docs: correct claims that no longer match the tree

README.md

@@ -30,7 +30,7 @@ MCP, A2A, webhooks and ActivityPub standards solve different problems. EEP compo
 
 - **MCP** lets an LLM *call a tool*. EEP lets an LLM *follow an entity over time* — discover it, subscribe and react to verified events from it.
 - **A2A** lets two agents *collaborate on a task*. EEP defines how either agent learns that an entity changed at all.
-- **Plain webhooks** require a custom protocol per publisher (auth, signing, retries, replay window). EEP is one wire format with HMAC-signed delivery, SSE and a 60-second replay window — implemented once, reusable everywhere.
+- **Plain webhooks** require a custom protocol per publisher (auth, signing, retries, replay window). EEP is one wire format with signed delivery, SSE, and event replay with a minimum 24-hour retention window — implemented once, reusable everywhere.
 - **ActivityPub** federates accounts in a social graph. EEP delivers state-change events from any entity (person org, agent, product, listing) to authorized subscribers, with optional payment / credential / identity gates.
 - **DIDs and Verifiable Credentials** identify *who* an entity is. EEP defines *what they tell their subscribers* and *how subscribers verify it*.
 

ROADMAP.md

@@ -26,9 +26,11 @@ Stabilization, hardening, and ecosystem unblocking. Drives toward the
       SBOM, sigstore/cosign keyless signing, GitHub Action SHA pinning
       via Renovate
 - [x] DCO enforcement on every commit to `main`
-- [ ] **Offline conformance fixtures** under `tests/conformance-fixtures/`,
-      consumable by `@eep-dev/compliance-cli --fixtures` without booting a
-      live publisher
+- [x] **Offline conformance fixtures** under `tests/conformance-fixtures/`,
+      consumable by `npx @eep-dev/compliance-cli --fixtures <dir>` without
+      booting a live publisher. The vectors and the release tarball existed
+      before; the CLI flag that made them runnable by anyone outside this
+      repo did not.
 - [ ] **Python feature parity**: `eep-gates` (proof verifier, commerce,
       service listing), `eep-middleware` (Flask/FastAPI/Django adapters)
 - [ ] `py.typed` markers on every Python package; `mypy --strict` clean
@@ -42,8 +44,15 @@ Stabilization, hardening, and ecosystem unblocking. Drives toward the
 
 Quality of life and adoption surface area.
 
-- [ ] **Monorepo migration to pnpm workspaces** with shared
-      `tsconfig.base.json` and a single `pnpm -r test` entry point
+- [x] **Monorepo migration to pnpm workspaces** with shared
+      `tsconfig.base.json` and a single `pnpm -r test` entry point —
+      `pnpm-workspace.yaml`, `tsconfig.base.json` and the root
+      `packageManager: pnpm@9.15.0` all landed. What remains is narrower and
+      tracked separately below.
+- [ ] **Consolidate to a single `pnpm-lock.yaml`.** Per-package
+      `package-lock.json` files still coexist with the pnpm workspace because
+      CI invokes per-package `npm ci`; moving CI to `pnpm -r install` removes
+      N redundant dependency resolutions per run.
 - [ ] **Schema → TypeScript / Pydantic codegen** with a CI drift gate
       (no hand-maintained types diverging from `schemas/v0.1/*.json`)
 - [ ] WebCrypto shim in `@eep-dev/signer` for edge runtimes
@@ -120,6 +129,19 @@ roadmap effort, and instead defers to the named external standard:
 
 ---
 
+## Keeping this file honest
+
+A roadmap that drifts from the tree is worse than no roadmap: it hides
+finished work and misrepresents what is left. Two entries had drifted in
+opposite directions — the pnpm migration had shipped while listed as pending,
+and the offline fixtures read as unstarted when only a CLI flag was missing.
+
+When updating an item, check the tree rather than memory:
+
+- "Done" needs a file, a command, or a CI job that demonstrates it.
+- "Not done" needs a check that it is genuinely absent — a partially shipped
+  item should be split so the remaining work is visible on its own.
+
 ## How this roadmap is updated
 
 - Items move from **Now** → **Next** → **Later** → **v1.0** → done

decouple.py → scripts/decouple-more-md-branding.py

@@ -1,9 +1,20 @@
+#!/usr/bin/env python3
+"""One-off de-branding pass from the more.md extraction.
+
+EEP was extracted from more.md's codebase and open-sourced; this script
+rewrote the remaining more.md identifiers to neutral examples. It has already
+run, and is kept only so the substitution list is auditable — if a stray
+more.md reference turns up, this records what the mapping was.
+
+It is not part of any build or test. Moved out of the repository root, where
+it was the first thing a new contributor saw.
+"""
 import os
 import re
 
 REPLACEMENTS = [
     (r"Copyright 2026 more\.md", "Copyright 2026 EEP Contributors"),
-    (r"hello@more\.md", "security@eep.dev"),
+    (r"hello@more\.md", "hello@eep.dev"),
     (r"MoreMDEntityCredential", "EEPEntityCredential"),
     (r"more-md SDK", "example SDK"),
     (r"did:web:api\.more\.md", "did:web:api.example.com"),

tests/conformance-fixtures/README.md

@@ -20,7 +20,7 @@ tests/conformance-fixtures/
 ├── envelope/                ← EEP/CloudEvents event envelope shapes
 ├── signature/               ← HMAC sign + verify, replay window, multi-signature
 ├── gates/                   ← 402 / 403 / 429 / 451 response shapes; access resolution
-└── subscription/            ← subscribe/unsubscribe request and response shapes
+└── subscription/            ← subscribe request shapes, SSRF rejection, leases, filters
 ```
 
 Every fixture directory contains either: