docs: correct claims that no longer match the tree

[ucekmez]

Summary

PR 21 of a stacked series — the last one. Base is #112. Not for merge without review.

Four documentation statements that were wrong.

1. The README understated the protocol's best reliability feature by ~1440×

EEP is one wire format with HMAC-signed delivery, SSE and a 60-second replay window

The 60 seconds is the HMAC timestamp tolerance (§5.3). The event replay window is a minimum of 24 hours (§4.3).

The sentence is positioning EEP against plain webhooks, and durable replay is the differentiator — so getting the number wrong made the pitch weaker, not stronger.

2. The fixtures README described contents the directory does not have

subscription/ ← subscribe/unsubscribe request and response shapes

There is no unsubscribe vector and there are no response shapes. Corrected to what is actually there.

3. decouple.py sat at the repository root

A one-off de-branding pass from the more.md extraction that has already run — the first thing a new contributor sees in a root listing, and part of no build or test. Moved to scripts/, given a header explaining what it was and why it's kept (the substitution list stays auditable), and its security-contact substitution corrected from security@eep.dev to hello@eep.dev — the address SECURITY.md and the README actually publish.

4. ROADMAP.md had drifted in both directions

Item	Listed as	Actually
pnpm workspace migration	unchecked v0.2	shipped — pnpm-workspace.yaml, tsconfig.base.json, packageManager: pnpm@9.15.0, pnpm -r test script all present
Offline conformance fixtures	unchecked	vectors, manifest and release tarball all existed; only the CLI flag was missing (landed in #95)

Both are corrected, and the pnpm item is split so the residual work — consolidating to a single pnpm-lock.yaml — is visible on its own rather than hidden inside a checkbox that looked untouched.

I also added a short note on keeping the file honest: check the tree rather than memory, and split a partially shipped item so the remainder stays visible. A stale roadmap is worse than none — it hides finished work and misrepresents what is left.

Scope

• Spec / schema only
• TypeScript package(s)
• Python package(s)
• Tests / CI
• Docs / examples

Checklist

• I read CONTRIBUTING.md and CODE_OF_CONDUCT.md.
• Tests added or updated where appropriate (none apply — no behaviour changes).
• Breaking change? No. Documentation and one file move; no code path, schema or wire format touched.
• Documentation updated for user-visible behavior.

Verification

Every claim written into the roadmap was checked against the tree rather than asserted:

$ python3 -c "import json;d=json.load(open('package.json'));print(d['packageManager'])"
pnpm@9.15.0
$ ls pnpm-workspace.yaml tsconfig.base.json   # both present
$ grep -c fixtures packages/@eep-dev/compliance-cli/src/index.ts
11

Check	Result
tests/	200 passed
tests/cross-impl/	56 passed, 3 skipped
codegen-schema-types --check	no drift
openapi-route-parity	✓
Nothing references the old decouple.py path	confirmed by grep

Notes for reviewers

I moved decouple.py rather than deleting it. It has served its purpose and could reasonably go, but deleting someone's tool is a call for a maintainer to make — the substitution list is the only record of what the extraction rewrote. Say the word and I'll remove it.

This is the final PR in the series. The full stack is #93 → #112 → this one, one PR per audit finding, each based on the previous so the diffs stay reviewable and never conflict. GitHub retargets each to main as its base merges.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.