentation and developer portal | |
+| Backlog cleanup, dependency/security updates | |
+| Monthly report | |
+
+---
+
+## Month 9 — January 2027
+
+**Focus:** Document Sign-Off checkpoints, vesting, growth.
+
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| Document Sign-Off v2 — Checkpoints (opt-in on-chain anchoring in Cardano metadata) | |
+| Vesting — time-locked multi-sig contracts | #81 |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| User profiles and contacts | |
+
+---
+
+## Month 10 — February 2027
+
+**Focus:** Invite flow and discovery.
+
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| Invite flow | PR #67 |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| Discover page — browse wallets, DAOs, governance | #52 |
+
+---
+
+## Month 11 — March 2027
+
+**Focus:** Polish, wrap-up, and forward-looking research.
+
+**Quirin**
+
+| Task | Issues |
+|------|--------|
+| Performance and UX audit | |
+| Final summary report — activity, outcomes, gaps, next steps | |
+
+**Andre**
+
+| Task | Issues |
+|------|--------|
+| Document Sign-Off v3 — Collaboration & standards (CRDT/QES bridge — scoped as research) | |
+| Monthly report | |
+
+---
+
+## Month 12 — April 2027
+
+**Focus:** Buffer / catch-up — absorb slippage from earlier months, finalize reporting, plan next cycle.
+
+No fixed feature commitments; reserved for spillover, stabilization, and next-roadmap planning.
+
+---
+
+## Flagship feature — Document Sign-Off
+
+A wallet-native, off-chain document approval layer: bind approval to an exact version hash, inherit the wallet's signer set + threshold, and collect CIP-8 sign-off (approve/reject) per signer. No new chain, no new token, no change to the transaction model — delivered as a Documents section inside the wallet.
 
-**Direction:** Growth features, polish, and wrap-up.
+| Phase | Scope | Months |
+|-------|-------|--------|
+| MVP — Sign-off | Documents section, six-state lifecycle, version-hash binding, signer review, exportable JSON+PDF proof. Off-chain. | M4–M5 |
+| v1 — Provenance | Revision history first-class, diff & rollback, richer audit export (off-chain). | M6 |
+| v2 — Checkpoints | Optional on-chain anchoring of a version's hash + parent in Cardano tx metadata. | M9 |
+| v3 — Collaboration & standards | Real-time co-authoring (CRDT), metadata standard (CIP candidate), eIDAS/EUDI QES bridge. | M11 (research) |
 
-- Vesting — time-locked multi-sig contracts (#81)
-- User profiles and contacts
-- Discover page — browse wallets, DAOs, governance (#52)
-- Performance and UX audit
-- Invite flow (PR #67)
-- Final summary report — activity, outcomes, gaps, next steps
-- Monthly reports
+**Data model:** five entities (`Document`, `DocumentVersion`, `DocumentReview`, `DocumentSignerSnapshot`, `DocumentEvent`) + optional `Checkpoint`, all reusing wallet signer identity and threshold. Approval belongs to a version, never a mutable container; a new version starts a fresh round at zero approvals.
 
 ---
 
 ## Research Track
 
 | Topic | Description | Months | Owner |
 |-------|-------------|--------|-------|
-| **FROST multi-sig wallets** | Research FROST (Flexible Round-Optimized Schnorr Threshold) signatures for Cardano. Evaluate feasibility of replacing or complementing native script multi-sig with threshold Schnorr signatures — smaller on-chain footprint, better privacy (single signature on-chain), and flexible threshold schemes. Investigate Cardano-compatible FROST libraries, protocol readiness, and migration path from current native scripts. | 6-9 | Quirin |
+| **FROST & PQC multi-sig wallets** | Research FROST (Flexible Round-Optimized Schnorr Threshold) signatures for Cardano. Evaluate feasibility of replacing or complementing native script multi-sig with threshold Schnorr signatures — smaller on-chain footprint, better privacy (single signature on-chain), and flexible threshold schemes. Investigate Cardano-compatible FROST libraries, protocol readiness, and migration path from current native scripts. Also evaluate **Lemour post-quantum (PQC) multi-sig** — lattice-based threshold signatures for long-term quantum resistance — as a forward-looking alternative/complement to FROST. | M3 (kickoff) – M6 (findings) | Quirin |
 
 **Research deliverables:**
 - Written summary of FROST vs native script trade-offs
+- Assessment of Lemour PQC multi-sig — maturity, libraries, and quantum-resistance trade-offs vs FROST
 - Proof-of-concept if libraries are available
 - Go/no-go recommendation for integration into the platform
 
@@ -145,33 +303,34 @@ Aggregated view of the 12-month roadmap split by contributor. Each task has a si
 - [M1] Fix transaction loading bug (#211)
 - [M1] Handle external PR — Summon API routes (PR #212)
 - [M1] Fix legacy wallet compatibility bug
-- [M2–3] Improved authentication — nonce-based auth, wallet connection fixes, registration flow (#135, #53)
-- [M2–3] Full address verification (#196)
-- [M2–3] Transaction pagination (#30)
-- [M4–6] Aiken crowdfund integration (PR #164)
-- [M4–6] Governance metadata fix (#122)
-- [M4–6] Proxy voting polish and documentation
-- [M4–6] FROST research kickoff (#220)
-- [M7–9] dApp connector — external dApps request multi-sig transactions
-- [M7–9] FROST research — deliver findings, PoC, go/no-go (#220)
-- [M10–12] Vesting — time-locked multi-sig contracts (#81)
-- [M10–12] Performance and UX audit
-- [M10–12] Invite flow (PR #67)
-- [M10–12] Final summary report
+- [M2] Mesh 2.0 upgrade — migrate to Mesh SDK 2.0
+- [M3] FROST research kickoff (#220)
+- [M4–5] Document Sign-Off MVP — data model, routes, CIP-8 enforcement, proof export
+- [M6] Document Sign-Off v1 — Provenance (history, diff & rollback, audit export)
+- [M6] FROST research — deliver findings, PoC, go/no-go (#220)
+- [M7] Governance metadata fix (#122)
+- [M7] dApp connector — external dApps request multi-sig transactions
+- [M8] Proxy voting polish and documentation
+- [M8] Transaction builder & tRPC integration tests (#255)
+- [M9] Document Sign-Off v2 — Checkpoints (opt-in on-chain anchoring)
+- [M9] Vesting — time-locked multi-sig contracts (#81)
+- [M10] Invite flow (PR #67)
+- [M11] Performance and UX audit
+- [M11] Final summary report
 
 ### Andre
 
 - [M1] Improve repository infrastructure — preprod environment and comprehensive smoke CI
 - [M1] CI smoke tests on real chain (#213)
 - [M1] Handle external PR — capability-based metadata (PR #208)
-- [M2–3] Summon migration — land API routes and wallet import (PR #212, PR #208)
-- [M2–3] Collateral service — 22 ADA → 4 UTxOs for proxy collateral (#221)
-- [M2–3] Better 404 page (#22)
-- [M4–6] Wallet V2 — on-chain registration and discovery (#33)
-- [M4–6] Pending transactions on homepage (#125)
-- [M4–6] Backlog cleanup, dependency/security updates
-- [M7–9] Hardware wallet support — Ledger/Trezor (#44)
-- [M7–9] Bot platform v2 — SDK, webhooks, example bots
-- [M7–9] API documentation and developer portal
-- [M10–12] User profiles and contacts
-- [M10–12] Discover page — browse wallets, DAOs, governance (#52)
+- [M2] CI improvements
+- [M3] Wallet V2 — on-chain registration and discovery (#33)
+- [M4–5] Document Sign-Off MVP — Documents UI, six-state lifecycle, signer review, diffs
+- [M6] Hardware wallet support — Ledger/Trezor (#44)
+- [M7] Pending transactions on homepage (#125)
+- [M7] Bot platform v2 — SDK, webhooks, example bots
+- [M8] API documentation and developer portal
+- [M8] Backlog cleanup, dependency/security updates
+- [M9] User profiles and contacts
+- [M10] Discover page — browse wallets, DAOs, governance (#52)
+- [M11] Document Sign-Off v3 — Collaboration & standards (research)
diff --git a/next.config.js b/next.config.js
@@ -44,9 +44,13 @@ const config = {
     unoptimized: false,
   },
   // Turbopack configuration (Next.js 16+)
-  // Empty config silences the warning about webpack/turbopack conflict
-  // WebAssembly support is enabled by default in Turbopack
-  turbopack: {},
+  // Pin the workspace root to this config's directory. Without this, Turbopack
+  // can mis-detect the root when stray lockfiles exist higher up the tree (e.g.
+  // a git worktree under a parent that also has a package-lock.json), which
+  // breaks resolution of the whisky WASM during dev SSR. `import.meta.dirname`
+  // is the project root in every checkout, so this is safe in CI and prod too.
+  // WebAssembly support is enabled by default in Turbopack.
+  turbopack: { root: import.meta.dirname },
 
   // Webpack config for builds that explicitly use webpack (e.g., with --webpack flag)
   webpack: function (config, options) {